Until Today, If You Were 17, It Could Have Been Illegal To Read Seventeen.com
eff.org
eff.org
"200 OK" = You just gave me irrevocable permission.
Or you know, if anyone sues you for copyright infringement, you should sue them back for hacking, since you obviously put the following in your terms of service "you may not access this site if you sue me in the future".
This isn't a hugely well thought through idea.
If you can't use HTTP status codes properly, then you simply aren't in a position to subjectively characterize someone's request as impermissible/unauthorized. This is especially the case when the server's choice to grant access conflicts with your intentions.
Actually Telenor in Norway recently sold a few hundred tablets for 1,- kr a piece 16 cents US, and this without a contract. First they said, no, no, no, it was a mistake in our computer system, but they ended up having to sell them anyway because they would have such a hard time proving that every one of the customers knew well and right that there must be a mistake.
Anyway special case scenarios would never be covered by your server saying 200 OK.
However, day to day scenarios would. If your server gives people access to a file, and the user has no reason to believe the server is making a mistake. Then the 200 OK holds.
It's like walking into an unlocked building. Many buildings are supposed to be unlocked and people walk in and out as they please. If you put up a big sign saying public library, then you can't go to the police and say someone broke in when you made no attempt to hinder them, then 200 OK holds.
The server is giving the file away. Yes, I asked for it. But unless it's a very limited special case where I seriously went out of my way to trick the server (like a scam artist would in real life), then you can't put a little note under the doormat saying thief.
In this example the customers paid the listed price, did they not? It was for exactly this argument that I spelled out "price clearly listed" in my original argument.
I also chose a vending machine knowing full well that whatever someone says will be a personal choice. No legal system would waste its time on someone "stealing" $1.25 from a vending machine that gave you the soda.
It's a moral question, not a legal one. If someone accidentally sets themselves up to be taken advantage of, would you take advantage of them if no one is watching? All of these hacktivists like to talk about how evil and immoral the government, the business, etc. are. So I ask what would they do in a situation with nothing on the line but their integrity.
If they would take the soda then who are they to ride in on their high horse?
If they would not take the soda, then why is it still OK to tromp through a website knowing that you're not supposed to be there, just because the sysadmin is an idiot?
I'm not even saying there's one and only one right answer, but if there's one thing I hate it's hypocrisy, and I think this is true of most people. I don't think that people mean to be hypocritical either. But if we don't critically examine why we think something is right or wrong then do we really have a sense of morality or are we simply doing what we feel is right?
Terms of service are typically very long documents and are time consuming to read. Do you read terms of service of every site you go to, to make sure you are permitted to be on that site?
So, can we justify having a law against "unauthorized access to a vending machine"? Let's see what we get based on what someone does.
Scenario A: Defendant takes a soda without paying for it. Defendant is going to argue that this isn't unauthorized access; maybe the prosecutor can argue that it is, but that doesn't even matter. What you're doing is stealing. That's what you should be prosecuted for. There is no call for a law against "unauthorized access" in order to prosecute in this case, what is needed is a law against taking what isn't yours. This scenario occurs in any case for which "unauthorized access" occurs in furtherance of anything which is actually wrong -- the wrong thing should already be illegal and have appropriate penalties for that conduct so there is no benefit in such cases of a separate prohibition on unauthorized access.
Scenario B: You want a soda but the machine won't take your money because the door won't close. So you open up the machine, put a $5 bill in the cash store and take your change and your soda. Here you aren't stealing anything; you've paid the asking price. Great, we've discovered a scenario where the prohibition on unauthorized access actually does something instead of being totally redundant -- you're not authorized to open up the vending machine, so even though you didn't steal anything or do anything to harm anyone, you still accessed it without authorization. So is this the scenario where we want to impose criminal liability? I don't think so. A law prohibiting that conduct is rubbish. You want laws to prohibit doing bad things, not to prohibit doing good things that are unanticipated.
Unless I damaged/changed the machine beforehand.
If they wanted to give me a $100 bill, it is fully within their rights to do so. If I really entered $50, then I certainly did not authorize my bank to debit my account for $100.
They might have some legal grounds depending on the local legislation to request the $50 back due to their fault/mistake, but I can dispute that and the result is far from certain.
It's unfortunate you ignore it. My original question was precisely a moral question. :)
But if we're debating if the 'taker' should be punished (as in the original post), then the legal question applies. It may be wrong to abuse the opportunity, depending on the circumstances, but it would be far more wrong to put the person in jail for doing something the vendor implicitly seemed to allow.
