Hacker News Reader

Comment by rayiner | Hacker News Reader

The CFAA is a shitty law, but this article apparently can't be troubled to read all of 18 USC 1030(a). All of the subsections require something more than mere access, and all require "knowing" intent. For example, subsection (1) requires knowing access to certain national security information. (4) requires a "protected" computer, knowing intent, intent to defraud, and obtaining something of value other than simple use of the computer.

In the common law there is this concept of implied license. You don't need explicit permission to enter a public store, but the store owner can revoke permission and if you enter the store knowing you don't have permission, you're committing a trespass. That's why the "knowing" part can't be ignored in the CFAA. That's why 3Taps lost against Craigslist--the IP block gave them notice of the fact that they were no longer entitled to access what is otherwise a public website.

View on HN

"the IP block gave them notice of the fact that they were no longer entitled to access what is otherwise a public website."

The same logic could presumably criminalise the behaviour of making a new account on a site after your old account has been blacklisted.

This isn't so much about banning people from entering a premises, this is more like banning someone from looking at your roadside advertising signs by standing between them and a sign and then taking them to court when they glance round you.

Creating a new account with a fake name directly interacts with the company's server. Looking at a roadside sign requires no activity on the part of the sign.

On the contrary, the sign must reflect photons into your eyes. :P

A billboard is bad metaphor for a website. With a billboard, you can get the information while standing in public or private space not owned or controlled by the advertiser. So a billboard is more like banner ad than a website. A website as a public store seems to be the better metaphor.

That could mean that creating a new account after your old account was banned could be a crime. That's like putting on dark sunglasses and a beard and walking back into the store after you've been kicked out. It's trespassing which is a crime. The difference is in the real world, simple trespass does not result in a life-altering felony conviction with a jail sentence.

>The difference is in the real world, simple trespass does not result in a life-altering felony conviction with a jail sentence.

Isn't that enough of a difference? Property owners be responsible for security of their property to some extent. If there is a door with a key hanging next to the door and anyone is allowed in by simply using the publicly available key, is it really trespassing?

It is still trespassing. It doesn't have to be difficult to do something for it to be illegal.

I think the bigger issue is that trespassing is usually handled with a warning and, if it does go to court, is usually a misdemeanor or a low-grade felony. For this, it seems that accessing a server that you do not have permission to use is seen as much more serious than merely trespassing.

I can't see an argument that supports that position. Certainly, if you do anything to vandalize or disrupt the server, then you have crossed a line and should be prosecuted. Anything less should be handled more reasonably.

18 USC 1030(a)(2): "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— ... (C) information from any protected computer;"

18 USC 1030(e)(2): the term “protected computer” means a computer— (A) [computers used by financial institutions or the government] or (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States [read as 'is on the internet']

So you're saying intent makes the difference. But I don't know how much that helps. We still have a state of reality in which the general public wanders the internet assuming they're allowed to access arbitrary websites without any explicit authorization from the operators. The strict (and obviously insane) interpretation is that they're all guilty because they know they haven't gone to Google's headquarters and gotten something like an authorization letter permitting them to do a search on google.com, but the alternative is the void for vagueness problem the author is trying to articulate: If you have implied authorization then where does impliedly authorized access end and unauthorized access begin? The line is so indistinct and open to interpretation that no one can say for sure, which is why all the hypotheticals (and some actual prosecutions) about mothers being jailed for Facebook posts and the like.

That is why the strict, and obviously insane, reading of the law is not the correct reading of the law. The intent element applies to every other element of the crime--you must intentionally (a) access a computer, (b) without authorization or inxcess or authorized access, and (c) obtain information from a protected computer.

Intent is the most important element of criminal statutes. For example, for homicide intent is the difference between a capital murder and involuntary manslaughter (and all the gradation between).

Right, it's a basic rule of statutory construction that you have to apply the intent requirement to every element of a crime.

As a practical matter, the CFAA has not been applied to situations where it was unclear whether the person violated the law. With 3taps and Swartz, it's pretty clear that the defendants knew they were kicked off the site and tried to access the, anyway. The debate in those cases is about the punishment, which at least in Swartz's case was disproportional to the crime.

>With 3taps and Swartz, it's pretty clear that the defendants knew they were kicked off the site and tried to access the, anyway.

I don't know. It seems like you could still make the argument, e.g. if your account gets disabled but nobody tells you why, you might have to assume something you did wasn't allowed, but why would you assume that to mean you can never create another account even if you behave differently in the future? And if you can do that then how are you supposed to know what specific subset of the things you did are the ones you aren't supposed to do again? So there was the argument in the Swartz case that, for example, getting kicked off for downloading too quickly just means they want you to slow down rather than stop because they don't want you to degrade performance for others. And the fact that we have to argue about it is the problem.

