Anti-Hacking Law Criminalizes Most Computer Users, Former Prosecutor Says | Hacker News Reader

Anti-Hacking Law Criminalizes Most Computer Users, Former Prosecutor Says

wired.com

69 pointszeratul24 comments

The article says: "In the Justice Department’s view, the CFAA criminalizes conduct as innocuous as using a fake name on Facebook..."

Facebook's Terms say: "You will not provide any false personal information on Facebook..."

But Facebook's registration is VERY unclear. They ask for an entry for "First Name" (not specifying whose), an entry for "Last Name" (again, not specifying whose), an entry for "Your Email" (specifying an article "Your", so presumably if they wanted my first name or last name, they would have specified "YOUR name") and an entry for "I am [Select Sex:]" (presumably asking me to predict the web developer's gender (?). If they wanted the registrant's gender, they should have said "YOU ARE [Select Sex:]", or at least make sure that the email question and the gender question were consistent. The Terms refer to the user as "You" and not "I".

Given that they have first person, second person, and no person specified on their registration page, any lawyer worth his $250/hour should be able to argue your way out of criminal charges (or even breach of contract) in using a fake name on Facebook.

A reasonable argument would be that the first time I went to Facebook, I wanted to search for a friend, so I put in HIS first name and last name, created an account, and now I am stuck with it.

Unfortunately, Facebook's very own terms restrict me from correcting this error (due to their lack of clarity and inconsistencies on the home page), as the terms say "You will not create more than one personal profile."

This is why HN - as awesome as it otherwise is - is awful for legal advice.

A reasonable argument would be that the first time I went to Facebook, I wanted to search for a friend, so I put in HIS first name and last name, created an account, and now I am stuck with it.

But unless you are a complete moron you would have known you were registering a new account and not doing a search. So now you've just lied under oath in Federal Court.

A good prosecutor would reason for the jury that given that you "work in computers" you would have known the difference between registration and site search - and so now you're also being charged with 18 USC §1621 [Federal Perjury] for making a false declaration and you're looking at up to an extra 5 years in prison tacked on to whatever the judge is going to hand you at the end of this. To make matters worse the prosecutor is appealing for all of the evidence you gave for your defense to be ignored given that you've demonstrated you are a bad witness.

Well done.

A little over a year ago, my uncle wanted to reconnect with an old friend, so he tried fFcebook for the first time. He came to the form and did EXACTLY what was described above. He knew that he was signing up for Facebook, but he only thought that he was signing up to read it and not to have his own page. He thought the e-mail and password were his username and password and the first and last name were his search terms. It took two months to get everything straightened out with him.

So, yes, Facebook's terrible UX will no longer just be obnoxious, it will actually be making people into criminals.

I agree that HN shouldn't be used for legal advice.

I was actually involved in a case where the registration page, terms and usage policy were confusing and inconsistent in a similar fashion (not exactly, but close), and as I recall, the judge agreed with that part of the complaint.

I am not a lawyer, but I believe the legal basis for that portion of the decision was that the terms are being defined by the corporation (presumably with reasonable resources to make sure they do it right), and being presented to the user (presumably with significantly less resources) with little option for discussion - you either agree or go away. And therefore the judge felt that it was incumbent on the the website to get it right, since they had designed the registration and defined the terms. The benefit of the doubt was given to the user.

I would never advocate lying under oath (as you suggested). Presenting an argument is different than lying under oath.

Your experience may be different, but that was my firsthand experience.

Yeah - depending on the specifics of your case, as a defendant you may be able to do a "defense in depth" where you argue multiple, possibly-contradictory explanations why you might not be guilty, without actually committing to one of them as actually true.

Presumption of innocence is awesome.

nice try. but to enforce that the prosecutor would have to call the guy "a complete moron"... i don't think the jury would take that very well.

nah.

He'd pull up your actual Facebook profile and then show it alongside the fake profile that was created when you 'thought you were doing a person search', and suggest you can't have got it right the first time and wrong the second.

I said you'd "have to be a complete moron", not that the prosecutor would have to describe you as one.

"honestly, i was typing all his information to better search for him"

You seem to be making the inaccurate assumption that both the law and its enforcement are logically consistent. This might seem reasonable if you are a mathematician or engineer who is used to working with formal specifications and precise definitions. Unfortunately, the people who write and uphold the law are about as far from engineers as you can get.

