6 ms·

I'm curious about the legality of this. Someone wrote that it was an "unauthorized" PHP API which was a client to the Whatsapp service. You don't need authoriza

I'm curious about the legality of this. Someone wrote that it was an "unauthorized" PHP API which was a client to the Whatsapp service. You don't need authorization to write a client to someone else's API, do you? They own neither the API, nor the right to build clients to it, right? A second question is: so you have the right to build a client. Do you actually have the right to run that client against their service? Is that "unauthorized access"? It makes sense that you can control who accesses your computer system; controlling how they do it seems murkier to me.

pionar 11y ago
> They own neither the API, nor the right to build clients to it, right? That's something that courts have been trying to figure out. The most famous case, of course, is Oracle v. Google. I think the biggest thing here was the usage of WhatsApp and the name WhatsAPI.
- BHSPitMonkey 11y ago
  That's a very different kind of case. This one refers to creating third-party presences on WhatsApp's messaging platform by talking to their servers remotely and mimicking the official client software in order to gain access. The Oracle case is a matter of Google implementing a Java standard library so that their Google's Java VM could run the same code that runs on Oracle's. Aside from an overloaded meaning of the term "API", the two situations have very little in common.
maxlybbert 11y ago
I can see two claims here: (1) the name is arguable confusingly similar to WhatsApp and could be considered a trademark violation, (2) using the service without permission could qualify as "exceeding authorized access" under the CFAA (Computer Fraud and Abuse Act, which is meant more for people who crack security for other purposes; although there's an argument that it applies here).
- Lawtonfogle 11y ago
  Even if we were to assume the CFAA is a reasonable and just law that should be applied in this case, it would still apply to those who use the code in a way that was against WhatsApp's permission, not for the one who provided the code. You might as well send legal threats to github for hosting the code.
  - maxlybbert 11y ago
    Yeah. I don't agree with the legal threats in any way; I'm simply answering "what law does the attorney claim was broken?" I don't know enough about the CFAA to say whether providing the tools to exceed authorized access counts as an additional violation. But it would be reasonable to assume that creating the tools required (sporadic) efforts to exceed authorized access.
    - Lawtonfogle 11y ago
      TBH, the CFAA scares me. While it isn't used to the full potential, it makes a vast amount of normal internet activity a felony, which then allows those in charge to pick off who they want as long as they don't incur too much outrage.
      - hsod 11y ago
        What normal internet activity does CFAA make a felony?
        deleted 11y ago
        [deleted]
        JupiterMoon 11y ago
        Connecting to a website when the owner has not specifically invited you to do so is technically an offence under the CFAA.
        fragmede 11y ago
josefdlange 11y ago
I think you and many people are overcomplicating this subtopic into the legal context of receiving C&D, etc letters. Their service is their software. They have control over it. If they wish to impose technical limitations to how it may be accessed and by whom, that is entirely their prerogative. Nothing in the law can tell a company or a user otherwise, short of subpoenas for customer data or some such like that. I think the larger legal issues come from the fact that circumventing these technical limitations can lead to to degradation of value and security for a company's customers due to derivative products created via this unauthorized client -- much like what has happened with SnapChat and third-party services retaining snaps. If systematic unauthorized access to a system could serve to diminish the value and trustworthiness of a company and its brand, you're damn right they will legally pursue those enabling it.
- kuschku 11y ago
  That is right – using WhatsAPI might be illegal. But developing the tool isn’t illegal in any way.
- ziahamza 11y ago
  Sure, they have complete right to safe guard customer data with authentication checks. But the situation here is that the customer is offering its consent to use their data on another platform or application. The same holds for rooting android/iphones and making them do what you want. Not getting into legal details, you should own your data across services and your hardware that you buy. Adding technical barriers is one thing, suing and interdependent group of people trying to learn the API and building tools on top is completely unfair.
click170 11y ago
I think the real question is why would you spend your time working on an API for a closed protocol knowing that you don't have the expressed or even tacit consent to do so, when you intend to turn around and release it. I mean if they made it for themselves and didn't share it maybe there wouldn't have been a problem, but I still wouldn't spend my time reversing a closed protocol without expecting the hammer to drop at some point. I'm not clear on whether you can write a client for someone else's protocol, but I can say for sure that I have every right to incercept and block any and every request that the official app makes, despite SSL. I pay for my internet connection, not the app developer.
- zaroth 11y ago
  How people choose to spend their time is definitely not the "real question" here. The real question is it legal to write software that interacts with an API which is covered by someone else's copyright (assuming you can even copyright an API) without their express permission? Since that happens pretty much every time you write a line of code, I would say it's a pretty important question. Whether or not you distribute said software, whether you distribute it in binary or source form, and whether you charge for said software are all interesting confounding variables and it would be extremely interesting to delve into whether those factors impact the result. Keep in mind this is simply software which sends and receives packets over a network. The server has no obligation to response, and there is no "linking" of libraries. Let's assume that none of WhatsApp's code is being distributed (assume a clean room implementation of the API, not decompiled from WhatsApp source) I wonder if things like if WhatsApp included a magic string in the header, and then claiming copyright of that string, if that could also impact the legal result.
seiji 11y ago
> You don't need authorization to write a client to someone else's API, do you? If the owner says "don't do that" and you do it anyway, even if there are no technical limitations, you are committing a crime in the eyes of federal law. Even if they don't tell you no and you just start poking around and accessing random (or guessed) API fields, it's still a federal crime since you "circumvented" their exposed interface. > It makes sense that you can control who accesses your computer system; controlling how they do it seems murkier to me. "How" can be difficult in a web context (browser vs. crawler), but in other contexts such as a mobile-only app with a proprietary API, they can say you're "hacking" their system if you access their system without directly interacting with their app (again, even if there are no technical limitations). Basically, just do this: http://static4.businessinsider.com/image/54db994569bedd6e65fd9834-545-726/screen%20shot%202015-02-11%20at%2012.37.45%20pm.png http://static4.businessinsider.com/image/54db994569bedd6e65f...
- JupiterMoon 11y ago
  Web scraping, for example, is not strictly speaking legal.
nickcano 11y ago
It really, really doesn't matter. WhatsApp has the money to manipulate the law however they want. Small-time developers do not. I came up as an engineer in the bot development industry (for online games), and the history of the industry proves this. Historically, game companies like Blizzard[1][2] and Jagex[3] have managed to win multi-million dollar lawsuits against small bot developers, citing intellectual property laws; even though the defendants only ever created custom clients or injected code into clients with the permission of the players using them. If gaming companies are able to use such absurd interpretations of IP law to win $7 million judgments against people who modify clients in-memory on end-user machines, then I'm sure a company with the capital of WhatsApp can destroy any open source developer that they want to. [1]http://en.wikipedia.org/wiki/MDY_Industries,_LLC_v._Blizzard_Entertainment,_Inc http://en.wikipedia.org/wiki/MDY_Industries,_LLC_v._Blizzard.... [2]http://legal.ceilingfansoftware.com/ http://legal.ceilingfansoftware.com/ [3]http://services.runescape.com/m=news/g=runescape/jagex-vs-ibot--anti-bot-update http://services.runescape.com/m=news/g=runescape/jagex-vs-ib...
- watty 11y ago
  I haven't read your links or spent time researching but is this really the same thing? Seems like game companies can argue (and IMO be correct) that bots are damaging to the game and community. Technically you're "just" injecting code into their software to make it operate differently but they typically have a EULA to prevent this.
  - immibis 11y ago
    Maybe open WhatsApp access is damaging to the WhatsApp community (spammers...).
    - hobarrera 11y ago
      If whatsapp created native clients for everyone, there would be a lot less need for these proyects. Spam? On Whatsapp? I've never heard of such a thing.
s73v3r 11y ago
Of course you need authorization to write a client to someone else's API.
- imrehg 11y ago
  Please explain. This is by no means "of course". I haven't seen a single API so far that explicitly required authorization.

