Hacker News Reader

Comment by paxys | Hacker News Reader

Interesting that AA frames it as TPG's app stealing confidential customer data, while it is the customer who set up the app and willingly provided their credentials in the first place.

Will AA be able to find a single customer who has a problem with what TPG does? What is their case then exactly? Would they similarly sue the app if customers were copy pasting data into it, rather than accessing it programmatically?

FYI the title is editorialized. This suit has nothing to do with screen scraping, but just data access in general. Services like these nowadays almost always use private APIs (built for mobile clients and SPAs) rather than parse HTML.

View on HN

> What is their case then exactly?

Speculating, but TOS generally say that you're not allowed to share your password with anyone. Assuming that's true for the AA site, AA might argue that TPG is encouraging users to break their TOS ("tortious interference").

Though if app doesn't actually share the password with TPG and just uses it locally there may well be a question of whether entering your password into a third-party app actually counts as sharing it with that party. How exactly would this be different logging in from a web browser? It's just a different kind of user agent. Are Google, Mozilla, Microsoft, and Apple guilty of tortious interference simply because the software they release has access to your passwords on your own machine and could report them back? (For that matter, they even store the synced passwords on their servers, though in principle those are supposed to be private.)

Of course there could also be specific terms in the TOS against accessing the service with unapproved user agents, independent of any prohibition on sharing credentials.

RIP password managers then, I guess

Yes. And iCloud-based Safari-storage of passwords for all iPhone users.

And every piece of financial software that does anything with your banking information.

I doubt that part of a TOS is enforceable as it restricts speech.

edit: No it doesn't, brain fart.

> I doubt that part of a TOS is enforceable as it restricts speech.

Contractual restrictions on speech are enforceable.

For a simpler example, think of NDAs

What law says someone can't restrict free speech?

American Airlines is alleging 12 legal claims:

1. Breach of Contract 2. Tortious Interference with a Contract 3. Unfair Competition by Misappropriation 4. Trespass 5. Trademark infringement 6. Dilution 7. Dilution under Texas State Law 8. False Designation of Origin 9. Copyright Infringement 10. CFAA 11. Violation of Texas Harmful Access by Computer Act 12. Unjust Enrichment

Curious how Breach of Contract can fly, considering TPG never agreed to a contract with AA to begin with. And AA is obviously not suing their own customers.

There's a ToS, which is a contract.

From the AA website: "By logging in, you accept the AAdvantage terms and conditions"

Yeah, but it would seem that the points guy ISN'T logging in. The AA customers are logging in using a tool provided by TPG.

Do you think TPG has never logged into AA during the development of this tool?

> but it would seem that the points guy ISN'T logging in. The AA customers are logging in using a tool provided by TPG.

AA provides a number of arguments against that. That's part of the dispute.

> Curious how Breach of Contract can fly, considering TPG never agreed to a contract with AA to begin with

AA presents an argument for the ToS binding TPG as a party.

IMO it would serve the common person well if we changed the way the law works so that if a corporation sues you for a laundry list of things, if a single claim gets thrown out, then they all do. That prevents this insane pile-on where a half-afternoon's work by 4 people in their giant legal department turns into a multi-year nightmare for an average citizen. I think that would be a fair way to reign in the corporate "throw everything at the wall, see what sticks, or at least hope we intimidate this regular Joe into submission" approach that's all too common today.

Meh, Red Ventures' estimated $11 billion valuation is slightly more than AA's market cap.

Then they would just send you 12 consecutive lawsuits. If they're that big and well-funded, they've got the time.

But can't they still do that right now? So parents proposal would make the situation a tiny bit better?

Judges, courts, and basically everyone (including most defendants) would rather have one hearing than 12.

Generally no. The reason you see a 12 claim filing is because they don't get unlimited do overs. You get some chances to amend the complaint, but once it starts moving forward, that's it.

That also happens when county prosecutors are up for re-election. Stack charges in case the jury finds one claim weak, there are 5 synonyms for the same underlying crime that the jury is willing to convict on. Also helps with forcing plea bargains.

While I agree with sentiment, I don't agree with the premise or the method. Corporations aren't the only ones stacking charges. Prosecutors and private citizens (usually operating pro se) are just as capable of frivolous litigation. The best action a judge can and should take is to dismiss the meritless claims before proceed to court phase.

