By setting that up, you take on the liability for it. The defendant is whoever set it up. No different from "if I roll a car down a hill and it hits something at the bottom, how can you hold the car liable?"
> No different from "if I roll a car down a hill and it hits something at the bottom, how can you hold the car liable?"
That's the difference between criminal and civil justice. You don't need to sign a law for it to bind you, but for contracts you do.
But terms of service are contracts which you sign by agreeing.
Courts have looked somewhat favorably on "I didn't read that" defenses, but accepting the agreement is a legal contract between you and the service provider.
The authentication mechanisms used by websites don't have a specific legal power, it's just a POST request among other GET requests sent during scraping. And we have jurisprudence saying scrapping is legal no matter what the ToS of the website says, because the scraping entity never signed up the contract.
The only protection against scrapping that auth is giving you isn't a legal one, it's a technical one (you can detect and ban the scraping user account).
Patently false: https://en.wikipedia.org/wiki/Implied-in-fact_contract