3 ms·

You really are overthinking it. Context and intent will always have a place in the law. Did you typo a wget to random URL and it returned my credit card number

You really are overthinking it. Context and intent will always have a place in the law. Did you typo a wget to random URL and it returned my credit card number / ssn and home address, realized this was something you shouldn't be accessing and stop? I'm sure you would have a good case that your intent was merely an accident or innocent and you won't get in trouble. Did you wget a million URL's over the course of the day and store these credit card numbers / ssn's for some use later? Probably might have a harder time justifying that. Again it is all about context and intent, these are going to be a factor in the court. It is never going to be a simple black or white sequence of events that can be followed to determine if you were doing something harmless or not, no matter how much the crowd here doesn't want that to be the case.

AnthonyMouse 13y ago
> You really are overthinking it. Context and intent will always have a place in the law. But there is a difference between the definition of a crime and the intent to meet that definition. Let's try an analogy. Suppose I go to a local retailer and tell the clerk that I'm a professor at the local university and ask her to record the name, address, credit card number and other information of everyone who buys something in the shop for me today because I want to collect some statistics. There are now two issues here. The first issue is whether the clerk agrees to provide me with the information. The shop owner and the credit card company need for her to not agree to this because it is clearly a security vulnerability. Even if I really am a professor collecting statistics for my research, she can't know that for certain, and I could be a scam artist out to commit credit card fraud. But let's suppose the clerk hasn't been properly trained and she gives me the credit card numbers. The obvious analogy is to a misconfigured web server. At this point it matters quite a lot what I do with the credit card numbers. If I'm a scam artist and start making fraudulent charges to the cards, there ought to be significant penalties. But if I really am out to do statistical analysis on local retailer purchasing behavior, should there be? Or should the retailer just take the opportunity to retrain the staff? There is a strong case for a lack of penalties -- because intent does matter. Which is the fundamental problem with the CFAA. It doesn't require the intent to commit a malicious act, only a vaguely defined lack of authorization to commit any act regardless of whether or not the act is malicious.

AnthonyMouse 13y ago

> You really are overthinking it. Context and intent will always have a place in the law. But there is a difference between the definition of a crime and the intent to meet that definition. Let's try an analogy. Suppose I go to a local retailer and tell the clerk that I'm a professor at the local university and ask her to record the name, address, credit card number and other information of everyone who buys something in the shop for me today because I want to collect some statistics. There are now two issues here. The first issue is whether the clerk agrees to provide me with the information. The shop owner and the credit card company need for her to not agree to this because it is clearly a security vulnerability. Even if I really am a professor collecting statistics for my research, she can't know that for certain, and I could be a scam artist out to commit credit card fraud. But let's suppose the clerk hasn't been properly trained and she gives me the credit card numbers. The obvious analogy is to a misconfigured web server. At this point it matters quite a lot what I do with the credit card numbers. If I'm a scam artist and start making fraudulent charges to the cards, there ought to be significant penalties. But if I really am out to do statistical analysis on local retailer purchasing behavior, should there be? Or should the retailer just take the opportunity to retrain the staff? There is a strong case for a lack of penalties -- because intent does matter. Which is the fundamental problem with the CFAA. It doesn't require the intent to commit a malicious act, only a vaguely defined lack of authorization to commit any act regardless of whether or not the act is malicious.