4 ms·

Whereas it's obviously silly to suppose that gaining access to Wi-Fi is a criminal act worth worrying about, it's also worth pointing out courts reject argument

Whereas it's obviously silly to suppose that gaining access to Wi-Fi is a criminal act worth worrying about, it's also worth pointing out courts reject arguments like this. In particular, in more serious legal matters, the fact that you admitted you understood the intent of the policy would be held against you. Courts simply don't buy into the idea that "if something is technically allowed, it's authorized", any more than it's legal to enter through a window if a door is locked.

brownbat 12y ago
> courts reject arguments like this. If by "arguments like this," you mean following the law but with suspect motives, then one of the strengths of the legal system in the US is that the courts absolutely accept arguments like these. In criminal matters, you typically need both intent and some act forbidden by statute before a finding of guilt. You can't indict someone for ill will. Intent alone is not generally sufficient for a conviction is the US, save for some cases of special liability (attempts, or some forms of aider and abettor or conspiracy). Sometimes intent doesn't matter at all, but that's generally reserved for traffic cases or statutory rape, where intent would pose special difficulties proving beyond a reasonable doubt at trial. I can think of only a few notable counterexamples where a court made inferences about true intent and made a finding against a party despite a standing rule that would have let them off. MGM v. Grokster could be read that way. Grokster ran a service with "substantial noninfringing uses," which was previously sufficient for a defense of fair use. However, Grokster was found to infringe based on their constant encouragement for people to use their services to infringe. Grokster had "the object of promoting [their service's] use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement." You could read that as a sort of retroactive punishment for ill intentioned behavior. Here's the twist though, that wasn't criminal law. There's generally a much higher bar for criminal law to strictly apply statutes as written. In civil law, both parties are citizens with equal rights before the courts, so there's more of a balancing test. In criminal law, most presumptions run against the state. This isn't just a US twist. A German scholar of jurisprudence, Friedrich Carl von Savigny, was one of the first to argue that criminal (and tax) laws must be interpreted as narrowly as possible, because people deserve fair and clear warning of what is allowed and prohibited. See also the "Rule of Lenity" in statutory interpretation, whereby ambiguous criminal statutes are interpreted in favor of the defendant (wikipedia points to McNally v. US and a few other relevant cases): https://en.wikipedia.org/wiki/Statutory_interpretation#Canons https://en.wikipedia.org/wiki/Statutory_interpretation#Canon... This isn't just a convention in the US though, judges cannot extend criminal laws to criminalize novel activity, because that would violate prohibitions against "ex post facto" laws under Art. 1 Sec. 9 of the Constitution. Ie, the Constitution forbids making some act a crime after it happened, the state must provide advanced warning. (Well, technically it's a violation of 14th Amendment Due Process, since Art. 1 Sec. 9 only binds the legislature, but similar principles apply). A fuller treatment can be found on this issue from the Supreme Court in Bouie v. City of Columbia and Rogers v. Tennessee. https://en.wikipedia.org/wiki/Bouie_v._City_of_Columbia https://en.wikipedia.org/wiki/Bouie_v._City_of_Columbia https://en.wikipedia.org/wiki/Rogers_v._Tennessee https://en.wikipedia.org/wiki/Rogers_v._Tennessee Although dissenting, and again not in criminal law, Scalia provided a nice quip on the subject in the recent Aereo opinion: "It is the role of good lawyers to identify and exploit [legal loopholes], and the role of Congress to eliminate them if it wishes." American Broadcasting Cos. v. Aereo, Inc., (Scalia, dissenting) (To the point of the intent required by the CFAA, which might be in question here, Kalow v. Springnut would probably be illustrative: http://blog.internetcases.com/2008/07/17/cfaa-requires-intent-to-cause-harm-not-merely-intent-to-transmit/ http://blog.internetcases.com/2008/07/17/cfaa-requires-inten... )
- praptak 12y ago
  It's not about following the law with suspect motives. It's about the fact that following the technical protocol does not give you much defense against unlawful access charges.
  - brownbat 12y ago
    That's absolutely correct. I was responding to the naked phrase "technically allowed," which in hindsight is ambiguous (ie, "allowed under the law via a technicality," or "technologically feasible"). Rereading, I still think I interpreted correctly the first time, but really can't be sure. Good catch.
- DanBC 12y ago
  > In criminal matters, you typically need both intent and some act forbidden by statute before a finding of guilt. You can't indict someone for ill will. Obtaining goods by deception seems to cover this. Especially with the public admission of "I siged on, and had to pay, but discovered that my colleague did not have to pay so I was deceptive about the equipment I used, and the only reason I was deceptive was to avoid the requirement to pay". There is no element in the discussion about needing to change user agent for work or anything else.
  - diminoten 12y ago
    Can you find an example in case law where someone's been prosecuted for obtaining access to a system by spoofing their MAC ID or user agent string? Surely this has come up before now, yes?
    - DanBC 12y ago
      Are you making an oblique reference to Aaron Swartz? http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/ But no, I probably can't find cases in courts. But then, I probably wouldn't be able to find cases where people steal the pillows, but that happens although it is a different law. http://www.telegraph.co.uk/travel/travelnews/10223157/What-can-you-get-away-with-stealing-from-hotels.html http://www.telegraph.co.uk/travel/travelnews/10223157/What-c... > I spoke to the Metropolitan Police on the law regarding towel-lifting. “It is a crime,” its spokesman said. “If we were to receive allegations, we would follow them up.” In reality, it appears most hotels would be more likely to blacklist a guest over a petty theft, charge the items to their card, and save the police the trouble. This is likely to be the case with fraud, which is both civil and criminal. The criminal fraud is probably tiny (unless you do it in every hotel you go to) and the hotel probably doesn't want the negative publicity. And they probably don't want to encourage the practice of user agent spoofing. So if hotels do care, and do take action, they'll just charge the credit card and block-list the user.
kika 12y ago
What about, say, Safari browser itself, which presents "Gecko" in it's useragent string? If it is a punishable offence, imagine how much money one can extract from Apple for doing so...
- lclarkmichalek 12y ago
  Did you even read the comment you are replying to? Intent matters.

