9 ms·

Yes. When they knowingly are collecting data they know they shouldn't have access to, unlike the data in the article.

eli 13y ago
Not defending the law (which I think is pretty terrible), but that seems like an incredibly fine distinction. I doubt Netflix would agree that I'm supposed to be able to download a list of every possible genre.
- tptacek 13y ago
  It is a fine distinction. The effort in a CFAA case to resolve the distinction will focus on evidence of intent; of the state of mind of the person committing the acts. The CFAA is a very bad law, but it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. I think a better thing to look at is CFAA sentencing and severity, which currently scale up with the counter in your "for()" loop and quickly produce dizzying penalties for minor offenses. Taking the piss out of CFAA sentencing would also reduce the incentive that US Attorneys have to throw the book at petty offenders.
  - TeMPOraL 13y ago
    > it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations Like in other cases when computers meet the law, it's often a "colour of bits" distinction. I recommend this article: http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23
    - Dylan16807 13y ago
      I don't think that's really what is going on here. "colour of bits" is distinction between process and result. The question of authorization comes down to intent and what fits societal norms of fair dealing. It's a complex mess and there's no alternative to it, vs. colour of bits where there are two sane points of view.
  - streetnigga 13y ago
    If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called. If someone subverts an authentication system to get authed, then they were clearly never authorized no matter the granted access to the data. Seems unauthorized or not is baked into the web already. It is the humans behind corporations and their lawyers trying to stretch the definition or create new mechanics. The AT&T case shows this for sure.
    - aaronem 13y ago
      > If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called. If I leave my apartment door unlocked, and you go in while I'm at work and steal my television, you are still liable for unlawful entry and burglary. There is no legally admissible argument that my not having locked the door confers upon you authorization to go through it. Of course, that's a much clearer case than API access tends to be, but the point I make from it is that "nobody stopped me from getting to this" does not imply "it must be lawful for me to make use of this".
      - wtbob 13y ago
        Yeah, but with HTTP API access, it's much more like someone who goes up to your apartment, knocks on your door, his knock is answered by your butler, he asks the butler for something, and the butler gives him it. It's not his fault that you hired a cretin for a butler.
        aaronem 13y ago
        No, but it's his fault that he exploited the butler's cretinism to gain access he knew or suspected he shouldn't have. If you're still unclear on the concept, your Google query for today is the Latin phrase mens rea; I'm no lawyer, but the impression I have is that that's the legal concept of import here.
  - AnthonyMouse 13y ago
    > The CFAA is a very bad law, but it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. The CFAA is a very bad law because it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. Imposing only misdemeanor penalties would certainly resolve the issue in practice by depriving the failure of its teeth, but it still wouldn't make it a good piece of legislation.
- mcphilip 13y ago
  I too wish there was an easier way to distinguish this. One of my weekend projects involved stripping actor, genre, and director information from IMDB for the AFI Top 100 movies. The prototype was simplistic but still gave some interesting data to mine (e.g. Robert Duvall has been in the most AFI Top 100 films, credited 6 times). The next step of the project would be to strip more data from IMDB, but I hesitated since I didn't want to get my IP banned or something. I had never considered that what I was doing could potentially be illegal.
  - thebelal 13y ago
    IMDB actually provides this information without needing to scrape their site. See http://www.imdb.com/interfaces http://www.imdb.com/interfaces
  - bgaluszka 13y ago
    In case you didn't know there is some data available in plain text format here http://www.imdb.com/interfaces http://www.imdb.com/interfaces.
  - pyre 13y ago
    > I hesitated since I didn't want to get my IP banned or something If you're worried about that I would use something like a DigitalOcean droplet. If your IP gets banned, at least it's not your home IP.
- gwu78 13y ago
  If they didn't, they should have to send you a letter telling you to stop building your list. I believe AT&T did send such a letter.

