Hacker News Reader

Comment by Animats | Hacker News Reader

The court seems to have it right, while the article author doesn't see the court's reasoning. The issue is whether accessing a web site after being sent a cease and desist letter telling you to stop is an act for which the accessor can be assessed damages. (Despite the title, this was a civil case, not a criminal case.)

A previous case established that accessing a web site in violation of its terms of use is not a offense under the Computer Fraud and Abuse Act. That's just a contractual issue.

Here, though, the site operator (Facebook) explicitly sent a cease and desist letter to the accessing service, telling them to stop doing what they were doing (which apparently involved some kind of message sending on behalf of Facebook users). That put the accessing service on notice that they were accessing the site without authorization. After that, access was considered unauthorized. Seems reasonable enough.

View on HN

This gets into the whole debate over who owns, or should own, your data

IMO I should have the right to access, and authorize 3rd parties to access, data stored about me even if it is on a 3rd party platform like facebook. If Facebook does not want to allow Me or my authorized agents to access this data then facebook;s only recurse should be to prevent me from using their platform AND delete any and all they have collected about me.

Here Facebook wants to control how my data is used, stored, and disseminated. they want the ability to Prevent me or my Authorized Agents from access my data, but they do not want to be forced to delete said data.

I am a strong advocate of strong Data protection, access, and Right to Know laws.

Authorization is the key question, for me Power Partners was authorized, by the USER, that should be all the Authorization they need. Facebook should be sending notices and cancelling the accounts of the USERS that authorized Power Partners, not be going after power partners directly.

Yes, but the USERS are not facebook customers, it's the bussinesses that pay money to advertise, FB considers user data their property so that's why they act this way.

So did the credit reporting agencies until laws were passed requiring them to give people access, and a path to correct inaccurate info.

Now these are hardly perfect, but I think this idea needs to be expanded to all companies that store PII about you.

For example I do not have a Facebook account, but I am sure they have data about me, I have no way of ascertaining what info they have, or the accuracy of the info, and they could in time be selling that inaccurate info to agencies or other parties that could impact my life in some manner.

Facebook is hardly the only one, and actually is far from the most egregious when it comes to the potential of screwing up your life. There are many companies most people have never heard of that take data from all kinds of sources, some with out any kind of actual verification and compile massive databases on people for sell to anyone.. Stalkers, Creditors, Employers, etc etc etc.

I disagree. That is, I agree that you should ultimately own your data and have the right to decide what Facebook is allowed to do with it, to have them tell you what data they have, and to have them delete it. I don't agree that you should have the right to force them to provide data-related services to you or anyone else simply because they have your data. If you want another third party to have access to your data, you can provide it to them directly. Don't have a server set up with a popular API for that? That doesn't mean you get to force someone who does to do it for you.

I do not believe I advocated for anything like that.

In this case The data was either Scraped via downloading the HTML pages, or used Facebooks API with the users permission. I believe that should be all that is required is the user permission, if the USER does something that is a violation facebook policy then the recourse should be banning of the User, and removal of all data for that user. Facebook does not want that however. So you see Facebook does not have to provide anything, but they can not pick and choose what a person does with the data they are storing about them.

That said there is one Data Service I do believe should be required, I should be able to request my data from any company to be delivered to me in some kind of Machine Readable format. XML, JSON, some other structured format. This could be only on Condition of Closing my account, or some other string attached, but I should be able to get access to this data.

Do you believe you have the right to access data stored about you in 3rd party SQL databases, and thus the right to exploit SQL injection flaws to get at that data?

(I'm stipulating for this question that you "should have the right" you generally advocate for. Obviously, under US law, you have no such right.)

HUH????

Seems like you are attempting to construct some kind of terrible and very specific straw man.

I believe I explained my position fully, and your comment does not pose any additional information or questions that requires any more comments than i have already made, if you would like to try again I will be happy to respond.

No, not a straw man. Clearly, your answer to my question is "no".

Follow-up question: what distinction would you draw between exploiting SQL injection to access data stored about you, and violating a TOS and ignoring a C&D to access that data through a service you knew was not authorizing you to do so?

Authorization is indeed a key question.

In delegating power in general there is usually an explicit point made whether that power can be delegated or not. In most TOC this power is not given to the customer.

