That's my understanding at least - am I in the wrong here?
This isn't about data ownership but about computer ownership. If you're going to access Facebook's servers, then you need to do so in a way that complies with Facebook's rules. Power Ventures ignored robots.txt, and circumvented an IP address block. In concept, this is no different than bypassing the password of a password protected web site.
That said, I'm with the EFF on this one.
I think that argument holds as much water as Facebook's, if not more so.
For an analogy to the real world, think about lockpicking. Lockpicking should be legal. Picking locks isn't the real crime; it's theft, trespassing, destruction of property, etc. that we should prosecute.
In this case users authorized Power Ventures to access their Facebook accounts (in exactly the same way users authorize Facebook to access their GMail/Hotmail/etc. accounts), so no actual crime was committed after circumventing the access controls.
Then, when the user has Power perform automated access, Facebook claims that a criminal law violation has occurred, because that's unauthorized access under their terms. They want that to be treated just like other California Penal Code unauthorized access -- access like exploiting a bug or stealing someone's password to view or change info never intended for you.
EFF says only a contractual violation has occurred; violating some arbitrary company-chosen 'terms of use' shouldn't be enough to trigger criminal enforcement.
It's an interesting and difficult distinction. So many of these systems and terms are defined by the arbitrary choices of coders and lawyers. At one level of abstraction, it's against the will of the system provider -- Facebook -- so it could be seen like a break-in.
But at another level, it's just a contract, and Facebook has other contract-enforcement options short of criminal prosecution: cancel the account, sue for actual damages, and so forth. If Facebook can define what's a 'crime' via arbitrary clickthrough terms, suddenly users and Power staff could wind up in jail for a terms-of-use violation that had no other economic damages.
So the issues are tricky, but important.
Under Facebook's claims, people could get arrested for something as small as using a browser or operating system that Facebook didn't like. If this idea is accepted, then Facebook can pretty much say anything and if you violate that thing and then access Facebook, Facebook would seek criminal penalties for your violation. For instance, if Facebook says "no person that doesn't own a pair of Nikes can access Facebook, under our new Nike sponsorship deal", and someone who doesn't own Nikes still accesses Facebook, Facebook would consider this "unauthorized access" and get mad. Or, if Facebook decides it doesn't like born in Florida, and they write "No one born in Florida may access Facebook", and you still access Facebook after being born in Florida, Facebook will try to get the police to come and arrest you.
Open Graph API is not unauthorized access because Facebook allows people to use it.
Under Facebook's terms, you could retrieve some Facebook pages from your cache, write a parser to parse your data and use it to harvest your data to a CSV file, and even this would be a violation.
The clause in question currently says:
You will not collect users' content or information, or otherwise access Facebook, using automated means (such as harvesting bots, robots, spiders, or scrapers) without our permission.
So Facebook can give permission, and clearly have given permission via some interfaces.
If Power could have done everything they wanted to do via the official developer APIs, no doubt the case would be different.
Power continued even after Facebook asked them to stop (and further tried to block Power's IPs) -- so at least some of the access occurred when permission, if any, was clearly not given.
But is that a crime? Or a contractual violation or tort?
But isn't this viewpoint stark raving mad?
I believe an exception is if you've posted "NO TRESPASSING" signs, making it clear that it's private property to which all entry is prohibited. But if you've invited the general public in subject to conditions, and someone violates a condition, they haven't yet committed a crime, unless they also refuse to leave when you try to eject them.
In Facebook's case, I'd say they've invited the general public to use their service, subject to some conditions, and so no law should be involved unless they've specifically asked the person involved to stop using their service and the person continues anyway.
You're wrong because Facebook has the money and will to sue you into poverty. :)
The devil's advocate argument is that you don't own the data, you uploaded it to Facebook to use in a limited capacity (e.g. they're not allowed to just broadcast it to the world without your permission or unless they trick you into exposing it with weird 'privacy' options).
To use their service, which happens to use data you gave them willingly, you need to access their server in a manner they are happy with. And they are claiming that using a third party option to access it is forbidden. This is perfectly normal.
In essence this is the EFF trying to establish some ground in a new field. It's nowhere near as cut and dry as they present it, you had the choice to never upload that data in the first place. It's not a safety deposit box where you own the contents, it's a online social site that you chose to use and provide some data in order to be able to use it.
I've got no legal expertise, but that would be my first attempt as a devil's advocate.
But the natural way people think about their personal information is that they own it. This needs to be codified into law. Perhaps activism along these lines is one of the most important things we should be doing as citizens of a digital age?
If you keep data on your local machine and facebook comes and takes it from you, that's a problem. But if you voluntarily send it to them, then they're going to do whatever they want with it. How else would you expect it to work?
All we're asking is for symmetry. If I send them data, they can do whatever they want with it inside the law, their ToS and privacy policy. If they send me data (even the data I previously sent them), I can do whatever I want with it inside the law.
> I would say that it ceased to be "your" data once you
> typed it into facebook. Common sense should say that
> anything you send to a remote server is no longer under
> your control. I don't understand what the other side
> of this issue is.
Now, one should probably act as if handing their data to one person was like handing it to the world, but there are obviously limits. If I purchase hosting from a company and host my data 'myself,' does my data now belong to the hosting company?
> If you keep data on your local machine and facebook comes
> and takes it from you, that's a problem. But if you
> voluntarily send it to them, then they're going to do
> whatever they want with it. How else would you expect it
> to work?