3 ms·

You can read the brief for their full argument: https://3taps.com/images/pics/430_Amicus%20Brief.pdf https://3taps.com/images/pics/430_Amicus%20Brief.pdf Thei

by gojomo 11y ago

You can read the brief for their full argument: https://3taps.com/images/pics/430_Amicus%20Brief.pdf https://3taps.com/images/pics/430_Amicus%20Brief.pdf Their analysis may allow for something like what you propose – a purely contractual cause-of-action for damages. But the EFF et al are objecting to criminal liability based on CFAA/CPC §502 (computer fraud statutes). I don't believe your shopkeeper analogy quite applies, though. Let's say the shopkeeper opens their shop, but puts a sign over the door to the effect "by entering, you promise to keep my prices secret". If someone enters, leaves, then later spills the pricing beans, it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. That's a major problem the EFF brief identifies with the Craigslist interpretation: it lets vague or arbitrary private conditions be creatively recast as criminal violations with more significant penalties. As a matter of fair law and the public's interest in clarity and the free-flow of true information, they argue that such application of the CFAA (and its California equivalent CPC §502) to be dangerously incorrect.

jasonlotito 11y ago
> ...it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. Seems to me that something like this is more like an NDA. Assuming someone saw and understood the sign, what are the legal ramifications? And how does this compare to establishments that require membership to use such as Costco?
rayiner 11y ago
Maybe that's true the first time, but 3taps business model wouldn't work with just one visit to craigslist. If you keep coming into the shop, the shopkeeper definitely has the right to revoke your implied license and sue you for trespass the next time you step on the premises.
- gojomo 11y ago
  But in the real-world, the shopkeeper would have to ask you to leave. And online, they'd have to use some actual access-control barrier. The EFF's argument allows that in such a (alternative) case, real 'unauthorized access' could have occurred. They write: Of course, Craigslist has the right to restrict access to its data through, for example, requiring a username and login, which would password protect access ot its other users' advertisements. If defendants bypassed that security measure by trying to break through this barrier by systematically attempting passwords or "hacking" their way in through some other method, then their access to Craigslist would necessarily have been "unauthorized". ... But once Craigslist chose not to password protect its data – a decision that would undercut Craigslist's successful business model – it necessarily authorized the public to view the information on the public website.
  - tedunangst 11y ago
    Does serving someone with a cease and desist count as asking them to leave?
    - gojomo 11y ago
      That seems to be a holding that Craigslist won from the court, which helped assure the settlement. That's a better standard than the originally-argued "violates terms of use". But it's still problematic given how draconian CFAA penalties can be, and given that the 'unauthorized access' in question penalizes access to information that's freely available to any other anonymous member of the public. Maybe the EFF will be able to use the $1MM that fell their way to further circumscribe such CFAA application.
      - tptacek 11y ago
        What do you mean, "how draconian CFAA penalties can be"? Which penalties are you referring to? The civil cause of action defined by CFAA expressly limits the kinds of damages plaintiffs can pursue, unlike other torts. This is why it's so upsetting to see these people use this manipulative language. Criminal CFAA --- or, more accurately, federal sentencing law --- can legitimately be criticized for being draconian. But criminal CFAA has almost nothing but a few definitions in common with civil CFAA. Causing damages under the civil cause of action defined by CFAA does not allow the government to fine you. That's not how this works.
        gojomo 11y ago
        No, a Craigslist judgement on CFAA grounds wouldn't trigger a federal fine. But any activity that wins damages on the civil side could also (at federal prosecutor discretion) be prosecuted criminally. A civil precedent on what counts as "exceed[ing] authorized access" under the CFAA also affects who might be subject to the full range of federal criminal penalties, in future actions. So Craigslist's interpretation winning, compared to EFF's, ultimately means more people threatened with 1-10 years in federal prison.
  - 11y ago

by gojomo 11y ago

jasonlotito 11y ago

> ...it's not clear to me that traditional, non-computer law would allow the shopkeeper to retroactively characterize the visit as 'trespass'. Seems to me that something like this is more like an NDA. Assuming someone saw and understood the sign, what are the legal ramifications? And how does this compare to establishments that require membership to use such as Costco?

rayiner 11y ago

Maybe that's true the first time, but 3taps business model wouldn't work with just one visit to craigslist. If you keep coming into the shop, the shopkeeper definitely has the right to revoke your implied license and sue you for trespass the next time you step on the premises.

gojomo 11y ago
But in the real-world, the shopkeeper would have to ask you to leave. And online, they'd have to use some actual access-control barrier. The EFF's argument allows that in such a (alternative) case, real 'unauthorized access' could have occurred. They write: Of course, Craigslist has the right to restrict access to its data through, for example, requiring a username and login, which would password protect access ot its other users' advertisements. If defendants bypassed that security measure by trying to break through this barrier by systematically attempting passwords or "hacking" their way in through some other method, then their access to Craigslist would necessarily have been "unauthorized". ... But once Craigslist chose not to password protect its data – a decision that would undercut Craigslist's successful business model – it necessarily authorized the public to view the information on the public website.
- tedunangst 11y ago
  Does serving someone with a cease and desist count as asking them to leave?
  - gojomo 11y ago
    That seems to be a holding that Craigslist won from the court, which helped assure the settlement. That's a better standard than the originally-argued "violates terms of use". But it's still problematic given how draconian CFAA penalties can be, and given that the 'unauthorized access' in question penalizes access to information that's freely available to any other anonymous member of the public. Maybe the EFF will be able to use the $1MM that fell their way to further circumscribe such CFAA application.
    - tptacek 11y ago
      What do you mean, "how draconian CFAA penalties can be"? Which penalties are you referring to? The civil cause of action defined by CFAA expressly limits the kinds of damages plaintiffs can pursue, unlike other torts. This is why it's so upsetting to see these people use this manipulative language. Criminal CFAA --- or, more accurately, federal sentencing law --- can legitimately be criticized for being draconian. But criminal CFAA has almost nothing but a few definitions in common with civil CFAA. Causing damages under the civil cause of action defined by CFAA does not allow the government to fine you. That's not how this works.
      - gojomo 11y ago
        No, a Craigslist judgement on CFAA grounds wouldn't trigger a federal fine. But any activity that wins damages on the civil side could also (at federal prosecutor discretion) be prosecuted criminally. A civil precedent on what counts as "exceed[ing] authorized access" under the CFAA also affects who might be subject to the full range of federal criminal penalties, in future actions. So Craigslist's interpretation winning, compared to EFF's, ultimately means more people threatened with 1-10 years in federal prison.
- 11y ago