EFF to Supreme Court: Violating Terms of Service Isn’t a Crime Under the CFAA | Hacker News Reader

EFF to Supreme Court: Violating Terms of Service Isn’t a Crime Under the CFAA

eff.org

119 pointsJarred29 comments

Good. It's hard to think of any other cases / examples where breaching a service contract which doesn't also lead to a crime is directly punishable under a statute.

I suppose it would be like the manufacturer of a blowtorch saying "this can only be used to blowtorch X,Y and Z" and then calling the Feds on you for using it to toast the tops of your creme brulee.

Or you tuning a pressure washer up to a higher than agreed upon pressure and discovering that there's some flaw in a component. You may have lost the warranty, but haven't broken a law.

But even those aren't great analogies

We had a bad user who we kept banning for harassing other users. He would come back over and over again, using different pictures, IPs, even throwaway phone numbers or FB accounts etc. We ended up stopping him by involving a lawyer who drafted a letter invoking the CFAA. But it revolved around him violating our terms of service (eg no harassment, banned users are banned forever etc.)

Anybody know: Would CFAA still apply here if EFF wins this case? Or are there any other laws which would cover this kind of unauthorized access?

Thanks!

They can probably be prosecuted for the Harassment, which is a crime. IANAL but if you offer free automated signups with any email address it seems like invoking the CFAA is a stretch, as you aren't really taking steps to secure the system in the first place. The CFAA would be more appropriate if they are cracking admin accounts and getting into the back-end.

It seems like any harassment complaint would have to be raised by the victims directly rather than by us, the service provider. In practice they just leave the site and never come back.

So what would the recourse be in this case for a bad actor? How about for one who generates dozens of accounts every day and spams others?

> Would CFAA still apply here if EFF wins this case?

I hope not! What you described here is a great example of why EFF should win this case. Violating ToS is not and _should not_ be cause for civil or criminal action. If you don't want this user on your service, then remove them. If they continually violate your ToS and it results in damages or losses, then perhaps you have a more reasonable civil case than one invoking CFAA, but IANAL.

Thanks - I feel like there should be something to legally strong-arm banned users into staying away. CFAA is one of the most direct: “I have banned you from my site and you keep coming back so I will take you to court to make you stop”. For those users we don’t really want to get damages from them as much as we just really want to never have to deal with them again. I’d even be fine with a restraining order Against the person using the site kind of thing as the maximal punishment.

If it were a physical store and you kicked someone out for bad behavior and then they kept coming back by wearing different wigs or something, it would still be illegal.

>> Or are there any other laws which would cover this kind of unauthorized access?

Here's the thing. Violating terms of service and unauthorized access are two different things. Your site apparently is publically accessible and anyone can create a fake user profile. You are not vetting anyone or granting any specific person access.

I mean they would log in with FB, through a VPN, then verify a phone number which was usually some throwaway. I am not sure how we could be more strict short of asking all of our users for pictures of their IDs. We were explicit with the user that they were banned and not allowed on the site anymore. I wonder how we would have made sure that user never returned.

If you were a local corner store and you had a disruptive customer who returned repeatedly, your recourse would be calling the cops for trespass.

CFAA violations come with 5-10 year prison sentences per violation. A little extreme for a trespasser whose conduct is otherwise non-criminal, don't you think?

Definitely extreme - ideally I would want something like a "restraining order" against the disruptive user that legally compels them to no longer use the website. If they still break that, then probably fines+damages of some kind. But you know, something.

The other extreme which some people are advocating "let the users do whatever the hell they want and it's your own fault if they keep spoofing fb accounts/phone numbers and creating new accounts" I find pretty bad and tone-deaf; it gives carte blanche to bad behavior. Any malicious user who is set on messing with you becomes a full-time job to deal with. Most people who run some kind of B2C website have run into this and once you hit 1M+ users you are bound to be dealing with a handful of those at any one time.

I wish FB would report when an account was established. I could ask for access to the user's postings and try to get dates on those, but that seems too intrusive. I would just like to be able to say, "Thanks for trying to sign up, but you've only had this account for 15 minutes and I don't trust you. Come back in a year when you look less like a troll."

That's hardly a perfect filter, of course, but I think there's a use case for communities that err on the side of stability over the broadest audience.

Thanks I agree. We thought the same and nowadays we look through the photo upload dates to get an estimate of when it was created. It was somewhat helpful.

Yes! Let's make sure in the memory of Aaron Schwartz and the many others who have faced undue scrutiny under CFAA that we see drastic reform of this draconian law and how it is applied.

Aaron Swartz http://www.aaronsw.com/

EDIT: why was this downvoted? Is there a different Aaron "Schwartz" or did the parent misspell Swartz?

No, you got it right. Schwartz is a misspelling.

Thanks for the correction! Apologies for my gross oversight.

And if someone wants an account of the entire case, here's a must-watch documentary, especially if you belong to the hacker culture: https://www.youtube.com/watch?v=9vz06QO3UkQ

Sorry, how does an amicus brief do anything approaching that whatsoever? Seems more immediately like a useful way to get people to hit the red donate button.

Reply on news.ycombinator.com