26 ms·

Court Holds That Circumventing IP Address Ban Is “Access Without Authorization”

149 points by maalyex 13y ago

andybak 13y ago
Just trying to understand how far this could be pushed. Would it be possible in a future case that a judge could deem 'not providing an API' a technological barrier to programmatic access and therefore hold that screen-scraping is in violation of the CFAA?
maalyex 13y ago
Admittedly a sensationalistic headline on my part The title of the linked article is "District Court Holds That Intentionally Circumventing IP Address Ban Is “Access Without Authorization” Under the CFAA". Violating the CFAA is, of course, illegal. From the linked article: "During the debate over the Aaron Swartz case, one of the legal issues was whether Swartz had committed an unauthorized access under the CFAA when he changed his IP address to circumvent IP address blocking" This particular ruling relates to Craigslist. http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- dpeck 13y ago
  I may be remembering wrong, but I believe in the Swartz case it was about spoofing his MAC address?
  - maalyex 13y ago
    From the article: "There was significantly more to the CFAA charges than that, to be clear, including circumventing a subsequent MAC address block and (most significantly) entering an MIT storage closet to install his computer directly. But changing IP addresses to get around IP address blocking was at least one of the possible grounds of unauthorized access."
  - fnordfnordfnord 13y ago
    I've done a lot more than that on gov't networks just to get slides to show up on a conference projector.
    - lotharbot 13y ago
      Using a workaround for buggy or misconfigured hardware is very different from "these guys told me to stop using their thing, but I can circumvent the measures they put in place to stop me." EDIT: related quotes from the ruling "Craigslist gave the world permission (i.e., “authorization”) to access the public information on its public website.... it rescinded that permission for 3Taps." "3Taps had to circumvent Craigslist’s IP blocking measures to continue scraping, so it indisputably knew that Craigslist did not want it accessing the website at all." "3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization”"
      - fnordfnordfnord 13y ago
        Not really, since I am not an IT guy. Using the law like that means that I have to rely on: Not accidentally breaking things. No misunderstandings with the real IT folks. Some petty asshole in authority who doesn't like me not wanting an excuse to cause trouble for me.
        lotharbot 13y ago
        I think you have it backwards. The court decision relied on the clarity of intent from 3taps. They had been both expressly told not to do something, and technically blocked from doing it. Their access to CL wasn't accidentally broken, they didn't misunderstand what they had been told in the C&D letter, and they didn't get caught by some surprising technicality. They had been clearly told to stop, and they circumvented the measures put in place to stop them. I said elsewhere: this is more or less equivalent to a store telling me not to come back and distributing my photo to staff... and then me shaving my beard and changing my clothes in order to sneak back in. Shaving and changing my clothes are not illegal in and of themselves; trespassing is illegal, and shaving and changing my clothes are the tools I chose to use in my effort to trespass.
  - anigbrowl 13y ago
    It's not 'about' spoofing his MAC address. It's about respecting the rights of property owners to set the terms of how other people may access their property. You know, when someone is charged with burglary the issue is not that they entered your place through the window rather than by ringing the doorbell, but that they entered without your permission. Try to imagine the outrage that would result if a judge said 'it's your fault for having an insecure window, tough luck.' EDIT: I might add that I don't care for JSTOR or the copyright system that they derive such benefit from. But then I don't especially care for our laws on taxation and related subjects - my disagreement with those doesn't give me the right to opt out of taxes that I dislike, or to appropriate the possessions of others whose wealth I might envy.
    - aero142 13y ago
      I really hate analogies in law because it always seems to provide very little support for whether a law is a good idea or not. Your analogy is to breaking and entering a physical residence, but you skip over the fact that this is a publicly available website. I'd say it has more in common with photographing a public building. Lets say Dunkin' Donuts doesn't want me photographing their buildings and making a map of all their locations. They demand that I stop taking photo's from the street and put up a small tarp that covers the physical line of sight to their building that I used to photograph. I then come back and photograph their building from 2 feet to the right and they claim I bypassed their building security. I don't think my analogy is any more correct than your, which is why I would rather we just decide what is best for society. Seems a lot more useful than trying to decide whether IP filtering is analogous to breaking a window.
      - anigbrowl 13y ago
        Dunkin' Donuts could exclude you from their premises if they saw fit. Your analogy is equivalent to 3taps making a list of Craigslist URLs and getting a front page screenshot for each one. Scraping is qualitatively different - you have go on into the website to analyze the content, so I suggest it's more like walking into the DD kitchen and trying to document their customer transactions.
  - deleted 13y ago
    [deleted]
graycat 13y ago
Quite broadly, that the Web site got traffic from the banned IP address is not solid evidence that the person who got the C&D letter accessed the Web site. The Web site will need better evidence than traffic from the banned IP address.
cynicalkane 13y ago
First, editorailized headlines are not allowed by site rules. (EDIT: The headline is now changed. It previously read, "Change your IP, go to jail" or something like that.) Anyway, Craigslist told 3taps in a legal notice: "Don't abuse our website." 3taps did anyway. IANAL but this appears clear from the second and third quoted paragraphs (and Orin Kerr, a noted expert on these things, seems to agree): The banned user has to follow only one, clear rule: do not access the website. The notice issue becomes limited to how clearly the website owner communicates the banning. Here, Craigslist affirmatively communicated its decision to revoke 3Taps’ access through its cease-and-desist letter and IP blocking efforts... You might as well say, "Enter a building, go to jail"... if the door is a side entrance to a privately owned public space (such as a shop) which has banned you from their property. That is how the judge sees it. I personally have some sympathy for 3taps and I expect most of HN does also. The open Internet is not like any old public space. But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.
- graycat 13y ago
  Sure, but what the heck is the proof that 3taps continued to abuse the Web site? That the Web site got traffic on the IP address they banned is not solid proof that 3taps was using their Web site.
  - mpyne 13y ago
    I assume you didn't read the article? 3taps used a proxy to show up to the website from a completely different IP. Either way it's easy enough, just see if 3taps has data from the craigslist website that was after the effective date of the IP block and C&D letter being received.
    - graycat 13y ago
