7 ms·

As the EFF argues in the linked brief, there shouldn't be any "civil cause of action related to unauthorized access" when the data in question is made publicly

by gojomo 11y ago

As the EFF argues in the linked brief, there shouldn't be any "civil cause of action related to unauthorized access" when the data in question is made publicly available on the internet. Craigslist was abusing the CFAA with an expansive interpretation – treating unapproved use as if it were the same thing as unauthorized access – similar to that of overzealous federal prosecutors. Craigslist's argument, if embraced by the courts, would make other cases imposing penalties on the reuse of otherwise-public data easier. The reference is fair to make these points to a mass audience, although a bit macabre.

rayiner 11y ago
> As the EFF argues in the linked brief, there shouldn't be any "civil cause of action related to unauthorized access" when the data in question is made publicly available on the internet. Why? The principle underlying the Craiglist lawsuit is centuries old. Craigslist is like a shop open to shoppers. The shopkeeper makes the premises open to the public, but the scope of that access is limited by the shopkeeper's purpose in granting that access. If a member of the public accesses the property for improper purpose, a civil action for trespass arises. The fact that the premises is an Internet website changes nothing.
- gojomo 11y ago
  You can read the brief for their full argument: https://3taps.com/images/pics/430_Amicus%20Brief.pdf https://3taps.com/images/pics/430_Amicus%20Brief.pdf Their analysis may allow for something like what you propose – a purely contractual cause-of-action for damages. But the EFF et al are objecting to criminal liability based on CFAA/CPC §502 (computer fraud statutes). I don't believe your shopkeeper analogy quite applies, though. Let's say the shopkeeper opens their shop, but puts a sign over the door to the effect "by entering, you promise to keep my prices secret". If someone enters, leaves, then later spills the pricing beans, it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. That's a major problem the EFF brief identifies with the Craigslist interpretation: it lets vague or arbitrary private conditions be creatively recast as criminal violations with more significant penalties. As a matter of fair law and the public's interest in clarity and the free-flow of true information, they argue that such application of the CFAA (and its California equivalent CPC §502) to be dangerously incorrect.
  - jasonlotito 11y ago
    > ...it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. Seems to me that something like this is more like an NDA. Assuming someone saw and understood the sign, what are the legal ramifications? And how does this compare to establishments that require membership to use such as Costco?
  - rayiner 11y ago
    Maybe that's true the first time, but 3taps business model wouldn't work with just one visit to craigslist. If you keep coming into the shop, the shopkeeper definitely has the right to revoke your implied license and sue you for trespass the next time you step on the premises.
    - gojomo 11y ago
      But in the real-world, the shopkeeper would have to ask you to leave. And online, they'd have to use some actual access-control barrier. The EFF's argument allows that in such a (alternative) case, real 'unauthorized access' could have occurred. They write: Of course, Craigslist has the right to restrict access to its data through, for example, requiring a username and login, which would password protect access ot its other users' advertisements. If defendants bypassed that security measure by trying to break through this barrier by systematically attempting passwords or "hacking" their way in through some other method, then their access to Craigslist would necessarily have been "unauthorized". ... But once Craigslist chose not to password protect its data – a decision that would undercut Craigslist's successful business model – it necessarily authorized the public to view the information on the public website.
      - tedunangst 11y ago
        Does serving someone with a cease and desist count as asking them to leave?
        gojomo 11y ago
- nitrogen 11y ago
  The fact that the premises is an Internet website changes nothing. It absolutely should. There is no accurate physical analogy for an HTTP server that responds with "200 OK" and valid data for a given set of "GET whatever HTTP/1.1" requests. Rather than contort existing trespass law to match the Internet, we have to derive meaningful boundaries for the Internet from ethical first principles if we want the conclusions to be remotely sane.
  - rayiner 11y ago
    The law of trespass reflects a basic ethical principle: owners of private property may invite the public to access their property for a proper purpose (the scope of which may even be implied) but nonetheless retain the right to deny access and to sue for trespass those who access that property for some other purpose. That ethical principle applies just as much to websites as coffee shops. Just because Craigslist makes its website available to the public for a defined purpose does not mean it's not trespass for a company to access that data for a different purpose.