Some of these are serious, like the CFAA claim, some are genuinely hilarious. Dilution? Really? Unfair competition? Are they accusing TPG of creating an airline?

> Speculating, but TOS generally say that you're not allowed to share your password with anyone. Assuming that's true for the AA site, AA might argue that TPG is encouraging users to break their TOS ("tortious interference").

They specifically claim it's presenting something that is intentionally confusingly similar to an official AA logon screen using copyrighted and trademarked AA content to harvest customer username and password info, does not prominently note it's nonaffiliation with AA, and directly violates the TOS itself, as well as arguing tortious interference, copyright infringement, trademark infringement, trademark dilution, and violation of the CFAA and the Texas equivalent.

They also note a similar dispute settled with a separate firm owned by the same parent before TPG tried to negotiate a deal with AA for permission to access customer data for this purpose and was turned down.

So I wonder what if any legal difference there would be if TPG was only providing a web app that runs in the browser.

Also, would there be any legal difference if they wrote a browser plug-in/extension that provides additional information while you're logged into AA's site?

What if their plug-in advertises for competitors or defames AA or navigates the user immediately away? It's hard to argue it is still a browser/user-agent if it changes or editorializes somebody else's content beyond a certain point.

> What is their case then exactly?

That they're stealing AA's opportunity for, ahem, "customer engagement".

They may have a case for tortious interference, I think? It does seem like an uphill climb. The strategy might just be to punish TPG with attorneys' fees and discourage this practice in the future.

Every similar case that has been litigated has been about wholesale copying of a large amount of content (e.g. millions of LinkedIn profiles, Craigslist listings, flight prices).

In this case an individual customer authorized the access and only their data was affected. This is a pretty common use case for a large category of apps – think Mint, Plaid, all wallet apps which organize and track different accounts.

So basically corporations don‘t even pretend like they grasp the idea, that you pwn your data. It is theirs. You can use it, give it to companies, to the government, but you are not allowed to destroy it (just like currencies in many countries). LOL.

Edit: typo. I wrote „pwn“ instead of „own“. But then I thought about it and somehow it feels appropriate.

Tangent: pwn is always a misspelling of own. Granted, intentional meme usage is almost entirely limited to the "conquer" metaphor, but unintentional usage wouldn't have that same restriction/implication.

I don’t this matters, from a legal standpoint.

The issue isn’t whether or not it’s what the customers wanted. The issue is that TPG wasn’t the party that entered into the agreement with AA when creating the account.

I’m not suggesting it’s right or wrong, but that’s the issue.

If I authorize an agent to act on my behalf in a particular way wouldn't they be considered and authorized as me? If I make a contract with Bob to mow my lawn, it's not like Bob's workers or employees have to sign the contract too. TPG shouldn't need to be party to the contract to be an agent of one of the contracted parties.

How does that logic apply to people that sublet rental spaces ?

Some leases specify that sub letting is not allowed and doing some would put the original tenant in breach of the lease agreement.

I'd even say most leases vs some, especially regarding residential. Buying a house for the purposes of renting requires different financing (although most are being bought for cash) than a typical homeowner's financing which has clauses that says the person receiving the financing will use the address as their primary residence.

These things get ridiculously specific.

Subletting isn't an agency relationship. It's not like tenants provide a service to landlords by occupying the property as well as paying rent.

Also, the law around real property including leases is different and more involved than straightforward contractual relationships.

What happens if you hire someone to be your agent at your job?

They should arbitrage the difference between our pay to replace me and get me fired.

Typically, aren't new contracts drawn up so that the person you hired is recognized on the other end as well?

That's how a temp agency works, no? You hire the agency because you need a worker for a short term job, and the agency will in turn hire a temp worker to actually do the job.

But if TPG is an agent of the customer, then AA should be suing the customer. As said above, TPG isn’t subject to the TOS because they aren’t the ones who agreed to them. So, it’s the user that is misusing AAs data. But they don’t want to sue their customers (and in particular each customer individually, because I’m sure there is a no-class-action clause)…

So here we are. It should be fascinating to see where this goes.

But if TPG is an agent of the customer, then AA should be suing the customer.

As the great Professor Hecker repeated so often in Business Associations - “The tortfeasor is always liable.” E.g. when you get hit by the Dominoes delivery driver, you can sue the delivery driver.

