Using a VPN could become a criminal offence under new CFAA interpretation

IIUC, there was no attempt to "bypass security." Rather, HiQ Labs was scraping unrestricted (i.e., not restricted by user ACLs) portions of Linkedin's web platform.

If any random user can access a particular web page, it's (IMHO) publicly available and using automated tools to scrape those pages is perfectly legal.

In fact, such scraping is done all the time on airline, hotel and other websites without issue.

As for VPNs, I'm guessing that LinkedIn blocked HiQ Labs' IP range, so they used a VPN to continue scraping the public pages. If my assumption isn't valid, please correct me. That

IP blocks (I'm thinking geo-blocks[0] for sites like Netflix) are sometimes necessary for the site to at least attempt to stay in contractual compliance with the content owners.

However, that doesn't seem to be the case here. If (again, this is my understanding) LinkedIn is just blocking HiQ Labs' IP range, but no one else's, that seems (as the 9th Circuit originally ruled[1]) like a targeted attempt to interfere with HiQ Labs' business:

   The Ninth Circuit held that there was no abuse of 
   discretion by the district court where the court 
   had found that even if some LinkedIn users 
   retained their privacy despite their public 
   status, as they were not scraped, such privacy 
   interests did not outweigh hiQ's interest in 
   maintaining its business. 

I say this because I (or HQ Labs) could manually enter all publicly accessible URLs at LinkedIn and copy-paste the returned contents.

While that would be an arduous process, it's not only perfectly legal, it's LinkedIn's intent to provide those pages without requiring a login -- validated by the fact they don't require logins to access those pages, while they do require logins to access others.

IANAL, but it seems to me that worrying about using VPNs becoming a criminal act is a tempest in a teapot.

I guess we'll just have to wait and see.

[0] https://en.wikipedia.org/wiki/Geo-blocking

[1] https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn

Edit: Corrected company name (HiQ vs. HiQ Labs).

I'm a little confused by that interpretation of the specific case in question (Hiq Labs v. LinkedIn).

IIUC, LinkedIn isn't doing GeoIP blocks (AFAIK, the San Francisco bay area is not being blocked by LinkedIn, just HiQ Labs' IP range).

What's more, HiQ Labs is scraping publicly available content. Most GeoIP blocking (such as Netflix/BBC, etc.) is done to keep subscribers from accessing content that the provider isn't licensed to provide in the location where the connection originates.

Even more, accessing such content even if you are in a location where that content is available requires a login (i.e., isn't publicly available) to access that content.

I don't see a parallel here.

As such, I'm not sure how the result here (either way) could impact the use of VPNs more broadly.

Then again, IANAL and may well be missing something.

If you'd expound on your reasoning around this, it would be greatly appreciated. Thanks!

Edit: Fixed typo.

Take your example. I don’t know whether a web page is encrypted. I do however know whether the transmission of one request of some website contents to a specific web browser is. But that won’t yet tell me whether the communication between me and the website has stayed confidential between the intended parties (which is probably what you’re interested in).

A pedantic point: van Buren decided the interpretation of "exceeds authorized access", not "without authorization". (There is no "unauthorized" in the statute--it says "accesses a computer without authorization or exceeds authorized access" as the operative part.)