      I did read the article. The article and the legal thinking are badly confused and, really, nonsense. Why? The main reason why and my point in my post is that blocking the IP address is just silly talk since an IP address can't be used at all reliably to identify a computer or user. The IP address is nearly irrelevant. The Web site might as well find that the person, say, Tom, they didn't like ate at McDonald's and then try to block everyone who eats at McDonald's. Then Tom can eat at Wendy's, and everyone who does continue to eat at McDonald's gets blocked and maybe accused of violating the C&D letter. Again, once again, over again, yet again, IP address just says next to nothing about who did or did not connect to the Web site. So, IP address should be ignored in this legal discussion. Away from McDonald's and more specifically about the Internet, (1) The user who got the C&D letter could just use a different IP address. One way to do that is to us a proxy as in the article. Another way is just to disconnect the electrical power from a cable modem and connect power again. Then the modem will likely forget the IP address it was last assigned, use the internet standard dynamic host connection protocol (DHCP) to get another IP address from the Internet service provider (ISP), and continue on. Another way is, the ISP can just assign a different IP address at any time for any reason. So, the person, Tom, who received the C&D letter can get a new IP address and, indeed, be forced to give up his old IP address. And the user, Tom, need not even be aware of this change in IP address. (2) The Web site could get torqued at the wrong person. So, the ISP of the person receiving the C&D letter, Tom, could assign the the IP address blocked by the Web site to another person, Joe, not involved in any of the legal efforts, and Tom could try to connect to the Web site. Then the Web site could blame Tom for access to their site by Joe. Bummer for Joe. For your > just see if 3taps has data from the craigslist website that was after the effective date of the IP block that's not nearly "easy enough". Even to start to look for this data, need full access to at least the computer of the person who got the C&D letter, Tom. So, have to grab Tom's computer. By what right? Tom can claim that he has been honoring the C&D letter and not been accessing the Web site and that the blocked IP address has been assigned to someone else, Joe. Even if get Tom's computer, now what? He could have several trillion bytes of data on his computer, and also have other computers in his house/office. Looking for the Craigslist data could be a lot of work and very intrusive, whether Tom had the data or not. The search could uncover business plans, love letters, etc. Tom should be able to keep private. The Craigslist data could be anywhere in that data or nowhere. The data could be encrypted. Tom might have copied the data to DVD and hidden it in the bottom of his kitty cat's litter box, under insulation in his attic, in one of several hundred books on his bookshelf, etc. Pawing through all of Tom's private possessions all based in IP address or less is outrageously intrusive and wildly unfair to Tom. Next, it need not be the least bit clear in what form the data is. The data, as sent by Craigslist, is essentially just simple text plus maybe some pictures in JPG, GIF, PNG, etc. A lot of that text data is HTTP, HTML, and CSS tokens, symbols, and markup that has next to nothing to do with the Craigslist data at issue; those tokens, etc. can easily be removed by a simple program or text editor leaving just the data. That data can be pulled into a spreadsheet, written to a database (e.g., SQL Server or MySql), combined with other data in files, tables, etc., graphed, formatted with TeX, PostScript, PDF, etc., and look nothing much like a Web page from Craigslist. So, turning Tom's house upside down promises to uncover nothing relevant to the C&D letter. Since maybe Tom is honoring the C&D letter, turning his house upside down is not justified by any evidence and is unfair to Tom. Moreover, maybe Tom got the Craigslist data from, say, a Google archived copy or a friend or another Web site. "Easy enough" is a very long way from being true: It's easy for Tom to have what looks like Craigslist data when he did honor the C&D letter. It's easy for Tom not to have honored the C&D letter and have some Craigslist data but be next to impossible to know this, no matter what devastation is inflicted on Tom's house or office. More generally, the Web site is volunteering to send its data over the Internet to computers and software that request the data via a HTTP GET request. About all the Web site knows is that there was a GET request from an IP address; neither the GET request nor the IP address say anything meaningful about a person. It's not the least bit clear who the person is. That's just how the Internet works. If the Web site doesn't like that, then they can shut down. So, really, the Web site can send all the letters they want, but they have no evidence that should justify searching what data Tom has or if Tom did or did not honor the C&D letter. The Web site effectively put the data out there in the public square for everyone, anonymously, to see, copy, keep, and in some, and maybe all, respects use. Then later the Web site changed their mind and wants some absurd restrictions based on some nearly meaningless evidence. The data is offered to anonymous users, and it is not clear just who the users are, and no amount of C&D letter writing and IP address tracking, etc. can change that.
aj700 13y ago
I don't understand. Does the article say that changing your ip is wrong and precedent-setting as such. Has Aaron, with all respect to him, left us ironically with the tyranny of true names? Legal precedent nationally across the US?
- lotharbot 13y ago
  > "Does the article say that changing your ip is wrong" No. The article says that circumventing a measure which you know was put in place to keep you out (in this case, an IP ban which followed a C&D letter) means you are intentionally committing "unauthorized access". Changing IPs just happened to be the method used to gain said unauthorized access. If you tell me I'm banned from your store, and then I shave my beard and change my shirt specifically so you won't recognize me when I sneak back in, that would likewise be "unauthorized access". This doesn't mean shaving and changing my shirt is wrong, just that doing it for the purpose of accessing something the owners have told me not to access is illegal.
losethos 13y ago
Divine law is that you do an offering before consulting God. God does punishments, though. You seem confused who who's ... not honoring the Sabbath is punishable by death. You just have to do 12 hours of worship a week. God says... effort meek fable Vietnam existeth loth benefits wise deferring yoke hiddest herb doubled whenever I'm_beginning_to_wonder Moon deceiving stages learning mentioning diminish hooks Whatever flights savoured beside pages folded front resolved beneath exhibit notions whirlpool Charity deriders quickly Soft perturbations deeps quickness cosmetics embracements approveth Libya forbear performed arrival surrounded expounded spirit ready collects in again forgotten temptations resistance check FOR Anaximenes NOT fraught contemplate rejection forenoons died I_could_be_wrong means villa maimed laying you_see_the_light treasured ceased eat distracting Master when_hell_freezes_over
bigiain 13y ago
Meanwhile, here in Australia: http://www.abc.net.au/news/2013-07-29/geo-blocking-mps-committee-price-report-apple-adobe-microsoft/4850484 http://www.abc.net.au/news/2013-07-29/geo-blocking-mps-commi... "A federal parliamentary committee has recommended that consumers find ways to lawfully evade technology that allows IT companies to charge up to twice as much for their products in Australia." " … said the report had made 10 recommendations to lower prices, included educating Australian businesses on how to bypass geo-blocks."
- chii 13y ago
  even if evading geo-blocking is lawful in australia (whether it is or not is another question), services like Steam, if they detect that you did such a thing, have the option of revoking access to your account, and you lose out. And the amazing thing is, steam's revocation is completely legal (plus you also agreed to it in the EULA). This whole thing is completely anti-consumer. The law needs to catch up and make sure that consumer has the same protection as physical goods.
  - bigiain 13y ago
    The optimist in me hopes this is a sign of "the law" doing its slow and steady "catching up". This was the report of a parliamentary inquiry - this was asked for and delivered to our lawmakers. If I were a business with a model predicated on geo-blocking and intending to do business with Australians, I'd be looking for a way to ensure by business model works _without_ that artificial barrier. (I'd suggest that like many consumer laws, you will no more be able to rely on click thru Eula clauses to enforce this than you can evade "fit for purpose" requirements in physical goods)
    - chii 13y ago
