6 ms·

How is this any different than all the other commonly prosecuted laws that hinge on intent?

by akerl_ 1y ago

AnthonyMouse 1y ago
For most laws the badness is inherent in the act. Intentionally killing someone is illegal because killing someone is bad and we're basically just giving you an out if it was unintentional, i.e. accidental killings aren't murder. The problem here is that accessing a computer is a completely normal and unproblematic thing to do on purpose, so the intent requirement isn't doing much without knowing what "authorization" is supposed to mean but that's the part that isn't clear.
- akerl_ 1y ago
  Message board nerds spend a lot of digital ink debating the clarity of what “authorization” means in the CFAA. It’s not clear to me that actual courts or juries find it to be that complicated, relative to other areas of criminal law. I don’t know if it’s that tech people are just predisposed to try to over complicate, or that legal terminology tends to have definitions that are separate from the tech/colloquial usage of terms. But looking at contemporary usage the CFAA, I don’t actually think “was this hacking or just using the computer like normal” is that hard to figure out.
  - AnthonyMouse 1y ago
    It's not that hard to figure out at the extremes. Using Google to find a nearby place to get lunch, not a violation. Phishing someone's password so you can sign into their company's network and delete all their files, go to jail. And then most of the cases that are actually brought are of the second category, which makes everything seem fine. But those are the same cases that could be brought under a better law or under other existing laws. The problem is that if message board nerds and other ordinary people can't figure out what the law requires in the cases that probably won't be prosecuted, but could be, then it deters people from doing things that shouldn't be -- and maybe even aren't -- against the law. And it gives the government a weapon it shouldn't have, because the lack of clarity can be used to coerce plea bargains.
    - tptacek 1y ago
      You still haven't explained what the lack of clarity you're concerned about it. The examples you've given have been things that are settled law not illegal. You're never going to get a schematic list of everything that could violate the law, and you don't get that for non-computer crimes either.
      - AnthonyMouse 1y ago
        It's not about enumerating every possible circumstance, it's about the law erring on the side of prohibiting more than it should rather than less and effectively shifting the burden to the defense to establish an exception to a rule that by its terms nominally prohibits anything a company doesn't like. Let's try this for an example. There is a company whose security is very bad. Their company portal is on the internet and if you visit the site it shows you everything. A journalist gets tipped off about this and is presented with the opportunity to read the company's internal documents which allegedly show clear evidence of a crime so they can write a story about it. How bad does the security have to be before the journalist is in trouble? Is it illegal if there is absolutely no access control but the company hadn't intended to publish that? What if anyone can create their own account? What if there is a login box but it doesn't care what you put in it, so you can make up your own username and password? What if it requires an existing username but accepts a blank password? What if it only requires a password and it's just really easy to guess? Or someone gave it to them? What if someone at the company sends them an internal URL but it's accessible on the internet? Does it matter if they sent it on purpose or by accident? I admittedly haven't checked which of those if any have already had precedents established, but it's unlikely that every one of those scenarios has made it all the way to the Supreme Court, so what's the journalist supposed to do when they find themselves facing one where it hasn't? Not write the story? Do it anyway because maybe? And it's not just a matter of how to tell where the line is. The journalist is being a journalist, not stealing credit cards. If the thing that matters is really intent then their intent was to expose a crime, and in that case why do we want a law that makes any of those illegal?
        akerl_ 1y ago

How is this any different than all the other commonly prosecuted laws that hinge on intent?

by akerl_ 1y ago

How is this any different than all the other commonly prosecuted laws that hinge on intent?

For most laws the badness is inherent in the act. Intentionally killing someone is illegal because killing someone is bad and we're basically just giving you an out if it was unintentional, i.e. accidental killings aren't murder. The problem here is that accessing a computer is a completely normal and unproblematic thing to do on purpose, so the intent requirement isn't doing much without knowing what "authorization" is supposed to mean but that's the part that isn't clear.

akerl_ 1y ago
Message board nerds spend a lot of digital ink debating the clarity of what “authorization” means in the CFAA. It’s not clear to me that actual courts or juries find it to be that complicated, relative to other areas of criminal law. I don’t know if it’s that tech people are just predisposed to try to over complicate, or that legal terminology tends to have definitions that are separate from the tech/colloquial usage of terms. But looking at contemporary usage the CFAA, I don’t actually think “was this hacking or just using the computer like normal” is that hard to figure out.
- AnthonyMouse 1y ago
  It's not that hard to figure out at the extremes. Using Google to find a nearby place to get lunch, not a violation. Phishing someone's password so you can sign into their company's network and delete all their files, go to jail. And then most of the cases that are actually brought are of the second category, which makes everything seem fine. But those are the same cases that could be brought under a better law or under other existing laws. The problem is that if message board nerds and other ordinary people can't figure out what the law requires in the cases that probably won't be prosecuted, but could be, then it deters people from doing things that shouldn't be -- and maybe even aren't -- against the law. And it gives the government a weapon it shouldn't have, because the lack of clarity can be used to coerce plea bargains.
  - tptacek 1y ago
    You still haven't explained what the lack of clarity you're concerned about it. The examples you've given have been things that are settled law not illegal. You're never going to get a schematic list of everything that could violate the law, and you don't get that for non-computer crimes either.
    - AnthonyMouse 1y ago
      It's not about enumerating every possible circumstance, it's about the law erring on the side of prohibiting more than it should rather than less and effectively shifting the burden to the defense to establish an exception to a rule that by its terms nominally prohibits anything a company doesn't like. Let's try this for an example. There is a company whose security is very bad. Their company portal is on the internet and if you visit the site it shows you everything. A journalist gets tipped off about this and is presented with the opportunity to read the company's internal documents which allegedly show clear evidence of a crime so they can write a story about it. How bad does the security have to be before the journalist is in trouble? Is it illegal if there is absolutely no access control but the company hadn't intended to publish that? What if anyone can create their own account? What if there is a login box but it doesn't care what you put in it, so you can make up your own username and password? What if it requires an existing username but accepts a blank password? What if it only requires a password and it's just really easy to guess? Or someone gave it to them? What if someone at the company sends them an internal URL but it's accessible on the internet? Does it matter if they sent it on purpose or by accident? I admittedly haven't checked which of those if any have already had precedents established, but it's unlikely that every one of those scenarios has made it all the way to the Supreme Court, so what's the journalist supposed to do when they find themselves facing one where it hasn't? Not write the story? Do it anyway because maybe? And it's not just a matter of how to tell where the line is. The journalist is being a journalist, not stealing credit cards. If the thing that matters is really intent then their intent was to expose a crime, and in that case why do we want a law that makes any of those illegal?
      - akerl_ 1y ago