    - gojomo 11y ago
      But this is another case where analogies to tangible property can easily mislead. Even though we metaphorically call viewing a website 'a visit', I'm not occupying any of the website's property, or even particularly using it a consumptive/rivalrous way. I haven't traveled anywhere or opened anything. Even the kind of 'access' is very different from the 'physical access' of passing through a door or entering a shop/home – though the reuse of the same word can lead to semantic confusion. Instead, I'm communicating. The website is sending me information, in response to simple requests. It can withhold whatever it wants. If the website hasn't even so much as enforced a click-through assent-agreement – much less a password-login! – what 'property' is being 'accessed' conditional on some narrow 'defined purpose', when I'm simply viewing things that area also open to everyone else without preconditions? If it's intellectual property, unlicensed reproduction or use of that is a very different cause-of-action than criminal 'unauthorized computer access'/trespass. (I believe that issue also came up in the case, and individual posters rather than Craigslist were found to be relevant rightsholders in individual listings.)
- maxlybbert 11y ago
  > The fact that the premises is an Internet website changes nothing. Well, the principle stays the same, but apparently Congress thought it changed enough that they had to write a new law to cover things.
- ectoplasm 11y ago
  > Craigslist is like a shop open to shoppers. Craigslist is a lot more like a free classifieds paper. The ads are received, typed up, and printed out by some office somewhere, and the resulting compilation is distributed in unattended and unlocked newspaper stands on the sidewalk.
- macspoofing 11y ago
  >Craigslist is like a shop open to shoppers. Is it?
- rawdisk 11y ago
  "... purpose in granting access." "... for improper purpose, ..." But in the 4/29/13 Order the Court says it would follow Nosal and that purpose is not enough to sustain "unauthorized access". Instead it says Defendants' failure to cease and desist after receiving notification from the Plaintiff is the reason why it is not dismissing the CFAA claim. If Defendants had simply "scraped" from a third party who was "authorized" to access Plaitiff's website (Google?), then perhaps the outcome here might have been different?
- MichaelCrawford 11y ago
  Was the respondent on craigslist's premises? IIRC their office is San Francisco. If thevshop is open to the public its not actually trespass until the shopkeeper asks one to leave. One fine day I discovered a gross electrical code violation at the Hacker Dojo in Mountain View. I called the fire marshall then tripped all the circuit breakers then unplugged every electrical cord in the place. One of the members called the police. The cop called the owner who told the cop that I was no longer permitted in the building. "What exactly does it mean not be be in the building? Where cannI be without violating the law?" "Just outside the door." I assert that the plaintiff in this case is just like someone standing outside the shop, on a public sidewalk, looking in the window.
tptacek 11y ago
Why? Why is the reference "fair to make these points to a mass audience"? I'm not saying Craigslist should have won the suit on the legal merits. I'm ambivalent about that. But surely, every time one company sues another company and their case isn't completely bulletproof, surely it can't be reasonable for us to say "that's just like what killed Aaron Swartz".
- gojomo 11y ago
  Because it is "the same statute", as they accurately say. And it's even a similar kind of interpretive abuse: stretching its definitions to rack up steeper potential penalties against a lesser-resourced entity. So no, not every lawsuit. But yes, if an expansive interpretation of the CFAA is deployed against someone, I think it's OK for them to remind the audience it's that law. (Your exaggerated paraphrase here, "that's just like what killed Aaron Swartz", is far more "manipulative and grotesque" than the actual wording of their small aside.)
  - tptacek 11y ago
    Once again, please explain what these "steep penalties" you're referring to are, specifically and in detail. The CFAA is a very short act, and it's not hard to read. Moreover, the civil cause of action in CFAA is a tiny part of the overall statute. I don't think it supports the argument you're trying to make. In fact, I think it contradicts it.
    - gojomo 11y ago
      Anything which wins damages under a civil action could also (at federal discretion) be charged criminally: the CFAA elements which allow civil recovery (section (g)) are a proper subset of those that allow criminal prosecution. As the EFF amicus brief notes: "…although this is a civil dispute, the CFAA is also a criminal statute, and permitting Craigslist's computer hacking claims to go forward would also mean creating criminal liability." Craigslist's specific allegations againt 3Taps would seem to qualify the responsible parties for imprisonment up to 5 years, on a first offense, by CFAA (c)(2)(B), if a prosecutor felt like making an example of them.