Whether such TOCs are valid is another question - courts may decide that one side had too much power and just forced terms down the throat of the other. Still in this case the question is not b2c but b2b. In that realm different rules apply. Again courts may decide that one side has too much power - facebook as the dominant social media platform has be be very careful to treat everyone in acceptable similar matter.

I totally agree with syshum's comments on this thread, I had the same thoughts while reflecting on this article.

Facebook (and LinkedIn and others) love to get your email login and grab your list of contacts. This is the exact same situation, except now fb is the dominant network and doesn't want other networks to get its users' data, even if those users explicitly authorize it. So it really boils down to what data the TOCs can lock down (fb would want it all locked) and what users should be allowed to "control" (I think it should be the users' right to control their data). And with the CFAA, or at least this court's interpretation, the government has sided massively with corporations, to the detriment of users (aka non-corporate citizens) and markets.

There is also the whole issue of C&D letters being binding. Just because a Corp (or person) believes something and has a lawyer paid to write up that belief does not make it a legally enforceable document. For example: I have vegetation on my property that produces oxygen. I like oxygen and I reserve all oxygen produced on my property for myself. You are hearby notified that all oxygen produced on my property, no matter where it is currently located belongs to me and you must cease and desist from consuming it.

[edited to add:] Or maybe those who don't want to be on Facebook can send it a cease and desist order to stop collecting data about them. I bet if you tried to enforce that, you'd find that the government doesn't protect citizens' right to their own data with overly broad laws the way it protects companies' right to gather and lock down data.

So if someone writes a novel about you, then you own the data in the novel?

I don't think that's entirely correct though. Facebook allows people to give other services access to their accounts (and apparently to the things Power was doing). When those services then use that access to do the things they were authorised to do, Facebook can't suddenly complain.

They shouldn't have offered access to those services in the first place then. So the solution is to rescind access to the services that they don't want accessed, not sue the infringing entity for using the service they were granted access to.

Then again, I have too little information. I don't know what messages were sent, and where and how.

While you have a valid point, I think it comes down to a matter of how one likes to run their business. Facebook could definitely use this case against other parties in the future.

> When those services then use that access to do the things they were authorised to do

Reread Animats' comment more carefully. As Animats pointed out, the accessing service wasn't authorised because authorisation had been revoked by way of the cease and desist letter.

> So the solution is to rescind access to the services that they don't want accessed

Which they did via a C&D letter.

What is so special about a cease and desist letter? So now 1 company can destroy the business model of another company by simply sending out a letter? Power was using a public API with user permission. If Facebook did not like that then change the API, or introduce a different security model.

If I created a business sending unsolicited snail mail to your address, and you asked me to stop using a cease and desist letter, should I comply, and allow you to destroy my business model?

I don't understand this analogy. Do most people have the legal ability to prevent letter-sending without working with the Post Office? Did the company have many other sources of revenue besides Facebook?

In Europe you can't send me unsolicited marketing mail if I've withdrawn permission.

(In most cases you need my explicit opt-in confirmation that I want your junk mail before you send it to me).

> In Europe

Is there some kind of Europe-wide agreement on unsolicited marketing mail that covers every country?

There are EU data protection directives that have that effect. (Saying "Europe" to mean "the EU" is technically "wrong" in the same sense as saying "America" to mean "the USA", but it's common enough to be widely understood. Language is a tool for communication)

Yes, if your business model revolves only and completely around sending these unsolicited pieces of mail to my address, I think there would be no problem in getting a court to uphold the cease-and-desist letter, thus destroying your business. Quite how your business was going to produce revenue just sending mail to one person is a mystery though, anyway...

In the US, people have the right to decide a sender may no longer send them snail mail if the sender has sent them obscene materials.

It's my understanding that case laws has led to obscenity in this context being 100% as defined by the recipient. If you believe content type X is obscene, and someone sends you content type X, you can follow the procedure for reporting obscenity. They are obligated to stop sending you anything.

but in this case, the users, through the Power website, did give permission to receive, or send, the "snail mail".

From the article "Power users also authorized the software to send Facebook messages to other Facebook users for them"

So in your analogy. I created a business of sending snail mail to addresses I already had in my possession on my list of contacts. My contacts might not appreciate my snail mail, but I am not sending snail mail to the Facebook corporate Office -Or- if I am sending to the Facebook Corporate Office, then only though its mail routing department, which was set up to handle these very packages.