Also, I think the OP was really referring to Auernheimer more than these others anyway, which gets more to the heart of the issue. He obviously intended to change the number at the end of the URL. The problem is that we don't know whether doing that is classified by the law as unauthorized access, but unless the courts are willing to throw out the statute or adopt a narrow interpretation, he still gets convicted for doing the thing he intended to do, not because he intended to violate the law, but because the judge decided after the fact that the thing he intended to do was a violation of the law. That seems extremely problematic because the judge is doing the clarification on what the law means ex post facto but then still subjecting the defendant's prior conduct to that new ruling, but that's the situation the statute leaves courts in unless they're willing to throw it out as a result of that.

>That is why the strict, and obviously insane, reading of the law is not the correct reading of the law.

That's the whole point. The clear interpretation is clearly wrong and the remaining interpretation has undefined behavior because of the lack of any obvious demarcation point for authorized access.

In addition to that, we have the "ignorance of the law" issue. If you don't know what "unauthorized access" means but you intentionally do something that a judge subsequently decides was unauthorized access, are you (or the hypothetical security researcher, for example) going to be willing to bet your freedom that the fact that you subjectively didn't intend for your access to be unauthorized is going to keep you out of prison? Chilling effects.

I think "unauthorized access" is like porn. You know it when you see it.

As for chilling effects for security researchers, I don't think they're an inadvertent result of vague statutory language. I think Congress clearly intended to make that sort of tinkering around illegal. After all, back in meat space, you can't pick my lock, burst into my living room, and say: "hey, your lock sucks, buy my security service!"

I don't think it's necessarily a good idea to create such a rule, but there is a certain internal logic to it. Laws create social norms. When it comes to private property, the laws create a social norm wherein you're expected to give peoples' private property a very wide berth except according to certain clearly-defined, socially-accepted conventions. I.e. you can come onto someone's property if you're invited, or if the property seems to be a public venue and you have no reason to think you're banned, but generally you stay the fuck away. The end result of that norm is that people don't go and buy the best possible locks. The social norm enforces the owner's right to exclude, not technology. I don't even lock the door to my apartment because I know that nobody is going to come into my apartment and just look around because they found the door unlocked. And I know that if a neighbor sees someone do it, they'll call the cops because it's such an egregious violation of the social norm that it's per se suspicious.

I don't think that trying to create that norm for internet sites is the best model, for various practical reasons, but like I said there's a certain internal logic to it.

>I think "unauthorized access" is like porn. You know it when you see it.

Isn't that one of those quotes from the Supreme Court like "three generations of imbeciles are enough" that everybody now uses to show how the Court is fallible?

It's just abdicating the role of Congress to make the law and the courts to say what the law is so that instead everyone can just do whatever they want on a case by case basis.

>As for chilling effects for security researchers, I don't think they're an inadvertent result of vague statutory language. I think Congress clearly intended to make that sort of tinkering around illegal.

I don't think the Congress that passed the CFAA contemplated that the sort of tinkering around we're talking about could even be possible. They pretty clearly passed it having in mind the idea that some foreign government or corporation might try to infiltrate the mainframes of US banks or the military, or maybe to have the ability to prosecute in case GE or Boeing is using one of those beasts to store their proprietary trade secrets and the Communists try to break in. I can't expect that overeager college professors were high on the list of expected defendants.

>I don't think it's necessarily a good idea to create such a rule, but there is a certain internal logic to it. Laws create social norms.

The issue in this case is that the law violates social norms (or more accurately, social norms violate the law), because the law so rarely gets enforced that people disregard it, so it becomes a tool for prosecutors to abuse in service of convicting political enemies and anyone else they don't like when nothing else will stick.

Anyone who operates an internet-facing server can tell you that break in attempts happen continuously. That's what the social norms are. I expect if you went to the FBI with a list of all the IP addresses that have tried to guess ssh passwords against your servers in the last week and asked them to prosecute they would tell you to shove off as they have more important things to do -- and those are the people who are unambiguously doing something wrong.

That's the trouble with the social norms argument. The social norms on the internet are that if you forget to lock your doors then within a few hours an army of foreign criminal syndicates will parachute out of stealth planes to eat all the food in your refrigerator and start storing marijuana and pirated movies in your garage and then teenagers will wander in off the street to write graffiti on the walls. I can sympathize with the inclination to just prosecute them all, but when they mostly aren't subject to your jurisdiction and there is an obvious available alternative of remembering to lock your doors, having a law which imposes severe penalties on less serious offenses but only against the minority of offenders present in your jurisdiction seems like nothing more than a trap for the unwary that makes little to no progress against the problem it purports to solve.

Reply on news.ycombinator.com