Is there a standard service that announces available services? If not, how do I know if I'm 'allowed' to use Google.com:80 ? Where is that fact delineated?
The CFAA requires knowingly exceeding authorized access or doing so intentionally. If, in fact, you don’t know access is unauthorized, you’re not liable for a CFAA violation. So you can go blissfully through life doing what you, in good faith, may reasonably guess the web site owner intends you to do. You don’t need the rules “deliniated” just like for any other kind of property.
However, there is what you say about what you knew, and what a jury may reasonably infer about what you knew. If you say you didn’t know accessing port 80 was unauthorized, the jury will probably buy it, because port 80 is expected to host publicly available web services. However, if you take a URL and start manually fiddling with numbers, and you see that it yields credit card information, the jury probably won’t believe you if you say you didn’t know that access was unauthorized.[1] Similarly if you access a resource, and the web site owner tells you not to do it, or bans your IP, now you know. CFAA prosecutions are almost invariably based on a scenario where it is abundantly clear that someone knew she wasn’t supposed to be doing what she was doing.
[1] But, say you’re accessing a page programatically and there is a bug in your code and you access some URL that yields credit card information, which you promptly delete because you are acting in good faith. There is no CFAA violation because you had neither knowledge or intent. And to my knowledge, nobody has been convicted of violating the CFAA in such a situation.
People on here talk all the time about how their digital possessions are just as important as their physical possessions (if not more-so). Given that it seems perfectly reasonable to have the same cultural norms about exploring digital spaces as physical ones.
If the owners don't want something public, it's trivial to lock it down--they might as well freak out when somebody uses the wrong door to enter the front of their shop.
Making a mistake doesn't relieve one of legal protection from trespass (physical or digital).
The protocol is relevant, because it conveys information. Just as unlocked doors generally indicate permission to access, unsecured HTTP generally indicates the same. But the protocol is only one piece of the puzzle. It is not dispositive. It does not conclusively decide rights and responsibilities. If a reasonable human would discern that the protocol allowing access was probably the result of a mistake rather than intent on the part of the property owner, that is what matters.
If I broadcast a request for an IPv4 address and your DHCP server proffers an IPv4 address that I can use for the next 15min, the address of a nameserver, and the address of a router that will forward packets to the global internet, I can reasonably conclude that you intended to allow me to exchange packets on your LAN and at least attempt to use your gateway to interact with the internet. On the other hand, depending on the situation, a "403 Forbidden" could reasonably be interpreted as a request to not send that type of HTTP request anymore.
The protocol isn't the only place to look for intent, but it absolutely does express intent in some situations.
Have I committed a crime? There were no doors, no locks, no signs to tell me that this area was restricted. Just because it wasn't on the map and may have not had a clearly marked entrance, doesn't mean that I should have known it was a restricted area.
Most criminal tresspass laws require at least clear signage or a previous communication, and even then, the area has to be clearly defined. You can't just wave your hand and say 'if you go over there, you're tresspassing'
There are some large(20,000+ acres) areas near me that are used as ATV playgrounds. The ATV riders are not authorized to be there, and the land owners have taken some steps to put up signs. They are not consistent or ubiquitious, and the properly lines are not clearly marked or identified. Being that the area is not surveyed, law enforcement is very reluctant to charge anyone with criminal tresspass because they can't even tell themselves where the legal property lines are.
Imagine trying to convince a jury beyond a reasonable doubt?
So this creates a bad situation where responsibly reporting security holes provides evidence that you knew the access was not authorized, regardless of your intent.
I don't think you actually believe what you're trying to argue here.
I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access.
Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?
Your intention. It matters.
Yes, it is reductio ad absurdum to question hitting port 80 on a public site. Work a little harder, though - what about port 8080? 6734? What if you monkey with the URL?
Note that there are people here claiming that the last bit is 'hacking' under the law, and in some cases they are right.
So now we can't change URLs without hacking, but only when doing so knowingly exceeds authorization. Well, what does that mean?
Let me offer an example: Someone uses the dumb disable-right-click Javascript to stop people from downloading their images. I disable JS and save an image. Put aside copyright and focus on the CFAA: Have I broken it? If so, does this seem to be the sort of thing that should be a felony to you?
That's why we have trials and juries and so on. 'Working a little harder' and trying to find trivial logical gotchas in law is a pointless thing to do and discuss because it's very much not how the legal system works. The law is not a program interpreted once by some literalist, implacable CPU.
The law has dealt with these kinds of things for hundreds of years. Intent matters.
The point I am making is about uncertainty before you get to a formal legal setting. Or is everything else you do in business do-first, hope you don't get busted later?
Legal uncertainty about edge cases is real, and a thing that dissuades people from doing thing things. Saying the law will figure it out is how we got here with the CFAA, not a solution to it.