4 ms·

> That's silly, you say, because that’s not what the law means. Well, how do you know what the law means? The law is so vague that it’s impossible to tell. No,

> That's silly, you say, because that’s not what the law means. Well, how do you know what the law means? The law is so vague that it’s impossible to tell. No, it's not that this isn't what the law means. It's that this isn't what the law says. There are vague laws, and there are ambiguous laws, but you are way overstating your case here. Either that, or you have never read § 1030.

elpool2 14y ago
Care to explain what the law really means then? Because I just read what the law _says_, but to me it still sounds pretty vague, and its unclear exactly what constitutes "authorization".
- monochromatic 14y ago
  Which section of this law criminalizes merely accessing something without authorization?
  - elpool2 14y ago
    "Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer. A protected computer is any computer which is used in or affecting interstate or foreign commerce or communication." His blog seems to be used in foreign communication, it can be accessed from foreign countries. Does that make it a "protected computer"? I accessed his computer and received information. And I was never "authorized" to do so, except through the implied openness of the web, which the law doesn't seem to mention at all.
    - danielweber 14y ago
      Orin Kerr has an excellent paper on the state of the law in this area that I'm too lazy too Google right now. But while the courts have occasionally ruled that "access" is "any access," other courts have realized how stupid this is and have moved away from that strict meaning. "Protected computer" is explicitly defined.
- tptacek 14y ago
  The defendant is charged in [Count _______ of] the indictment with computer fraud in violation of Section 1030(a)(4) of Title 18 of the United States Code. In order for the defendant to be found guilty of that charge, *the government must prove each of the following elements* beyond a reasonable doubt: First, the defendant knowingly [accessed without authorization] [exceeded authorized access to] a computer [that was exclusively for the use of a financial institution or the United States government] [that was not exclusively for the use of a financial institution or the United States government, but the defendant’s access affected the computer’s use by or for the financial institution or the United States government] [used in or affecting interstate or foreign commerce or communication] [located outside the United States but using it in a manner that affected interstate or foreign commerce or communication of the United States]; Second, the defendant did so with the intent to defraud; Third, by [accessing the computer without authorization] [exceeding authorized access to the computer], the defendant furthered the intended fraud; [and] Fourth, the defendant by [accessing the computer without authorization] [exceeding authorized access to the computer] obtained anything of value[.] [; and] [Fifth, the total value of the defendant’s computer use exceeded $5,000 during [specify applicable period.] The last clause applies when the object of the fraud is access to the computer itself; for instance, if your fraud was "gain free wireless access".
  - jellicle 14y ago
    In this case, the defendant is charged with 1030(a)(4), which is fraud, and the government therefore has to prove fraud. The defendant could also have been charged - in some other case - with 1030(a)(2), which is obtaining information from any protected computer without access. In that case, the government would not have to prove fraud.
    - tptacek 14y ago
      A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog. Furthermore, regardless of whether the prosecution charges a crime that requires intent to commit fraud --- for instance, in the unlikely event that they tried to spin a yarn about a blog affecting interstate commerce --- CFAA crimes aren't strict liability. They must prove intent to exceed authorization.
rsingel 14y ago
It's not that far off. Prosecutors have used the CFAA to try to prosecute people for violating the ToS act of MySpace (thrown out by judge post-conviction) and to lodge charges against a scalper which used automated ways to get past a CATPCHA in order to buy tickets. And now Weev gets convicted for finding an undocumented webpage that was a security hole and using that to collect email addresses they then used to embarrass AT&T. He face YEARS in prison. The CFAA is vague on its face.

elpool2 14y ago

Care to explain what the law really means then? Because I just read what the law _says_, but to me it still sounds pretty vague, and its unclear exactly what constitutes "authorization".

monochromatic 14y ago
Which section of this law criminalizes merely accessing something without authorization?
- elpool2 14y ago
  "Whoever... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains... information from any protected computer. A protected computer is any computer which is used in or affecting interstate or foreign commerce or communication." His blog seems to be used in foreign communication, it can be accessed from foreign countries. Does that make it a "protected computer"? I accessed his computer and received information. And I was never "authorized" to do so, except through the implied openness of the web, which the law doesn't seem to mention at all.
  - danielweber 14y ago
    Orin Kerr has an excellent paper on the state of the law in this area that I'm too lazy too Google right now. But while the courts have occasionally ruled that "access" is "any access," other courts have realized how stupid this is and have moved away from that strict meaning. "Protected computer" is explicitly defined.
tptacek 14y ago
The defendant is charged in [Count _______ of] the indictment with computer fraud in violation of Section 1030(a)(4) of Title 18 of the United States Code. In order for the defendant to be found guilty of that charge, *the government must prove each of the following elements* beyond a reasonable doubt: First, the defendant knowingly [accessed without authorization] [exceeded authorized access to] a computer [that was exclusively for the use of a financial institution or the United States government] [that was not exclusively for the use of a financial institution or the United States government, but the defendant’s access affected the computer’s use by or for the financial institution or the United States government] [used in or affecting interstate or foreign commerce or communication] [located outside the United States but using it in a manner that affected interstate or foreign commerce or communication of the United States]; Second, the defendant did so with the intent to defraud; Third, by [accessing the computer without authorization] [exceeding authorized access to the computer], the defendant furthered the intended fraud; [and] Fourth, the defendant by [accessing the computer without authorization] [exceeding authorized access to the computer] obtained anything of value[.] [; and] [Fifth, the total value of the defendant’s computer use exceeded $5,000 during [specify applicable period.] The last clause applies when the object of the fraud is access to the computer itself; for instance, if your fraud was "gain free wireless access".
- jellicle 14y ago
  In this case, the defendant is charged with 1030(a)(4), which is fraud, and the government therefore has to prove fraud. The defendant could also have been charged - in some other case - with 1030(a)(2), which is obtaining information from any protected computer without access. In that case, the government would not have to prove fraud.
  - tptacek 14y ago
    A blog is not a protected computer, which is a term with a definition in the law --- it's one that used by financial institutions, by the US government, or that affects interstate commerce. Again: not a blog. Furthermore, regardless of whether the prosecution charges a crime that requires intent to commit fraud --- for instance, in the unlikely event that they tried to spin a yarn about a blog affecting interstate commerce --- CFAA crimes aren't strict liability. They must prove intent to exceed authorization.

rsingel 14y ago

It's not that far off. Prosecutors have used the CFAA to try to prosecute people for violating the ToS act of MySpace (thrown out by judge post-conviction) and to lodge charges against a scalper which used automated ways to get past a CATPCHA in order to buy tickets. And now Weev gets convicted for finding an undocumented webpage that was a security hole and using that to collect email addresses they then used to embarrass AT&T. He face YEARS in prison. The CFAA is vague on its face.