Until Today, If You Were 17, It Could Have Been Illegal To Read Seventeen.com

https://www.eff.org/deeplinks/2013/04/until-today-if-you-were-17-it-could-have-been-illegal-read-seventeencom-under-cfaa

by leephillips • 13 years ago

163 101 13 years ago

eff.org

TazeTSchnitzel3• 13 years ago

As a seventeen-year-old myself, I am now even more glad that I do not reside in the United States.

I wonder if anyone reads T&Cs, though. Perhaps I should prohibit over-18s from using my websites.

fyi802• 13 years ago

over-18s are adults, and so it should be easier to stick criminal charges on them.

Only problem is that victims can't press criminal charges, only the state can. So these laws are purely tools of the corrupt state actors and their cronies.

peterwwillis• 13 years ago

It would be great to see access log statistics of big websites' terms of service pages.

fyi802• 13 years ago

How can a TOS tell someone (a minor) that the person is forbidden to accept an agreement, while simultaneously holding that person subject to that agreement?

It's a paradox in the space-time continuum.

Has any court tested the theory that a minor can be held in violation of a TOS? Contracts entered into by minors are void on their face.

This seems a lot like having a "NO Trespassing" sign in the bathroom of a coffee shop, and then prosecutors charging people who walk in the front door.

TazeTSchnitzel3• 13 years ago

Hmm, it's an interesting problem. Does the ToS cover the ToS page? Am I breaking the ToS by viewing the ToS?

Digit-Al2• 13 years ago

Good point. If you put a final clause on your ToS that said "Reading these terms of service is a criminal offence" could you make criminals out of everyone who reads your ToS? :-)

BenAlabaster• 13 years ago

It's about more than having holding someone to an agreement they're legally forbidden to accept. It's holding someone to an agreement they don't have facility to read without breaching the agreement. Their terms of service are on the website which the minor cannot read without accessing the website... by which time they are guilty of breach of the terms of service. I don't think I'll never understand the idiocy of American law.

apg2• 13 years ago

You could also say that the agreement is void w/r/t a minor, because they don't have capacity to contract, via Statute of Frauds. Of course there are plenty of times when they can contract, but TOS in general seem completely obtuse and not actually conducive of anything worthwhile.

ctdonath2• 13 years ago

"You hadn't exactly gone out of your way to call attention to them had you? I mean like actually telling anyone or anything.' 'But the plans were on display...' 'On display? I eventually had to go down to the cellar to find them.' 'That's the display department.' 'With a torch.' 'Ah, well the lights had probably gone.' 'So had the stairs.' 'But look, you found the notice didn't you?' 'Yes,' said Arthur, 'yes I did. It was on display in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of The Leopard".'" -- Douglas Adams.

cdrxndr• 13 years ago

Check out the Oglaf.com landing page for a funny play on this paradox (somewhat NSFW ... really funny, too).

It amounts to:

* If over 18: Select "Over 18".

* If not over 18: Get your parental guardian, who is over 18, to select "Not 18" on your behalf.

dangrossman• 13 years ago

Contracts entered into by minors are not void, they are voidable, and only by the minor before the age of majority or a reasonable time thereafter. Minors enter into contracts every day -- millions of them work, for one, and child actors' contracts are in their name, not their parents'.

Digit-Al2• 13 years ago

The law seems to be fundamentally broken when it comes to minors. This is basically saying "we don't think you are mature enough to look at this content, but if you do look at it we will consider you mature enough to take criminal responsibility.", which is absolute bull. Surely we should either say that they are responsible or that they are not.

aethertap3• 13 years ago

Perhaps it's time for a new SOPA blackout style campaign based on changing terms of service. If a large number of popular sites modified their terms of service so that it became illegal to view those sites for anyone in public office, maybe the absurdity of the whole thing would become evident to the people behind this.

erichocean• 13 years ago

That's actually an interesting idea:

Would a ToS hold up in court that specifically denied access to the company's service by government employees?

If a company had that in their ToS, and they discovered that a government employee had used their service, could they sue for damages?

Are businesses in the US obligated to provide service to government employees?

aethertap3• 13 years ago

I don't think that government employees hold any special privilege in terms of private contracts, but I don't know. At the very least, it would be interesting to find out.

