Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

cdn.ca9.uscourts.gov

Post reply on HN
Print view View original

61–70 of 293 posts

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#61

Post by derefr »

Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

Scrapers generally, sure. Not sure about scrapers on other social-media sites like Facebook, though.

The question being: if just having access to the network isn't enough to grant you access to the data of a specific profile, but instead you have to aggregate samples from a bunch of people in the network in order to see "through their eyes" to the data on the profiles of their friends and friends-of-friends, is that allowed?

Because, if even that was allowed, that'd surely open a different kind of floodgate.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#62

Post by CamperBob2 »

codedokode wrote: post #47

This is actually bad, would not it be better if sites would be allowed to block crawlers? I don't see what is the legal basis for forbidding to ban scrapers. Is there a law that a site must serve pages for anyone?

Parent was downvoted but I think they have a point. This sounds overbroad, to an extent that I'd worry will get the whole ruling tossed out by SCOTUS.

On the other hand, if the ruling stands, it sounds like it will finally be possible to do useful things with Craigslist.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#63

Post by dmix »

penagwin wrote: post #57
meowface wrote: post #40

Considering the kind of private scraping and selling tactics LinkedIn has been chronically guilty of (and not just the ordinary "growth hack" stuff: "LinkedIn violated data protection by using 18M email addresses of non-members to buy targeted ads on Facebook" [1]), it's satisfying to see LinkedIn lose this. [1] https://techcrunch.com/2018/11/24/linkedin-ireland-data-prot...

I feel like this is a really common theme I've seen several times. Something like "Music Lyric site X sues Google for embedding their lyrics in the results directly" which is funny because site X got the lyrics by scraping them from other sites. Plus Google only exists from scraping content, but I believe their TOS includes "don't scrape our content". I find it really funny that the scrapers are battling scrapers - l…

Regardless, there is legitimate value in the collection, cleaning, interlinking, and presentation of existing data. How that is interpreted by the law is one thing but merely because the data came from a variety of other public/private sources doesn't mean it derived all of its value externally.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#64

Post by meritt »

derefr wrote: post #61
Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

Scrapers generally, sure. Not sure about scrapers on other social-media sites like Facebook, though. The question being: if just having access to the network isn't enough to grant you access to the data of a specific profile, but instead you have to aggregate samples from a bunch of people in the network in order to see "through their eyes" to the data on the profiles of their friends and friends-of-friends, is that…

If you have to login to access the data, that data isn't publicly available, and unlikely to be protected by this decision.

Page 31 of the filing specifically differentiates this case from one regarding Facebook:

"While Power Ventures was gathering user data that was protected by Facebook’s username and password authentication system, the data hiQ was scraping was available to anyone with a web browser."

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#65

Post by Franciscouzo »

Pfhreak wrote: post #53
freehunter wrote: post #37

Earlier quoted context omitted.

I have a scraper for a site that used to offer an API for their publicly available site but removed the API with no warning. The info is still available to the general public, but only through their website. I created a scraper for the public page, but shortly after they switched to loading some public information through Javascript so my HTML scraper couldn't see it anymore. I ended up having to write an application…

> There is no reason why your page should refuse to load plain text without Javascript enabled. Sure there is. You prefer writing javascript and you want to serve your site through a CDN. You might not think that's a good reason, but that's certainly a reason.

What does a CDN has to do with it?

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#66

Post by toomuchtodo »

meritt wrote: post #64
derefr wrote: post #61

Earlier quoted context omitted.

Scrapers generally, sure. Not sure about scrapers on other social-media sites like Facebook, though. The question being: if just having access to the network isn't enough to grant you access to the data of a specific profile, but instead you have to aggregate samples from a bunch of people in the network in order to see "through their eyes" to the data on the profiles of their friends and friends-of-friends, is that…

If you have to login to access the data, that data isn't publicly available, and unlikely to be protected by this decision. Page 31 of the filing specifically differentiates this case from one regarding Facebook: "While Power Ventures was gathering user data that was protected by Facebook’s username and password authentication system, the data hiQ was scraping was available to anyone with a web browser."

