Comment by 1vuio0pswjnm7 | Hacker News Reader

Comment by 1vuio0pswjnm7 | Hacker News Reader

"In both of those instances, the pages and data scraped are publicly available on the internet-no hacking necessary-but sites involved could easily change the fine print on their terms of service to label the aggregation of that information "unauthorized.""

They could. But if they filed a claim under the CFAA without ever sending a cease and desist letter to the alleged intruder, I think the claim would be dismissed.

Is simply changing TOS enough for a CFAA claim to have a reasonable chance of success. I could be wrong, but I believe for every CFAA claim we have seen so far based on "scraping", there was some notice to stop directed specifically at the respondent. If someone thinks just changing TOS (public notice) is enough for a CFAA claim to survive a Motion to Dismiss and there is no need to also contact the alleged offender asking them to stop, then let's hear about the precedent that supports that idea. I do not think there is any such precedent, but I could be wrong.

As to precedent, there is a decision by the 11th circuit asserting such an expansive reading of the law. It's the very decision that's the subject of this appeal.

Other than that, you're mixing civil and criminal law rather liberally. I agree that it would be insane to create criminal liability for run-of-the-mill violations of ToS, and there is a decision from the MySpace era saying as much (and not even involving any changes to those ToS).

But once you have been specifically asked to not do something, by any means that would reasonably get that message across (so, not just C&D), it becomes... murky?

We'll have to wait and see but I believe there should be a relevant distinction between a publicly accessible database like a backend to a public non-governmental website versus a non-public database being served by a protected governemnt computer, such as the ones Van Buren (2019) or Rodriguez (2010) accessed. Not to mention there was an existing (employer-employee) relationship between either Van Buren or Rodriguez and the operator of the computer database: the US government. Compare that to scraping a public website; the person doing he scraping may have relationship with the operator of the website.

I could set "Terms of Use" for the data stored on protected computers I own. I could place limits on "acceptable use" of this data. But can I really argue that I gave adequate notice to all the tech companies and partners that try to access this data.

So robots.txt has no meaning?

I think the main issue is with scrapers that don't adhere to robots.txt/X-robot headers.

Google doesn't either, they just don't index the paths written in robots.txt but bots still hit them.

No, because robots.txt is a friendly request and not a demand. It can never be a demand.

It's not binding, but it's a hint they may listen to where you can say things like if there's a certain URL structure where your server would keep serving content infinitely and just waste the crawlers time and resources, you can hint to them they maybe they should avoid certain URLs, but hey if they wanna waste their resources crawling that anyway be my guest!

Is it possible for private enterprise to file suit under the CFAA? I thought the CFAA was a criminal statue.

Reply on news.ycombinator.com