I know that recently there have been some gun shops that have been refusing to serve government employees, so there is at least a small amount of precedent.

DanBC2• 13 years ago

Why isn't this being used to aggressively prosecute spammers?

Sending unsolicited bulk email has been against the ToS of many service providers for very many years. There's real financial harm done. And spam is disliked by very many people.

Vivtek• 13 years ago

Because spam doesn't threaten anybody who counts.

Next question?

jiggy2011• 13 years ago

How many spammers are even in the US?

snowwrestler• 13 years ago

Because courts have ruled that it's not actually illegal to violate terms of service.

Note how the headline says it "could" have been illegal--if the Justice Dept. had decided to prosecute a teenager on these grounds (never heard of that happening), and if a federal judge had handed down a conviction on those grounds (the 9th Circuit actually ruled the opposite).

DanBC2• 13 years ago

As explained in the article the Justice Department uses fierce interpretation of the law.

While the law stands in its current unclear state people are still at risk of prosecution. Conviction might be improbable, but it's still an unpleasant situation to be in.

Courts show that judges are not unanimous about this. (https://www.eff.org/cases/u-s-v-nosal)

Note that the Nosal case was a person who was permitted to access to computer, but who then misused information got from it, and not someone who was prevented from accessing the computer.

(https://www.eff.org/deeplinks/2013/01/rebooting-computer-cri...)

rmc2• 13 years ago

Because it's very very hard to track down spammers.

_kst_2• 13 years ago

I wonder if particularly serious violators would be tried as adults.

apg2• 13 years ago

With the right case, I don't see how this would withstand Supreme Court review. The Ninth Circuit doesn't seem to like it (Drew/Duval). My guess is the the SCOTUS wouldn't approve of private parties drafting their own criminal laws.

kefka• 13 years ago

Do you want to run foul on multiple felonies (1 per day per ToS violation) along with dozens of other "felonies" that you undoubtedly commit without knowledge.....

Just so you can petition the Supreme Court to take your case, knowing that they can just sit back instead and do nothing?

Wasn't there this Aaron kid that got hit by that very tactic? Hmm. He didn't take the "decades in prison" so well, did he?

diminoten7• 13 years ago

Aaron was sick, don't pretend like anyone under that kind of pressure would simply kill themselves.

rayiner2• 13 years ago

Yes, because I try to evade a major defense contractor's attempts to kick me off their network dozens of times a day.

mpyne12• 13 years ago

> He didn't take the "decades in prison" so well, did he?

So the example you take from what happened to Aaron Swartz is to apply yet more propaganda from the other side, instead of facts?

It's not even something you have to mislead about; 2-3 years in prison as an upper-end estimate is bad enough to make your point without being evasive, and even the ~6 months upper limit that the prosecution had offered in a plea bargain is said to be serious enough to make your point.

You could even mention that Aaron would have been a "felon" should he have been convicted or plea guilty on those charges and you'd have been accurate.

And yet you choose the only outcome that wasn't actually possible to push your point forward...

hmottestad3• 13 years ago

I wish someone would take the HTTP codes literally:

"200 OK" = You just gave me irrevocable permission.

Or you know, if anyone sues you for copyright infringement, you should sue them back for hacking, since you obviously put the following in your terms of service "you may not access this site if you sue me in the future".

antihero• 13 years ago

What would 500 Server Error mean, legally, if you did SQLi and it broke the script?

This isn't a hugely well thought through idea.

shitlord• 13 years ago

I don't mean to be disparaging, but HTTP status codes have been well-documented. The only issue is that they are used poorly/incorrectly so often.

If you can't use HTTP status codes properly, then you simply aren't in a position to subjectively characterize someone's request as impermissible/unauthorized. This is especially the case when the server's choice to grant access conflicts with your intentions.

jessedhillon• 13 years ago

HTTP statuses are not a semantic description. `200 OK` means only that the transfer of a document can take place -- the legality of the request is a different matter. This would be like holding DOT engineers responsible for making it possible to drive drunk, since the roads have no features to prevent offenders from entering the highway.

maxerickson3• 13 years ago

Your analogy is extreme.

A better one might be having a section of road connected to public roads that it is illegal to drive on.

