Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accessing Publicly Available Information on the Internet Is Not a Crime

eff.org

Post reply on HN
Print view View original

61–70 of 299 posts

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#61

Post by jimktrains2 »

rayiner wrote: post #54
jimktrains2 wrote: post #50

Earlier quoted context omitted.

In the coffee shop example, would this be like trying to sue someone who is banned from your shop from looking in the window at your price list? In this case, it's more like LinkedIn is attempting to get a PFA order, but I think they need to show abuse, not just looking in the window at the menu you posted on the window?

No because that's not how computers work. Computers don't just emit radiation into the aether that anyone can capture. Accessing a website involves making a physical piece of property do something in response to your HTTP request.

So, I can't shine a flashlight in your store window to look at the menu in the middle of the night? I have to send photons into your "physical piece of property do something".

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#62

Post by [deleted] »

mcguire wrote: post #59
rayiner wrote: post #24

There is a difference between public property and private property that is made available to the public. Just because the cafe on the corner has its door open and lets you stroll in off the street doesn't mean that the property owner doesn't retain the right to exclude people. And if the property owner revokes your permission, then going onto the property again can be a crime (trespass).[1] Servers are no different.…

I am not a lawyer and I do not have citations to back this up, but I suspect that, if you put up a billboard and then send cease and desist letters to people looking at it, or taking pictures of it, or whatever analogy to programs examining public web pages you like, then you would be laughed out of court.

[deleted]

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#63

Post by cybwraith »

rayiner wrote: post #36
cybwraith wrote: post #28

Earlier quoted context omitted.

That's not a great analogy. The store owner can't just get your arrested/charged with a crime if they don't tell you that you aren't allowed first. Http lacks such a human mechanism. The closest thing I can think of in the standard is the response code. So your server replying 200 OK should implicitly be considered permission to access that resource legally until it stops replying with that code.

But that's exactly what happened here: > LinkedIn sent hiQ cease and desist letters warning that any future access of its website, even the public portions, were “without permission and without authorization” and thus violations of the CFAA. The EFF's point about terms of service is a good one, but also irrelevant. Terms of service don't provide adequate notice that someone's implied license to access a website has b…

Again:

> your server replying 200 OK should implicitly be considered permission to access that resource

I do see your point and how you could disagree with my statement above. However, if the store owner forgets you next time and says "Come on in! Oh and here is a take-home menu with all our items and prices" but then calls the police to have you removed, there is a problem.

Now imagine said store owner actually owns several locations possibly even with different public names and doesn't want to serve said customer. They could provide a list of all addresses of stores they run explicitly banning permission. Otherwise, that customer walking into store B would need to be told again they would not be served at time of entry.

Assuming the CFAA C&D from LinkedIn does have legal standing here... If hiQ were using IP addresses and not DNS resolution to crawl, how would they know a particular IP is a LinkedIn resource they aren't allowed to access? Did the C&D provide all addresses they are not permitted to access?

My point is that its not black and white, and certainly not clear that this should be covered by the CFAA under "hacking".

Edit: You could also make the argument and analogy to a restraining order which places the responsibility for compliance on the banned party. However those don't just happen because one entity sends a letter to another entity, it needs to be explicitly granted via the legal process.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#64

Post by interfixus »

joshuamorton wrote: post #44
interfixus wrote: post #41

Earlier quoted context omitted.

Fine. I hereby forbid access by any entity owned, operated, or otherwise controlled by Microsoft Corporation to any internet server or service operated by me. Disregard of this interdiction shall be considered a crime, the digital equivalent of trespassing.

And this is why we have judges and juries.

Actually, where I live, we don't have juries.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#65

Post by ynniv »

UncleEntity wrote: post #57
ynniv wrote: post #42

Earlier quoted context omitted.

Google, Bing, etc are also scraping their site, and I see no cease and desist order there. Make Googlebot authenticate itself, or admit the data is publicly accessible.

The Whataburger I went to for breakfast this morning gives some homeless people free coffee and asks others to leave...

And when hiQ shows up looking homeless and accepts the gift of coffee, they are committing a crime?