The ol' DMCA trivial encryption switcharoo. I'd expect a lot more sites and their data to require a login now, to the detriment of the data being publicly indexed.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#67

Post by admax88q »

txcwpalpha wrote: post #49
codedokode wrote: post #48

Earlier quoted context omitted.

this is bad comparison because when scraping a site, you don't cross any borders, you just send and receive information. You can compare this to a phone call or to talking to someone.

A website or server is property, just like land is. Accessing it is no different than accessing any other piece of property. Opening a website is, for all intents and purposes, the same as crossing a border. To take it a step further, the information on said website is also personal property, and accessing the information without permission is also trespassing. Specifically, this is called trespass to chattels [1] (t…

Lol really?

I'm not "on" your site when I browse there. I asked your server to send me some data and it did so.

Its real life equivalent to social engineering. Its so far not illegal for me to ask you things and for you to disclose them to me even if you weren't supposed to. I'm allowed to lie to you even to persuade you to tell me things.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#68

Post by thomasjudge »

buro9 wrote: post #46
Animats wrote: post #22

This action does more than that. The court left the preliminary injunction against LinkedIn in place: "The district court granted hiQ’s motion. It ordered LinkedIn to withdraw its cease-and-desist letter, to remove any existing technical barriers to hiQ’s access to public profiles, and to refrain from putting in place any legal or technical measures with the effect of blocking hiQ’s access to public profiles." So Lin…

.

In the opinion they specifically discuss DOS attacks: "Internet companies and the public do have a substantial interest in thwarting denial-of-service attacks and blocking abusive users, identity thieves, and other ill-intentioned actors. But we do not view the district court’s injunction as opening the door to such malicious activity"

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#69

Post by txcwpalpha »

admax88q wrote: post #67
txcwpalpha wrote: post #49

Earlier quoted context omitted.

A website or server is property, just like land is. Accessing it is no different than accessing any other piece of property. Opening a website is, for all intents and purposes, the same as crossing a border. To take it a step further, the information on said website is also personal property, and accessing the information without permission is also trespassing. Specifically, this is called trespass to chattels [1] (t…

Lol really? I'm not "on" your site when I browse there. I asked your server to send me some data and it did so. Its real life equivalent to social engineering. Its so far not illegal for me to ask you things and for you to disclose them to me even if you weren't supposed to. I'm allowed to lie to you even to persuade you to tell me things.

You didn't "ask my server". You used a tool to extract data from my server.

It's more akin to you standing just outside my property border and using a fishing pole to pull fish from a pond that is inside my property border. You're still trespassing even if your two feet aren't physically on my land.

The common legal argument (see the second link in my above comment) is that accessing a web server actually does constitute being "on" the server because you are sending signals to my server in order to interact with it, and this satisfies the "physical contact" part of trespassing.

From Wikipedia:

> The courts that imported this common law doctrine into the digital world reasoned that electrical signals traveling across networks and through proprietary servers may constitute the contact necessary to support a trespass claim.

>Its real life equivalent to social engineering. Its so far not illegal for me to ask you things and for you to disclose them to me even if you weren't supposed to. I'm allowed to lie to you even to persuade you to tell me things.

This absolutely would be illegal and I'm not sure why you think otherwise. Misrepresenting yourself in order for me to reveal to you private information is fraud and is illegal in pretty much every jurisdiction I can think of.

Re: 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

#70

Post by admax88q »

txcwpalpha wrote: post #31
LyndsySimon wrote: post #28

Earlier quoted context omitted.

You generally can’t be charged with trespass unless you refuse to leave when told to do so. An open door to a home is different, but unfenced property is 100% not trespass until you refuse to leave.

That's not true at all. If you are aware that the property you are accessing is not meant for your use, you can be charged with trespassing regardless of if you have specifically been asked to leave or not. It's even possible to be guilty of trespass even if you weren't aware that you weren't allowed on the land. This is negligent trespassing.

Negligence only applies I'm situations where a reasonable person should have known. You're only able to be charged with trespassing whilst being unaware if you were to so ridiculously unaware of your surroundings that any reasonable person in the same situation _would_ have known that they were trespassing.

If a public park blends into somebodies private lawn you can't be charged with tresspassing for stepping over the line.

Post reply on HN