Live data from Hacker News

Using a VPN could become a criminal offence under new CFAA interpretation

news.ycombinator.com

31–40 of 98 posts

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#31
> in their opinion they are allowed to put the "gate down" for some users on a public website.

If they want to, the only reasonable way is to inform the visitor they're not eligible to use the site unless they fulfill specific conditions. If the user knowingly ignores this information - this is reasonable to be interpreted as some sort of offense depending on the context.

IP-based segregation, however, is just bullshit.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#32
post #9

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a compute…

You are right, the actual wording they used was : "on an otherwise publicly accessible website". I've edited my submission accordingly. In law every word even every comma counts.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#33

Earlier quoted context omitted.

> the foreign user is potentially liable for felony criminal charges in the US US law does not apply to non-US citizens. How could a foreigner possibly be liable for anything?

So long as you don’t set foot on US soil, or piss off someone enough to get extradited. Being a foreigner is often enough to avoid the punishment, but it’s not enough to be exempt from the laws.

What the hell? You're telling me some foreign national could actually be extradited to the US over VPN IP nonsense? As if this was as bad as drug trafficking?

I just checked my country's laws. Looks like international drug trafficking is the only reason allowed for extradition. Good to see the people writing these things have some common sense.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#34
post #9

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a compute…

I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech…

Hmm. You could also argue that not having understanding of the technology is a good thing. For instance, the judge can remove themselves from the details and look at it on a higher level.

It’s the job of the attorneys to make the case for or against using subject matter experts etc.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#35
Well, in the video of the hearing you posted earlier hiQ's counsel said an IP block is not akin to a password. The court added that IP addresses do not identify people. As such IP blocks ban computers not people. There was also suggestion that the "access control" only relates to the manner of access; people can easily change IP addresses. The court seemed to agree with that argument. hiQ's counsel argued that a "gates up, gates down" analysis is not appropriate because in this case "there is no gate" (or at least, the gate was up from the beginning). Again, the court seemed to agree.

Watching that hearing it seemed clear to me the court understands the dangers of letting tech companies use the threat of CFAA's criminal culpability against www users or competitors. One justice made the point that when the CFAA was passed there was no www. The court questioned how public web servers could be comparable to "private" government computers.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#36
post #7

It's not being talked about because there's no evidence of "new CFAA interpretation" until the court says something like that. It's very common for parties to try and argue all kinds of extreme interpretations of law that might favor their case, with the expectation that it most likely will be refused but hey, it's worth to try; but they are not newsworthy until/unless the court actually considers the argument as val…

So only after it’s precedent and harder to undo then does it matter?

This is basically saying there’s no point in testing software, ship every line to prod and see what happens.

This is exactly the kind of political ennui the system purposely tries to inculcate. Not fine grain mind control, but indifference.

Laws dictate acceptable social agency. One might think we’d take what ends up in them at least as seriously as rich man’s busy work.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#38
post #9

Well… first it’s not a « public » website; like Facebook and Google, you connect to a privately owned server and, while the « path » is public, the server you contact isn’t. So they are well within their right to block anyone. But trying to make illegal a way to bypass their security is a really dangerous way and if they win, then many, many, privacy tech would have a problem. Hope the judge know how to use a compute…

I really wish that every legal professional and judicial administrator had some rudimentary computer science knowledge. Having friends whom are lawyers, I can tell you that most of them don't have any meaningful understanding of technology becauae they spend so many years of their career heads down on what is effecctively paperwork. They know enough to realize how bass ackwards their industry is when it comes to tech…

The alternative to encryption really is totaltarian control of the internet. In order to have any level of confidence that the data is not tampered with you need strict security on every meter of cabling, every line of code, every transceiver, and every person involved with the design and fabrication of those things.

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#39

Earlier quoted context omitted.

From the context, (CFAA, a US law) "VPN to get access to content that is otherwise blocked in your country through an IP Block" wouldn't be referring to using a VPN to bypass blocks imposed by "your local government" or censorship-related issues, but rather circumventing blocks imposed by US-based content providers. Hypothetical scenario: User outside the United States uses a VPN to access US Netflix content. In doin…

> the foreign user is potentially liable for felony criminal charges in the US US law does not apply to non-US citizens. How could a foreigner possibly be liable for anything?

Here's one example:

https://www.zdnet.com/article/us-charges-greek-national-for-...

Re: Using a VPN could become a criminal offence under new CFAA interpretation

#40
This is a good sensationalist title that could easily be changed to "Will using a VPN become illegal under the CFAA?" and like any such headlines, the answer is "no".

Just because one side is making an argument for that interpretation in a civil case means pretty much exactly nothing.

What's more, the Supreme Court in recent rulings has started to slap down overly broad interpretations of "hacking" under the CFAA. Notably, the court recently curtailed the definition of "unauthorized" use in van Buren [1], which to me was a welcome but somewhat unexpected ruling.

There's absolutely nothing to worry about here.

[1]: https://www.lawfareblog.com/supreme-court-reins-cfaa-van-bur...

EDIT: corrected van Buren characterization.

Post reply on HN