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#66

Post by mcguire »

rayiner wrote: post #54
jimktrains2 wrote: post #50

Earlier quoted context omitted.

In the coffee shop example, would this be like trying to sue someone who is banned from your shop from looking in the window at your price list? In this case, it's more like LinkedIn is attempting to get a PFA order, but I think they need to show abuse, not just looking in the window at the menu you posted on the window?

No because that's not how computers work. Computers don't just emit radiation into the aether that anyone can capture. Accessing a website involves making a physical piece of property do something in response to your HTTP request.

But you had to take active steps to cause your physical piece of property to respond to HTTP requests...

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#67

Post by rayiner »

jimktrains2 wrote: post #61
rayiner wrote: post #54

Earlier quoted context omitted.

No because that's not how computers work. Computers don't just emit radiation into the aether that anyone can capture. Accessing a website involves making a physical piece of property do something in response to your HTTP request.

So, I can't shine a flashlight in your store window to look at the menu in the middle of the night? I have to send photons into your "physical piece of property do something".

I don't think anyone who understands how computers work would compare the active process of a server responding to an HTTP request to the entirely passive phenomenon of shining light into a window and capturing the photons that bounce off.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#68

Post by xoa »

PatientTrader wrote: post #5
FilterSweep wrote: post #3

> LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true Protect them from what, your unlocked front door ? [0][1] [0] "Hackers selling 117 million LinkedIn passwords" http://money.cnn.com/2016/05/19/technology/linkedin-hack/ind... [1] http…

> I'd also note that these companies are barely (if ever) held liable for life-compromising hacks on their platforms. You do know it is impossible to stop all cyber attacks? Its always a matter of when, not if. Zero day attacks are developed everyday with not even the best funded cyber security systems able to thwart them. The geniuses are on the offensive side, if they want in, they will get in.

>You do know it is impossible to stop all cyber attacks?

This is a fallacious argument, specifically the Nirvana Fallacy. Perfection not being achievable in no way means that there can't be standard best practices that are a minimum requirement, nor that liability cannot still exist. Certain types of cyberattacks are in fact possible to stop perfectly merely by virtue of not holding onto information at all. As a trivial example, there should be no plaintext password leaks (or even easily brute force password leaks) at all, ever. Adaptive hashes/key stretching have been a thing since the dawn of security, Robert Morris described CRYPT for unix password usage in 1978. bcrypt is from 1999. There has been no reasonable basis at all for plain text or even raw fast hash primitives to be utilized, ever, yet they have been. In no other industry dealing with these kinds of privacy and safety concerns is that sort of practice considered acceptable, not should it be.

Holding personal private information at all long term should fundamentally be considered a liability situation, because it's not necessary, it's a commercial choice. Can't be hacked if it doesn't exist. If businesses choose to hold it, they should also be taking reasonable steps to protect it, and accept liability for failures. That's the natural balancing flip side to them getting profit from using it. If they're allowed to turn any costs of holding it into externalities that distorts the market.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#69

Post by maneesh »

FilterSweep wrote: post #3

> LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true Protect them from what, your unlocked front door ? [0][1] [0] "Hackers selling 117 million LinkedIn passwords" http://money.cnn.com/2016/05/19/technology/linkedin-hack/ind... [1] http…

If I leave my front door to my personal residence unlocked, and someone comes to the front door, opens it, and walks inside without permission --- is that illegal?

I'm actually not sure.

Re: Accessing Publicly Available Information on the Internet Is Not a Crime

#70

Post by ynniv »

maneesh wrote: post #69
FilterSweep wrote: post #3

> LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true Protect them from what, your unlocked front door ? [0][1] [0] "Hackers selling 117 million LinkedIn passwords" http://money.cnn.com/2016/05/19/technology/linkedin-hack/ind... [1] http…

If I leave my front door to my personal residence unlocked, and someone comes to the front door, opens it, and walks inside without permission --- is that illegal? I'm actually not sure.

It is legal until you inform them they are trespassing and ask them to leave.
Post reply on HN