      hehe, then you are much more optimistic than me! I dont believe that current sellers of licenses of software (and other media too) would like such consumer protection laws, because it means they no longer control their consumer's collection - e.g., any law that does not enforce the 2nd sale doctrine for digital goods is bound to fail to protect consumers, but media creators would not want to allow 2nd sale of their digital goods (ever!).
niels_olson 13y ago
If this applies to IP addresses, it should seem reasonably short work to show that it applies to physical addresses. In which case, patent trolls may quickly be a thing of the past.
- chii 13y ago
  pray tell, why is that?
joshmn 13y ago
So proxies are illegal too!?
- alan_cx 13y ago
  Well, it depends what you use them for.
- dspillett 13y ago
  Not directly, but if they are used to get around legal limitations then yes. There is no specific law covering this sort of thing which is why cases of this nature are often grey areas: it all depends on how you interpret/implement laws written to cover the physical world as you transcribe them to operate online. For instance gaining access to money by pretending to be in a country where you would qualify for a grant in, despite living elsewhere, is fraud - gaining access to resources online the same way using a proxy to pretend you come from somewhere else is the same thing. As with many tools proxies themselves are not illegal (well, in most territories!) and have a great many legal uses, but they can be used as part of an attempt to get away with breaking the law.
teeja 13y ago
Seems clear to me that banning an IP address is nothing more than a ban on that IP address. The user could conceivably go to a library and use their IP to access the site. Since that's self-evidently a non-productive approach, the only way to communicate the block of an individual user is to affirmatively contact that user and obtain a signed recognition of that user's banning. That may create a technical problem for the banner, but the method the judge chose simply ignores the fact that an IP address (unlike a ham radio license but exactly like a telephone number) is never attached to an individual.
- lotharbot 13y ago
  In this case, the user knew they'd been banned due to the Cease and Desist letter they received.
  - graycat 13y ago
    Yes, but when that Web site gets traffic from the banned IP address, what is the evidence that the person who got the C&D letter was the one responsible for the traffic? The traffic could have been from any customer of the ISP used by the banned user.
    - roel_v 13y ago
      While I think that your argument is flawed in its understanding of the law, a technological approach could be: let x be the suspect IP address. When we receive a request from x, we send them some messages that we don't send to other users; or maybe we change messages slightly (like leave out some footers, or with a different image link, whatever). When the fake/modified messages show up on the suspect website, we can reasonably assume that they accessed our website. At that point, it doesn't even matter any more whether they did it through x or another.
      - graycat 13y ago
        Right. Now are beginning to make a little sense -- a big change from the OP. So, the problem was not getting the data from Craigslist but publishing it elsewhere. But your point still will not make Craigslist at all happy: Craigslist has a lot of data. Maybe someone, Tom, wants to get a copy of a lot of that data and do some things with it. The data at issue need not be in any meaningful way subject to the marking you describe. That is, what Craigslist sends is HTTP, HTML, CSS, simple text, and maybe some files in JPG, PNG, GIF, etc. Tom can grab just the text, put it into a database, analyze it, and republish leaving the marking far behind. So, right, if Tom does something sufficiently stupid, then he can be slapped down for violating the C&D letter. Otherwise, not stupid, it's essentially impossible for the Web site to know if Tom honored the C&D letter. Then, searching Tom's computer, etc. will be based on next to no go evidence and be wildly unfair to Tom.
alan_cx 13y ago
So, on a shared internet connection, where many people might well use that one IP address, does this mean banning one person bans all?
- dspillett 13y ago
  Basically yes. Most sites that have found the need to implement bans by address consider this collateral damage to be worth it - in fact to get around it being difficult to IP-ban someone on an ISP that hands out variable addresses some will ban a whole range (first banning one address, then another, then another, and after several addresses in a range (something like a /20 or more - a /24 would not cover all but the smallest ISP's dynamic address pool) are banned the whole range gets the hammer, at least temporarily. IPv6 will make a difference if its adoption means that the use of NAT drops considerably, but even if every device really does have a unique address there is still the problem of several users on the same device (implementing per-user addresses on a single device is never going to happen as it is just too much hassle for little or no gain).
deleted 13y ago
[deleted]
- tzs 13y ago
  RTFA before ranting.
mapt 13y ago
Hacker News implements permanent IP bans on anyone that performs tasks like reloading Chrome after the 15th HN tab opened for the day's reading crashes the core of the browser. When the browser reloads tabs, 15 concurrent connections are made at once, and the IP gets banned. This is such a trigger-happy approach that a great number of legitimate users have found themselves IP banned, to the extent that a voluntary unban tool has been created: 1) open Tor for a different IP, and 2) go to http://news.ycombinator.com/unban?ip=<original http://news.ycombinator.com/unban?ip=<original ip address>. By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things. Criminal trespass is dealt with on a very limited basis by police officers seeking to uphold short-term civic order, correctively rather than retributively. If it became a strict-liability crime about pursuing criminals and punishing them with decades of jailtime, we would have an unworkable system where the harm of criminalization obviously outweighed the harm of being in a place that was technically off-limits. That is basically the case in most permutations of the CFAA. This happens to be a corporate defendant in a civil suit with an unambiguous C&D... but beware any broader interpretion of the thing while it still has criminal penalties attached.
- bennyg 13y ago
  Even a wget on HN will do the same. I did it for shits and gigs one time and found my IP banned before it finished running.
- bradleyjg 13y ago
  > By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things. I don't read the opinion to say that. In fact, I'd say that the court put more weight on the C&D than the IP ban (contra Prof. Kerr who reads the statue as giving primacy to the technological measure). Though admittedly the analysis is rather short. 3taps doesn't argue it thought it got caught up in an over aggressive automated filter. It knew Craigslist didn't want it to access its website and did anyway. I don't see why slippery slope arguments ought to let them off the hook. Though I agree a civil forum is generally the best for this sort of thing.
EtienneK 13y ago
Does everyone in the States have a static IP address? Here where I live, every time you reconnect to the internet you get a new IP.
- pdonis 13y ago
  It depends on your ISP and what kind of service you have. Most providers of high speed internet (meaning cable or fiber optic) these days don't change your IP very often, so although it's technically not "static" (meaning, there is no guarantee that it will stay the same), it ends up being more or less the same thing in practical terms.
  - graycat 13y ago
    Not really: For whatever reason, my electric company commonly drops power for a second or so about once a week. How do I know? Because then the clock on my microwave oven just blinks not knowing what time it is. Well, that one second power drop also causes my cable modem to forget the IP address it was assigned via DHCP by my ISP. So, the guy with the C&D letter can tell the Web site that traffic on the banned IP address was no good evidence that the traffic was from him and, instead, could have been from any customer of the relevant ISP. Moreover, the ISP could assign the IP address the Web site banned to just any customer not involved in the C&D letter, etc. Then the Web site would ban that person; I hope that person would not get charged with a crime.
    - pdonis 13y ago
