On a network you have to first identify yourself and then request access.
If you have been specifically asked to not access that (open) network in the past the onus should be on the network to keep a record of you.
If you knowingly change your identity to bypass that level of security, then yes you are now trespassing.
Arguing that an IP address is an identity "for this case" or "this argument" has the same fundamental problem. No, an IP address is not an identity and blocking an IP address is the physical world equivalent of putting up some traffic cones on a sidewalk. You can still get to where you want to go but you now have to "walk around" or "work around" as we call it in the digital world.
The only "clear message" it sends is, "don't use that IP."
> The only "clear message" it sends is, "don't use that IP."
Are you saying with a straight face that anyone at Power thought it was a coincidence that suddenly they couldn't access Facebook from very specific IP addresses?
Then it should stop authorizing Power to do so. Why would it let the credentials work for Power unless those credentials authorized Power access? That's the problem. The simple solution is 2-factor authentication.
This is a solved problem. If you have "open access" of your web services and and access is non-disruptive, I don't know why this should be a criminal violation. It shouldn't be criminal just because it doesn't fit with your business model.
What if you tell me to stop doing it, but my friend is allowed and he types all of the commands that i tell him to type and then he sends me the data? That's why it doesn't quite make sense.
It doesn't make as much sense for a publicly accessible website and user tokens. It makes sense from a tort point of view, but not from a criminal point of view. The next step away would be for users to install an app that logs into facebook and forwards the data to the centralized server.
Note: I'm not at all sure it should be enforceable, and the idea makes me uncomfortable, but I can't come up with a good reason.
This is a bit different from the common problem where someone guesses a URL and gets hit with unauthorized access. There, they merely lacked explicit permission to access the system in question, and the weird legal argument is that building a URL by hand implies unauthorized access. Here, the access followed a letter explicitly telling him not to access their system.
Also, even though facebook themselves sometimes ask for the credentials to your other services (i.e. email accounts so they can scan for shared contacts), I bet their user agreements stipulate that your credentials for facebook should not be shared. I doubt they'd be stupid enough to punish their users for this, but is there some law that would be useful here for taking action against Power for encouraging users to breach their agreement with fb?
NOTE: I'm not a lawyer so you'll need to check with one before relying on what I've just said to be correct!
You've just made quite a few APIs illegal.
It's not really relevant to this case.
Also, the laws against identity theft do not always (ever?) reference the victim's knowledge. In California, if you impersonate someone and profit as a result, you are guilty of false impersonation. The law doesn't care if the person you're impersonating knows.