This is still hugely problematic, because it invites discussion of the intent of the operator and the intent of the driver and ignores the part where it is not particularly difficult to put up an effective barrier.

AnthonyMouse2• 13 years ago

>`200 OK` means only that the transfer of a document can take place -- the legality of the request is a different matter. This would be like holding DOT engineers responsible for making it possible to drive drunk, since the roads have no features to prevent offenders from entering the highway.

You're confusing violating a law with violating the law. If getting "200 OK" means you were authorized and can't be convicted of unauthorized access to a computer, but you proceed to purloin credit card numbers and make fraudulent charges to them, you're still going to jail for credit card fraud.

The real issue is that "unauthorized access" is hopelessly ambiguous if you don't use the likes of protocol status codes, and totally redundant if you do.

If you get "200 OK" then you haven't made unauthorized access because you were authorized. If you get "403 FORBIDDEN" then you haven't made unauthorized access because you were denied access. That interpretation makes "unauthorized access" impossible to achieve, because if access is denied then there is no access to be unauthorized and if access is granted then it is authorized access.

The trouble is that the alternative interpretation is even worse: If you can't rely on what the machine tells you, how do you know when you're authorized? Some cases are really obvious (e.g. you are not authorized to places orders against just any random customer's credit card), but those situations are pretty much always separately illegal regardless of unauthorized access. What that leaves is the hopelessly ambiguous cases, which is what allows prosecutors to argue that violating terms of service or downloading too many journal articles is a federal felony. I'm still not convinced that those cases need to be illegal at all -- and if you can articulate a specific one that ought to be then by all means prohibit it explicitly and stop with the blanket prohibitions on whatever "unauthorized access" is supposed to mean if it doesn't mean what the machine allows you to do.

axusgrad• 13 years ago

This law seems analogous to allowing arbitrary code execution; a public website can write it's own law for anyone visiting the site, and hit them with a felony.

larrys• 13 years ago

"But the real problem is the CFAA, which allows prosecutors to use these silly terms to manufacture computer crimes."

This is all ridiculous. While I understand the point of the post, and it makes for great mainstream media play, it's total hyperbole. The fact that prosecutors can do something and what they would reasonably do are two different things. To wit exceeding the speed limit by 1mph could get you a ticket but almost never gets you a speeding ticket.

aethertap3• 13 years ago

I think the part people are worried about is the "almost" in "almost never gets you a speeding ticket."

People will probably almost never be prosecuted for this kind of thing, unless they're looking for an excuse to prosecute someone. I take little comfort in the idea that I'm relying on prosecutors and judges to be reasonable, and I think it's worth taking action when laws like this make arbitrary enforcement possible.

unimpressive2• 13 years ago

Yes, but heres the thing, on a bad day, if the police decide to single you out, you can get a traffic ticket for being 1mph over the speed limit.

Usually it doesn't make the news because the consequences are something between having to stand up to the police in court and a 300 dollar fine. Nobody cares if you get a speeding ticket over nothing.

The way that the CFAA is written, you can levy felony charges against basically any internet user with impunity. So if the Department of Justice decides to single you out, they can hit you with crazy multi-decade felony charges for the lulz.

And then you end up on the front page of the New York times for killing yourself.

diminoten7• 13 years ago

Police don't enforce laws, judges do.

A judge would throw this out (this being either the 1mph over ticket or the 17-year-old reading Seventeen), and the prosecutor who brought it forward would end his career.

rayiner2• 13 years ago

You can only be hit with a misdemeanor for violating the CFAA. It upgrades to felony status only when in furtherance of another crime.

A lot of this could be solved by getting rid of the misdemeanor penalty, and making it a felony only in conjunction with the commission of another felony.

CamperBob23• 13 years ago

Unreasonably low speed limits aren't posted to let the cops pull over everybody. They're posted so that the cops can pull over anybody.

Same story here. It's frankly disturbing how few people understand this.

mattstreet• 13 years ago

YUP and you get run off the road half the time if you're only driving the speed limit. And risk pissing off the cops when they aren't ticketing for going too slow.

arjie• 13 years ago

Selectively enforced laws are terrible. They are tools for enforcers to discriminate. Naturally most people aren't bothered. Most people do not attract the eye of Sauron.

gamblor956• 13 years ago

Every time I think about opening up my wallet and donating to the EFF for their various successful efforts, they turn around and post something stupid like this.