      that one second power drop also causes my cable modem to forget the IP address it was assigned via DHCP by my ISP. Does the IP address actually change when this happens? Some ISPs have their DHCP server assign IPs according to the MAC address of the cable modem, which of course won't change if power is shut off and then turned on again. the guy with the C&D letter can tell the Web site that traffic on the banned IP address was no good evidence that the traffic was from him and, instead, could have been from any customer of the relevant ISP. If he was a private individual getting internet access from an ISP that did that, sure. But in the particular case referred to in the OP, the "guy with the C&D letter" was a company, not an individual, and as I understand it, the IP addresses that were banned were the ones mapped to that company's domain name based on DNS records. That's a different situation. the ISP could assign the IP address the Web site banned to just any customer not involved in the C&D letter, etc. Then the Web site would ban that person; I hope that person would not get charged with a crime. It's not clear how Craigslist found out that 3Taps had changed the IP addresses it was using and resumed scraping the site. However, whatever means it used to find that out was apparently accurate, since 3Taps admitted that it had changed IP addresses and was still scraping the site. The court case was based entirely on Craigslist saying that 3Taps was no longer authorized to access their site; there was no dispute about whether they had actually done so.
icambron 13y ago
IANAL, but I'd have guessed that the answer to Kerr's first question -- does an IP address block constitute a "technological barrier?" -- would be no. My reasoning is this: IP addresses change all the time and so a normal, unsophisticated user could, perhaps even unwittingly evade the barrier without any sort of technological workaround. If you could accidentally do it in the course of your day, it's doesn't pass muster as a "barrier". Imagine you had a building complex with many roads leading to it and you want to forbid motorcycles from entering it. You set up a blockade on one of those roads, and have a security guard turn away motorcycles. But there are all these other roads leading to the complex without blockades. Normal, every day people roads just like the one that has a blockade, and anyone could use them to drive in on a motorcycle. Does that constitute a barrier that's being circumvented? That's all all directed at that narrow question. For the record, I don't think you should be allowed to use a website when the owners have asked you not to, but I do see how it's pretty different than, say, brute forcing the SSH password. And so that narrower question might have some impact on what charges their guilty of.
- pdonis 13y ago
  IP addresses change all the time IP addresses assigned by ISPs do, yes. But as I understand it, the IP addresses Craigslist banned in this case were the ones assigned to 3Taps' domain name based on DNS records. That's a different situation.
  - icambron 13y ago
    That's a reasonable point.
szuhanchang 13y ago
How does the Citizens United ruling factor into this? Basically, I'm wondering if a valid defense would be to say that although 3Taps as a company was banned from using Craigslist, individual employees and separate companies were not. As a result, the subsequent retrievals of information by individual employees / a separate company out of their own volition and not using company resources constitute legal access of Craigslist. The information legally gathered by the separate entities were then passed back to the company, so 3Taps never actually accessed Craigslist after the ban. Would this work, and why / why not?
graycat 13y ago
An IP address does not for long accurately identify a computer or a person. E.g., Internet service providers (ISP) make heavy use of dynamic host connection protocol (DHCP) which assigns a new IP address for each new connection from a user. And, for a user permanently connected via a cable modem, losing power to the modem commonly causes it to forget it's assigned IP address and when power is on again to request a new IP address from the ISP. Also, commonly ISPs change user IP addresses for whatever reasons without notice. Really, a user often doesn't know what IP address he is using. Fixed IP addresses are important for servers but not for users. And due to the fact that with 32 bit IP addresses there are only about 4 billion IP addresses to serve the whole Internet, ISPs commonly assign a new IP address for each connection and may have fewer IP addresses than paying customers. A Web site has no easy way to know that a specific IP address is from a specific computer or a specific person. And, indeed, just by having electric power go out, the user's computer will likely be using a new IP address. So, for a Web site to block an IP address does not block a specific computer or specific user. So, a user can just say, "That you got some traffic from that IP address is no evidence that I accessed your Web site. That traffic could have been from any customer of my ISP." Next, there is a problem with screen scraping: The way the Web works, with HTTP, HTML, and CSS, when a Web site sends a Web page to a user, what is sent is essentially just simple, plain text. Then screen scraping is just keeping what was sent. The Web site sent the text; the user just kept a copy; keeping a copy at least until the original changes is a standard performance feature of Web browsers. So, it's standard for a user to have and keep a copy of what the Web site sent. The Web site freely sent the data as just simple text; if the Web site doesn't want people to have that data, then the Web site should not send that data to people.
systemtrigger 13y ago
I'm confused then because according to founder Greg Kidd 3taps does not get its data by scraping Craigslist: "...We didn't get the data from them anyways. We're finding it from other sources which have already indexed it like Google, like Bing, like other search engines that are out there." http://www.youtube.com/watch?v=6Rf6JrSYZ4U#t=27m32s http://www.youtube.com/watch?v=6Rf6JrSYZ4U#t=27m32s
- pdonis 13y ago
  If you read the fine print (which is in various documents linked to on 3Taps' website), you find that it's not quite as simple as that. 3Taps started out getting the data from Google; but when Craigslist found out what they were doing, they restricted Google's access in a way that made it necessary for 3Taps to scrape Craigslist's site directly. It's notable that, in these documents (which are written by 3Taps), the fact that Craigslist sent them a C&D letter is never mentioned. So it's not clear where, exactly, in the process the C&D letter came in.
hmottestad 13y ago
At college we discussed what an IP is. An IP has two parts, the identification and the location. If you change your IP to mask your identity, then you are telling the server you are someone else, however if you change IP to mask your location you are only saying you are somewhere else.
- epo 13y ago
  Your college explanation was so skimpy as to be useless. An IP, at best, identifies a particular endpoint at a particular point in time, consider dynamically allocated IP addresses or virtual machines with externally visible IPs. Whoever allocated the IP may have records showing which telephone line was allocated that IP at a particular time. That might narrow it down to a residence, building or office. But this is all irrelevant. As I understand it, there was a court order forbidding 3taps to access a particular service. Additionally their IP was blocked. Changing IP to try and circumvent the ban is the kind of thing a 13 year old thing might think was clever and 3taps should be slapped down very hard for this it is, in effect, contempt of court.
zby 13y ago
IRC ops must now be celebrating.
crb002 13y ago
Craigslist asked 3taps not to use their IPs to connect. 3taps complied and stopped using those IPs. What's the beef?
- lotharbot 13y ago
  Craigslist asked 3taps not to use their data. 3taps continued to use CL's data, even going so far as to circumvent a security measure (the IP block -- weak, but still technically a security measure). The court decision, which is linked elsewhere in this discussion, consistently connects the IP ban to the C&D letter. They don't seem particularly concerned with the details of how 3Taps accessed the data, only that 3Taps intentionally accessed data whose owners had clearly revoked access.

