Violating Terms of Use Isn’t a Crime, EFF Tells Court
eff.org
eff.org
That's insane. The terms of service is essentially a contract that you are agreeing to to use the website/software/service. Failure to adhere to it is a breach of contract, not a violation of law.
If you break an NDA, for example, you don't wind up in jail or have a criminal history. The other party takes you to court to enforce the penalty listed out in the contract for the breach.
License and contract are overlapping, not mutually exclusive (a license can either be a gratuitous license or a license contract.)
Website ToS may be (a component of) either sort of license arrangement. (On a site where your access is undisputably part of an exchange-for-value, like a pay site, you have a contract relationship and the ToS are almost certainly a part of that contract, probably by reference.)
(But, agreed that a ToS violation shouldn't ever be a crime by itself - that reading of the CFAA would give, for example, website operators the power to write criminal law).
The theory here is that, after breaking the TOS, if you continue to use the service then that use is unauthorized and therefore felonious.
As the EFF notes, previous judges have refused to rule it this way, basically on the basis of "that's insane, even if it is what the law says".
Edit: for reference, the relevant legal bits are here, in section (a.2.C), with relevant definitions in (e.2.B): https://www.law.cornell.edu/uscode/text/18/1030
For this particular case, they were just told to cease and desist with the scripting/scraping of the data. Access was never revoked. Any decent lawyer should be able to easily make a claim that a reasonable person thought they still had authorized access because it had not been revoked. I don't think the article makes clear whether or not they had a username/password login or whether or not the files were available just with public URLs, but it doesn't matter in my mind because the company had a business relationship with Oracle to provide third party support for Oracle products. They would have to block access, end the business agreement, or specifically notify them that continued access is no longer allowed for the unauthorized access argument to hold up.
I don't think they should be held as even a contract, much less criminal law.
Truthfully, they are really only there to protect the company by outlining to the user what might get them banned from the site and so on. Oracle is overstepping its authority here imo. It is their own fault they didn't revoke access to the site from that company.
Much in the same way that you can't start using someone else's land without their permission and you don't get to say "I never knew" or "I never agreed not to use the land". By default, you are not allowed to and must have that right granted to you and you are expected to know that.
Should an (otherwise non-criminal) violation of a software license be treated as a criminal offence by the courts just because it involved a computer? Hell no. Private citizens do not get to invent criminal law themselves and the EFF should fight this hard but not for the reasons you give.
If I had a physical analog of facebook (a bunch of photos, a travel journal, and a list of my friends) and left it on a table, then do you need a license to pick it up and review it? No. So why do you need one if I do the same thing as a web site?
I'm not sure that's correct, but it could be. It was my understanding it was a contract. That's why you have to agree to it - you are providing your consent and acknowledgement that you have read the terms and agree to abide by them.
If it was a license, they could simply grant it to you without requiring your consent. For example - I can buy a license for some shareware/trialware software by just sending them money and getting the license key in my email. Then when I go to use the software, it may ask for me to agree to the terms of service so that there is a formal agreement on the allowed uses of the software.
ToS is used in conjunction with a license usually. And the ToS in that case outlines how that license may be revoked.
I don't think ToS is a license though all by itself.
Here, "Oracle sent Rimini a cease and desist letter demanding that it stop using automated scripts. It did not, however, rescind Rimini’s authorization to access the files outright." So the question is, was the implied consent to use Oracle's servers effectively revoked?
Arguably not. A public mall can get you kicked off the property for any reason, and can press charges for criminal trespass if you don't leave. But it can't press charges for criminal trespass for violating the sign on the door that says "no hats." And it probably can't press charges for criminal trespass if it sees you wearing a hat and tells you to take it off, but doesn't kick you off the property.
The terms of service ("Nutzungsbedigungen") that Oracle posts on their website that dictate how to use and access their website are invalid in Germany as well.
I think a lot of it started with the changing of copyright law into criminal law.
The US civil laws really only apply to middle class suckers. Rich people can use their lawyers to work around it. Poor people are "judgment proof". If you don't have a house, you're working under the table, and your bank account is empty, there's fuck all people can do against you. With criminal law on the other hand...
There's only so many times you can hit someone who's judgement proof before you start wishing you could get them tossed in jail.
I recently had someone who screwed me over from about a very large amount of money. He was laughing at me in the face making sure I remembered that even if I won a lawsuit against him, I'd never be able to collect. He was unfortunately quite right.
