Maybe they used graphql and their api expectantly allowed access to data that it shouldn't of had access too?
[0] - https://www.techdirt.com/2013/09/30/dojs-insane-argument-aga...
I am unaware of any case going to trial using that interpretation of the CFAA since, though.
Which interpretation would that be? That unauthorized access is illegal?
When the access is freely given out without any subterfuge, it's not my job to self-enforce my best guess at what my access level should have been.
In this case, it would be like going through the UI and trying to access the record and getting denied because of a client side access block, so you make a direct call to the backend instead to retrieve the record. You’re making a perfectly legitimate HTTP request but for something you know you shouldn’t be able to access: illegal.
Personally, I would not bet my freedom on that assumption.
CFAA covers unauthorized access to protected computers, not piles of records on park benches.
And "protected computer" is basically all computers. Imagine if the records were on a kindle; that shouldn't change the legality and if the CFAA does so that's a bad thing.
Is it really though? What harm may come from legislation preventing you from rifling through somebody’s phone that they left on a park bench?
I’m not saying CFAA isn’t problematic, but I’m very unconvinced that this is the problematic part.
A public web server doesn't have such direct privacy issues.
When it comes to records on a bench vs. a non-personal kindle on a bench, I think they should have equal and low protection. Abusing the data should face penalties, but not poking around.
I don’t see any obvious reason as to why this should be allowed, but it’s trivial to come up with a whole plethora of reasons for why you shouldn’t be allowed to poke around such devices.
Was it alleged that judyrecords had mens rea?
https://www.law.cornell.edu/wex/mens_rea
The [Model Penal Code (MPC)] and Mens Rea
Most states use the MPC's classification for various mentes reae. The MPC organizes and defines culpable states of mind into four hierarchical categories:
1. acting purposely - the defendant had an underlying conscious object to act
2. acting knowingly - the defendant is practically certain that the conduct will cause a particular result
3. acting recklessly - The defendant consciously disregarded a substantial and unjustified risk
4. acting negligently - The defendant was not aware of the risk, but should have been aware of the risk
Some have expanded the MPC classification to include a fifth state of mind: "strict liability." Strict liability crimes do not require a guilty state of mind.
Not as far as I know. That's my point. They did not intend to illegally publish records, which makes it very different from weev's case.
Hackers love to think that they’re captain Kirk outsmarting the computer, but real life isn’t Star Trek and judges are very much humans and don’t look kindly on such stunts.
A reasonable person would know that you aren’t authorized to dump AT&Ts customer database by incrementing an integer on their site.
Or I guess I can just start up a website at "youre-unauthorized.com", so a every reasonable person is duly noticed that they aren't authorized to see it, put my secrets there, set the web server to allow access to all requests everywhere, and then file a criminal complaint on everyone who accesses my secrets that I put out in public.
A reasonable person knows intuitively that only crime committed was that of embarrassing the rich and/or well connected.
That's obviously true under some formulations, but it doesn't matter, because they won't be on trial. The person who performed the unauthorized access will be.
> A reasonable person knows intuitively that only crime committed was that of embarrassing the rich and/or well connected.
I consider myself a reasonable person and I'm perfectly happy to have unauthorized access punishable under the law. I value the fact that society takes an onion-like approach to information security. There are incentives for private organizations to secure data, but when they fail to, the risk of criminal sanctions probably prevent some breaches that would otherwise occur. I also do not value the ability to look at computer systems on an unauthorized basis -- i.e. I do not think it brings any value to society -- so by my lights, I lose nothing by it being illegal.
Not only that, but despite what views borderline-ASD hackers might hold, courts do make decisions about vague things like “intent” on a daily basis.
A reasonable person might fail to properly lock their door. Try that defense in front of a judge, odds are you’ll end up in prison.
> Not only was the organization so derelict in their affairs that they failed to protect sensitive customer data, they didn't even notice the "crime" had taken place
None of this would reduce the intruders liability. Perhaps the company should be tried separately for their failure to protect customer data, but that’s a different issue.
It means that the stakeholders of the system, normally its owners, do not mean for you to have access. Here's one way you can estimate whether the owners intend that you should have access:
Imagine an in-person conversation with the owner or controller of the data, or their most knowledgeable representative. If you asked them verbally whether you may access the data, and they said "no," then you "shouldn't" have access to the data.
> If you are granted access to a valid request then what other interpretation can there be . . .
See above. This is also the interpretation that will be relevant in court if you are sued or arrested, so mark it carefully.
Intent matters, weev knew his access wasn’t authorized. Judyrecords didn’t know they were accessing non-public data by incrementing the integer, weev did.
It’s not. How (and if) the door is locked makes no difference whatsoever.