6 ms·

Admittedly a sensationalistic headline on my part The title of the linked article is "District Court Holds That Intentionally Circumventing IP Address Ban Is “

by maalyex 13y ago

Admittedly a sensationalistic headline on my part The title of the linked article is "District Court Holds That Intentionally Circumventing IP Address Ban Is “Access Without Authorization” Under the CFAA". Violating the CFAA is, of course, illegal. From the linked article: "During the debate over the Aaron Swartz case, one of the legal issues was whether Swartz had committed an unauthorized access under the CFAA when he changed his IP address to circumvent IP address blocking" This particular ruling relates to Craigslist. http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

dpeck 13y ago
I may be remembering wrong, but I believe in the Swartz case it was about spoofing his MAC address?
- maalyex 13y ago
  From the article: "There was significantly more to the CFAA charges than that, to be clear, including circumventing a subsequent MAC address block and (most significantly) entering an MIT storage closet to install his computer directly. But changing IP addresses to get around IP address blocking was at least one of the possible grounds of unauthorized access."
- fnordfnordfnord 13y ago
  I've done a lot more than that on gov't networks just to get slides to show up on a conference projector.
  - lotharbot 13y ago
    Using a workaround for buggy or misconfigured hardware is very different from "these guys told me to stop using their thing, but I can circumvent the measures they put in place to stop me." EDIT: related quotes from the ruling "Craigslist gave the world permission (i.e., “authorization”) to access the public information on its public website.... it rescinded that permission for 3Taps." "3Taps had to circumvent Craigslist’s IP blocking measures to continue scraping, so it indisputably knew that Craigslist did not want it accessing the website at all." "3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization”"
    - fnordfnordfnord 13y ago
      Not really, since I am not an IT guy. Using the law like that means that I have to rely on: Not accidentally breaking things. No misunderstandings with the real IT folks. Some petty asshole in authority who doesn't like me not wanting an excuse to cause trouble for me.
      - lotharbot 13y ago
        I think you have it backwards. The court decision relied on the clarity of intent from 3taps. They had been both expressly told not to do something, and technically blocked from doing it. Their access to CL wasn't accidentally broken, they didn't misunderstand what they had been told in the C&D letter, and they didn't get caught by some surprising technicality. They had been clearly told to stop, and they circumvented the measures put in place to stop them. I said elsewhere: this is more or less equivalent to a store telling me not to come back and distributing my photo to staff... and then me shaving my beard and changing my clothes in order to sneak back in. Shaving and changing my clothes are not illegal in and of themselves; trespassing is illegal, and shaving and changing my clothes are the tools I chose to use in my effort to trespass.
        fnordfnordfnord 13y ago
        >Shaving and changing my clothes are not illegal in and of themselves In your analogy, shaving and changing clothes are illegal, according to the ruling.
        lotharbot 13y ago
        No. If you read the ruling at [0], you will find you are quite mistaken. This decision was not about changing IPs; it was about "whether Craigslist had the power to revoke, on a case-by-case basis, the general permission it granted to the public to access the information on its website" (in the analogy, whether the store can revoke my individual permission to enter.) The court agreed that CL has the power to revoke authorization to access its site. The decision does not reference the IP ban for its own sake, but always as a part of a multi-step argument, best articulated on page 10. "3-Taps (1) received a personally-addressed cease-and-desist letter stating that it could not access Craigslist’s website “for any reason”; (2) discovered that it could no longer access the website at all from its IP addresses; and (3) was sued for continuing to access that website after circumventing the IP restrictions. A person of ordinary intelligence would understand Craigslist’s actions to be a revocation of authorization to access the website, and thus have fair notice that further access was “without authorization.”" The decision is quite clear in its focus on the access being "without authorization". In the analogy, the court would not reference shaving my beard in isolation, but in the context of my being personally told not to come back, discovering that security turned me away after recognizing my photograph, and then making a "deliberate decision" to enter the store through the mechanism of shaving my beard and changing my clothes in order to avoid being denied entry. The court would make it quite clear that the problem was my re-entry to the store. [0] http://www.volokh.com/wp-content/uploads/2013/08/Order-Denying-Renewed-Motion-to-Dismiss.pdf http://www.volokh.com/wp-content/uploads/2013/08/Order-Denyi...
- anigbrowl 13y ago
  It's not 'about' spoofing his MAC address. It's about respecting the rights of property owners to set the terms of how other people may access their property. You know, when someone is charged with burglary the issue is not that they entered your place through the window rather than by ringing the doorbell, but that they entered without your permission. Try to imagine the outrage that would result if a judge said 'it's your fault for having an insecure window, tough luck.' EDIT: I might add that I don't care for JSTOR or the copyright system that they derive such benefit from. But then I don't especially care for our laws on taxation and related subjects - my disagreement with those doesn't give me the right to opt out of taxes that I dislike, or to appropriate the possessions of others whose wealth I might envy.
  - aero142 13y ago
    I really hate analogies in law because it always seems to provide very little support for whether a law is a good idea or not. Your analogy is to breaking and entering a physical residence, but you skip over the fact that this is a publicly available website. I'd say it has more in common with photographing a public building. Lets say Dunkin' Donuts doesn't want me photographing their buildings and making a map of all their locations. They demand that I stop taking photo's from the street and put up a small tarp that covers the physical line of sight to their building that I used to photograph. I then come back and photograph their building from 2 feet to the right and they claim I bypassed their building security. I don't think my analogy is any more correct than your, which is why I would rather we just decide what is best for society. Seems a lot more useful than trying to decide whether IP filtering is analogous to breaking a window.
    - anigbrowl 13y ago
      Dunkin' Donuts could exclude you from their premises if they saw fit. Your analogy is equivalent to 3taps making a list of Craigslist URLs and getting a front page screenshot for each one. Scraping is qualitatively different - you have go on into the website to analyze the content, so I suggest it's more like walking into the DD kitchen and trying to document their customer transactions.
- deleted 13y ago
  [deleted]

by maalyex 13y ago

dpeck 13y ago

I may be remembering wrong, but I believe in the Swartz case it was about spoofing his MAC address?

