Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

cdn.ca9.uscourts.gov

Post reply on HN
Print view View original

31–40 of 293 posts

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#31

Post by txcwpalpha »

LyndsySimon wrote: post #28
txcwpalpha wrote: post #23

Earlier quoted context omitted.

As a real-world analogue: you can indeed be guilty of trespassing on someone's property even if you don't have to jump over any fences or pick any locks to get there. In some places, they don't even have to have a "no trespassing" sign. Simply being present on someone else's property without an invitation from them is illegal, and no, an open door does not count as an invitation.

You generally can’t be charged with trespass unless you refuse to leave when told to do so. An open door to a home is different, but unfenced property is 100% not trespass until you refuse to leave.

That's not true at all. If you are aware that the property you are accessing is not meant for your use, you can be charged with trespassing regardless of if you have specifically been asked to leave or not.

It's even possible to be guilty of trespass even if you weren't aware that you weren't allowed on the land. This is negligent trespassing.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#32

Post by jcranmer »

LyndsySimon wrote: post #28
txcwpalpha wrote: post #23

Earlier quoted context omitted.

As a real-world analogue: you can indeed be guilty of trespassing on someone's property even if you don't have to jump over any fences or pick any locks to get there. In some places, they don't even have to have a "no trespassing" sign. Simply being present on someone else's property without an invitation from them is illegal, and no, an open door does not count as an invitation.

You generally can’t be charged with trespass unless you refuse to leave when told to do so. An open door to a home is different, but unfenced property is 100% not trespass until you refuse to leave.

Trespass in criminal law usually requires notice that trespassing is prohibited, but this is usually satisfied by posting a "no trespassing" sign in a prominent area.

For example, my state's law (emphasis added):

> Whoever, without right enters or remains in or upon the dwelling house, buildings, boats or improved or enclosed land, wharf, or pier of another, or enters or remains in a school bus, as defined in section 1 of chapter 90, after having been forbidden so to do by the person who has lawful control of said premises, whether directly or by notice posted thereon, ...

The federal version of trespass (which I think applies to Indian reservations) considers merely fencing off the area to be sufficient notice that trespassing is prohibited.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#33

Post by momokoko »

Kalium wrote: post #4
tick_tock_tick wrote: post #3

Earlier quoted context omitted.

Not saying the court made the right call but for that case the big issue for the court was the pages were clearly not intended for the public and the defendant knew it.

I believe the salient issue is whether or not there were effective access controls, not whether or not a page could be reasonably interpreted as intended to be non-public.

That is false. What effective access controls do, legally speaking, is help determine if a person could reasonably conclude that the information was non-public.

For example, if a door is locked, but easily defeated, there is an implied assumption that what lies behind it is only available to someone with the key. Another example is an unlocked door with a sign that states "No access without authorization". Or an unmarked and unlocked door that is on private property in a place where it would be very unlikely for someone to reasonably conclude that the access was intended to be public.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#34

Post by dx87 »

Would that ruling mean that sites could no longer refuse to show content based on how they're accessed? For example, sites that won't load if the browser is in headless mode, or sites that depend on javascript as a way of blocking wget/curl.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#35

Post by sgc »

alistairSH wrote: post #29
blackflame7000 wrote: post #18

Earlier quoted context omitted.

Ahh so if a company leaks data it's the viewer's fault, not the companies?

Nobody leaked any data here. These were public profiles that were "controlled" by a robots.txt file. The judge appears to question whether robots.txt is sufficient to prevent scraping, or if a proper authorization step would be required. The best real-world analogy I can come up with... I post a No Trespassing sign on my garden, but don't fence/gate the property. Is it ok to access the property and take my tomatoes?…

It's more like a store putting up a no shoes no shirt no service sign and then trying to sue for trespass when a beachgoer comes in to shop anyway. LinkedIn is a business with publicly accessible assets they want to be frequented, but they want to control how you do that. However they are finding the laws regulating the rights people have in respect to frequenting places open to the public apply.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#37

Post by freehunter »

dx87 wrote: post #34

Would that ruling mean that sites could no longer refuse to show content based on how they're accessed? For example, sites that won't load if the browser is in headless mode, or sites that depend on javascript as a way of blocking wget/curl.

I have a scraper for a site that used to offer an API for their publicly available site but removed the API with no warning. The info is still available to the general public, but only through their website. I created a scraper for the public page, but shortly after they switched to loading some public information through Javascript so my HTML scraper couldn't see it anymore. I ended up having to write an application around Selenium to load the Javascript and import this public information. I'm just waiting for them to start randomizing the CSS classes to make scraping even harder. The content is static, even as data changes on the server it does not refresh on the page unless you reload the page.

There is no reason why your page should refuse to load plain text without Javascript enabled.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#39

Post by [deleted] »

Miner49er wrote: post #16
henryfjordan wrote: post #6

hiQ asked the court for a preliminary injunction to stop Linkedin from denying them access, won it, and this is the result of Linkedin's appeal of that injunction. This is not the end of the case. The title is wrong. The 9th Circuit just ruled that hiQ has a decent enough argument to move forward. The question of whether them scraping a public site can violate the CFAA is not settled. > We therefore conclude that hiQ…

AP seems to be saying differently. https://apnews.com/1e1cacd92df74f48846e8bce5237b97d

[deleted]

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#40

Post by meowface »

Considering the kind of private scraping and selling tactics LinkedIn has been chronically guilty of (and not just the ordinary "growth hack" stuff: "LinkedIn violated data protection by using 18M email addresses of non-members to buy targeted ads on Facebook" [1]), it's satisfying to see LinkedIn lose this.

[1] https://techcrunch.com/2018/11/24/linkedin-ireland-data-prot...

Post reply on HN