eli 13y ago

Not defending the law (which I think is pretty terrible), but that seems like an incredibly fine distinction. I doubt Netflix would agree that I'm supposed to be able to download a list of every possible genre.

tptacek 13y ago
It is a fine distinction. The effort in a CFAA case to resolve the distinction will focus on evidence of intent; of the state of mind of the person committing the acts. The CFAA is a very bad law, but it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. I think a better thing to look at is CFAA sentencing and severity, which currently scale up with the counter in your "for()" loop and quickly produce dizzying penalties for minor offenses. Taking the piss out of CFAA sentencing would also reduce the incentive that US Attorneys have to throw the book at petty offenders.
- TeMPOraL 13y ago
  > it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations Like in other cases when computers meet the law, it's often a "colour of bits" distinction. I recommend this article: http://ansuz.sooke.bc.ca/entry/23 http://ansuz.sooke.bc.ca/entry/23
  - Dylan16807 13y ago
    I don't think that's really what is going on here. "colour of bits" is distinction between process and result. The question of authorization comes down to intent and what fits societal norms of fair dealing. It's a complex mess and there's no alternative to it, vs. colour of bits where there are two sane points of view.
- streetnigga 13y ago
  If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called. If someone subverts an authentication system to get authed, then they were clearly never authorized no matter the granted access to the data. Seems unauthorized or not is baked into the web already. It is the humans behind corporations and their lawyers trying to stretch the definition or create new mechanics. The AT&T case shows this for sure.
  - aaronem 13y ago
    > If it is API data that needs to be protected I would hope to see some HTTP code saying unauthorized. If it is a public feed then I probably would expect a 201 when successfully called. If I leave my apartment door unlocked, and you go in while I'm at work and steal my television, you are still liable for unlawful entry and burglary. There is no legally admissible argument that my not having locked the door confers upon you authorization to go through it. Of course, that's a much clearer case than API access tends to be, but the point I make from it is that "nobody stopped me from getting to this" does not imply "it must be lawful for me to make use of this".
    - wtbob 13y ago
      Yeah, but with HTTP API access, it's much more like someone who goes up to your apartment, knocks on your door, his knock is answered by your butler, he asks the butler for something, and the butler gives him it. It's not his fault that you hired a cretin for a butler.
      - aaronem 13y ago
        No, but it's his fault that he exploited the butler's cretinism to gain access he knew or suspected he shouldn't have. If you're still unclear on the concept, your Google query for today is the Latin phrase mens rea; I'm no lawyer, but the impression I have is that that's the legal concept of import here.
- AnthonyMouse 13y ago
  > The CFAA is a very bad law, but it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. The CFAA is a very bad law because it's hard to resolve "authorized" versus "unauthorized" deterministically without coming up with absurd situations. Imposing only misdemeanor penalties would certainly resolve the issue in practice by depriving the failure of its teeth, but it still wouldn't make it a good piece of legislation.
mcphilip 13y ago
I too wish there was an easier way to distinguish this. One of my weekend projects involved stripping actor, genre, and director information from IMDB for the AFI Top 100 movies. The prototype was simplistic but still gave some interesting data to mine (e.g. Robert Duvall has been in the most AFI Top 100 films, credited 6 times). The next step of the project would be to strip more data from IMDB, but I hesitated since I didn't want to get my IP banned or something. I had never considered that what I was doing could potentially be illegal.
- thebelal 13y ago
  IMDB actually provides this information without needing to scrape their site. See http://www.imdb.com/interfaces http://www.imdb.com/interfaces
- bgaluszka 13y ago
  In case you didn't know there is some data available in plain text format here http://www.imdb.com/interfaces http://www.imdb.com/interfaces.
- pyre 13y ago
  > I hesitated since I didn't want to get my IP banned or something If you're worried about that I would use something like a DigitalOcean droplet. If your IP gets banned, at least it's not your home IP.
gwu78 13y ago
If they didn't, they should have to send you a letter telling you to stop building your list. I believe AT&T did send such a letter.