1. Make a website and write somewhere in the middle of ToS that visitor must pay $1000 (for example) for every page viewed or for every second spent on a site
2. Persuade him to press "I have read and agree to the ToS" and to stay as long as possible
3. Send a bill
Click wrap is different and some may be considered binding.
(Caveat: IANAL)
X-Terms-of-Service: This HTTP request is subject to the terms of use published
at https://example.com/tos. By responding to this request you are accepting
these terms and conditions in full.[Edit: IANAL.]
I'm a little confused here. I'm with the EFF that violating the TOS shouldn't be criminal. But if you're given a C&D that says "stop using automated scripts" and you continue using automated scripts, why is the TOS relevant at all? Isn't Rimini clearly exceeding their authorized access (left available for manual downloads) based on the C&D?
Google probably violates this all the time with automated crawling (I've no doubt that there are sites without robots.txt, but with a written ToS that prohibits use of "automated scripts".
Importantly, Oracle didn't actually lock their account. And even more importantly, AFAIU this guy was an employee.
For these and some other technical reasons (I haven't read the case but likely part of it may be related to the jury instructions), the question to be answered by the court really comes down to whether violation of Terms of Service alone suffices to meet the "without authorization" prong of the criminal statute.
If the answer is no then the case goes back to trial. The defendant doesn't get a free pass, it's just that the prosecution will have a slightly higher burden to overcome in showing lack of authorization. Higher in the sense that the burden involves taking into consideration other factors than merely boilerplate policies and notices.
Another way to look at it is, say your boss tells you that you must leave the office at 5PM sharp, and that nobody is allowed to log into corporate accounts after 5PM. This policy is also displayed from /etc/motd everytime you login. You occasionally stay at work late some evenings, accessing the corporate accounts in a typical fashion. One day you're accused of doing something nefarious--maybe you were, maybe you weren't. Is your working after 5PM a prima facie showing that your access was unauthorized? That is, do all they have to show is that corporate policy was not to login at 5PM? Is it rebuttal? Does it matter whether your boss communicated this to you personally?
The way these legal tests work, at least in common law countries, is that you break the law down into predicates. For the law to apply, you must show that each predicate holds. Each predicate is it's own little universe. You don't take other predicates into account; there's often a separate predicate for intent and other overarching context. The predicate here is "without authorization". What does that mean? It's a tricker question than you'd think. And it can't merely mean whatever your boss intended--it has to be an objective standard that doesn't lead to absurd outcomes in the real world. Especially in criminal law, a crime can't turn on someone's subjective intent, except for the intent of the accused. Similarly, specifically in regards "without authorization" not even the accused's intent matters.
No, that's not all the CFAA cares about.
>(a)(2)(C) Whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer;
Thus my confusion. Why present the case as "without authorization" (based on the TOS) in the first place, when "exceed[ing] authorized access" (based on the C&D) seems like a much lower bar to clear and is less likely to provoke nonprofits complaining about precedent?
Recent case law has mostly struck down the CFAA criminal penalties for violating TOS. But case law generally imposes a higher obligation on employees to comply with authorized use agreements that they've signed.
If you concretely enumerate the authorized uses of employee access and leave out subpoenas, the first time you're served with a FISA letter you can keep the court busy for weeks pending a ruling on the CFAA consequences.
This will never work long term and it will certainly piss off some judges & FBI agents, but at least it can further defang the overzealous authorized use language in the CFAA.
The fact that the FBI (or whoever drafted the natl security letter) is inducing you to commit a felony may also trump the gag order. But YMMV with that argument. Even if you win that one on appeal you'll spend some time in jail in the interim.
The argument that it is a crime comes down to arguments around what constitutes 'unauthorised access'.
As 'unauthorised access' to a computer system is a crime, if you make your definition of 'authorised' "access subject to our terms of use" : Huzzah! Violating your terms of use is now a crime!
This all comes back to laws written in wooly "the courts will work it out" language.
Is it though? Not a lawyer and my layman's intuition makes it hard to see a connection between ToS and contract.
Like, if I type `something.com` in my browser by accident and their ToS is "you owe us $400 for each TCP packet, kindly do provide goverment issued ID". So I have couple of questions:
- How is that different from ToS on Facebook?
- How marking a checkbox creates a contract between a person and entity owning a site, same way as my signature or providing personal info, address and money to Amazon in exchange for goods?
- And who that person would even be in FB case (anyone can put my name into a website from a public library computer)?