149 points by maalyex 13y ago

Just trying to understand how far this could be pushed. Would it be possible in a future case that a judge could deem 'not providing an API' a technological barrier to programmatic access and therefore hold that screen-scraping is in violation of the CFAA?

maalyex 13y ago

Admittedly a sensationalistic headline on my part The title of the linked article is "District Court Holds That Intentionally Circumventing IP Address Ban Is “Access Without Authorization” Under the CFAA". Violating the CFAA is, of course, illegal. From the linked article: "During the debate over the Aaron Swartz case, one of the legal issues was whether Swartz had committed an unauthorized access under the CFAA when he changed his IP address to circumvent IP address blocking" This particular ruling relates to Craigslist. http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

dpeck 13y ago
I may be remembering wrong, but I believe in the Swartz case it was about spoofing his MAC address?
- maalyex 13y ago
  From the article: "There was significantly more to the CFAA charges than that, to be clear, including circumventing a subsequent MAC address block and (most significantly) entering an MIT storage closet to install his computer directly. But changing IP addresses to get around IP address blocking was at least one of the possible grounds of unauthorized access."
- fnordfnordfnord 13y ago
  I've done a lot more than that on gov't networks just to get slides to show up on a conference projector.
  - lotharbot 13y ago
    Using a workaround for buggy or misconfigured hardware is very different from "these guys told me to stop using their thing, but I can circumvent the measures they put in place to stop me." EDIT: related quotes from the ruling "Craigslist gave the world permission (i.e., “authorization”) to access the public information on its public website.... it rescinded that permission for 3Taps." "3Taps had to circumvent Craigslist’s IP blocking measures to continue scraping, so it indisputably knew that Craigslist did not want it accessing the website at all." "3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization”"
    - fnordfnordfnord 13y ago
      Not really, since I am not an IT guy. Using the law like that means that I have to rely on: Not accidentally breaking things. No misunderstandings with the real IT folks. Some petty asshole in authority who doesn't like me not wanting an excuse to cause trouble for me.
      - lotharbot 13y ago
        I think you have it backwards. The court decision relied on the clarity of intent from 3taps. They had been both expressly told not to do something, and technically blocked from doing it. Their access to CL wasn't accidentally broken, they didn't misunderstand what they had been told in the C&D letter, and they didn't get caught by some surprising technicality. They had been clearly told to stop, and they circumvented the measures put in place to stop them. I said elsewhere: this is more or less equivalent to a store telling me not to come back and distributing my photo to staff... and then me shaving my beard and changing my clothes in order to sneak back in. Shaving and changing my clothes are not illegal in and of themselves; trespassing is illegal, and shaving and changing my clothes are the tools I chose to use in my effort to trespass.
- anigbrowl 13y ago
  It's not 'about' spoofing his MAC address. It's about respecting the rights of property owners to set the terms of how other people may access their property. You know, when someone is charged with burglary the issue is not that they entered your place through the window rather than by ringing the doorbell, but that they entered without your permission. Try to imagine the outrage that would result if a judge said 'it's your fault for having an insecure window, tough luck.' EDIT: I might add that I don't care for JSTOR or the copyright system that they derive such benefit from. But then I don't especially care for our laws on taxation and related subjects - my disagreement with those doesn't give me the right to opt out of taxes that I dislike, or to appropriate the possessions of others whose wealth I might envy.
  - aero142 13y ago
    I really hate analogies in law because it always seems to provide very little support for whether a law is a good idea or not. Your analogy is to breaking and entering a physical residence, but you skip over the fact that this is a publicly available website. I'd say it has more in common with photographing a public building. Lets say Dunkin' Donuts doesn't want me photographing their buildings and making a map of all their locations. They demand that I stop taking photo's from the street and put up a small tarp that covers the physical line of sight to their building that I used to photograph. I then come back and photograph their building from 2 feet to the right and they claim I bypassed their building security. I don't think my analogy is any more correct than your, which is why I would rather we just decide what is best for society. Seems a lot more useful than trying to decide whether IP filtering is analogous to breaking a window.
    - anigbrowl 13y ago
      Dunkin' Donuts could exclude you from their premises if they saw fit. Your analogy is equivalent to 3taps making a list of Craigslist URLs and getting a front page screenshot for each one. Scraping is qualitatively different - you have go on into the website to analyze the content, so I suggest it's more like walking into the DD kitchen and trying to document their customer transactions.
- deleted 13y ago
  [deleted]

graycat 13y ago

Quite broadly, that the Web site got traffic from the banned IP address is not solid evidence that the person who got the C&D letter accessed the Web site. The Web site will need better evidence than traffic from the banned IP address.

cynicalkane 13y ago

First, editorailized headlines are not allowed by site rules. (EDIT: The headline is now changed. It previously read, "Change your IP, go to jail" or something like that.) Anyway, Craigslist told 3taps in a legal notice: "Don't abuse our website." 3taps did anyway. IANAL but this appears clear from the second and third quoted paragraphs (and Orin Kerr, a noted expert on these things, seems to agree): The banned user has to follow only one, clear rule: do not access the website. The notice issue becomes limited to how clearly the website owner communicates the banning. Here, Craigslist affirmatively communicated its decision to revoke 3Taps’ access through its cease-and-desist letter and IP blocking efforts... You might as well say, "Enter a building, go to jail"... if the door is a side entrance to a privately owned public space (such as a shop) which has banned you from their property. That is how the judge sees it. I personally have some sympathy for 3taps and I expect most of HN does also. The open Internet is not like any old public space. But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.

