Court: Violating a site’s terms of service isn’t criminal hacking

https://arstechnica.com/tech-policy/2020/03/court-violating-a-sites-terms-of-service-isnt-criminal-hacking/

by LinuxBender • 6 years ago

513 111 6 years ago

arstechnica.com

101404• 6 years ago

"US court"

Reply

LinuxBender3• 6 years ago

updated title

Reply

LinuxBender3• 6 years ago

It was changed back to the original title.

Reply

ipnon2• 6 years ago

This really begs the question: what is?

Reply

duxup3• 6 years ago

Some sort of civil court conflict type situation... at most ... and maybe not even that?

I moderated plenty busy forums that had rules and ToS, but I didn't think of violations as anything more than something that might lead to me terminating an account.

Now one greifer did have a habit of mass producing accounts quite cleverly and the parent company actually sued him in civil court, but that was unique and actually disrupted the entire site with griefing and such. They even got the ear of a local prosecutor who thought that disrupting the site might count as a criminal act. The griefer went away after that and nothing came of it other than filing a civil case and I belive some contact with the local prosecutor... dude agreed to go away forever.

But of course in the example they are talking about just creating a fake account and speaking more generally about ToS violations.

Reply

ipnon2• 6 years ago

Seems to be a duck violation. If it looks like a crime and sounds like a crime ... admittedly not the best metric for equitable justice.

Reply

goda90• 6 years ago

Breaking past security systems. So like scraping publicly facing data might violate TOS, but you can't call it hacking. Using exploits to get the password hashes would be criminal hacking.

Reply

ds2• 6 years ago

Its really not that clear and we will need to wait for the courts to figure out what means what.

For instance this: https://www.theguardian.com/technology/2013/mar/18/at-and-t-...

All they did was "scrape publicly facing data"

Reply

v0tary• 6 years ago

Yea, it also only talks about bypassing/breaking passwords, what if the user has a sticky note at their desk and the password is readily exposed. Is that considered hacking? Should be. Unauthorized access regardless of how irresponsible the owner of that account is. At the same time you do not need a ToS or banner saying that. (it still remains illegal to break/trespass into someone's home without a notice saying so!)

Slippery slope. I'd gander a guess this will continue to be a case-by-case call.

Reply

lidHanteyk• 6 years ago

Welcome to the central failure of the CFAA: Hacking attempts should be treated as a normal part of life, and systems should be designed to resist hacking, but the law gets this exactly backwards. In a saner legislative setting, hacking would be like harmful radio wave interference, something which is both punishable in a court of law but also which devices are designed to consider in the course of normal operation.

Reply

google2341233• 6 years ago

Hacking attempts are treated as a normal part of life and systems are designed to resist hacking. Fortunately, we also have to law acting as an additional form of deterrent.

Reply

dependenttypes2• 6 years ago

hacking would be like harmful radio wave interference

DoS attacks specifically. I would argue that any other form of hacking should not be punishable and it should only be up to the devices to protect against them.

Reply

dependenttypes2• 6 years ago

Hopefully nothing and laws like CFAA get trashed.

Reply

gowld3• 6 years ago

http://begthequestion.info/

Reply

microdrum• 6 years ago

The right decision.

And why would it be? Why should private actors be able to invent new criminal liabilities simply by publishing various terms of service?

Spotify: "If you listen to The Jackson 5 on our streaming service from a location in Ohio on a Tuesday, that is a violation of our Terms of Service."

Federal judge: "You heard the man. Off to jail!"

Reply

duxup3• 6 years ago

Distantly reminds me of the "annoy" website (I forget the exact URL) that was created as a sort of protest of some legislation in the early days of the internet that referenced "annoying" someone (I forget the exact language).

Reply

perl4ever• 6 years ago

Some system that I use at work prohibits "mischievous" use in the banner.

Reply

ds2• 6 years ago

Feels like this is going to create some headaches for prosecuting CFAA cases if the verdict stands.

I suspect the definition of 'unauthorized access' will need to be more clearly defined since I know many cases in the past relied around users doing shit that was unauthorized by the TOS.

Reply

bosswipe• 6 years ago

Good.