pionar 11y ago

> They own neither the API, nor the right to build clients to it, right? That's something that courts have been trying to figure out. The most famous case, of course, is Oracle v. Google. I think the biggest thing here was the usage of WhatsApp and the name WhatsAPI.

BHSPitMonkey 11y ago
That's a very different kind of case. This one refers to creating third-party presences on WhatsApp's messaging platform by talking to their servers remotely and mimicking the official client software in order to gain access. The Oracle case is a matter of Google implementing a Java standard library so that their Google's Java VM could run the same code that runs on Oracle's. Aside from an overloaded meaning of the term "API", the two situations have very little in common.

maxlybbert 11y ago

I can see two claims here: (1) the name is arguable confusingly similar to WhatsApp and could be considered a trademark violation, (2) using the service without permission could qualify as "exceeding authorized access" under the CFAA (Computer Fraud and Abuse Act, which is meant more for people who crack security for other purposes; although there's an argument that it applies here).

Lawtonfogle 11y ago
Even if we were to assume the CFAA is a reasonable and just law that should be applied in this case, it would still apply to those who use the code in a way that was against WhatsApp's permission, not for the one who provided the code. You might as well send legal threats to github for hosting the code.
- maxlybbert 11y ago
  Yeah. I don't agree with the legal threats in any way; I'm simply answering "what law does the attorney claim was broken?" I don't know enough about the CFAA to say whether providing the tools to exceed authorized access counts as an additional violation. But it would be reasonable to assume that creating the tools required (sporadic) efforts to exceed authorized access.
  - Lawtonfogle 11y ago
    TBH, the CFAA scares me. While it isn't used to the full potential, it makes a vast amount of normal internet activity a felony, which then allows those in charge to pick off who they want as long as they don't incur too much outrage.
    - hsod 11y ago
      What normal internet activity does CFAA make a felony?
      - deleted 11y ago
        [deleted]
      - JupiterMoon 11y ago
        Connecting to a website when the owner has not specifically invited you to do so is technically an offence under the CFAA.
      - fragmede 11y ago

josefdlange 11y ago

I think you and many people are overcomplicating this subtopic into the legal context of receiving C&D, etc letters. Their service is their software. They have control over it. If they wish to impose technical limitations to how it may be accessed and by whom, that is entirely their prerogative. Nothing in the law can tell a company or a user otherwise, short of subpoenas for customer data or some such like that. I think the larger legal issues come from the fact that circumventing these technical limitations can lead to to degradation of value and security for a company's customers due to derivative products created via this unauthorized client -- much like what has happened with SnapChat and third-party services retaining snaps. If systematic unauthorized access to a system could serve to diminish the value and trustworthiness of a company and its brand, you're damn right they will legally pursue those enabling it.

