4 ms·

Nope. You're committing a violation of Federal law if you access any protected computer (a protected computer is one used in interstate commerce, which is to s

Nope. You're committing a violation of Federal law if you access any protected computer (a protected computer is one used in interstate commerce, which is to say any computer connected to the internet), you do so without authorization or exceed your authorization, and you obtain any information whatsoever from that computer. Read it yourself. For the most part he CAN declare his blog off limits and press charges. Except that Federal prosecutor has to decide to press charges, not the individual. Note tptacek: you should understand there are several different sorts of crimes criminalized by this statute, and fraud is only one of them, and for the other ones, no fraud is required to have occurred. Read carefully.

tptacek 14y ago
That's simply not true. The law is here: http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 EFF's analysis of the law is here: http://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA) http://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(C... The Ninth Circuit's model jury instructions are here: http://www3.ce9.uscourts.gov/web/sdocuments.nsf/0/71dd91317b8b28ca88257742005f1ccb?OpenDocument http://www3.ce9.uscourts.gov/web/sdocuments.nsf/0/71dd91317b...
- jellicle 14y ago
  §1030(a)(1) through §1030(a)(7) are seven separate crimes. A person can commit one or two or all seven of them. They are separate. Read the government manual: http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf You're filling this whole thread with disinformation. Stop it.
  - tptacek 14y ago
    I listed all seven of them downthread before you wrote this comment. Which of them applies to a blog post? Please be specific. You can feel free to point to the part of the DOJ manual that rebuts me, too.
    - deleted 14y ago
      [deleted]
    - deleted 14y ago
      [deleted]
    - deleted 14y ago
      [deleted]
      - tptacek 14y ago
        The CFAA conviction referred to here (the Lori Drew case, also mentioned in the DOJ manual) was overturned.
    - jfoutz 14y ago
      My apologies. My pretending to be a lawyer via google is stupid. 1030(a)(2)(c) seems really terrifying, obviously there is formal language in the text "Whoever— (2) intentionally accesses a computer without authorization and thereby obtains - (C) information from any protected computer; obviously includes formal language that means something i don't understand.
      - tptacek 14y ago
        I'm not a lawyer either, for what it's worth ('rprasad is). "Protected computer" is a term defined later in the CFAA.
    - macchina 14y ago
      He actually does have a point based on the text. 1030(a)(2)(C) Whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer; shall be punished as provided in subsection (c) of this section. Under the statute, a "protected computer" generally means any computer connected to the internet. Also, based on the legislative history, "obtains information" has been read to mean "merely observing" information. The only issue is "without authorization." Based on its plain meaning, the law could mean that you need affirmative authorization to access any website. Obviously, that's a real stretch, but there was a case decided by the 1st Circuit Court of Appeals [1] that held a company liable for using a web scraper - where the court said the defendants exceeded authorized access based on the website's boilerplate copyright notice. [1]http://openjurist.org/274/f3d/577/ef-cultural-travel-bv-v-explorica-inc http://openjurist.org/274/f3d/577/ef-cultural-travel-bv-v-ex...
- dfc 14y ago
  Another good reference is: Cybercrime: A Sketch of 18 U.S.C. 1030 and Related Federal Criminal Laws[1] It was written by the Congressional Research Service and is well suited for non-lawyers. It is all of 9 pages including cover material and is the tl;dr version of the 97 page: Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws[2] [1] http://www.fas.org/sgp/crs/misc/RS20830.pdf http://www.fas.org/sgp/crs/misc/RS20830.pdf [2] http://www.fas.org/sgp/crs/misc/97-1025.pdf http://www.fas.org/sgp/crs/misc/97-1025.pdf
anigbrowl 14y ago
No, jellicle. That's Bullshit, informed more by your political biases than any kind of fact. You can't just focus on statute and ignore precedent, because precedent defines the standards for statutory interpretation. So many people on HN look at the statute and think that's the whole law, and then assume that any arguable interpretation of said statute is legally binding. This is absolutely not the case.
- elpool2 14y ago
  What is the relevant precedent in this case that helps clarify what the law means? Is there precedent that says that you have to commit fraud to be convicted? Or that making a website public always constitutes authorization? What about if the website is publicly available, but the url isn't published, so you'd be required to guess the url to access it. Anyone know what the relevant case law is in that scenario? Edit: Actually, the EFF page that tptacek linked to earlier mentions the US vs Drew case, where they charged that a person was "unauthorized" simply by being in violation of the MySpace terms of service, but the court instead ruled that they were not unauthorized because the law itself was too vague ("the absence of minimal guidelines to govern law enforcement"), and because the terms of service weren't prominent enough.
  - tptacek 14y ago
    And that conviction was overturned.
  - jellicle 14y ago
    There's a lot of confusion in this thread. The courts agree that accessing any internet computer in excess of any sort of actual access restriction is a crime. There was a question - can this be stretched to fit violations of terms of use? That is, a user unquestionably (in the case at hand) has 100% access to read and write on a particular forum, unless they post hate speech (private terms of use of the forum). Now they post hate speech. Does this TOU violation constitute a Federal crime? And the courts seem to be coming down on the side of no, despite the language of the law that would seem to say yes. It's just a little too much of a stretch for the courts to make any TOU violation into a Federal crime. On the other hand, violating any sort of unambiguous access restriction is clearly illegal. Suppose you start work at a new job. The boss tells you not to read the files in the "BOSS" directory on the webserver, which is connected to the internet and not password protected. You read them. Have you committed a Federal misdemeanor? Yes. No court disagrees. Many people have been convicted and sentenced to prison terms for extremely similar behavior (often involving employees who take files with them when they leave employment, or similar).