Reply

threatofrain3• 6 years ago

Do technical communities have a consensus on how to classify these behaviors or scenarios? Then what anchor do we have?

Reply

CiPHPerCoder10• 6 years ago

The onus should be on the service operators to clearly define what's authorized and what isn't; and if they miss something, the liability should be borne by the service operator, not the person who found their gap.

Reply

clort3• 6 years ago

It should not be the simple act of accessing a computer contrary to the owners terms and conditions that is a crime, but the specific acts of searching for, wilfully accessing and sharing privileged information on systems where the persons whose information you were accessing had a reasonable expectation that that information would be private.

I think that covers police databases, social security and also customer details on a website amongst others. It would not necessarily cover accidentally accessing customer data on a system (that happens) but if you started wilfully sharing that data or details about how to access it with persons other than the owners of the system then you could start to get into the problematic zone. To prevent the scenario where the owners just do nothing and then when the 'hacker' tells somebody else they call the cops and accuse, it should probably be a crime, after being notified that your system is leaking private data, that you didn't take any action to plug that hole.

Reply

CiPHPerCoder10• 6 years ago

I suspect the definition of 'unauthorized access' will need to be more clearly defined

I've been saying this for years! For reasons unrelated to TOS rulings, too.

A little bit of background...

In 2011, I was charged with unauthorized access to a protected computer. The website in question (Infragard Tampa Bay, run by the FBI through a company called Sylint) was running an older version of DotNetNuke that had a 2008 vulnerability.

The nature of the vulnerability was as follows: If you accessed a specific URL which required no authorization, you could upload files to the server and presumably execute them. (I say presumably, because I didn't.)

I wanted to fight the charge because I never exceeded "authorized access" by using a publicly accessible web form on the public Internet, and the CFAA's terms were vague.

* The website was publicly accessible, without needing authorization

* The file upload form was publicly accessible, without needing authorization

* The folder that files were uploaded to was publicly accessible, without needing authorization

* All of my conduct was authorized by the software they ran on the public Internet, and therefore the unauthorized access I was accused of never actually occurred

My overworked public defender didn't have any fight in him. The EFF wouldn't help either (the person I talked to didn't see the significance of this CFAA ambiguity for civil rights). I grew up in a poor family and couldn't afford legal counsel, so I ended up pleading guilty, which has totally fucked my life up ever since. (It really doesn't get better, even 8-9 years later.)

since I know many cases in the past relied around users doing shit that was unauthorized by the TOS.

Good. I hope this becomes a precedent that frustrates prosecutors and helps defense cases in appeals court.

Reply

3pt14159• 6 years ago

Yikes man. I'm sorry that happened to you. If you don't mind my asking, what part of your life is still messed up because of this? Is it directly related to the charges or is it the outcome of spending time behind bars?

Reply

WrtCdEvrydy• 6 years ago

Who charged you? Infragard's sole job is to facilitate data transfer between industry and the feds to ensure there's security at every layer. That's some weapons grade bullshit right there.

Reply

google2341233• 6 years ago

Just because something is connected to the public internet doesn't mean that you can hack it. Most homes are accessible from public roads, that doesn't mean you are allowed to climb through any open window that you see.

You used a vulnerability to hack into some server associated with the FBI, I don't see any ambiguity here.

Reply

simonh• 6 years ago

For me, there's a distinction between accessing information you have not been authorised to access, and doing something unauthorised with data you had authorised access to.

Thats why I don't agree with the article that contrasts the Facebook/Power Ventures case with the hiQ Labs case. These are fundamentally different. Power Ventures was using Facebook Users credentials to log on to facebook and I think thats a clear case of unauthorised access. Facebook had no direct relationship with Power Ventures and had not granted them access to those accounts at all.

In the hiQ Labs case they had legitimate access to LinkedIn and were just scraping publicly viewable information. It's jut that LinkedIn didn't like what they were doing with it.

Of course the SSA database access case from 2010 is an anomaly in this aspect. The user was authorised to access the data if doing so in the course of his work, and I think the police case from 2015 was ruled correctly. In both case they're reprehensible creeps, but they should be prosecuted as creeps, not as hackers.

Reply

danShumway2• 6 years ago

Power Ventures was using Facebook Users credentials to log on to facebook and I think thats a clear case of unauthorised access. Facebook had no direct relationship with Power Ventures and had not granted them access to those accounts at all.