graycat 13y ago
Sure, but what the heck is the proof that 3taps continued to abuse the Web site? That the Web site got traffic on the IP address they banned is not solid proof that 3taps was using their Web site.
- mpyne 13y ago
  I assume you didn't read the article? 3taps used a proxy to show up to the website from a completely different IP. Either way it's easy enough, just see if 3taps has data from the craigslist website that was after the effective date of the IP block and C&D letter being received.
  - graycat 13y ago
    I did read the article. The article and the legal thinking are badly confused and, really, nonsense. Why? The main reason why and my point in my post is that blocking the IP address is just silly talk since an IP address can't be used at all reliably to identify a computer or user. The IP address is nearly irrelevant. The Web site might as well find that the person, say, Tom, they didn't like ate at McDonald's and then try to block everyone who eats at McDonald's. Then Tom can eat at Wendy's, and everyone who does continue to eat at McDonald's gets blocked and maybe accused of violating the C&D letter. Again, once again, over again, yet again, IP address just says next to nothing about who did or did not connect to the Web site. So, IP address should be ignored in this legal discussion. Away from McDonald's and more specifically about the Internet, (1) The user who got the C&D letter could just use a different IP address. One way to do that is to us a proxy as in the article. Another way is just to disconnect the electrical power from a cable modem and connect power again. Then the modem will likely forget the IP address it was last assigned, use the internet standard dynamic host connection protocol (DHCP) to get another IP address from the Internet service provider (ISP), and continue on. Another way is, the ISP can just assign a different IP address at any time for any reason. So, the person, Tom, who received the C&D letter can get a new IP address and, indeed, be forced to give up his old IP address. And the user, Tom, need not even be aware of this change in IP address. (2) The Web site could get torqued at the wrong person. So, the ISP of the person receiving the C&D letter, Tom, could assign the the IP address blocked by the Web site to another person, Joe, not involved in any of the legal efforts, and Tom could try to connect to the Web site. Then the Web site could blame Tom for access to their site by Joe. Bummer for Joe. For your > just see if 3taps has data from the craigslist website that was after the effective date of the IP block that's not nearly "easy enough". Even to start to look for this data, need full access to at least the computer of the person who got the C&D letter, Tom. So, have to grab Tom's computer. By what right? Tom can claim that he has been honoring the C&D letter and not been accessing the Web site and that the blocked IP address has been assigned to someone else, Joe. Even if get Tom's computer, now what? He could have several trillion bytes of data on his computer, and also have other computers in his house/office. Looking for the Craigslist data could be a lot of work and very intrusive, whether Tom had the data or not. The search could uncover business plans, love letters, etc. Tom should be able to keep private. The Craigslist data could be anywhere in that data or nowhere. The data could be encrypted. Tom might have copied the data to DVD and hidden it in the bottom of his kitty cat's litter box, under insulation in his attic, in one of several hundred books on his bookshelf, etc. Pawing through all of Tom's private possessions all based in IP address or less is outrageously intrusive and wildly unfair to Tom. Next, it need not be the least bit clear in what form the data is. The data, as sent by Craigslist, is essentially just simple text plus maybe some pictures in JPG, GIF, PNG, etc. A lot of that text data is HTTP, HTML, and CSS tokens, symbols, and markup that has next to nothing to do with the Craigslist data at issue; those tokens, etc. can easily be removed by a simple program or text editor leaving just the data. That data can be pulled into a spreadsheet, written to a database (e.g., SQL Server or MySql), combined with other data in files, tables, etc., graphed, formatted with TeX, PostScript, PDF, etc., and look nothing much like a Web page from Craigslist. So, turning Tom's house upside down promises to uncover nothing relevant to the C&D letter. Since maybe Tom is honoring the C&D letter, turning his house upside down is not justified by any evidence and is unfair to Tom. Moreover, maybe Tom got the Craigslist data from, say, a Google archived copy or a friend or another Web site. "Easy enough" is a very long way from being true: It's easy for Tom to have what looks like Craigslist data when he did honor the C&D letter. It's easy for Tom not to have honored the C&D letter and have some Craigslist data but be next to impossible to know this, no matter what devastation is inflicted on Tom's house or office. More generally, the Web site is volunteering to send its data over the Internet to computers and software that request the data via a HTTP GET request. About all the Web site knows is that there was a GET request from an IP address; neither the GET request nor the IP address say anything meaningful about a person. It's not the least bit clear who the person is. That's just how the Internet works. If the Web site doesn't like that, then they can shut down. So, really, the Web site can send all the letters they want, but they have no evidence that should justify searching what data Tom has or if Tom did or did not honor the C&D letter. The Web site effectively put the data out there in the public square for everyone, anonymously, to see, copy, keep, and in some, and maybe all, respects use. Then later the Web site changed their mind and wants some absurd restrictions based on some nearly meaningless evidence. The data is offered to anonymous users, and it is not clear just who the users are, and no amount of C&D letter writing and IP address tracking, etc. can change that.

aj700 13y ago

I don't understand. Does the article say that changing your ip is wrong and precedent-setting as such. Has Aaron, with all respect to him, left us ironically with the tyranny of true names? Legal precedent nationally across the US?

lotharbot 13y ago
> "Does the article say that changing your ip is wrong" No. The article says that circumventing a measure which you know was put in place to keep you out (in this case, an IP ban which followed a C&D letter) means you are intentionally committing "unauthorized access". Changing IPs just happened to be the method used to gain said unauthorized access. If you tell me I'm banned from your store, and then I shave my beard and change my shirt specifically so you won't recognize me when I sneak back in, that would likewise be "unauthorized access". This doesn't mean shaving and changing my shirt is wrong, just that doing it for the purpose of accessing something the owners have told me not to access is illegal.

losethos 13y ago

Divine law is that you do an offering before consulting God. God does punishments, though. You seem confused who who's ... not honoring the Sabbath is punishable by death. You just have to do 12 hours of worship a week. God says... effort meek fable Vietnam existeth loth benefits wise deferring yoke hiddest herb doubled whenever I'm_beginning_to_wonder Moon deceiving stages learning mentioning diminish hooks Whatever flights savoured beside pages folded front resolved beneath exhibit notions whirlpool Charity deriders quickly Soft perturbations deeps quickness cosmetics embracements approveth Libya forbear performed arrival surrounded expounded spirit ready collects in again forgotten temptations resistance check FOR Anaximenes NOT fraught contemplate rejection forenoons died I_could_be_wrong means villa maimed laying you_see_the_light treasured ceased eat distracting Master when_hell_freezes_over

bigiain 13y ago

Meanwhile, here in Australia: http://www.abc.net.au/news/2013-07-29/geo-blocking-mps-committee-price-report-apple-adobe-microsoft/4850484 http://www.abc.net.au/news/2013-07-29/geo-blocking-mps-commi... "A federal parliamentary committee has recommended that consumers find ways to lawfully evade technology that allows IT companies to charge up to twice as much for their products in Australia." " … said the report had made 10 recommendations to lower prices, included educating Australian businesses on how to bypass geo-blocks."

chii 13y ago
even if evading geo-blocking is lawful in australia (whether it is or not is another question), services like Steam, if they detect that you did such a thing, have the option of revoking access to your account, and you lose out. And the amazing thing is, steam's revocation is completely legal (plus you also agreed to it in the EULA). This whole thing is completely anti-consumer. The law needs to catch up and make sure that consumer has the same protection as physical goods.
- bigiain 13y ago
  The optimist in me hopes this is a sign of "the law" doing its slow and steady "catching up". This was the report of a parliamentary inquiry - this was asked for and delivered to our lawmakers. If I were a business with a model predicated on geo-blocking and intending to do business with Australians, I'd be looking for a way to ensure by business model works _without_ that artificial barrier. (I'd suggest that like many consumer laws, you will no more be able to rely on click thru Eula clauses to enforce this than you can evade "fit for purpose" requirements in physical goods)
  - chii 13y ago
    hehe, then you are much more optimistic than me! I dont believe that current sellers of licenses of software (and other media too) would like such consumer protection laws, because it means they no longer control their consumer's collection - e.g., any law that does not enforce the 2nd sale doctrine for digital goods is bound to fail to protect consumers, but media creators would not want to allow 2nd sale of their digital goods (ever!).

