But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem.
Hope the judge know how to use a computer and understand the implications…
We are headed for a more authoritarian future if those making law or making judgments only see privacy tech as fringe and criminal, or have little meaningful underatandiing of it.
It’s the job of the attorneys to make the case for or against using subject matter experts etc.
Take your example. I don’t know whether a web page is encrypted. I do however know whether the transmission of one request of some website contents to a specific web browser is. But that won’t yet tell me whether the communication between me and the website has stayed confidential between the intended parties (which is probably what you’re interested in).
Is the data in a TLS connection transformed in such a way that it would make it difficult for an intermediary to figure out the plain information being sent?
If so, the data is in fact encrypted. Where are you getting this idea that encryption is more than that? That is by definition what encryption is, and everything else is just approaches and security layers on top of it. You don't have to like the encryption method, you don't have to care who it's from, you don't have to care about anything else. Encryption is encryption even if it's as pointless as a caesar cipher.
And yeah, there's things like certificates and CAs with HTTPS, but that's totally secondary to the encryption part. No one would bother with HTTPS if it couldn't establish encrypted connections.
If a lawyer or a judge doesn't understand that they themselves are frequently using encryption when they use the internet, that's a problem. They don't need to care about the nitty gritty details that you and others bring up. If they view encryption as something that only bad guys use, why should they be a part of the judicial system in the year 2021?
I feel like you're overdefining encryption to make a point, when you don't need to at all.
Honestly, I haven't the faintest clue the point you are making or why you are nitpicking to this degree. I think I made it clear why legal and judicial professionals should have a rudimentary understanding and awareness of encryption for the purpose of making sound decisions that affect society. If your disagreement with my definition of encryption gets in the way of that for you, then I really don't know what to say. Look up what the word "encrypt" means, think of the etymology, and rethink what you've been saying.
You're asking for them to have a very strange understanding of encryption, that doesn't match how the term is normally used. The important part is the security, not that you need an algorithm to decode. It's not nitpicking to say you're asking for them to know something irrelevant that's adjacent to some important things they should understand.
The only thing worse than a judge who doesn't understand the first thing about computers would be a judge who thinks they understand computers but doesn't.
If you don't want people sending you letters, get rid of the mailbox. For tech, close your ports. If you don't want to send information out, stop responding to the letters (or packets).
IIUC, there was no attempt to "bypass security." Rather, HiQ Labs was scraping unrestricted (i.e., not restricted by user ACLs) portions of Linkedin's web platform.
If any random user can access a particular web page, it's (IMHO) publicly available and using automated tools to scrape those pages is perfectly legal.
In fact, such scraping is done all the time on airline, hotel and other websites without issue.
As for VPNs, I'm guessing that LinkedIn blocked HiQ Labs' IP range, so they used a VPN to continue scraping the public pages. If my assumption isn't valid, please correct me. That
IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners.
However, that doesn't seem to be the case here. If (again, this is my understanding) LinkedIn is just blocking HiQ Labs' IP range, but no one else's, that seems (as the 9th Circuit originally ruled[1]) like a targeted attempt to interfere with HiQ Labs' business:
The Ninth Circuit held that there was no abuse of
discretion by the district court where the court
had found that even if some LinkedIn users
retained their privacy despite their public
status, as they were not scraped, such privacy
interests did not outweigh hiQ's interest in
maintaining its business.
I say this because I (or HQ Labs) could manually enter all publicly accessible URLs at LinkedIn and copy-paste the returned contents.
While that would be an arduous process, it's not only perfectly legal, it's LinkedIn's intent to provide those pages without requiring a login -- validated by the fact they don't require logins to access those pages, while they do require logins to access others.
IANAL, but it seems to me that worrying about using VPNs becoming a criminal act is a tempest in a teapot.
I guess we'll just have to wait and see.
[0] https://en.wikipedia.org/wiki/Geo-blocking
[1] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn
Edit: Corrected company name (HiQ vs. HiQ Labs).
The entire thing is a farce. There has never been any way to know where an endpoint device is
And VPNs are often necessary to prevent the service from detecting it wrong.
Suppose I'm currently near an international border and my phone picks up a tower on the other side of the border. Now the IP address my phone gets is listed as being in the wrong country.
A lot of companies route all their traffic through a head office somewhere so they can inspect the traffic in a central location. It's not always in the same country where the users are.
Suppose I'm using a VPN for privacy reasons, not to bypass geographic restrictions, but I want it to be in a different country to maximize the inconvenience to anyone trying to violate my privacy, so now the country listed is the wrong one. I would have to use another VPN to get it back to being where I actually am.
The obvious solution to all of this is to forget about trying to tie locations to IP addresses, since that has never worked, and just ask the user's device what country it's in. The user can set it to a different one but that's no different than the status quo.
A good point. Note that I said:
IP blocks...are sometimes necessary for the site
to at least *attempt to stay in contractual
compliance* with the content owners.
I merely suggested that such geo-blocks could be a result of contractual requirements between the distributors and the content owners.
Personally, I think it's dumb too.
But I'm not a content distributor or content owner. As such, my opinion has no impact on the legal contracts between such entities.
>The obvious solution to all of this is to forget about trying to tie locations to IP addresses, since that has never worked, and just ask the user's device what country it's in. The user can set it to a different one but that's no different than the status quo.
You won't get any argument about that from me.