by gojomo 11y ago

rayiner 11y ago

> As the EFF argues in the linked brief, there shouldn't be any "civil cause of action related to unauthorized access" when the data in question is made publicly available on the internet. Why? The principle underlying the Craiglist lawsuit is centuries old. Craigslist is like a shop open to shoppers. The shopkeeper makes the premises open to the public, but the scope of that access is limited by the shopkeeper's purpose in granting that access. If a member of the public accesses the property for improper purpose, a civil action for trespass arises. The fact that the premises is an Internet website changes nothing.

gojomo 11y ago
You can read the brief for their full argument: https://3taps.com/images/pics/430_Amicus%20Brief.pdf https://3taps.com/images/pics/430_Amicus%20Brief.pdf Their analysis may allow for something like what you propose – a purely contractual cause-of-action for damages. But the EFF et al are objecting to criminal liability based on CFAA/CPC §502 (computer fraud statutes). I don't believe your shopkeeper analogy quite applies, though. Let's say the shopkeeper opens their shop, but puts a sign over the door to the effect "by entering, you promise to keep my prices secret". If someone enters, leaves, then later spills the pricing beans, it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. That's a major problem the EFF brief identifies with the Craigslist interpretation: it lets vague or arbitrary private conditions be creatively recast as criminal violations with more significant penalties. As a matter of fair law and the public's interest in clarity and the free-flow of true information, they argue that such application of the CFAA (and its California equivalent CPC §502) to be dangerously incorrect.
- jasonlotito 11y ago
  > ...it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. Seems to me that something like this is more like an NDA. Assuming someone saw and understood the sign, what are the legal ramifications? And how does this compare to establishments that require membership to use such as Costco?
- rayiner 11y ago
  Maybe that's true the first time, but 3taps business model wouldn't work with just one visit to craigslist. If you keep coming into the shop, the shopkeeper definitely has the right to revoke your implied license and sue you for trespass the next time you step on the premises.
  - gojomo 11y ago
    But in the real-world, the shopkeeper would have to ask you to leave. And online, they'd have to use some actual access-control barrier. The EFF's argument allows that in such a (alternative) case, real 'unauthorized access' could have occurred. They write: Of course, Craigslist has the right to restrict access to its data through, for example, requiring a username and login, which would password protect access ot its other users' advertisements. If defendants bypassed that security measure by trying to break through this barrier by systematically attempting passwords or "hacking" their way in through some other method, then their access to Craigslist would necessarily have been "unauthorized". ... But once Craigslist chose not to password protect its data – a decision that would undercut Craigslist's successful business model – it necessarily authorized the public to view the information on the public website.
    - tedunangst 11y ago
      Does serving someone with a cease and desist count as asking them to leave?
      - gojomo 11y ago
nitrogen 11y ago
The fact that the premises is an Internet website changes nothing. It absolutely should. There is no accurate physical analogy for an HTTP server that responds with "200 OK" and valid data for a given set of "GET whatever HTTP/1.1" requests. Rather than contort existing trespass law to match the Internet, we have to derive meaningful boundaries for the Internet from ethical first principles if we want the conclusions to be remotely sane.
- rayiner 11y ago
  The law of trespass reflects a basic ethical principle: owners of private property may invite the public to access their property for a proper purpose (the scope of which may even be implied) but nonetheless retain the right to deny access and to sue for trespass those who access that property for some other purpose. That ethical principle applies just as much to websites as coffee shops. Just because Craigslist makes its website available to the public for a defined purpose does not mean it's not trespass for a company to access that data for a different purpose.
  - gojomo 11y ago
    But this is another case where analogies to tangible property can easily mislead. Even though we metaphorically call viewing a website 'a visit', I'm not occupying any of the website's property, or even particularly using it a consumptive/rivalrous way. I haven't traveled anywhere or opened anything. Even the kind of 'access' is very different from the 'physical access' of passing through a door or entering a shop/home – though the reuse of the same word can lead to semantic confusion. Instead, I'm communicating. The website is sending me information, in response to simple requests. It can withhold whatever it wants. If the website hasn't even so much as enforced a click-through assent-agreement – much less a password-login! – what 'property' is being 'accessed' conditional on some narrow 'defined purpose', when I'm simply viewing things that area also open to everyone else without preconditions? If it's intellectual property, unlicensed reproduction or use of that is a very different cause-of-action than criminal 'unauthorized computer access'/trespass. (I believe that issue also came up in the case, and individual posters rather than Craigslist were found to be relevant rightsholders in individual listings.)
maxlybbert 11y ago
> The fact that the premises is an Internet website changes nothing. Well, the principle stays the same, but apparently Congress thought it changed enough that they had to write a new law to cover things.
ectoplasm 11y ago
> Craigslist is like a shop open to shoppers. Craigslist is a lot more like a free classifieds paper. The ads are received, typed up, and printed out by some office somewhere, and the resulting compilation is distributed in unattended and unlocked newspaper stands on the sidewalk.
macspoofing 11y ago
>Craigslist is like a shop open to shoppers. Is it?
rawdisk 11y ago
"... purpose in granting access." "... for improper purpose, ..." But in the 4/29/13 Order the Court says it would follow Nosal and that purpose is not enough to sustain "unauthorized access". Instead it says Defendants' failure to cease and desist after receiving notification from the Plaintiff is the reason why it is not dismissing the CFAA claim. If Defendants had simply "scraped" from a third party who was "authorized" to access Plaitiff's website (Google?), then perhaps the outcome here might have been different?
MichaelCrawford 11y ago
Was the respondent on craigslist's premises? IIRC their office is San Francisco. If thevshop is open to the public its not actually trespass until the shopkeeper asks one to leave. One fine day I discovered a gross electrical code violation at the Hacker Dojo in Mountain View. I called the fire marshall then tripped all the circuit breakers then unplugged every electrical cord in the place. One of the members called the police. The cop called the owner who told the cop that I was no longer permitted in the building. "What exactly does it mean not be be in the building? Where cannI be without violating the law?" "Just outside the door." I assert that the plaintiff in this case is just like someone standing outside the shop, on a public sidewalk, looking in the window.

