4 ms·

Although I'm not sure how important intent alone is, I don't believe that intent to commit fraud specifically is the only or even primary factor. The Wikipedia

Although I'm not sure how important intent alone is, I don't believe that intent to commit fraud specifically is the only or even primary factor. The Wikipedia article about web scraping [1] is quite interesting though very much just a start; it becomes pretty complex when you look at some older rulings such as Feist v. Rural [2] or (especially) Dastar v. Twentieth Century Fox Film Corp. [3]. Then you start thinking about how some of the more recent "click-wrap" agreements play into things... To me they seem unrealistic and/or unenforceable, but it even more complicated when you factor in that the 'protected contents' might be public domain or otherwise potentially preempted by copyright, etc... It's definitely an evolving area of law. And an area of law that I really enjoy as a 'hacker'. I just hope for continually positive legal evolution... 1 - http://en.wikipedia.org/wiki/Web_scraping http://en.wikipedia.org/wiki/Web_scraping 2 - http://en.wikipedia.org/wiki/Feist_v._Rural http://en.wikipedia.org/wiki/Feist_v._Rural 3 - http://en.wikipedia.org/wiki/Dastar_Corp._v._Twentieth_Century_Fox_Film_Corp http://en.wikipedia.org/wiki/Dastar_Corp._v._Twentieth_Centu....

tptacek 14y ago
In the general case, the government must prove beyond a reasonable doubt that the unauthorized access to the computer system was in furtherance of an actual fraud that produced something of value for the accused. The additional crimes chargeable under the CFAA are: * Access to state secrets * Access to financial records or to "protected systems" * Access to government computers * Attempts to intentionally cause damage * Attempts to commit extortion using the access None of these apply to blogs.
- jahewson 14y ago
  Hmm... No. A "protected computer" can be simply "a computer which is used in or affecting interstate or foreign commerce or communication", which includes pretty much anything nowadays as long as some money changes hands, some Google AdWords on your blog ought to be enough. > In the general case, the government must prove beyond a reasonable doubt that the unauthorized access to the computer system was in furtherance of an actual fraud that produced something of value for the accused. That is 100% false, and I'm calling you out as having simply made it up. Fraud is NOT required, take a look at 1030, we can quite clearly read: "Whoever - (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains (C) information from any protected computer, shall be punished as provided in subsection (c) of this section" It's there in black and white.
  - tptacek 14y ago
    The only case anyone can cite where someone's been charged on bare unauthorized access under 1030(a)(2) on the auspices of a TOS violation to "any computer connected to the Internet" was overturned. The precedent we have says you cannot in fact be convicted for this thing that Rob thinks you can be convicted for. Nobody is making anything up. On either side of the argument. I seriously don't care about the fine point we're hung up on here. 1030(a)(2) is a bad rule, at least until we fix the definition of "protected computer". There's no underlying political disagreement about whether the statute reads as reasonable, even though in practice it does not mean the thing Rob thinks it means. My only investment in this debate is that it's clear that most people on HN think that the unreasonable part of CFAA is how they determine "unauthorized access", and that incrementing a number in a URL to harvest information should be fair game. There, I care a lot. People skilled in the art can make a convincing argument for lots of vulnerabilities being so trivial they can't reasonably constitute unauthorized access. That's not how the law works and it's not how the law should work. When Rob says that the problem with the law we have is that it's too easy to make a case that access is unauthorized, Rob is wrong. He's wrong in the specifics: you won't be charged and couldn't be convicted for reading his blog. He's also wrong in principle: the problem with the CFAA, such as it is, isn't that it's too easy to make "unauthorized access".
    - adanto6840 14y ago
      Completely agree - the issue here is absolutely the definition of "protected computer". That said, I'm curious which specific case you're referring to in your first paragraph - and which court it was in. I've done a fair amount of research into this type of case law and, from what I've seen, it seems like things have gone both ways in various different courts. As far as I know there is no binding precedent, at least not from a higher court, but I'd love to be wrong on this. Seeing as this comment may end up lost within this thread, feel free to shoot me an email directly (available on my profile).
    - jahewson 14y ago
      I wasn't responding to Rob's remarks, I was responding to yours. Don't use Rob as a straw man. Also I didn't say "any computer connected to the Internet", that's also a straw man. > I seriously don't care about the fine point we're hung up on here. ... and that's why you're getting your facts wrong.

tptacek 14y ago

In the general case, the government must prove beyond a reasonable doubt that the unauthorized access to the computer system was in furtherance of an actual fraud that produced something of value for the accused. The additional crimes chargeable under the CFAA are: * Access to state secrets * Access to financial records or to "protected systems" * Access to government computers * Attempts to intentionally cause damage * Attempts to commit extortion using the access None of these apply to blogs.

jahewson 14y ago
Hmm... No. A "protected computer" can be simply "a computer which is used in or affecting interstate or foreign commerce or communication", which includes pretty much anything nowadays as long as some money changes hands, some Google AdWords on your blog ought to be enough. > In the general case, the government must prove beyond a reasonable doubt that the unauthorized access to the computer system was in furtherance of an actual fraud that produced something of value for the accused. That is 100% false, and I'm calling you out as having simply made it up. Fraud is NOT required, take a look at 1030, we can quite clearly read: "Whoever - (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains (C) information from any protected computer, shall be punished as provided in subsection (c) of this section" It's there in black and white.
- tptacek 14y ago
  The only case anyone can cite where someone's been charged on bare unauthorized access under 1030(a)(2) on the auspices of a TOS violation to "any computer connected to the Internet" was overturned. The precedent we have says you cannot in fact be convicted for this thing that Rob thinks you can be convicted for. Nobody is making anything up. On either side of the argument. I seriously don't care about the fine point we're hung up on here. 1030(a)(2) is a bad rule, at least until we fix the definition of "protected computer". There's no underlying political disagreement about whether the statute reads as reasonable, even though in practice it does not mean the thing Rob thinks it means. My only investment in this debate is that it's clear that most people on HN think that the unreasonable part of CFAA is how they determine "unauthorized access", and that incrementing a number in a URL to harvest information should be fair game. There, I care a lot. People skilled in the art can make a convincing argument for lots of vulnerabilities being so trivial they can't reasonably constitute unauthorized access. That's not how the law works and it's not how the law should work. When Rob says that the problem with the law we have is that it's too easy to make a case that access is unauthorized, Rob is wrong. He's wrong in the specifics: you won't be charged and couldn't be convicted for reading his blog. He's also wrong in principle: the problem with the CFAA, such as it is, isn't that it's too easy to make "unauthorized access".
  - adanto6840 14y ago
    Completely agree - the issue here is absolutely the definition of "protected computer". That said, I'm curious which specific case you're referring to in your first paragraph - and which court it was in. I've done a fair amount of research into this type of case law and, from what I've seen, it seems like things have gone both ways in various different courts. As far as I know there is no binding precedent, at least not from a higher court, but I'd love to be wrong on this. Seeing as this comment may end up lost within this thread, feel free to shoot me an email directly (available on my profile).
  - jahewson 14y ago
    I wasn't responding to Rob's remarks, I was responding to yours. Don't use Rob as a straw man. Also I didn't say "any computer connected to the Internet", that's also a straw man. > I seriously don't care about the fine point we're hung up on here. ... and that's why you're getting your facts wrong.