Too true. Once two perfectly sound legal arguments are made without breaking any semantic rules of the legal system, but point to opposite conclusions, the law becomes a political process. Good lawyers complete the first phase and hope, truly excellent ones are adept politicos as well.

It takes years of legal training to stop thinking about the reality of the situation or what laymen would say "actually happened".

The law (in general) is not interpreted by ASD judges with no common sense who are trying to find loopholes for you. Though is seems rich people get that kind of treatment when they do their taxes.

(Note, IANAL).

'A reasonable argument would be that the first time I went to Facebook, I wanted to search for a friend, so I put in HIS first name and last name, created an account, and now I am stuck with it.

Lest you think this is just a hypothetical, consider the prosecution of Lori Drew for creating a fake profile on Myspace.

The problem, as Prof. Kerr has repeatedly pointed out in his blog (over at http://www.volokh.com) is that if you have a law which can be argued to criminalize what most people do, then we move from a government of laws to a government of prosecutors. It was on this basis that he put time into defending Lori Drew, arguing that the US Constitution did not permit this prosecution because it was a violation of due process.

His work was largely instrumental in getting the misdemeanor convictions thrown out.

Just some interesting background. Orin Kerr is not only a former prosecutor. He is now a law professor at George Washington school of law, has blogged for a long time about the issues of the CFAA and other legal issues at the Volokh Conspiracy (http://www.volokh.com). His thoughts are always worth reading.

He donated a lot of pro bono time to Lori Drew's legal defence because he felt that if violating a web site's terms of service could count as a CFAA violation that this raised fundamental due process problems, and he's also gotten a fair bit of respect as an expert in the area of computer crime law with his law review articles and even blog posts being cited by courts in these areas.

> The government argued that violating MySpace’s terms of service was the legal equivalent of computer hacking.

> a judge subsequently threw out the verdict on grounds that the CFAA was constitutionally vague and that upholding the verdict would set a precedent for anyone who breaches similar contracts to be criminally prosecuted.

What happens when a judge with less sense sets a terrible precedent?

You appeal.

That only works when 1) you have enough money for a lengthy appeals process, 2) the appellate court agrees to hear your case, and 3a) the appellate court contains judges with more sense or 3b) you can repeat starting from 1.

3b stops working when you hit the Supreme Court, which frequently fails both 2 and 3a.

I eagerly await the justice system that obsoletes appeals by always being perfect the first time....

Headline is misleading, or at least I got the wrong impression. I thought it was talking about a new law, but it's talking about the existing law. At the end it even mentions an amendment that specifically excludes TOS violations.

Headline makes it sound like bad news, but I'd say the article is actually good news.

It'd be nicer if he had realized the fallacies of the prevailing 'legal' environment before he signed up to be a prosecutor (specifically, widespread laws make everyone guilty of something, so enforcement is really more about your place in society). Instead he was a cog in the system long enough to unjustly ruin some people's lives, then suddenly gets some critical thinking skills. Is it really that hard to think through your actions beforehand?

Are all prosecutions unjust? Do you know his record? How do you know he ruined people's lives?

If someone is ignorant of the flaws in the system before he joins it, but dedicates himself to righting them once he discovers them, should that then expose him to this sort of scorn?

Prosecutions are conducted under the guise of due process, but are anything but. Certainly many who are prosecuted are guilty, but chances are there was at least one innocent person under the steamroller that this guy was helping drive.

For one, he gets the scorn because all the people who groomed him into thinking he was "building a better world" aren't in the spotlight. If he's truly repetant, he can reflect upon how they misled him and adjust his personal opinion accordingly.

But really, he's pointing out one law lacking due process like it's the exception. It's not. The whole system has cargo-culted the idea of justice, going through the motions so outsiders think there's intelligence and justice behind it.

Reminds me of "the right to read" by Richard Stallman, it is a preview of a world where the right to read is regulated, throttled and taxed.

http://www.gnu.org/philosophy/right-to-read.html

well.. just like any other law.

everyone is guilty all the time. or have you never ever checked an sms while in a red light?

"to my friends everything. to my enemies, the law!"

My favorite part of the article by far is the uncaptioned action shot of the man drinking apple juice.

Reply on news.ycombinator.com