Hacker News Reader

Comment by metayrnc | Hacker News Reader

> Amazon.com Services, LLC filed suit against Perplexity AI, Inc., an artificial intelligence company, asserting that Perplexity’s web browser tool, Comet, unlawfully accessed Amazon’s website in violation of the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA). Perplexity’s Comet browser includes an AI “Assistant” that, when activated by a user, navigates Amazon.com on the user’s behalf, sending browser screenshots to Perplexity’s servers for further instruction. Amazon claimed that this use of the Assistant, despite their explicit prohibition, amounted to unauthorized access to its servers.

View on HN

My understanding of the case law on this subject is that courts are extremely wary of letting terms of service violations rise to the level of federal crime. It essentially endows anyone with a domain name into an authority which can create federal law on demand.

Might be the only way to reign in the AI bots. By accessing my site with a bot, you agree to reimburse me for that data at the rate of $1,000,000 per character retrieved. Please contact licensing@domain to get set up with payment and access keys

And by linking to your site from other websites, by not requiring authenticated human-only login, and by not blocking traffic from all referrers, you agree to allow my bot to access you site at zero cost.

I have clearly communicated the constraints of use on my site using robots.txt, which is the established standard for communicating things like these. You are expected to fetch it and figure it out. It is not necessary to build walls and lock doors when a no trespassing sign is clearly visible.

Seriously, though, making robots.txt have the weight of law would be a massive improvement for the ecosystem in general.

and what happens when the perpetrator does not reside where that law can reach?

FYI:

https://enwp.org/Van_Buren_v._United_States

https://enwp.org/HiQ_Labs_v._LinkedIn

Yes, although the DoJ policy change reflecting still says civil liability might exist if a cease-and-desist is ignored: https://www.wsgr.com/en/insights/doj-acknowledges-limits-to-...

But didn’t Amazon cite laws that it broke (allegedly)? Not simply their ToS?

The CFAA makes it a federal offense to intentionally access a computer "without authorization" or "exceeding authorized access" so the sticky part is how far the site's ToS can go in defining what uses are authorized, lest it be a federal felony to use an ad blocker or whatever else might be forbidden in a ToS.

Illinois makes it a state crime to violate terms of service.

Sec. 17-51. Computer tampering. (a) A person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her: (1) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data; (2) Accesses or causes to be accessed a computer or any part thereof, a computer network, or a program or data, and obtains data or services; (a-10) For purposes of subsection (a), accessing a computer network is deemed to be with the authorization of a computer's owner if: (2) the owner authorizes the public to access the computer network and the person accessing the computer network complies with all terms or conditions for use of the computer network that are imposed by the owner;

That's pretty similar wording to the CFAA, which OP mentioned has been checked by case law.

Isn't this how every agent works these days? Apple and Google are working on tool calling for apps, but that's still going to be backstopped by screen scraping for years very likely.

It's a good bet that everybody's got equivalent CFAA boilerplate in their terms, so I guess all agentic automations are crimes now.

This is a civil case not a criminal one, and just because it is the same broad act does not mean courts apply it the same way in civil and criminal contexts.

And Amazon LOST at this stage in the linked appeal, with the 9th Circuit finding that they were not entitled to a preliminary injunction because they were unlikely to succeed on the “access” prong of the CFAA or CDAFA claim against Perplexity.

So, it is doubly weird to conclude “all agentic automations are crimes now” based on the case linked here.

Reply on news.ycombinator.com