5 ms·

Reading the CFAA, 18 USC 1030(a)(2)(C) says: <i>"intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ...

Reading the CFAA, 18 USC 1030(a)(2)(C) says: <i>"intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer"</i> It doesn't say "intent to commit fraud" or even "intent to obtain information". It just says "intent to unauthorized access". Negligence and recklessness count as intent, so accessing a computer without caring whether you had authorization or not is still "intent". When the CFAA was written in 1986, all access to computers was explicitly authorized. Then the web happened, when people started recklessly accessing computers without caring whether they were authorized, and everyone was in technical violation of the law.

chii 14y ago
INAL, but i as a reasonable person would compare a website to a business/restraunt that is open to the public. A member of the public can enter and look around the area that is obviously designated as public. There are areas in the restraunt that is marked "staff only" - some may have locks, some may not. But anyone who is not a staff entering those areas (whether they broke the lock, or just opened the door coz it was unlocked) is trespassing. Now, imagine a website in the above scenario. If the administration area of the website is "unlocked" and a user "stumbled" into it, is it still a crime?
- oftenwrong 14y ago
  As a professional non-lawyer, the problem I see in your comparison is that he requested the data, and was given it. He did not just enter the door. He knocked on the door, and a staff member opened it up for him.
  - Dylan16807 14y ago
    Oh boy, a restaurant analogy. How about this. He was looking at the five cheese pizza on the menu and thought "what do I get if I order a seven cheese", did so, and they brought one out to him. No 'staff areas', just ordering a normal meal that's not on his menu.
- betterunix 14y ago
  I would compare a website to an answering machine; it is a lot closer to what is happening. I dial your number, I get your answering machine, and now I can interact with that answering machine. Same with a website -- I direct my browser to it, and I get to ask it for information, and it is your responsibility to ensure that nothing I send will cause information to be leaked. See, the problem with laws like CFAA is that they are based on the premise that there is "nothing" a bank could do to prevent hackers from accessing their computers without permission. At no point did anyone stop to say, "Maybe computers that process billions of dollars in transactions every day should not be plugged into the public phone network or Internet until we have some good reason to think those computers cannot be manipulated by hackers;" instead, the thinking was, "Hackers are evil wizards, nobody could possibly protect themselves from hackers, so we should make a law that allows us to throw the evil wizards in prison!" The idea that AT&T should be blamed for leaving customer data out in the open like that is not even on the table (strangely, if AT&T left a binder full of personal information unattended on a table in a public park, and labeled the binder "DO NOT OPEN," they would probably be the target of a successful lawsuit).
shawn-butler 14y ago
This is a very naive understanding. The statute was intentionally modified from "knowingly" to "intentionally" and the reasons for this change are a matter of public record. It was to explicitly decriminalize accidental or careless unauthorized access. Any judicial review takes such documentation into account. This article is an uninformed rant spreading FUD in the pursuit of a personal goal and it doesn't deserve the attention it is receiving any more than the garbage legal scaremongering for which SCO was notorious. Also it's "proof of concept" fails to identify screen resolution so not only is the author a failure at reading the law but also at writing working code.

chii 14y ago

INAL, but i as a reasonable person would compare a website to a business/restraunt that is open to the public. A member of the public can enter and look around the area that is obviously designated as public. There are areas in the restraunt that is marked "staff only" - some may have locks, some may not. But anyone who is not a staff entering those areas (whether they broke the lock, or just opened the door coz it was unlocked) is trespassing. Now, imagine a website in the above scenario. If the administration area of the website is "unlocked" and a user "stumbled" into it, is it still a crime?

oftenwrong 14y ago
As a professional non-lawyer, the problem I see in your comparison is that he requested the data, and was given it. He did not just enter the door. He knocked on the door, and a staff member opened it up for him.
- Dylan16807 14y ago
  Oh boy, a restaurant analogy. How about this. He was looking at the five cheese pizza on the menu and thought "what do I get if I order a seven cheese", did so, and they brought one out to him. No 'staff areas', just ordering a normal meal that's not on his menu.
betterunix 14y ago
I would compare a website to an answering machine; it is a lot closer to what is happening. I dial your number, I get your answering machine, and now I can interact with that answering machine. Same with a website -- I direct my browser to it, and I get to ask it for information, and it is your responsibility to ensure that nothing I send will cause information to be leaked. See, the problem with laws like CFAA is that they are based on the premise that there is "nothing" a bank could do to prevent hackers from accessing their computers without permission. At no point did anyone stop to say, "Maybe computers that process billions of dollars in transactions every day should not be plugged into the public phone network or Internet until we have some good reason to think those computers cannot be manipulated by hackers;" instead, the thinking was, "Hackers are evil wizards, nobody could possibly protect themselves from hackers, so we should make a law that allows us to throw the evil wizards in prison!" The idea that AT&T should be blamed for leaving customer data out in the open like that is not even on the table (strangely, if AT&T left a binder full of personal information unattended on a table in a public park, and labeled the binder "DO NOT OPEN," they would probably be the target of a successful lawsuit).

shawn-butler 14y ago

This is a very naive understanding. The statute was intentionally modified from "knowingly" to "intentionally" and the reasons for this change are a matter of public record. It was to explicitly decriminalize accidental or careless unauthorized access. Any judicial review takes such documentation into account. This article is an uninformed rant spreading FUD in the pursuit of a personal goal and it doesn't deserve the attention it is receiving any more than the garbage legal scaremongering for which SCO was notorious. Also it's "proof of concept" fails to identify screen resolution so not only is the author a failure at reading the law but also at writing working code.