3 ms·

Hmm... No. A "protected computer" can be simply "a computer which is used in or affecting interstate or foreign commerce or communication", which includes prett

Hmm... No. A "protected computer" can be simply "a computer which is used in or affecting interstate or foreign commerce or communication", which includes pretty much anything nowadays as long as some money changes hands, some Google AdWords on your blog ought to be enough. > In the general case, the government must prove beyond a reasonable doubt that the unauthorized access to the computer system was in furtherance of an actual fraud that produced something of value for the accused. That is 100% false, and I'm calling you out as having simply made it up. Fraud is NOT required, take a look at 1030, we can quite clearly read: "Whoever - (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains (C) information from any protected computer, shall be punished as provided in subsection (c) of this section" It's there in black and white.

tptacek 14y ago
The only case anyone can cite where someone's been charged on bare unauthorized access under 1030(a)(2) on the auspices of a TOS violation to "any computer connected to the Internet" was overturned. The precedent we have says you cannot in fact be convicted for this thing that Rob thinks you can be convicted for. Nobody is making anything up. On either side of the argument. I seriously don't care about the fine point we're hung up on here. 1030(a)(2) is a bad rule, at least until we fix the definition of "protected computer". There's no underlying political disagreement about whether the statute reads as reasonable, even though in practice it does not mean the thing Rob thinks it means. My only investment in this debate is that it's clear that most people on HN think that the unreasonable part of CFAA is how they determine "unauthorized access", and that incrementing a number in a URL to harvest information should be fair game. There, I care a lot. People skilled in the art can make a convincing argument for lots of vulnerabilities being so trivial they can't reasonably constitute unauthorized access. That's not how the law works and it's not how the law should work. When Rob says that the problem with the law we have is that it's too easy to make a case that access is unauthorized, Rob is wrong. He's wrong in the specifics: you won't be charged and couldn't be convicted for reading his blog. He's also wrong in principle: the problem with the CFAA, such as it is, isn't that it's too easy to make "unauthorized access".
- adanto6840 14y ago
  Completely agree - the issue here is absolutely the definition of "protected computer". That said, I'm curious which specific case you're referring to in your first paragraph - and which court it was in. I've done a fair amount of research into this type of case law and, from what I've seen, it seems like things have gone both ways in various different courts. As far as I know there is no binding precedent, at least not from a higher court, but I'd love to be wrong on this. Seeing as this comment may end up lost within this thread, feel free to shoot me an email directly (available on my profile).
- jahewson 14y ago
  I wasn't responding to Rob's remarks, I was responding to yours. Don't use Rob as a straw man. Also I didn't say "any computer connected to the Internet", that's also a straw man. > I seriously don't care about the fine point we're hung up on here. ... and that's why you're getting your facts wrong.

tptacek 14y ago

The only case anyone can cite where someone's been charged on bare unauthorized access under 1030(a)(2) on the auspices of a TOS violation to "any computer connected to the Internet" was overturned. The precedent we have says you cannot in fact be convicted for this thing that Rob thinks you can be convicted for. Nobody is making anything up. On either side of the argument. I seriously don't care about the fine point we're hung up on here. 1030(a)(2) is a bad rule, at least until we fix the definition of "protected computer". There's no underlying political disagreement about whether the statute reads as reasonable, even though in practice it does not mean the thing Rob thinks it means. My only investment in this debate is that it's clear that most people on HN think that the unreasonable part of CFAA is how they determine "unauthorized access", and that incrementing a number in a URL to harvest information should be fair game. There, I care a lot. People skilled in the art can make a convincing argument for lots of vulnerabilities being so trivial they can't reasonably constitute unauthorized access. That's not how the law works and it's not how the law should work. When Rob says that the problem with the law we have is that it's too easy to make a case that access is unauthorized, Rob is wrong. He's wrong in the specifics: you won't be charged and couldn't be convicted for reading his blog. He's also wrong in principle: the problem with the CFAA, such as it is, isn't that it's too easy to make "unauthorized access".

adanto6840 14y ago
Completely agree - the issue here is absolutely the definition of "protected computer". That said, I'm curious which specific case you're referring to in your first paragraph - and which court it was in. I've done a fair amount of research into this type of case law and, from what I've seen, it seems like things have gone both ways in various different courts. As far as I know there is no binding precedent, at least not from a higher court, but I'd love to be wrong on this. Seeing as this comment may end up lost within this thread, feel free to shoot me an email directly (available on my profile).
jahewson 14y ago
I wasn't responding to Rob's remarks, I was responding to yours. Don't use Rob as a straw man. Also I didn't say "any computer connected to the Internet", that's also a straw man. > I seriously don't care about the fine point we're hung up on here. ... and that's why you're getting your facts wrong.