Live data from Hacker News

9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

cdn.ca9.uscourts.gov

131–140 of 293 posts

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#131
post #118

Earlier quoted context omitted.

> You didn't "ask my server". You used a tool to extract data from my server. The tool asked the server. The server replied. > It's more akin to you standing just outside my property border and using a fishing pole to pull fish Bullshit. Using HTTP to access public information is akin to standing outside your business and writing down the phone number in the banner. Or even reading the "No trespassing" sign. As long…

>here should be nothing wrong with reading information that you were authorized to view. You aren't authorized to view it. That's the entire point. And the lack of access control does not implicitly give you authorization to view it.

When it comes to physical properties there's a huge difference between reading a banner posted in a street and entering the property to read some secret data: you have to be in different locations. That's why your analogy is completely faulty.

When it comes to PUBLIC data in a website there's no difference. How would I know I'm authorized, implicitly or explicitly, to access a website, say www.google.com? Should I phone the domain owner before accessing?

Just because you meant for something to be off limits but failed to inform anyone doesn't automatically make it off limits. "Trespassing" in a website is analogous to hacking it, using stolen credentials, using exploits and things like that.

Unless some law passes that says that someone remotely accessing a folder called /secrets/, or /inside-the-property/ or something like that is trespassing, it won't be the case.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#132
post #118

Earlier quoted context omitted.

> You didn't "ask my server". You used a tool to extract data from my server. The tool asked the server. The server replied. > It's more akin to you standing just outside my property border and using a fishing pole to pull fish Bullshit. Using HTTP to access public information is akin to standing outside your business and writing down the phone number in the banner. Or even reading the "No trespassing" sign. As long…

>here should be nothing wrong with reading information that you were authorized to view. You aren't authorized to view it. That's the entire point. And the lack of access control does not implicitly give you authorization to view it.

> And the lack of access control does not implicitly give you authorization to view it.

I know you're trying really hard to sway opinion on HN for some reason, but I'm just going to reinforce the entire point of this thread and, assuming we're staying within the context of publicly accessible information: the Ninth Circuit Court strongly disagrees with you.

Common law torts, such as trespass to chattels, may apply. But it's not a criminal offense.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#133
post #132

Earlier quoted context omitted.

>here should be nothing wrong with reading information that you were authorized to view. You aren't authorized to view it. That's the entire point. And the lack of access control does not implicitly give you authorization to view it.

> And the lack of access control does not implicitly give you authorization to view it. I know you're trying really hard to sway opinion on HN for some reason, but I'm just going to reinforce the entire point of this thread and, assuming we're staying within the context of publicly accessible information: the Ninth Circuit Court strongly disagrees with you. Common law torts, such as trespass to chattels, may apply. B…

I don't know why you think this has anything to do with opinion. I'm relaying information that is available in the Wikipedia link that I provided in an earlier comment.

>but I'm just going to reinforce the entire point of this thread

That isn't the entire point of this thread, nor is it the point of the PDF posted in the OP.

>Common law torts, such as trespass to chattels, may apply. But it's not a criminal offense.

Nobody has said anything about it being a criminal offense. The relation to trespassing is literally the entire point of this thread.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#134
post #130

Earlier quoted context omitted.

I'm confused. Why would a blind person be any less likely to use JavaScript?

To test for a blind persons ability to render your website a good method is a CLI browser. Neither the blind persons device or a CLI browser will render javascript

I’m no expert in this space, but if free, common, and easily accessible tools render your site readable and usable, I’m not sure how refusing to use those tools would be a claim under ADA.

There are plenty of real ways that sites are unusable by screen readers, using Javascript to download dynamic content shouldn’t be one of them.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#135
post #130

Earlier quoted context omitted.

I'm confused. Why would a blind person be any less likely to use JavaScript?

To test for a blind persons ability to render your website a good method is a CLI browser. Neither the blind persons device or a CLI browser will render javascript

[deleted]

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#136
post #131

Earlier quoted context omitted.

>here should be nothing wrong with reading information that you were authorized to view. You aren't authorized to view it. That's the entire point. And the lack of access control does not implicitly give you authorization to view it.

When it comes to physical properties there's a huge difference between reading a banner posted in a street and entering the property to read some secret data: you have to be in different locations. That's why your analogy is completely faulty. When it comes to PUBLIC data in a website there's no difference. How would I know I'm authorized, implicitly or explicitly, to access a website, say www.google.com? Should I ph…

>When it comes to physical properties there's a huge difference between reading a banner posted in a street and entering the property to read some secret data: you have to be in different locations. That's why your analogy is completely faulty.

At no point is accessing a web server similar in any matter to reading words off of a banner posted in a street. You cannot use a faulty analogy of your own to describe why my analogy is faulty.

>When it comes to PUBLIC data in a website there's no difference.

Yes there is. Even for data that is public and meant to be accessed to the public, you still must access the web server. It is much more similar to walking into a publicly accessible restaurant and reading their menu, it is not similar to reading a banner on the outside of the restaurant.

>How would I know I'm authorized, implicitly or explicitly, to access a website, say www.google.com? Should I phone the domain owner before accessing?

A reasonable person knows that www.google.com is meant for public use. It is common knowledge and from whatever avenue you heard about Google, you probably gathered from context that www.google.com is somewhere you are allowed to go.

This is absolutely not the case if you randomly guess a URL like 'mycompany. intranet. io/financials /employeelist. xls'. And it certainly is not the case when you are explicitly told (such as in a robots.txt) that you are not allowed.

>Just because you meant for something to be off limits but failed to inform anyone doesn't automatically make it off limits.

It does, though. The owner of property is under no responsibility to inform the public that their property isn't meant for use. It is up to each individual person to determine if they are allowed to use it or not. This is typically done by context clues and societal expectations: it would be absurd for a random member of the public to walk through someone's open front door and claim "well I was never explicitly told to not come into your house...". The person should know, based on social conventions that you don't just walk into someone else's house, that it's not allowed. This is the same for websites. There is some leeway given, such as if you saw a sign for "Open House" and simply walked into the wrong house. But it is still possible to commit an act of trespassing even if you didn't explicit intend to: this is called negligent trespassing.

>"Trespassing" in a website is analogous to hacking it, using stolen credentials, using exploits and things like that.

No, it's not. Did you even click on the link I provided earlier regarding trespassing?

>Unless some law passes that says that someone remotely accessing a folder called /secrets/, or /inside-the-property/ or something like that is trespassing, it won't be the case.

That law already exists. It's called the CFAA, and the debate around it is what is being discussed in this post.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#138
post #72

What if hiQ were to then go and sell the information that's been scraped from public profiles? Would this be considered illegal?

I would assume the data would still be covered by copyright meaning they could use that data and maybe create and sell derivative works, but not just scrape and publish.

My LinkedIn profile is copyright by me, insomuch as it’s a creative work.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#140

This is actually bad, would not it be better if sites would be allowed to block crawlers? I don't see what is the legal basis for forbidding to ban scrapers. Is there a law that a site must serve pages for anyone?

There is no legal basis for "forbidding to ban scrapers".

The question is whether there is any legal basis for banning scrapers, i.e., for blocking hiQ. In other words, if hiQ keeps scraping, are they violating anyone's rights and/or breaking the law by doing that?

As long as that remains a legitimate, open question, then hiQ can argue they should be allowed to keep scraping without incurring civil or criminal liability. That is the purpose of the injunction. There could be no legal basis for blocking hiQ. Until that question is resolved, hiQ can keep on scraping.

Post reply on HN