The C&D, I think, is equivalent to preventing contacts from communicating with each other, or, Postal Censorship[1], which I suppose is more a policy issue than a legal one. Which I suppose extends FB to be a governing body, which I guess leads us to CFAA...

[1]https://en.wikipedia.org/wiki/Postal_censorship

Cease and desist is someone giving clear, unambiguous instruction that they're withdrawing permission for someone else to do stuff.

In this case they'd already tried some technical measures which he evaded.

It isn't a "public" API, it's Facebook's API that they're making available to the public. They have the right to control access to their API, be it by password authentication or telling someone to stop using it.

Not that I necessarily agree with how this case turned out, but Facebook is under no obligation to support the business model of another company...

> "Facebook is under no obligation to support the business model of another company..."

Agreed, but neither should they have the ability to destroy a business by the single act of sending out a letter. Pretty much from that point on the company can't legally operate.

If you build a company that is a) fully dependent on another company to exist and b) reliant on that company providing you service it doesn't have any business reason to provide, then you the founder of the company destroyed it.

If a business is flimsy enough to be destroyed by a letter, it was toast anyway.

Not to mention this argument that someone else's business is this precious thing that can't be destroyed. Its totally bizarre. How often does Apple release features that eat another company's lunch? Better yet, think of all the disruptive SV business models that are purely based on destroying businesses and replacing them with alternatives.

> "If a business is flimsy enough to be destroyed by a letter, it was toast anyway."

Completely disagree. In the early stages of its life, almost any business is very vulnerable. If Microsoft had irritated IBM just the slightest bit in the early days, they would have been toast, or at best a small niche company, because they were completely dependant on IBM's goodwill. An IBM executive could have decided they preferred the boys at Apple instead. no letter even required. Yet look at Microsoft today. Who is to say that a business starting out using a Facebook API today, could not diversify and be a powerhouse and industry leader, tomorrow?

The point is that this ruling allows one company to make illegal, the business activity of another just by sending out a letter irrespective of whether that company's activity is actually illegal

It became illegal when Power circumvented the C&D letter to continue accessing systems they had expressly been forbidden to access. Their conduct was fine until FB decided they wanted no part in it.

This is how it should be. If I, as a company, decide I don't want to do business with you, either individually or corporately, barring discrimination rules, why shouldn't I have that right?

Facebook has the right to determine who can and cannot access their systems, barring a court order. You seem to be suggesting they should not have that right.

But Power was using its customers' fb users' credentials with their permission, so it was fb users "who" accessed fb. Only they did it through other computers that were owned by Power. Should fb have the right to determine what and which computer you use to access fb?

So you're saying that a business should be able to deny service to any customer for any reason?

(For the record, I agree)

Just as a thought experiment, can this reasoning apply to agreements with utilities providers etc? For instance, if I fail to pay an electricity bill, and the electricity provider transfers my debt to a debt collector, can I send a cease and desist letter to the collector and insist that I only deal with the provider who I originally had a contract with?

I know this is probably subject to a whole bunch of regional laws, statutes and precedents, but it's (to my view) in the same category of problem.

while the article author doesn't see the court's reasoning.

Indeed, you can tell the author is in trouble because multiple times he says, "I don't understand the court's reasoning." Well, maybe you should try to understand it before criticizing it!

Doesn't seem reasonable to me at all. If you do not wish someone to visit your public website, you have to close it to them e.g. by revoking their login credentials or blocking their IP address. Or, don't make your page public---there are plenty of technologies to connect people that do not involve public web pages.

We can also look at it the other way round. Let's check whether Facebook will be convicted of a violation of the Computer Fraud and Abuse Act if they continue to track any data related to a person (e.g. obtained from embedded Like buttons or images uploaded by FB users) after that person has send them a cease & desist letter...

> or blocking their IP address

It's mentioned in the article that Facebook DID block their IP. Power simply changed it and continued.

I've never used Facebook's API but I assume each server/app that wants to access it has an API key specific to that server/app. Couldn't Facebook just revoke the key? Or change its permissions?

Reply on news.ycombinator.com