I type 'something.com' and you owe me $400 for every IP packet you send. That's an equally valid (or invalid) ToS either.
you proceeded to argue the case the way he said it should be argued, but by quoting PP and challenging, you seem to be arguing with him, when in fact you are agreeing with him.
if you edit your comment, I could even delete mine :)
I don't think ToS should be able to be enforced either because it is unreasonable in today's society to assume checking that box in a sign-up process is actually giving informed consent to the terms for the wast majority of people. But even if it was, worst case it's a breach of contract.
So how to deal with abusive users then? Hand wave and say it is okay to block them for certain actions that are not terms of service?
And of course arbitrary terms of service already can't be enforced.
If you mean "abusive" as in hate crime, bullying, stalking and so forth, there are already specific laws covering those things.
To be honest I think all of this stems largely from gross incompetence/ignorance among the people responsible for this sort of legislation.
As long as you don't build this in a way that encourages people to mindlessly go through the list and click yes on all of them, I'd currently consider this, and nothing less, sufficient for informed consent.
You might, but it's doubtful that any court would.
For example, on a web site where you're taking real money in return for providing access to otherwise protected content, your terms and conditions would typically describe a contract, which the parties will enter into once you've offered those terms and your customer has accepted.
As such, the deal would be subject to the same safeguards as any other business-to-consumer contract. For example, here in the UK, there are some conditions that are automatically considered unfair and would not be enforceable, and for digital sales there is certain information you're required to provide at various stages in the purchase process or you risk the deal being challenged.
The flip side is that assuming your terms are reasonable and properly disclosed, they will normally be enforcible like any other B2C contract.
When I said arbitrary terms of service can't be enforced, I meant that the site owner won't have good luck trying to obligate users to do things (their typical response to a problem with the user will be limited to withholding access from the service). I wasn't very clear.
Once you realize that is a reasonable workflow you've realized how unenforceable TOS are for everything but corporate contracts where documents are being signed and witnessed.
Well I found a few flaws in their system and started racking up money way faster than should have been allowed. After a few days of this and hundreds in my account I got a phone call during dinner. It was ChaCha, threatening to sue me for 'hacking them'. The 180 they pulled when I casually mentioned I was only 15 was amazing to witness. They completely dropped the matter on a verbal agreement that I would not visit their site anymore.
As an operator your main interface to their system was a Java desktop application. Basically you sit there waiting for it to go 'ding!', you read the question, and accept if you think you're capable of answering. You would research (they heavily pushed their sources but Google was better about 100% of the time) and then communicate the answer back to the user using the application.
Once it was accepted the application would make an HTTP request to ChaCha's server to basically say 'A question was answered by this user'. This was easily visible using normal tools like Wireshark, etc. For your efforts you would be rewarded some very small amount of money, something like $.02.
I simply wrote a VB.NET application to hit this HTTP endpoint over and over again which would add money to my account without me doing any work. They didn't seem to be doing any verification that I had actually been given questions to answer.
The reason they noticed me was because I left ~8 instances of this program running for like 3 days straight which netted me hundreds of dollars ready to be cashed out, way more than any operator would be even remotely capable of normally given their pay scheme. So I was smart enough to figure this out but dumb enough to get caught almost immediately. And I'm not a lawyer but my guess is that this was considered fraud. Glad my morals eventually straightened out before I got myself in real trouble, honestly this was a decent lesson for 15 year old me.
And not a bad lesson for the company, either :)
(If you don't know what that is, just stay away)
Although it's an interesting story, it's worth remembering that you were probably just lucky here. I didn't notice where you were living at the time, but in most western legal systems you could certainly have got into real trouble under financial crime and/or computer misuse laws. Most likely, you weren't legally protected because you were 15, just practically protected because the company didn't want it on the record that it got outsmarted by a 15-year-old and/or because most 15-year-olds don't have enough assets to be worth suing for compensation.
For example, if Congress has a law making ToU violations crimes, then there should be a select few DAs who are required to go out and prosecute people who enable AdBlock and visit a certain site. And it should always start with legislators if possible. See how fast stupid laws go away.
"You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission."
Criminals go to jail.
That is the argument at least.
Note that this is rather hypothetical.
http://www.goodreads.com/quotes/341110-you-were-already-in-a...
The fact that they were making money off it - and ignored a request to stop - is probably the main difference between this and going after open-source projects. Its essentially taking customers away from Oracle's own support services.
It could have come down to simply an aggressive/abusive crawler affecting other customers?