niels_olson 13y ago

If this applies to IP addresses, it should seem reasonably short work to show that it applies to physical addresses. In which case, patent trolls may quickly be a thing of the past.

chii 13y ago
pray tell, why is that?

joshmn 13y ago

So proxies are illegal too!?

alan_cx 13y ago
Well, it depends what you use them for.
dspillett 13y ago
Not directly, but if they are used to get around legal limitations then yes. There is no specific law covering this sort of thing which is why cases of this nature are often grey areas: it all depends on how you interpret/implement laws written to cover the physical world as you transcribe them to operate online. For instance gaining access to money by pretending to be in a country where you would qualify for a grant in, despite living elsewhere, is fraud - gaining access to resources online the same way using a proxy to pretend you come from somewhere else is the same thing. As with many tools proxies themselves are not illegal (well, in most territories!) and have a great many legal uses, but they can be used as part of an attempt to get away with breaking the law.

teeja 13y ago

Seems clear to me that banning an IP address is nothing more than a ban on that IP address. The user could conceivably go to a library and use their IP to access the site. Since that's self-evidently a non-productive approach, the only way to communicate the block of an individual user is to affirmatively contact that user and obtain a signed recognition of that user's banning. That may create a technical problem for the banner, but the method the judge chose simply ignores the fact that an IP address (unlike a ham radio license but exactly like a telephone number) is never attached to an individual.

lotharbot 13y ago
In this case, the user knew they'd been banned due to the Cease and Desist letter they received.
- graycat 13y ago
  Yes, but when that Web site gets traffic from the banned IP address, what is the evidence that the person who got the C&D letter was the one responsible for the traffic? The traffic could have been from any customer of the ISP used by the banned user.
  - roel_v 13y ago
    While I think that your argument is flawed in its understanding of the law, a technological approach could be: let x be the suspect IP address. When we receive a request from x, we send them some messages that we don't send to other users; or maybe we change messages slightly (like leave out some footers, or with a different image link, whatever). When the fake/modified messages show up on the suspect website, we can reasonably assume that they accessed our website. At that point, it doesn't even matter any more whether they did it through x or another.
    - graycat 13y ago
      Right. Now are beginning to make a little sense -- a big change from the OP. So, the problem was not getting the data from Craigslist but publishing it elsewhere. But your point still will not make Craigslist at all happy: Craigslist has a lot of data. Maybe someone, Tom, wants to get a copy of a lot of that data and do some things with it. The data at issue need not be in any meaningful way subject to the marking you describe. That is, what Craigslist sends is HTTP, HTML, CSS, simple text, and maybe some files in JPG, PNG, GIF, etc. Tom can grab just the text, put it into a database, analyze it, and republish leaving the marking far behind. So, right, if Tom does something sufficiently stupid, then he can be slapped down for violating the C&D letter. Otherwise, not stupid, it's essentially impossible for the Web site to know if Tom honored the C&D letter. Then, searching Tom's computer, etc. will be based on next to no go evidence and be wildly unfair to Tom.

alan_cx 13y ago

So, on a shared internet connection, where many people might well use that one IP address, does this mean banning one person bans all?

dspillett 13y ago
Basically yes. Most sites that have found the need to implement bans by address consider this collateral damage to be worth it - in fact to get around it being difficult to IP-ban someone on an ISP that hands out variable addresses some will ban a whole range (first banning one address, then another, then another, and after several addresses in a range (something like a /20 or more - a /24 would not cover all but the smallest ISP's dynamic address pool) are banned the whole range gets the hammer, at least temporarily. IPv6 will make a difference if its adoption means that the use of NAT drops considerably, but even if every device really does have a unique address there is still the problem of several users on the same device (implementing per-user addresses on a single device is never going to happen as it is just too much hassle for little or no gain).

deleted 13y ago

[deleted]

tzs 13y ago
RTFA before ranting.

mapt 13y ago

Hacker News implements permanent IP bans on anyone that performs tasks like reloading Chrome after the 15th HN tab opened for the day's reading crashes the core of the browser. When the browser reloads tabs, 15 concurrent connections are made at once, and the IP gets banned. This is such a trigger-happy approach that a great number of legitimate users have found themselves IP banned, to the extent that a voluntary unban tool has been created: 1) open Tor for a different IP, and 2) go to http://news.ycombinator.com/unban?ip=<original http://news.ycombinator.com/unban?ip=<original ip address>. By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things. Criminal trespass is dealt with on a very limited basis by police officers seeking to uphold short-term civic order, correctively rather than retributively. If it became a strict-liability crime about pursuing criminals and punishing them with decades of jailtime, we would have an unworkable system where the harm of criminalization obviously outweighed the harm of being in a place that was technically off-limits. That is basically the case in most permutations of the CFAA. This happens to be a corporate defendant in a civil suit with an unambiguous C&D... but beware any broader interpretion of the thing while it still has criminal penalties attached.

bennyg 13y ago
Even a wget on HN will do the same. I did it for shits and gigs one time and found my IP banned before it finished running.
bradleyjg 13y ago
> By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things. I don't read the opinion to say that. In fact, I'd say that the court put more weight on the C&D than the IP ban (contra Prof. Kerr who reads the statue as giving primacy to the technological measure). Though admittedly the analysis is rather short. 3taps doesn't argue it thought it got caught up in an over aggressive automated filter. It knew Craigslist didn't want it to access its website and did anyway. I don't see why slippery slope arguments ought to let them off the hook. Though I agree a civil forum is generally the best for this sort of thing.

EtienneK 13y ago

Does everyone in the States have a static IP address? Here where I live, every time you reconnect to the internet you get a new IP.