I strongly disagree. Facebook didn't have a relationship with Power Ventures, but it did have a relationship with its own users who granted Power Ventures access to their accounts. And while I admit it's not legally recognized yet, I firmly believe that users have an inherent Right to Delegate lawful access to 3rd-party software products and services[0].

I don't think the Power Ventures case had anything at all to do with unauthorized access. I think it was an attempt by Facebook to block users from exercising control over their own data.

For context, look at the DMCA claims Facebook also filed in that case. It's been a really long battle to fight against the DMCA's unconstitutional provisions against subverting DRM for legal reasons. We have a lot of precedent to see how companies use systems like the DMCA. And the way they commonly use them is not to go after pirates, it's for market lock in and to restrict legitimate users. To paraphrase Doctorow, there are really bad consequences when we allow a company to make it a federal offense to use a product in a way that doesn't make their shareholders money.

Treating ToS violations as a federal crime gives companies that ability on an even broader scale. It's legal to circumvent DRM? Oh, but our ToS blocks that. You exported your own data that you legally own? No, our ToS blocks that. You build a Matrix bridge for your DMs in my chat app and another competing service? Sorry, that's a federal offense now.

A company should not be allowed to arbitrarily invent new federal laws. At most, violating a ToS should be a civil offense, and companies like Facebook should be forced to sue their own users, not providers like Power Ventures.

[0] https://anewdigitalmanifesto.com/#right-to-delegate

Reply

sprite• 6 years ago

How does this correlate to for example accessing a 3rd party API that has some sort of protection, for example an API key or request signature algorithm. Would those be considered a 'password'?

Reply

cl0rkster• 6 years ago

TOS is too vague a term and too broad to cover the complexities that proper legislation in the matter would require. Not to mention, I can write anything I want in my TOS, but you can't enforce illegal terms. People know bad action like they know porn when they see it.

Reply

phkahler3• 6 years ago

"Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote.

IMO that is the most important part of the ruling. You cant have criminal penalties and then delegate the definition of the crime to each website.

Lying or breaking TOS is different than hacking. You are granted access by the site, and it's no different than the access they grant every other user.

Reply

distances2• 6 years ago

Lying or breaking TOS is different than hacking.

I think this is a good analogy: I accepted the terms, but I was lying. Sue me for lying then. TOS are not contracts for sure, as nobody is expected to actually read them and they aren't negotiatable.

Reply

abnry2• 6 years ago

Genuine question: if it isn't a contract, what legal purpose does a terms of service serve then? I assume any website serving a non-paying user has the right to terminate any services at any point, no reason given. A ToS might establish credibility among users as an open display of policy, but I don't see a legal purpose.

Reply

chacham15• 6 years ago

TOS are not contracts for sure

Please be careful when you make legal claims, especially when they probably arent true. IANAL but AFAIK most TOS fall under whats called a shrink wrap contract: https://en.wikipedia.org/wiki/Shrink_wrap_contract

Reply

SkyBelow• 6 years ago

What happens when this logic is applied elsewhere?

Lies for financial gain can become fraud. Is it acceptable to make it so lying for financial gain won't be a crime? What about lying for the sake of obtaining consent? Legal jurisdictions are starting to make this a crime, at least in limited instances (such as lying about use of certain birth control measures).

One can even look at social engineering, which is considered a form of hacking, that specializes in lying to people or presenting false narratives.

These all seem edge cases that still need to be handled.

Reply

wang_li2• 6 years ago

Contracts don’t have to be negotiable.

https://legaldictionary.net/adhesion-contract/

Reply

alasdair_6• 6 years ago

You cant have criminal penalties and then delegate the definition of the crime to each website.

How does this differ from criminal trespass, where each landowner can define permitted use versus trespassing however they wish?

Reply

jMyles• 6 years ago

That is not in keeping with the tradition of trespass, and is probably a similar mistake in the (relatively few) jurisdictions that have tried to craft such a framework.

Also, using biblical proportions to describe undesirables traversing your land is melodrama in the extreme.

Reply

Dylan16807• 6 years ago

The only criminal act in trespassing is coming back after being banned. Whatever you did to get banned is not a criminal issue.