I was just looking at this in the context of the Rogel Aguilera-Mederos (110 year sentence) truck-crash case the other week. IANAL, but as I understand it there's a legal concept called "respondeat superior" and the "McHaffie Rule" that may complicate that assertion. A lawyer could and probably would stomp me on this description, naturally.

Respondeat superior means the employer is also liable, not solely liable. Again, the tortfeasor is always liable. Iaal.

> But if TPG is an agent of the customer, then AA should be suing the customer.

Respondeat superior lets you sue the principal for torts of an agent committed in the scope of their agency, but it doesn't eliminate the liability of the agent for their own torts.

You typically want to sue the principal when the agent is less able to pay, less willing to settle, or one of many easily replaceable agents employed by the principal for the same purpose.

When the first and third of those are reversed and the second is unclear (which seems to be the case here), you want to focus on the agent. You could sue the multitude of principals, too, but that's just a lot more cost for little additional benefit (and possibly sympathy backfire in a jury trial.)

And here's me, all idealistic, thinking that decisions on who to sue should be about the merits of the complaint, rather than "who has the potential to give me the most money".

Civil lawsuits are a means of dealing with a problem, mainly by recovering losses (via damages) but also sometimes by imposing other legal compulsion (equitable relief).

“how does filing a lawsuit against this party improve my expected resolution to whatever problem motivated the lawsuit, and is that worth the added cost of pursuing that party” should be part of your calculus. That's not to say the merits of the case don't figure in, but a meritorious case against someone who even the best possible outcome won't do anything to improve your condition is just a way to waste your money and time, and the courts.

AA and all other US airlines argue that information about your customer account is part of a data set that belongs to them, so they set the terms by which the data may be accessed. It's in their terms of service. This isn't particularly unique to airlines either.

Can a company write "Chrome is not allowed to access this website" in their terms of service and then sue Google when customers still use it?

They could (conceivably) if Google touted using their browser to access said website despite all this, especially if Google derived some benefit from it. It may well not come down to making available a tool, but to knowingly encouraging the breaking of ToS (assuming it's valid in the first place).

Someone else gave a decent answer to your question, but I’m not sure that’s this situation. TPG is scraping AA and then displaying the results in TPG’s app. There’s an http request being sent by a TPG computer and IP address to AA. I think that’s a relevant distinction. I also think that’s relevant to whether TPG is a party to the AA TOS.

I don't think that's an important distinction. TPG could be doing everything locally on the user's device (maybe they are?) and AA's complaint would be no different.

What about ICloud plus Prody then? It comes from Apple’s servers. Add Safari reader on top of it and I think it becomes similar.

Move Reader to iCloud proxy and I think it becomes almost identical?

That should simply not be enforceable, period. If we had any consumer advocacy in government in the US, this BS would have never even come up.

The US was formed under the premises that adults have the right to make their own decisions - good and bad, and that adults are the masters of their own property.

I think these principles have served us pretty well despite the violations of human dignity like not being able to check your AA points from the TPG app.

At the same time, doesn't AA have the right to protect themselves from potential abuse? I don't have a problem at all saying that I'm not supposed to share my credentials with 3rd parties. The user has no control over what the 3rd party might do, and can only make that decision based on what they think they are going to be doing.

> The US was formed under the premises that adults have the right to make their own decisions - good and bad, and that adults are the masters of their own property.

Yes, and AA servers, copyrights, and trademarks are all, under the law, it's property, of which it is master.

That's kind of the whole basis of the lawsuit.

> Interesting that AA frames it as TPG's app stealing confidential customer data, while it is the customer who set up the app and willingly provided their credentials in the first place.

They think the data belongs to them. They think they own the consumers and all the data they generate. To them, it's their consumer data, something they abuse to get consumers to log in and look at ads, and they'll be damned if they let some random software have access to it no matter what the user wants.

GDPR makes it clear that personal data belongs to the person, these companies are just middle men who are temporarily processing it. Cases like this perfectly illustrate why such a change in perspective is necessary. Access to this data is a privilege and it can be revoked.

>We already make $1,000s per customer on a business model that we have developed and refined for decades.

>Let's create a crappy experience that the user has to put up with, to squeeze a few extra cents per year.

Never underestimate the greed of these people. They'd literally put ads under our eyelids if they could. They'd put ads in our dreams. They see our moments of peace as an opportunity to get richer.

Reply on news.ycombinator.com