pdonis 13y ago
It depends on your ISP and what kind of service you have. Most providers of high speed internet (meaning cable or fiber optic) these days don't change your IP very often, so although it's technically not "static" (meaning, there is no guarantee that it will stay the same), it ends up being more or less the same thing in practical terms.
- graycat 13y ago
  Not really: For whatever reason, my electric company commonly drops power for a second or so about once a week. How do I know? Because then the clock on my microwave oven just blinks not knowing what time it is. Well, that one second power drop also causes my cable modem to forget the IP address it was assigned via DHCP by my ISP. So, the guy with the C&D letter can tell the Web site that traffic on the banned IP address was no good evidence that the traffic was from him and, instead, could have been from any customer of the relevant ISP. Moreover, the ISP could assign the IP address the Web site banned to just any customer not involved in the C&D letter, etc. Then the Web site would ban that person; I hope that person would not get charged with a crime.
  - pdonis 13y ago
    that one second power drop also causes my cable modem to forget the IP address it was assigned via DHCP by my ISP. Does the IP address actually change when this happens? Some ISPs have their DHCP server assign IPs according to the MAC address of the cable modem, which of course won't change if power is shut off and then turned on again. the guy with the C&D letter can tell the Web site that traffic on the banned IP address was no good evidence that the traffic was from him and, instead, could have been from any customer of the relevant ISP. If he was a private individual getting internet access from an ISP that did that, sure. But in the particular case referred to in the OP, the "guy with the C&D letter" was a company, not an individual, and as I understand it, the IP addresses that were banned were the ones mapped to that company's domain name based on DNS records. That's a different situation. the ISP could assign the IP address the Web site banned to just any customer not involved in the C&D letter, etc. Then the Web site would ban that person; I hope that person would not get charged with a crime. It's not clear how Craigslist found out that 3Taps had changed the IP addresses it was using and resumed scraping the site. However, whatever means it used to find that out was apparently accurate, since 3Taps admitted that it had changed IP addresses and was still scraping the site. The court case was based entirely on Craigslist saying that 3Taps was no longer authorized to access their site; there was no dispute about whether they had actually done so.

icambron 13y ago

IANAL, but I'd have guessed that the answer to Kerr's first question -- does an IP address block constitute a "technological barrier?" -- would be no. My reasoning is this: IP addresses change all the time and so a normal, unsophisticated user could, perhaps even unwittingly evade the barrier without any sort of technological workaround. If you could accidentally do it in the course of your day, it's doesn't pass muster as a "barrier". Imagine you had a building complex with many roads leading to it and you want to forbid motorcycles from entering it. You set up a blockade on one of those roads, and have a security guard turn away motorcycles. But there are all these other roads leading to the complex without blockades. Normal, every day people roads just like the one that has a blockade, and anyone could use them to drive in on a motorcycle. Does that constitute a barrier that's being circumvented? That's all all directed at that narrow question. For the record, I don't think you should be allowed to use a website when the owners have asked you not to, but I do see how it's pretty different than, say, brute forcing the SSH password. And so that narrower question might have some impact on what charges their guilty of.

pdonis 13y ago
IP addresses change all the time IP addresses assigned by ISPs do, yes. But as I understand it, the IP addresses Craigslist banned in this case were the ones assigned to 3Taps' domain name based on DNS records. That's a different situation.
- icambron 13y ago
  That's a reasonable point.

szuhanchang 13y ago

How does the Citizens United ruling factor into this? Basically, I'm wondering if a valid defense would be to say that although 3Taps as a company was banned from using Craigslist, individual employees and separate companies were not. As a result, the subsequent retrievals of information by individual employees / a separate company out of their own volition and not using company resources constitute legal access of Craigslist. The information legally gathered by the separate entities were then passed back to the company, so 3Taps never actually accessed Craigslist after the ban. Would this work, and why / why not?

graycat 13y ago

An IP address does not for long accurately identify a computer or a person. E.g., Internet service providers (ISP) make heavy use of dynamic host connection protocol (DHCP) which assigns a new IP address for each new connection from a user. And, for a user permanently connected via a cable modem, losing power to the modem commonly causes it to forget it's assigned IP address and when power is on again to request a new IP address from the ISP. Also, commonly ISPs change user IP addresses for whatever reasons without notice. Really, a user often doesn't know what IP address he is using. Fixed IP addresses are important for servers but not for users. And due to the fact that with 32 bit IP addresses there are only about 4 billion IP addresses to serve the whole Internet, ISPs commonly assign a new IP address for each connection and may have fewer IP addresses than paying customers. A Web site has no easy way to know that a specific IP address is from a specific computer or a specific person. And, indeed, just by having electric power go out, the user's computer will likely be using a new IP address. So, for a Web site to block an IP address does not block a specific computer or specific user. So, a user can just say, "That you got some traffic from that IP address is no evidence that I accessed your Web site. That traffic could have been from any customer of my ISP." Next, there is a problem with screen scraping: The way the Web works, with HTTP, HTML, and CSS, when a Web site sends a Web page to a user, what is sent is essentially just simple, plain text. Then screen scraping is just keeping what was sent. The Web site sent the text; the user just kept a copy; keeping a copy at least until the original changes is a standard performance feature of Web browsers. So, it's standard for a user to have and keep a copy of what the Web site sent. The Web site freely sent the data as just simple text; if the Web site doesn't want people to have that data, then the Web site should not send that data to people.

systemtrigger 13y ago

I'm confused then because according to founder Greg Kidd 3taps does not get its data by scraping Craigslist: "...We didn't get the data from them anyways. We're finding it from other sources which have already indexed it like Google, like Bing, like other search engines that are out there." http://www.youtube.com/watch?v=6Rf6JrSYZ4U#t=27m32s http://www.youtube.com/watch?v=6Rf6JrSYZ4U#t=27m32s

pdonis 13y ago
If you read the fine print (which is in various documents linked to on 3Taps' website), you find that it's not quite as simple as that. 3Taps started out getting the data from Google; but when Craigslist found out what they were doing, they restricted Google's access in a way that made it necessary for 3Taps to scrape Craigslist's site directly. It's notable that, in these documents (which are written by 3Taps), the fact that Craigslist sent them a C&D letter is never mentioned. So it's not clear where, exactly, in the process the C&D letter came in.

hmottestad 13y ago

At college we discussed what an IP is. An IP has two parts, the identification and the location. If you change your IP to mask your identity, then you are telling the server you are someone else, however if you change IP to mask your location you are only saying you are somewhere else.

epo 13y ago
Your college explanation was so skimpy as to be useless. An IP, at best, identifies a particular endpoint at a particular point in time, consider dynamically allocated IP addresses or virtual machines with externally visible IPs. Whoever allocated the IP may have records showing which telephone line was allocated that IP at a particular time. That might narrow it down to a residence, building or office. But this is all irrelevant. As I understand it, there was a court order forbidding 3taps to access a particular service. Additionally their IP was blocked. Changing IP to try and circumvent the ban is the kind of thing a 13 year old thing might think was clever and 3taps should be slapped down very hard for this it is, in effect, contempt of court.

zby 13y ago

IRC ops must now be celebrating.

crb002 13y ago

Craigslist asked 3taps not to use their IPs to connect. 3taps complied and stopped using those IPs. What's the beef?

lotharbot 13y ago
Craigslist asked 3taps not to use their data. 3taps continued to use CL's data, even going so far as to circumvent a security measure (the IP block -- weak, but still technically a security measure). The court decision, which is linked elsewhere in this discussion, consistently connects the IP ban to the C&D letter. They don't seem particularly concerned with the details of how 3Taps accessed the data, only that 3Taps intentionally accessed data whose owners had clearly revoked access.