Hacker News Reader

Comment by bryanrasmussen | Hacker News Reader

>I very much feel their ruling is correct. The CFAA is intended to target "hackers," not policy violations.

ok, but devil's advocate for a second - much hacking is actually just lying to people to get access to things you shouldn't have access to - so pretty much closer to policy violations than the stuff most people associate with 'hacking'

View on HN

That's fraud and it's always been illegal.

CFAA stands for "Computer Fraud and Abuse Act". The entire purpose of the law is that is addresses that type of fraud.

I believe this would still be covered by the first clause, the one not even being argued in this decision.

> Subsection (a)(2) specifies two distinct ways of obtaining information unlawfully—first, when an individual “accesses a computer without authorization,” §1030(a)(2), and second, when an individual “exceeds authorized access” by accessing a computer “with authorization” and then obtaining information he is “not entitled so to obtain,” §§1030(a)(2), (e)(6).

I fraudulently obtain and use credentials to a system which authorize another person to access it. I am still "accessing a computer without authorization", because those credentials never authorized me.

This starts to get really fuzzy if I fraudulently have credentials explicitly granted to me...

But let’s say you called someone on the phone and lied to them to gain access to a computer system, you committed wire fraud doing so. It’s just a different crime because the thing you did wrong involves lying on the phone.

If you obtain access using somebody else's credentials through fraud, YOU are not authorized. Thus you are violating the CFAA.

Obtaining access through fraud is fraud. Why do you need to morph one crime into another?

Think Breaking and Entering requires breakin. If someone gave you keys under false pretences, thats a different crime.

Reply on news.ycombinator.com