And as far as I know trespassing bans have to be a manual blacklist or whitelist. You can't define some arbitrarily complex behavior that makes you into a trespasser. Maybe I'm wrong on that?

Reply

emiliobumachar• 6 years ago

Presumably not very different. I assume you also cannot have individual customers fined and jailed for violating clause 336b of the 30-page contract everyone signs without reading before stepping into your store. And if you can, that's messed up.

Reply

infogulch2• 6 years ago

A webmaster can deny any kind of access they don't want by just not serving to them, just like a landowner can put up a fence. People on the outside can still look over the fence from a public space perfectly legally, like a webmaster serving their homepage to everyone, and the landowner can't demand of people outside the fence, for example, "You can look over the fence, but only if you don't make a mean face at me". If you don't want people to look at all, well, don't make it public and put up a wall instead, and require authorization to enter.

If the landowner voluntarily allows someone inside, they can have pretty arbitrary rules about what people are allowed to do inside (in addition to the actual law), but the only real recourse they have to enforce their arbitrary rules once broken is to evict an offender to the outside. They don't get to pretend that their arbitrary rules are suddenly laws punishable as if they were a crime.

Reply

michaelmrose• 6 years ago

In practice people are convicted of criminal trespass when they have either obviously entered unlawfully or have entered lawfully and have been told to leave and have not done so.

If a property posts a sign or sends a letter that only people wearing green may enter. If we allowed the owner to prosecute people found to be on the premises without the correct color even if they leave immediately upon being asked to we would indeed be letting the property owner enforce their whims within the scope of their property with punishments handed down by official channels.

In practice this is basically impossible in most or probably all jurisdictions although probably untested in virtually all instances. Basically almost nobody would press such a case and if they did the local government would be unlikely to pursue such charges or succeed in them if pursued.

Such matters are inherently local and subject to local laws but lets look at the city of Seattle as an example. In Seattle you can call the cops if people are on your property and wont leave however even in that obvious case prosecution is unlikely unless some other crime is committed in the process. The city pursuing a case against people that merely broke your personal rules for conduct on your premises isn't explicitly mentioned not because it is allowed but because it is beyond the pale of absurdity.

Reading for example the guidance provided by the city of Seattle I read that local businesses partner with law enforcement to remove bad actors according to the contact trespass program.

The Contract Trespass Program is an agreement among private property owners, businesses and the police department to regulate conditions of entry onto their private property. This can include prohibiting people on the property altogether, or it might involve allowing people onto the property only under certain conditions.

The conditions that can be enforced through the Contract Trespass Program are listed in the agreements

and posted on the premises. By signing a contract with the police department, property owners agree to let police officers

warn and then arrest people who continue to violate the conditions

when the owners are not present.

They enumerate the reasons they will cooperate in removing parties and arrest people who have been warned by authorities that they are in violation.

Looking further into the matter businesses don't HAVE to participate in the contact trespass program but they are told that

Officers may still arrest for violations of SMC 12A.08.040 (Criminal Trespass) on private property regardless of a trespass warning agreement if someone with the authority to set the conditions of entry or revoke the privilege to be on the property has previously warned the individual of the trespass violation and will testify as a witness

They might arrest people who have been previously warned if they are still there when the cops arrive

They are further warned that

For a successful prosecution, someone with the authority to control the conditions of entry and revoke the privilege to be on the property must testify that the person (1) knew or should have known the conditions of entry, (2) violated the conditions of entry or had their privilege to enter the property revoked, and (3) the person refused to stop the unlawful behavior or leave or they returned to the property after having their privileges revoked. Property owners are encouraged to keep detailed records of the interactions with trespassers on their property.

Please note especially

the person refused to stop the unlawful behavior or leave or returned to the property after having their privileges revoked

In summary the two situations are exactly alike in the alternate universe in which trespassing is used in that fashion but instead of suggesting a weakness in the defense of such CFAA act cases it suggests that were trespassing laws used in such a fashion they ought to be challenged under the same premise.