See, for example, a family who were jailed for exactly this: http://www.guardian.co.uk/uk/2003/jan/16/rebeccaallison2
Citations welcome to this being different in other countries.
There probably needs to be a way to address the situation where someone knows the data they are accessing ought to be restricted, but your analogy throws away an awful lot of the context that is important to that discussion.
Perhaps, but IMO it's really the core moral question.
But you are right that context is important, which is why these debates go so often into what "reasonable" persons would do.
So with weev, for instance, I think a "reasonable" person could probably say that they're not really supposed to have access to so much personal data, and that they probably shouldn't have gone way the hell out of their way to get 114,000 email addresses when 4 orders of magnitude less would have sufficed to prove the vulnerability.
Now, do I think that email addresses of any kind warrant 41 months in prison? Absolutely not! But I also don't see how it's a stretch to consider that weev stepped beyond the bounds of reasonable behavior.
A good trick would be massive civil penalties for disclosing personal data to third parties. That leaves us uncomfortable with weev scraping large amounts of data but able to punish him for any damage he causes by sharing it, and it makes some potential for innocent little AT&T to share the stick.
Edit: better to say that it leaves us able to punish weev for causing damage. There is easily potential for causing more damage than could be restored by a single person.
A better one might be having a section of road connected to public roads that it is illegal to drive on.
This is still hugely problematic, because it invites discussion of the intent of the operator and the intent of the driver and ignores the part where it is not particularly difficult to put up an effective barrier.
You're confusing violating a law with violating the law. If getting "200 OK" means you were authorized and can't be convicted of unauthorized access to a computer, but you proceed to purloin credit card numbers and make fraudulent charges to them, you're still going to jail for credit card fraud.
The real issue is that "unauthorized access" is hopelessly ambiguous if you don't use the likes of protocol status codes, and totally redundant if you do.
If you get "200 OK" then you haven't made unauthorized access because you were authorized. If you get "403 FORBIDDEN" then you haven't made unauthorized access because you were denied access. That interpretation makes "unauthorized access" impossible to achieve, because if access is denied then there is no access to be unauthorized and if access is granted then it is authorized access.
The trouble is that the alternative interpretation is even worse: If you can't rely on what the machine tells you, how do you know when you're authorized? Some cases are really obvious (e.g. you are not authorized to places orders against just any random customer's credit card), but those situations are pretty much always separately illegal regardless of unauthorized access. What that leaves is the hopelessly ambiguous cases, which is what allows prosecutors to argue that violating terms of service or downloading too many journal articles is a federal felony. I'm still not convinced that those cases need to be illegal at all -- and if you can articulate a specific one that ought to be then by all means prohibit it explicitly and stop with the blanket prohibitions on whatever "unauthorized access" is supposed to mean if it doesn't mean what the machine allows you to do.
They should stop letting 1st year law students write these ridiculous rants. Courts have almost all rejected attempts to criminalize website TOS violations. Indeed, courts have generally held that TOS is binding only against the company, since the company by the terms of the TOS is free to change the terms at will without prior notification to visitors.
Relying on courts to interpret a law the way that you happen to like seems, well, pretty goddamned stupid. Let's fix the law.
In fact, you are incorrect that "he was allowed access" in that the wire fraud counts in the indictment (page 10) is based on the idea that he should not have been given access to JSTOR in the first place. (I'm not claiming that Aaron's access to JSTOR was illegal, but rather that the case against Aaron argued his access was not allowed, while the parent argues that Aaron's case was based on the idea that he was allowed access, but was not permitted to distribute)
Your description of what the Aaron Swartz case is about is completely incongruous with the charges filed by the prosecutor.
[1] http://www.wired.com/images_blogs/threatlevel/2012/09/swartz...
I.e. he was kicked off of two different nets, MIT's and JSTOR's.
He walked into the server closet covering his face with a bicycle helmet. Whatever improvements MIT might be able to make to the message of "you're not welcome on this net", Aaron definitely received it loud and clear.
JSTOR provides unlimited access to MIT and many other schools. Anyone on the MIT network had access to JSTOR. He was not on a JSTOR network.
When JSTOR saw that one user was requesting a lot of files, they assumed a bad motive, and banned the IP address. After he got a new IP address, JSTOR contacted MIT about it, and they banned the MAC address from their wifi network.