tptacek 14y ago

That's simply not true. The law is here: http://www.law.cornell.edu/uscode/text/18/1030 http://www.law.cornell.edu/uscode/text/18/1030 EFF's analysis of the law is here: http://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(CFAA) http://ilt.eff.org/index.php/Computer_Fraud_and_Abuse_Act_(C... The Ninth Circuit's model jury instructions are here: http://www3.ce9.uscourts.gov/web/sdocuments.nsf/0/71dd91317b8b28ca88257742005f1ccb?OpenDocument http://www3.ce9.uscourts.gov/web/sdocuments.nsf/0/71dd91317b...

jellicle 14y ago
§1030(a)(1) through §1030(a)(7) are seven separate crimes. A person can commit one or two or all seven of them. They are separate. Read the government manual: http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf http://www.justice.gov/criminal/cybercrime/docs/ccmanual.pdf You're filling this whole thread with disinformation. Stop it.
- tptacek 14y ago
  I listed all seven of them downthread before you wrote this comment. Which of them applies to a blog post? Please be specific. You can feel free to point to the part of the DOJ manual that rebuts me, too.
  - deleted 14y ago
    [deleted]
  - deleted 14y ago
    [deleted]
  - deleted 14y ago
    [deleted]
    - tptacek 14y ago
      The CFAA conviction referred to here (the Lori Drew case, also mentioned in the DOJ manual) was overturned.
  - jfoutz 14y ago
    My apologies. My pretending to be a lawyer via google is stupid. 1030(a)(2)(c) seems really terrifying, obviously there is formal language in the text "Whoever— (2) intentionally accesses a computer without authorization and thereby obtains - (C) information from any protected computer; obviously includes formal language that means something i don't understand.
    - tptacek 14y ago
      I'm not a lawyer either, for what it's worth ('rprasad is). "Protected computer" is a term defined later in the CFAA.
  - macchina 14y ago
    He actually does have a point based on the text. 1030(a)(2)(C) Whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer; shall be punished as provided in subsection (c) of this section. Under the statute, a "protected computer" generally means any computer connected to the internet. Also, based on the legislative history, "obtains information" has been read to mean "merely observing" information. The only issue is "without authorization." Based on its plain meaning, the law could mean that you need affirmative authorization to access any website. Obviously, that's a real stretch, but there was a case decided by the 1st Circuit Court of Appeals [1] that held a company liable for using a web scraper - where the court said the defendants exceeded authorized access based on the website's boilerplate copyright notice. [1]http://openjurist.org/274/f3d/577/ef-cultural-travel-bv-v-explorica-inc http://openjurist.org/274/f3d/577/ef-cultural-travel-bv-v-ex...
dfc 14y ago
Another good reference is: Cybercrime: A Sketch of 18 U.S.C. 1030 and Related Federal Criminal Laws[1] It was written by the Congressional Research Service and is well suited for non-lawyers. It is all of 9 pages including cover material and is the tl;dr version of the 97 page: Cybercrime: An Overview of the Federal Computer Fraud and Abuse Statute and Related Federal Criminal Laws[2] [1] http://www.fas.org/sgp/crs/misc/RS20830.pdf http://www.fas.org/sgp/crs/misc/RS20830.pdf [2] http://www.fas.org/sgp/crs/misc/97-1025.pdf http://www.fas.org/sgp/crs/misc/97-1025.pdf

anigbrowl 14y ago

No, jellicle. That's Bullshit, informed more by your political biases than any kind of fact. You can't just focus on statute and ignore precedent, because precedent defines the standards for statutory interpretation. So many people on HN look at the statute and think that's the whole law, and then assume that any arguable interpretation of said statute is legally binding. This is absolutely not the case.

elpool2 14y ago
What is the relevant precedent in this case that helps clarify what the law means? Is there precedent that says that you have to commit fraud to be convicted? Or that making a website public always constitutes authorization? What about if the website is publicly available, but the url isn't published, so you'd be required to guess the url to access it. Anyone know what the relevant case law is in that scenario? Edit: Actually, the EFF page that tptacek linked to earlier mentions the US vs Drew case, where they charged that a person was "unauthorized" simply by being in violation of the MySpace terms of service, but the court instead ruled that they were not unauthorized because the law itself was too vague ("the absence of minimal guidelines to govern law enforcement"), and because the terms of service weren't prominent enough.
- tptacek 14y ago
  And that conviction was overturned.
- jellicle 14y ago
  There's a lot of confusion in this thread. The courts agree that accessing any internet computer in excess of any sort of actual access restriction is a crime. There was a question - can this be stretched to fit violations of terms of use? That is, a user unquestionably (in the case at hand) has 100% access to read and write on a particular forum, unless they post hate speech (private terms of use of the forum). Now they post hate speech. Does this TOU violation constitute a Federal crime? And the courts seem to be coming down on the side of no, despite the language of the law that would seem to say yes. It's just a little too much of a stretch for the courts to make any TOU violation into a Federal crime. On the other hand, violating any sort of unambiguous access restriction is clearly illegal. Suppose you start work at a new job. The boss tells you not to read the files in the "BOSS" directory on the webserver, which is connected to the internet and not password protected. You read them. Have you committed a Federal misdemeanor? Yes. No court disagrees. Many people have been convicted and sentenced to prison terms for extremely similar behavior (often involving employees who take files with them when they leave employment, or similar).