Looks like it's offered only to "critical infrastructure organizations".

> is getting an early notification whenever a server goes "online" on the internet.

Please elaborate.

> I think it's illegal under the Computer Fraud and Abuse act.

Things that are illegal for individuals to do aren't necessarily illegal for governments to do. This is a reason why the government should be vigorously doing this, rather than leaving it to private citizens, who risk being charged under the Computer Fraud and Abuse Act.

-----

> Also, what should the government do when it finds something?

It should contact the site operator.

-----

> What if the site operators are unresponsive or cannot be contacted?

I would imagine that in the case that site operators couldn't be contacted, they wouldn't be contacted.

> What if the site operators are unresponsive or cannot be contacted?

This seems like only a minor problem. If people are unresponsive, then oh well, they tried to tell you you're hacked. If the site owner cannot be determined, they can email your ISP. This seems to work well for "one of your customers is torrenting movies", and since every ISP is known by definition (thanks, IP addresses), it should be fairly straightforward to get that message to the actual customer. (Send it with the invoice; if the customer doesn't pay invoices, then it's easy to resolve the hacked site. You were shutting them off anyway.)

Everything's illegal under the CFAA. It's an old bad overreaching law that should be repealed. The government rarely prosecutes itself though, so that's no reason why. Unfortunately, the culture in the US is such that the populace would freak out if the government tried to do such a thing, never mind practical surmountable issues.

The way I read the article, they're actually collecting vulnerability information. So they check a site with Version X running on it, and detect the vuln; then they later see Version Y, without the vuln, and update their vulnerability database.

Nothing in the article suggests that they contact site-owners (I haven't re-read the article, so might be wrong).

I'm not sure why you think it's a potential violation of CFAA to connect to a public server and probe it. There's no suggestion of unauthorized access; that would involve exploiting vulnerabilities they find, and that would be unauthorized access.

Something tells me that even with the somewhat stretched version of extraterritoriality that the US claims about laws like CFAA, they wouldn't try applying that to their closest intelligence/defence partner country operating largely domestically...

Does CFAA restrict government interactions?

If the site operators are unresponsive then that sucks, but it would still help secure those that are responsive.

I mean... They could at least ty to contact the operator.

I would be surprised if this was the result of active scanning. It's more likely the FBI received a report from someone, and just forwarded it along.

I don’t know if copy right protection is the same as penetration testing.