maalyex 13y ago
From the article: "There was significantly more to the CFAA charges than that, to be clear, including circumventing a subsequent MAC address block and (most significantly) entering an MIT storage closet to install his computer directly. But changing IP addresses to get around IP address blocking was at least one of the possible grounds of unauthorized access."
fnordfnordfnord 13y ago
I've done a lot more than that on gov't networks just to get slides to show up on a conference projector.
- lotharbot 13y ago
  Using a workaround for buggy or misconfigured hardware is very different from "these guys told me to stop using their thing, but I can circumvent the measures they put in place to stop me." EDIT: related quotes from the ruling "Craigslist gave the world permission (i.e., “authorization”) to access the public information on its public website.... it rescinded that permission for 3Taps." "3Taps had to circumvent Craigslist’s IP blocking measures to continue scraping, so it indisputably knew that Craigslist did not want it accessing the website at all." "3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization”"
  - fnordfnordfnord 13y ago
    Not really, since I am not an IT guy. Using the law like that means that I have to rely on: Not accidentally breaking things. No misunderstandings with the real IT folks. Some petty asshole in authority who doesn't like me not wanting an excuse to cause trouble for me.
    - lotharbot 13y ago
      I think you have it backwards. The court decision relied on the clarity of intent from 3taps. They had been both expressly told not to do something, and technically blocked from doing it. Their access to CL wasn't accidentally broken, they didn't misunderstand what they had been told in the C&D letter, and they didn't get caught by some surprising technicality. They had been clearly told to stop, and they circumvented the measures put in place to stop them. I said elsewhere: this is more or less equivalent to a store telling me not to come back and distributing my photo to staff... and then me shaving my beard and changing my clothes in order to sneak back in. Shaving and changing my clothes are not illegal in and of themselves; trespassing is illegal, and shaving and changing my clothes are the tools I chose to use in my effort to trespass.
      - fnordfnordfnord 13y ago
        >Shaving and changing my clothes are not illegal in and of themselves In your analogy, shaving and changing clothes are illegal, according to the ruling.
        lotharbot 13y ago
        No. If you read the ruling at [0], you will find you are quite mistaken. This decision was not about changing IPs; it was about "whether Craigslist had the power to revoke, on a case-by-case basis, the general permission it granted to the public to access the information on its website" (in the analogy, whether the store can revoke my individual permission to enter.) The court agreed that CL has the power to revoke authorization to access its site. The decision does not reference the IP ban for its own sake, but always as a part of a multi-step argument, best articulated on page 10. "3-Taps (1) received a personally-addressed cease-and-desist letter stating that it could not access Craigslist’s website “for any reason”; (2) discovered that it could no longer access the website at all from its IP addresses; and (3) was sued for continuing to access that website after circumventing the IP restrictions. A person of ordinary intelligence would understand Craigslist’s actions to be a revocation of authorization to access the website, and thus have fair notice that further access was “without authorization.”" The decision is quite clear in its focus on the access being "without authorization". In the analogy, the court would not reference shaving my beard in isolation, but in the context of my being personally told not to come back, discovering that security turned me away after recognizing my photograph, and then making a "deliberate decision" to enter the store through the mechanism of shaving my beard and changing my clothes in order to avoid being denied entry. The court would make it quite clear that the problem was my re-entry to the store. [0] http://www.volokh.com/wp-content/uploads/2013/08/Order-Denying-Renewed-Motion-to-Dismiss.pdf http://www.volokh.com/wp-content/uploads/2013/08/Order-Denyi...
anigbrowl 13y ago
It's not 'about' spoofing his MAC address. It's about respecting the rights of property owners to set the terms of how other people may access their property. You know, when someone is charged with burglary the issue is not that they entered your place through the window rather than by ringing the doorbell, but that they entered without your permission. Try to imagine the outrage that would result if a judge said 'it's your fault for having an insecure window, tough luck.' EDIT: I might add that I don't care for JSTOR or the copyright system that they derive such benefit from. But then I don't especially care for our laws on taxation and related subjects - my disagreement with those doesn't give me the right to opt out of taxes that I dislike, or to appropriate the possessions of others whose wealth I might envy.
- aero142 13y ago
  I really hate analogies in law because it always seems to provide very little support for whether a law is a good idea or not. Your analogy is to breaking and entering a physical residence, but you skip over the fact that this is a publicly available website. I'd say it has more in common with photographing a public building. Lets say Dunkin' Donuts doesn't want me photographing their buildings and making a map of all their locations. They demand that I stop taking photo's from the street and put up a small tarp that covers the physical line of sight to their building that I used to photograph. I then come back and photograph their building from 2 feet to the right and they claim I bypassed their building security. I don't think my analogy is any more correct than your, which is why I would rather we just decide what is best for society. Seems a lot more useful than trying to decide whether IP filtering is analogous to breaking a window.
  - anigbrowl 13y ago
    Dunkin' Donuts could exclude you from their premises if they saw fit. Your analogy is equivalent to 3taps making a list of Craigslist URLs and getting a front page screenshot for each one. Scraping is qualitatively different - you have go on into the website to analyze the content, so I suggest it's more like walking into the DD kitchen and trying to document their customer transactions.
deleted 13y ago
[deleted]