That's just it though, that's not correct. What you might have meant was:
Everyone starts off with access to the MIT network. It is not MIT's obligation to continue to provide network services to anyone that they have a previous contract for. And even for those with contracts, it would almost certainly include boilerplate to the effect that services will be terminated for abuse of the network.
> When JSTOR saw that one user was requesting a lot of files, they assumed a bad motive, and banned the IP address.
> After he got a new IP address, JSTOR contacted MIT about it, and they banned the MAC address from their wifi network.
So you yourself admit: aaronsw started off with access to both JSTOR and MIT networks, and was explicitly kicked off of them both.
What steps did Aaron take to ensure that he was welcome on the networks again when he later tried to connect?
Someone lied to you. Did they have a reason? Did you ask?
The OP made it seem like he broke some ToS accidentally and then was somehow going to face jail time. This is certainly not the case. He deliberately accessed a network he had been banned from with clear criminal intent.
It's "reasoning" on a par with citing lawyer-spam emails as evidence of the need for tort reform.
[To clarify, since I seem to be attracting downvotes, I'm not saying there isn't a potential problem with lack of clarity over whether any ToCs can be used as a basis for criminal prosecution (or for that matter with frivolous litigation). I'm saying that highlighting an absurd ToC that nobody would be remotely interested in enforcing is a poor argument against the enforceability of ToCs per se (similarly: legal threats so spurious they're actually embarrassing don't actually say very much about civil law). Worse still, it's actually counter-productive since the lack of any interest in prosecuting absurd ToCs could be construed by those in favour of criminal penalties for ToC violation as showing the DoJ's discretion works.]
source: TFA.
Would a ToS hold up in court that specifically denied access to the company's service by government employees?
If a company had that in their ToS, and they discovered that a government employee had used their service, could they sue for damages?
Are businesses in the US obligated to provide service to government employees?
I know that recently there have been some gun shops that have been refusing to serve government employees, so there is at least a small amount of precedent.
Sending unsolicited bulk email has been against the ToS of many service providers for very many years. There's real financial harm done. And spam is disliked by very many people.
Next question?
Note how the headline says it "could" have been illegal--if the Justice Dept. had decided to prosecute a teenager on these grounds (never heard of that happening), and if a federal judge had handed down a conviction on those grounds (the 9th Circuit actually ruled the opposite).
While the law stands in its current unclear state people are still at risk of prosecution. Conviction might be improbable, but it's still an unpleasant situation to be in.
Courts show that judges are not unanimous about this. (https://www.eff.org/cases/u-s-v-nosal)
Note that the Nosal case was a person who was permitted to access to computer, but who then misused information got from it, and not someone who was prevented from accessing the computer.
(https://www.eff.org/deeplinks/2013/01/rebooting-computer-cri...)
I wonder if anyone reads T&Cs, though. Perhaps I should prohibit over-18s from using my websites.
Only problem is that victims can't press criminal charges, only the state can. So these laws are purely tools of the corrupt state actors and their cronies.
In the meantime, could we start a grassroots campaign to get companies to explicitly state at the top of their ToS that a violation of the ToS may be arbitrated only and does not constitute a 'unauthorized access' under CFAA?
Obviously the EFF would have to draft the exact clause, so that actual destructive hacking can still be prosecuted.
This sounds tricky, but if the EFF can't write something we could put in the ToS to protect users from the Feds trying to extort cooperation from users by abusing CFAA (a la Aaron) then how can we expect legislators to get it right?
Specifically some things the ToS should define is how "damages" will be defined, proper ways to disclose vulnerabilities, things which are NOT considered subverting access control, and a lower standard for trespass of online chattel which required actual damage or dissemination.
I wouldn't be so sure of that. The demographic for many magazines are people aspiring to be something they're not and actively seeking to know what they should like.
e.g. The demographic for Seventeen is 10 to 16 year old girls that want to feel older and more mature; the demographic for GQ is mostly men that can't afford most of the things on display in GQ.
This is all ridiculous. While I understand the point of the post, and it makes for great mainstream media play, it's total hyperbole. The fact that prosecutors can do something and what they would reasonably do are two different things. To wit exceeding the speed limit by 1mph could get you a ticket but almost never gets you a speeding ticket.
People will probably almost never be prosecuted for this kind of thing, unless they're looking for an excuse to prosecute someone. I take little comfort in the idea that I'm relying on prosecutors and judges to be reasonable, and I think it's worth taking action when laws like this make arbitrary enforcement possible.
Usually it doesn't make the news because the consequences are something between having to stand up to the police in court and a 300 dollar fine. Nobody cares if you get a speeding ticket over nothing.