They should stop letting 1st year law students write these ridiculous rants. Courts have almost all rejected attempts to criminalize website TOS violations. Indeed, courts have generally held that TOS is binding only against the company, since the company by the terms of the TOS is free to change the terms at will without prior notification to visitors.

CamperBob23• 13 years ago

Fellow named Aaron Swartz might disagree with you there. A big part of the charges against him centered on violation of the JSTOR ToS.

Relying on courts to interpret a law the way that you happen to like seems, well, pretty goddamned stupid. Let's fix the law.

Zimahl2• 13 years ago

The bulk of the Aaaron Swartz case was around distribution of copyrighted material which he was allowed access to but not distribution of. This is not merely a ToS issue as there are laws against distribution of copyrighted material.

notahacker• 13 years ago

Yeah, it's pretty obvious here that the problem lies with Hearst Media having ridiculously stupid terms and conditions, as much as the EFF would like to chastise the DoJ for retaining (but not exercising) the right to cite them in a prosecution.

It's "reasoning" on a par with citing lawyer-spam emails as evidence of the need for tort reform.

[To clarify, since I seem to be attracting downvotes, I'm not saying there isn't a potential problem with lack of clarity over whether any ToCs can be used as a basis for criminal prosecution (or for that matter with frivolous litigation). I'm saying that highlighting an absurd ToC that nobody would be remotely interested in enforcing is a poor argument against the enforceability of ToCs per se (similarly: legal threats so spurious they're actually embarrassing don't actually say very much about civil law). Worse still, it's actually counter-productive since the lack of any interest in prosecuting absurd ToCs could be construed by those in favour of criminal penalties for ToC violation as showing the DoJ's discretion works.]

pessimizer• 13 years ago

Or, more specifically: "Thankfully, the Ninth and Fourth Circuits have rejected the government’s aggressive interpretation of the CFAA (with amicus help from EFF), but the Justice Department has shown no signs that it has given up on aggressive interpretations."

source: TFA.

guelo• 13 years ago

You won't donate to the EFF because the EFF helped win some of these cases so far so the EFF shouldn't raise the issue anymore?

squozzer• 13 years ago

TOS violations can be analogized into one of several types of real-world crimes -- trespassing, vandalism, or theft. Generally all of these crimes require the victim to press charges. Except they occur through that lovely Internet, so the feds involve themselves and who knows under what circumstances they would disengage? Certainly Hearst did not intend to keep teen girls away from Seventeen -- who else would read it? The option to press charges is probably all that's needed.

tenpoundhammer• 13 years ago

What do you get when combine horrible lawmakers with horrible corporations?

                ▲
                |

dromidas• 13 years ago

It's a good thing nobody actually reads seventeen.com... except advertisers who are trying to figure out what people much younger than them are supposed to like. Which of course is all wrong because it's created by older people.

GHFigs• 13 years ago

Which of course is all wrong because it's created by older people.

I wouldn't be so sure of that. The demographic for many magazines are people aspiring to be something they're not and actively seeking to know what they should like.

e.g. The demographic for Seventeen is 10 to 16 year old girls that want to feel older and more mature; the demographic for GQ is mostly men that can't afford most of the things on display in GQ.

zaroth• 13 years ago

The law should be changed, or overturned as unconstitutional, but that is a higly uncertain and lengthy process.

In the meantime, could we start a grassroots campaign to get companies to explicitly state at the top of their ToS that a violation of the ToS may be arbitrated only and does not constitute a 'unauthorized access' under CFAA?

Obviously the EFF would have to draft the exact clause, so that actual destructive hacking can still be prosecuted.

This sounds tricky, but if the EFF can't write something we could put in the ToS to protect users from the Feds trying to extort cooperation from users by abusing CFAA (a la Aaron) then how can we expect legislators to get it right?

Specifically some things the ToS should define is how "damages" will be defined, proper ways to disclose vulnerabilities, things which are NOT considered subverting access control, and a lower standard for trespass of online chattel which required actual damage or dissemination.

Until Today, If You Were 17, It Could Have Been Illegal To Read Seventeen.com

Related Stories