brownbat 12y ago

> courts reject arguments like this. If by "arguments like this," you mean following the law but with suspect motives, then one of the strengths of the legal system in the US is that the courts absolutely accept arguments like these. In criminal matters, you typically need both intent and some act forbidden by statute before a finding of guilt. You can't indict someone for ill will. Intent alone is not generally sufficient for a conviction is the US, save for some cases of special liability (attempts, or some forms of aider and abettor or conspiracy). Sometimes intent doesn't matter at all, but that's generally reserved for traffic cases or statutory rape, where intent would pose special difficulties proving beyond a reasonable doubt at trial. I can think of only a few notable counterexamples where a court made inferences about true intent and made a finding against a party despite a standing rule that would have let them off. MGM v. Grokster could be read that way. Grokster ran a service with "substantial noninfringing uses," which was previously sufficient for a defense of fair use. However, Grokster was found to infringe based on their constant encouragement for people to use their services to infringe. Grokster had "the object of promoting [their service's] use to infringe copyright, as shown by clear expression or other affirmative steps taken to foster infringement." You could read that as a sort of retroactive punishment for ill intentioned behavior. Here's the twist though, that wasn't criminal law. There's generally a much higher bar for criminal law to strictly apply statutes as written. In civil law, both parties are citizens with equal rights before the courts, so there's more of a balancing test. In criminal law, most presumptions run against the state. This isn't just a US twist. A German scholar of jurisprudence, Friedrich Carl von Savigny, was one of the first to argue that criminal (and tax) laws must be interpreted as narrowly as possible, because people deserve fair and clear warning of what is allowed and prohibited. See also the "Rule of Lenity" in statutory interpretation, whereby ambiguous criminal statutes are interpreted in favor of the defendant (wikipedia points to McNally v. US and a few other relevant cases): https://en.wikipedia.org/wiki/Statutory_interpretation#Canons https://en.wikipedia.org/wiki/Statutory_interpretation#Canon... This isn't just a convention in the US though, judges cannot extend criminal laws to criminalize novel activity, because that would violate prohibitions against "ex post facto" laws under Art. 1 Sec. 9 of the Constitution. Ie, the Constitution forbids making some act a crime after it happened, the state must provide advanced warning. (Well, technically it's a violation of 14th Amendment Due Process, since Art. 1 Sec. 9 only binds the legislature, but similar principles apply). A fuller treatment can be found on this issue from the Supreme Court in Bouie v. City of Columbia and Rogers v. Tennessee. https://en.wikipedia.org/wiki/Bouie_v._City_of_Columbia https://en.wikipedia.org/wiki/Bouie_v._City_of_Columbia https://en.wikipedia.org/wiki/Rogers_v._Tennessee https://en.wikipedia.org/wiki/Rogers_v._Tennessee Although dissenting, and again not in criminal law, Scalia provided a nice quip on the subject in the recent Aereo opinion: "It is the role of good lawyers to identify and exploit [legal loopholes], and the role of Congress to eliminate them if it wishes." American Broadcasting Cos. v. Aereo, Inc., (Scalia, dissenting) (To the point of the intent required by the CFAA, which might be in question here, Kalow v. Springnut would probably be illustrative: http://blog.internetcases.com/2008/07/17/cfaa-requires-intent-to-cause-harm-not-merely-intent-to-transmit/ http://blog.internetcases.com/2008/07/17/cfaa-requires-inten... )

