Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

cdn.ca9.uscourts.gov

Post reply on HN
Print view View original

51–60 of 293 posts

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#51

Post by blacksmith_tb »

buro9 wrote: post #46
Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

.

Hmm, not a lawyer, but I think if you commit one crime in the process of doing something else that's legal, you're still guilty. But LinkedIn couldn't block your spider if it came back and throttled at a reasonable rate.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#52

Post by manfredo »

rayiner wrote: post #26
blackflame7000 wrote: post #18

Earlier quoted context omitted.

Ahh so if a company leaks data it's the viewer's fault, not the companies?

Yes. That's the general rule--negligence of a victim does not negate the culpability of the criminal. "It was easy to commit the crime" is not a defense. If you find yourself with access to something you think you're not supposed to have access to, you're supposed to do the right thing.

I think the issue is not "negligence of the victim" so much as, "took no steps to make the information private". If I don't lock my door and someone goes into my house, opens my filing cabinet, and copies my financial info then they're still a criminal. They took information from a place that was unambiguously meant to be private. But if I staple a copy of my financial info to a telephone pole, surely those who read it are not committing the crime of reading private information.

A URL that is not authenticated seems more like the latter than the former. The web is public unless people take steps to make it private. Criminalizing accessing unprotected URLs is like arresting people for reading the financial info I left stapled to the telephone pole. A while back there was a "world's most exclusive chat room" website that hosted IRC channels for people above twitter follower numbers. People learned that they could just manually increment a URL parameter to access higher room numbers regardless of their twitter follower count. Were those people committing a crime?

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#53

Post by Pfhreak »

freehunter wrote: post #37
dx87 wrote: post #34

Would that ruling mean that sites could no longer refuse to show content based on how they're accessed? For example, sites that won't load if the browser is in headless mode, or sites that depend on javascript as a way of blocking wget/curl.

I have a scraper for a site that used to offer an API for their publicly available site but removed the API with no warning. The info is still available to the general public, but only through their website. I created a scraper for the public page, but shortly after they switched to loading some public information through Javascript so my HTML scraper couldn't see it anymore. I ended up having to write an application…

> There is no reason why your page should refuse to load plain text without Javascript enabled.

Sure there is. You prefer writing javascript and you want to serve your site through a CDN.

You might not think that's a good reason, but that's certainly a reason.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#54

Post by henryfjordan »

docker_up wrote: post #43
henryfjordan wrote: post #6

hiQ asked the court for a preliminary injunction to stop Linkedin from denying them access, won it, and this is the result of Linkedin's appeal of that injunction. This is not the end of the case. The title is wrong. The 9th Circuit just ruled that hiQ has a decent enough argument to move forward. The question of whether them scraping a public site can violate the CFAA is not settled. > We therefore conclude that hiQ…

You misunderstand basic law terminology. A preliminary injunction is considered very strong. So it's not that "nothing is final here", it's actually almost pretty much final unless something comes out of left field.

The injunction was to stop LinkedIn from blocking access while the case is ongoing, not to stop them from arguing that hiQ violated the CFAA. The trial court could hear the arguments and say "hiQ is wrong, they did violate the CFAA". Maybe that's not likely, but it also is not yet decided.

So what exactly did I misunderstand and why do you think this is final?

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#55

Post by emilfihlman »

Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

Leaving the injunction in place is insane and a huge oversight. It amounts to making web pages carriers that cannot select who they serve.

It should have said only that there is nothing judicially wrong with scraping but also not limited the rights of a service.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#56

Post by JamesBarney »

sgc wrote: post #35
alistairSH wrote: post #29

Earlier quoted context omitted.

Nobody leaked any data here. These were public profiles that were "controlled" by a robots.txt file. The judge appears to question whether robots.txt is sufficient to prevent scraping, or if a proper authorization step would be required. The best real-world analogy I can come up with... I post a No Trespassing sign on my garden, but don't fence/gate the property. Is it ok to access the property and take my tomatoes?…

It's more like a store putting up a no shoes no shirt no service sign and then trying to sue for trespass when a beachgoer comes in to shop anyway. LinkedIn is a business with publicly accessible assets they want to be frequented, but they want to control how you do that. However they are finding the laws regulating the rights people have in respect to frequenting places open to the public apply.

I think this is the best analogy I've seen on this thread.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#57

Post by penagwin »

meowface wrote: post #40

Considering the kind of private scraping and selling tactics LinkedIn has been chronically guilty of (and not just the ordinary "growth hack" stuff: "LinkedIn violated data protection by using 18M email addresses of non-members to buy targeted ads on Facebook" [1]), it's satisfying to see LinkedIn lose this. [1] https://techcrunch.com/2018/11/24/linkedin-ireland-data-prot...

I feel like this is a really common theme I've seen several times. Something like "Music Lyric site X sues Google for embedding their lyrics in the results directly" which is funny because site X got the lyrics by scraping them from other sites.

Plus Google only exists from scraping content, but I believe their TOS includes "don't scrape our content".

I find it really funny that the scrapers are battling scrapers - like guys you only exist because you do THE EXACT SAME THING

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#58

Post by penagwin »

freehunter wrote: post #37
dx87 wrote: post #34

Would that ruling mean that sites could no longer refuse to show content based on how they're accessed? For example, sites that won't load if the browser is in headless mode, or sites that depend on javascript as a way of blocking wget/curl.

I have a scraper for a site that used to offer an API for their publicly available site but removed the API with no warning. The info is still available to the general public, but only through their website. I created a scraper for the public page, but shortly after they switched to loading some public information through Javascript so my HTML scraper couldn't see it anymore. I ended up having to write an application…

> There is no reason why your page should refuse to load plain text without Javascript enabled.

On a technical level sure. SPA's should pre-render data before sending it to the client.

The problem is that's a ton of extra work when the client will have to fetch data anyway - so it's difficult to justify the time to management.

EDIT: If their page fetches the data with JS you might actually have an easier time figuring what their API looks like instead of scraping the rendered page. You might find there's more data available than is rendered too.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#59

Post by Causality1 »

Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

Would it hold up if profiles were only visible to logged-in users and part of the sing-up EULA was an agreement not to scrape profiles with automated tools?

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#60

Post by [deleted] »

txcwpalpha wrote: post #49
codedokode wrote: post #48

Earlier quoted context omitted.

this is bad comparison because when scraping a site, you don't cross any borders, you just send and receive information. You can compare this to a phone call or to talking to someone.

A website or server is property, just like land is. Accessing it is no different than accessing any other piece of property. Opening a website is, for all intents and purposes, the same as crossing a border. To take it a step further, the information on said website is also personal property, and accessing the information without permission is also trespassing. Specifically, this is called trespass to chattels [1] (t…

[deleted]
Post reply on HN