kuschku 11y ago
That is right – using WhatsAPI might be illegal. But developing the tool isn’t illegal in any way.
ziahamza 11y ago
Sure, they have complete right to safe guard customer data with authentication checks. But the situation here is that the customer is offering its consent to use their data on another platform or application. The same holds for rooting android/iphones and making them do what you want. Not getting into legal details, you should own your data across services and your hardware that you buy. Adding technical barriers is one thing, suing and interdependent group of people trying to learn the API and building tools on top is completely unfair.

click170 11y ago

I think the real question is why would you spend your time working on an API for a closed protocol knowing that you don't have the expressed or even tacit consent to do so, when you intend to turn around and release it. I mean if they made it for themselves and didn't share it maybe there wouldn't have been a problem, but I still wouldn't spend my time reversing a closed protocol without expecting the hammer to drop at some point. I'm not clear on whether you can write a client for someone else's protocol, but I can say for sure that I have every right to incercept and block any and every request that the official app makes, despite SSL. I pay for my internet connection, not the app developer.

zaroth 11y ago
How people choose to spend their time is definitely not the "real question" here. The real question is it legal to write software that interacts with an API which is covered by someone else's copyright (assuming you can even copyright an API) without their express permission? Since that happens pretty much every time you write a line of code, I would say it's a pretty important question. Whether or not you distribute said software, whether you distribute it in binary or source form, and whether you charge for said software are all interesting confounding variables and it would be extremely interesting to delve into whether those factors impact the result. Keep in mind this is simply software which sends and receives packets over a network. The server has no obligation to response, and there is no "linking" of libraries. Let's assume that none of WhatsApp's code is being distributed (assume a clean room implementation of the API, not decompiled from WhatsApp source) I wonder if things like if WhatsApp included a magic string in the header, and then claiming copyright of that string, if that could also impact the legal result.

seiji 11y ago

> You don't need authorization to write a client to someone else's API, do you? If the owner says "don't do that" and you do it anyway, even if there are no technical limitations, you are committing a crime in the eyes of federal law. Even if they don't tell you no and you just start poking around and accessing random (or guessed) API fields, it's still a federal crime since you "circumvented" their exposed interface. > It makes sense that you can control who accesses your computer system; controlling how they do it seems murkier to me. "How" can be difficult in a web context (browser vs. crawler), but in other contexts such as a mobile-only app with a proprietary API, they can say you're "hacking" their system if you access their system without directly interacting with their app (again, even if there are no technical limitations). Basically, just do this: http://static4.businessinsider.com/image/54db994569bedd6e65fd9834-545-726/screen%20shot%202015-02-11%20at%2012.37.45%20pm.png http://static4.businessinsider.com/image/54db994569bedd6e65f...

JupiterMoon 11y ago
Web scraping, for example, is not strictly speaking legal.

nickcano 11y ago

It really, really doesn't matter. WhatsApp has the money to manipulate the law however they want. Small-time developers do not. I came up as an engineer in the bot development industry (for online games), and the history of the industry proves this. Historically, game companies like Blizzard[1][2] and Jagex[3] have managed to win multi-million dollar lawsuits against small bot developers, citing intellectual property laws; even though the defendants only ever created custom clients or injected code into clients with the permission of the players using them. If gaming companies are able to use such absurd interpretations of IP law to win $7 million judgments against people who modify clients in-memory on end-user machines, then I'm sure a company with the capital of WhatsApp can destroy any open source developer that they want to. [1]http://en.wikipedia.org/wiki/MDY_Industries,_LLC_v._Blizzard_Entertainment,_Inc http://en.wikipedia.org/wiki/MDY_Industries,_LLC_v._Blizzard.... [2]http://legal.ceilingfansoftware.com/ http://legal.ceilingfansoftware.com/ [3]http://services.runescape.com/m=news/g=runescape/jagex-vs-ibot--anti-bot-update http://services.runescape.com/m=news/g=runescape/jagex-vs-ib...

watty 11y ago
I haven't read your links or spent time researching but is this really the same thing? Seems like game companies can argue (and IMO be correct) that bots are damaging to the game and community. Technically you're "just" injecting code into their software to make it operate differently but they typically have a EULA to prevent this.
- immibis 11y ago
  Maybe open WhatsApp access is damaging to the WhatsApp community (spammers...).
  - hobarrera 11y ago
    If whatsapp created native clients for everyone, there would be a lot less need for these proyects. Spam? On Whatsapp? I've never heard of such a thing.

s73v3r 11y ago

Of course you need authorization to write a client to someone else's API.

imrehg 11y ago
Please explain. This is by no means "of course". I haven't seen a single API so far that explicitly required authorization.