Reply

UweSchmidt• 6 years ago

Who is really reading a site's terms of service, or EULAs etc.? We mandate food companies to clearly label items with standardized, readable and compact information, but software companies can confront users with text that could only ever be interpreted by bored lawyers. The idea that this could be 'binding', let alone leading to a 'crime', is silly to me.

Reply

orthecreedence• 6 years ago

Who is really reading a site's terms of service, or EULAs etc.?

I do. I make a point to take the first five to six hours of every working day reviewing the ToS for each website I'm projected to visit that day.

I diff the text against known past versions and if there are significant enough changes to any particular ToS, I stop using that site until I can sit down in-person with my $550/hr lawyer (usually I only do this once or twice a week) and review the changes to make sure I'm clear of all liabilities for my projected use-cases. Once I get the go-ahead, I resume access to that website.

Overall the process only takes on average 30 hours a week, and the costs are around $2000/week. It's worth it though, I wouldn't want to break any rules set by private land owners (whether virtual or not).

Reply

vbezhenar• 6 years ago

Will your lawyer be accountable if you would break some rule because of his error? Did you sign any papers about his accountability? Were those papers reviewed by independent lawyers?

Reply

kingbirdy• 6 years ago

Worth noting this is only a district court ruling, and as the article notes there are a number of conflicting circuit court rulings on the issue. Until a case makes it to the Supreme Court, it's not safe to take this as a given nationally.

Reply

tyiworld• 6 years ago

Yikes

Reply

peter_d_sherman2• 6 years ago

Here's an interesting legal question:

If you use the public internet to go to a public website's landing page, by doing that, do you automatically accept a website's Terms Of Service (contract)?

I would argue no, because the social custom is that public-facing websites are intended to be accessed by the public, and until and unless they explicitly accept a contract (such as a Terms Of Service agreement), there is no contract...

Now... I could be wrong.

In fact, lawyers could argue that there is a social contract, an implied contract (they do this with Negligence claims) even before there is a written contract...

So, I'd be interested in arguments, both for and against, with respect to the presence or absence of a contract, either express or implied...

(We can all agree that if a website creates a pop-up or page which says "By using this site, you accept the terms of service", and if you click "Agree", you agreed (well, unless you do not have the capacity to do so, or other factors apply... <g>)... that's not what I'm soliciting arguments for here...)

Reply

Spivak• 6 years ago

At minimum I think most people would agree that the "default ToS" probably would cover malicious actions and unintended access in both directions.

Reply

peter_d_sherman2• 6 years ago

My question is not about what the default ToS covers or doesn't cover, my question is about when/where/how/if -- someone on the Internet accepts a ToS...

And it's not really a question.

It's a solicitation of opinions.

To understand what I'm asking for, you must have an understanding of Contract Law.

That is, what is a contract, when are they accepted, how are they accepted, etc.

OK, now given those understandings, apply that to a public website.

How does/would someone in the public accept a public website's ToS, other than clicking "I agree", when presented by a page or requester saying "Do you agree to accept this website's ToS?".

Does it happen?

If so, why so?

If not, why not?

I'm looking for compelling arguments, both for and against, both pro and con...

Reply

jdmichal• 6 years ago

IANAL. I would start with consideration. What's the consideration from the site that would form a contract? Access that is freely granted to the public anyway? Could I write a contract in which the only consideration I give is access to a public park? The counter argument would be that internet sites are private. Something more akin to a store than a public park.

I would also include meeting of the minds. At someplace like a gym, you sign your contract and exchange consideration before being granted access. In other words, in order to gain the consideration of access, you must agree with the gym's offer. Sites with required login to gain access work like that, but not "public" websites. They're more like stores than gyms -- anyone can walk in and access is not restricted. [0] So where is the meeting of the minds when I type in a URL and the page loads?

[0] Access can be revoked, since it's still private property, but then your crime is in not leaving or reentering after revocation -- entering in the first place was legal.

Reply

antpls• 6 years ago

I'm not a lawyer, I live in Europe. I remember having read somewhere that it is related to clear consentement principles (in the same spirit that the cookie laws and GDPR). At least in Europe, I believe you must be presented to a ToS and a clear, explicit, "I accept" button for the ToS to be valid. I could be wrong, and/or it may only be valid in Europe

Reply

Court: Violating a site’s terms of service isn’t criminal hacking

Related Stories