praptak 12y ago
It's not about following the law with suspect motives. It's about the fact that following the technical protocol does not give you much defense against unlawful access charges.
- brownbat 12y ago
  That's absolutely correct. I was responding to the naked phrase "technically allowed," which in hindsight is ambiguous (ie, "allowed under the law via a technicality," or "technologically feasible"). Rereading, I still think I interpreted correctly the first time, but really can't be sure. Good catch.
DanBC 12y ago
> In criminal matters, you typically need both intent and some act forbidden by statute before a finding of guilt. You can't indict someone for ill will. Obtaining goods by deception seems to cover this. Especially with the public admission of "I siged on, and had to pay, but discovered that my colleague did not have to pay so I was deceptive about the equipment I used, and the only reason I was deceptive was to avoid the requirement to pay". There is no element in the discussion about needing to change user agent for work or anything else.
- diminoten 12y ago
  Can you find an example in case law where someone's been prosecuted for obtaining access to a system by spoofing their MAC ID or user agent string? Surely this has come up before now, yes?
  - DanBC 12y ago
    Are you making an oblique reference to Aaron Swartz? http://www.volokh.com/2013/01/14/aaron-swartz-charges/ http://www.volokh.com/2013/01/14/aaron-swartz-charges/ But no, I probably can't find cases in courts. But then, I probably wouldn't be able to find cases where people steal the pillows, but that happens although it is a different law. http://www.telegraph.co.uk/travel/travelnews/10223157/What-can-you-get-away-with-stealing-from-hotels.html http://www.telegraph.co.uk/travel/travelnews/10223157/What-c... > I spoke to the Metropolitan Police on the law regarding towel-lifting. “It is a crime,” its spokesman said. “If we were to receive allegations, we would follow them up.” In reality, it appears most hotels would be more likely to blacklist a guest over a petty theft, charge the items to their card, and save the police the trouble. This is likely to be the case with fraud, which is both civil and criminal. The criminal fraud is probably tiny (unless you do it in every hotel you go to) and the hotel probably doesn't want the negative publicity. And they probably don't want to encourage the practice of user agent spoofing. So if hotels do care, and do take action, they'll just charge the credit card and block-list the user.

kika 12y ago

What about, say, Safari browser itself, which presents "Gecko" in it's useragent string? If it is a punishable offence, imagine how much money one can extract from Apple for doing so...

lclarkmichalek 12y ago
Did you even read the comment you are replying to? Intent matters.