It's Your Data, It's Your Bot: It's Not A Crime

When everyone is a lawbreaker selective enforcement gives law enforcement tremendous power beyond what's written in the law. A similar situation applies to contracts, and contracts for software and services are so impenetrable these days that you're bound to be violating something or other just in everyday use.

Take, for example, the standard UK limitation of liability cut-and-paste block. (About half a page.)

It's that long because there is case history on each point suggesting that if you don't enumerate each of those the conditions separately then you may get nailed for it. And every time there's a new test case that isn't quite covered, the list gets longer.

The only way to correct that kind of mess is through legislation. And there are so many examples of that kind of crufty-for-a-good-reason language that the patchwork would take years to unravel and have many unexpected consequences (not to mention lots of uncertainty until five hundred years of new case law was established).

There are people working on this kind of thing (for example the new companies act, which makes incorporation documents much simpler and removes some of the 'peppercorn and two groats must be thrice weekly burned over a blue flame' anachronisms) but it takes time.

Of course, facebook would not prosecute you, but this is not the point. Facebook has been going after services that make it easier to delete your account, or move information to another service. This is what FB does not like.

Of course, what they are doing is completely disgusting, but facebook seems to be able to do whatever they want, and their users do not mind, as long as they don't change the profile screen too much. Then there is an uproar.

You're wrong because Facebook has the money and will to sue you into poverty. :)

The devil's advocate argument is that you don't own the data, you uploaded it to Facebook to use in a limited capacity (e.g. they're not allowed to just broadcast it to the world without your permission or unless they trick you into exposing it with weird 'privacy' options).

To use their service, which happens to use data you gave them willingly, you need to access their server in a manner they are happy with. And they are claiming that using a third party option to access it is forbidden. This is perfectly normal.

In essence this is the EFF trying to establish some ground in a new field. It's nowhere near as cut and dry as they present it, you had the choice to never upload that data in the first place. It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it.

I've got no legal expertise, but that would be my first attempt as a devil's advocate.

This isn't about data ownership but about computer ownership. If you're going to access Facebook's servers, then you need to do so in a way that complies with Facebook's rules. Power Ventures ignored robots.txt, and circumvented an IP address block. In concept, this is no different than bypassing the password of a password protected web site.

That said, I'm with the EFF on this one.

Then, when the user has Power perform automated access, Facebook claims that a criminal law violation has occurred, because that's unauthorized access under their terms. They want that to be treated just like other California Penal Code unauthorized access -- access like exploiting a bug or stealing someone's password to view or change info never intended for you.

EFF says only a contractual violation has occurred; violating some arbitrary company-chosen 'terms of use' shouldn't be enough to trigger criminal enforcement.

It's an interesting and difficult distinction. So many of these systems and terms are defined by the arbitrary choices of coders and lawyers. At one level of abstraction, it's against the will of the system provider -- Facebook -- so it could be seen like a break-in.

But at another level, it's just a contract, and Facebook has other contract-enforcement options short of criminal prosecution: cancel the account, sue for actual damages, and so forth. If Facebook can define what's a 'crime' via arbitrary clickthrough terms, suddenly users and Power staff could wind up in jail for a terms-of-use violation that had no other economic damages.

So the issues are tricky, but important.

If you keep data on your local machine and facebook comes and takes it from you, that's a problem. But if you voluntarily send it to them, then they're going to do whatever they want with it. How else would you expect it to work?

A competitor would never gain enough traction to reach critical mass (defined as when the average person has an account on both) without some help from facebook in the form of a stupid business decision. Or if they managed to think of some killer feature.

But simply a copy will never work.

And BTW, the main reason you hate facebook is because they are big. So adding a competitor will not help you - eventually they will get big too, and you will hate them as well.

a) They are going after the third party, not the people that gave them their passwords, and

b) I believe Facebook also harvest passwords for other sites (hotmail etc)

c) In practice, there's not much difference between "Nobody can create a service that uses user's passwords to automate their Facebook access" and "You can't use any automated processes to access Facebook".