The way that the CFAA is written, you can levy felony charges against basically any internet user with impunity. So if the Department of Justice decides to single you out, they can hit you with crazy multi-decade felony charges for the lulz.
And then you end up on the front page of the New York times for killing yourself.
A judge would throw this out (this being either the 1mph over ticket or the 17-year-old reading Seventeen), and the prosecutor who brought it forward would end his career.
Weather this is an insult to the intelligence of their readers, or carefully calculated propaganda probably depends on who you ask.
But either way, Aaron is actually a bad example as what he was charged with was still wrong to do (even if you agree with the end result he was trying to bring about). Not "felony" wrong perhaps, but even weev would have been a better example for what you're talking about.
On the other hand, "convicted of" is something that matters to the government, not to the rest of us. I'm not going to pretend that someone didn't do something just because a jury never returned a conviction, if there's enough evidence to support the claim in question. Likewise it's possible for a jury to convict people of crimes they've never committed; I won't deign to consider someone "guilty" of something they obviously didn't do just because a jury and legal process said otherwise. I'll leave the splitting of fine hairs to the legal process.
If you think that, it's because you have latched onto the idea that Aaron was being prosecuted only for thoughtcrime, which is incorrect.
To put it quite simply, Aaron decided to gain access to networks he was quite clearly ejected from. Aaron had access to JSTOR from his own Harvard campus account, so Aaron's own actions (going so far out of his way to do so from MIT's net) indicate he thought he was doing something at least a little bit wrong.
I don't think that evading network bans by itself is necessarily a horrible offense, but I certainly don't think it's completely OK and as far as I know the law doesn't either. In fact the CFAA could apply based merely on the cost of the MIT techs' time it took to track him down, even if he never intended to copy documents.
Where intent did play a role is that it made the existing charges he could have received just for his actions more severe. But he could have wanted to donate to charity and his acts alone would have been illegal.
And, I also think they would have been morally wrong, just as I wouldn't trespass on someone's property if they asked me to leave, no matter how innocuous my purposes are otherwise.
Don't just take my word for it, even Dr. Lessig agreed with that much (that Aaron's actions could be construed as wrong): "...if what the government alleged was true — and I say “if” because I am not revealing what Aaron said to me then — then what he did was wrong. And if not legally wrong, then at least morally wrong." http://lessig.tumblr.com/post/40347463044/prosecutor-as-bull...
Doubtful, but I'd be curious to hear of any examples.
A judge would throw this out...and the prosecutor who brought it forward would end his career.
Nothing about it never happening, and no reasons besides. So, I asked, "when has a judge thrown it out and the prosecutor's career ended?" To which you replied to the effect of, "Duh! I just told you!"
A lot of this could be solved by getting rid of the misdemeanor penalty, and making it a felony only in conjunction with the commission of another felony.
Same story here. It's frankly disturbing how few people understand this.
Just so you can petition the Supreme Court to take your case, knowing that they can just sit back instead and do nothing?
Wasn't there this Aaron kid that got hit by that very tactic? Hmm. He didn't take the "decades in prison" so well, did he?
So the example you take from what happened to Aaron Swartz is to apply yet more propaganda from the other side, instead of facts?
It's not even something you have to mislead about; 2-3 years in prison as an upper-end estimate is bad enough to make your point without being evasive, and even the ~6 months upper limit that the prosecution had offered in a plea bargain is said to be serious enough to make your point.
You could even mention that Aaron would have been a "felon" should he have been convicted or plea guilty on those charges and you'd have been accurate.
And yet you choose the only outcome that wasn't actually possible to push your point forward...
▲
|It's a paradox in the space-time continuum.
Has any court tested the theory that a minor can be held in violation of a TOS? Contracts entered into by minors are void on their face.
This seems a lot like having a "NO Trespassing" sign in the bathroom of a coffee shop, and then prosecutors charging people who walk in the front door.
You can put that "Reading this sentence makes the sky yellow" in your ToS if you want as well. Doesn't make it true.
However, if the ToS is meant to be law, then yes. But courts are known to throw out ToS sections that are written in bad faith. Anything like weev and Aaron are far edge cases with big money and names behind them. Hearst and the DoJ would be highly unlikely to pursue even civil action for breaking the ToS.
It amounts to:
* If over 18: Select "Over 18".
* If not over 18: Get your parental guardian, who is over 18, to select "Not 18" on your behalf.