tptacek 11y ago

Why? Why is the reference "fair to make these points to a mass audience"? I'm not saying Craigslist should have won the suit on the legal merits. I'm ambivalent about that. But surely, every time one company sues another company and their case isn't completely bulletproof, surely it can't be reasonable for us to say "that's just like what killed Aaron Swartz".

gojomo 11y ago
Because it is "the same statute", as they accurately say. And it's even a similar kind of interpretive abuse: stretching its definitions to rack up steeper potential penalties against a lesser-resourced entity. So no, not every lawsuit. But yes, if an expansive interpretation of the CFAA is deployed against someone, I think it's OK for them to remind the audience it's that law. (Your exaggerated paraphrase here, "that's just like what killed Aaron Swartz", is far more "manipulative and grotesque" than the actual wording of their small aside.)
- tptacek 11y ago
  Once again, please explain what these "steep penalties" you're referring to are, specifically and in detail. The CFAA is a very short act, and it's not hard to read. Moreover, the civil cause of action in CFAA is a tiny part of the overall statute. I don't think it supports the argument you're trying to make. In fact, I think it contradicts it.
  - gojomo 11y ago
    Anything which wins damages under a civil action could also (at federal discretion) be charged criminally: the CFAA elements which allow civil recovery (section (g)) are a proper subset of those that allow criminal prosecution. As the EFF amicus brief notes: "…although this is a civil dispute, the CFAA is also a criminal statute, and permitting Craigslist's computer hacking claims to go forward would also mean creating criminal liability." Craigslist's specific allegations againt 3Taps would seem to qualify the responsible parties for imprisonment up to 5 years, on a first offense, by CFAA (c)(2)(B), if a prosecutor felt like making an example of them.