Court Holds That Circumventing IP Address Ban Is “Access Without Authorization”

http://www.volokh.com/2013/08/18/district-court-holds-that-intentionally-circumventing-ip-address-block-is-unauthorized-access-under-the-cfaa/

by maalyex • 13 years ago

149 133 13 years ago

volokh.com

maalyex3• 13 years ago

Admittedly a sensationalistic headline on my part

The title of the linked article is "District Court Holds That Intentionally Circumventing IP Address Ban Is “Access Without Authorization” Under the CFAA".

Violating the CFAA is, of course, illegal. From the linked article: "During the debate over the Aaron Swartz case, one of the legal issues was whether Swartz had committed an unauthorized access under the CFAA when he changed his IP address to circumvent IP address blocking"

This particular ruling relates to Craigslist.

http://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

dpeck• 13 years ago

I may be remembering wrong, but I believe in the Swartz case it was about spoofing his MAC address?

maalyex3• 13 years ago

From the article: "There was significantly more to the CFAA charges than that, to be clear, including circumventing a subsequent MAC address block and (most significantly) entering an MIT storage closet to install his computer directly. But changing IP addresses to get around IP address blocking was at least one of the possible grounds of unauthorized access."

fnordfnordfnord4• 13 years ago

I've done a lot more than that on gov't networks just to get slides to show up on a conference projector.

anigbrowl12• 13 years ago

It's not 'about' spoofing his MAC address. It's about respecting the rights of property owners to set the terms of how other people may access their property. You know, when someone is charged with burglary the issue is not that they entered your place through the window rather than by ringing the doorbell, but that they entered without your permission. Try to imagine the outrage that would result if a judge said 'it's your fault for having an insecure window, tough luck.'

EDIT: I might add that I don't care for JSTOR or the copyright system that they derive such benefit from. But then I don't especially care for our laws on taxation and related subjects - my disagreement with those doesn't give me the right to opt out of taxes that I dislike, or to appropriate the possessions of others whose wealth I might envy.

cynicalkane• 13 years ago

First, editorailized headlines are not allowed by site rules. (EDIT: The headline is now changed. It previously read, "Change your IP, go to jail" or something like that.)

Anyway, Craigslist told 3taps in a legal notice: "Don't abuse our website." 3taps did anyway. IANAL but this appears clear from the second and third quoted paragraphs (and Orin Kerr, a noted expert on these things, seems to agree):

The banned user has to follow only one, clear rule: do not access the website. The notice issue becomes limited to how clearly the website owner communicates the banning. Here, Craigslist affirmatively communicated its decision to revoke 3Taps’ access through its cease-and-desist letter and IP blocking efforts...

You might as well say, "Enter a building, go to jail"... if the door is a side entrance to a privately owned public space (such as a shop) which has banned you from their property. That is how the judge sees it.

I personally have some sympathy for 3taps and I expect most of HN does also. The open Internet is not like any old public space. But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.

joe_the_user2• 13 years ago

IANAL too and I support Aaron 1000% but the outrage just misses the basics of Anglo-British law.

I am sure that court would hold that [throwing your bubble gum on the side walk] would constitute "Access Without Authorization" if it believed that this act was done with that intent. Because our legal system is ultimately about intent, not action. If [throwing your bubble gum on the side walk] is done with the intent to murder, it would constitute attempted murder, etc...

Edit: All that said, the bigger questions would come down to "the legality of the shrink-wrap-license" (now featured as the "click-through-but-unread-license") question.

gpcz• 13 years ago

Correct me if I'm wrong, but I believe you need to have actus reus (guilty act) and mens rea (guilty mind) to prosecute. Therefore, in addition to intent, the prosecution would have to show that throwing bubble gum on the sidewalk was an act that could lead to murder / lead to accessing a computer system without authorization. In that case, all this talk about what is/isn't authorized access still complies with the basics of common law because it defines what is an actus reus.

Disclaimer: IANAL either.

afarrell• 13 years ago

Guilt for most crimes requires two parts: - Intent, willfulness, recklessness or perhaps even negligence. This is the "mens rea" or "guilty mind" - An action which is a product of that guilty mind, the "actus reus" or "guilty act" Part of the latter is that the act has to actually reasonably be able to result in the harm of the crime.

I am not a lawyer, but the author of The Illustrated Guide to the Law is: http://lawcomic.net/guide/?p=266 You should read all of it.

maalyex3• 13 years ago

First, editorialized headlines are not allowed by site rules

Apologies. I suppose I should have known this, but I didn't (I've seen many such headline over the years).

But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.

If this ruling sticks, I can imagine that instead of blacklisting an IP, standard practice will be to return a web page saying "you are hereby notified...".

How do you legally notify someone if all you know is their IP? (serious question, IANAL)

saraid216• 13 years ago

How do you legally notify someone if all you know is their IP? (serious question, IANAL)

I don't know about legally, but Wikipedia keeps informing me that I have a new message. When I look, it's an IP-based user talk page and the message is from 2008. I'd naively consider that sufficient, but maybe a better-informed legal scholar with technical chops wouldn't.

I mean... I wasn't even living at this address or subscribed to this internet provider in 2008.

mpyne5• 13 years ago

How do you legally notify someone if all you know is their IP? (serious question, IANAL)

That is a great question, but the case you linked had zero such ambiguity, and in fact is one of the more straightforward CFAA rulings I've ever seen on HN.

bradleyjg3• 13 years ago

You have to find their upstream and subpoena their DHCP (or equivalent) records. That's what the plaintiffs in the P2P lawsuits have been trying to do. You may not be successful for a variety of reasons. In that case this ruling would not apply.

Not the ruling is precedent anyway, since it is a district court (lowest federal court) order.

anigbrowl12• 13 years ago

I personally have some sympathy for 3taps and I expect most of HN does also.

I don't. Craigslist said 'stay off our site' and they refused. I do not subscribe to this HN meme that 'if you can hack it, you should enjoy the benefits.' All that has resulted in is a security arms race which doesn't benefit anyone.

eksith2• 13 years ago

All that has resulted in is a security arms race which doesn't benefit anyone.

Except arms manufacturers/discoverers.

AsymetricCom3• 13 years ago

The obvious correct action in this case from 3taps was to pay someone else to use the site as a proxy ie. have someone else go there and deliver the goods to you.

chacham152• 13 years ago

I think where we have sympathy for them is in that they solve a problem / are trying to provide value to people when craigslist has refused to do so. We dont like that innovation is being thrown out because it isnt in the controlling companies best interests. I understand that the right to control your software/hardware comes first (and would not ever change that), but it just sucks that this is the result in this case.

6d0debc071• 13 years ago

All that has resulted in is a security arms race which doesn't benefit anyone.

On the contrary, if we lack low level predators on a short feedback/evolution cycle, then the high level ones operating on a longer cycle will be more effective when the threat environment changes abruptly.

bradleyjg3• 13 years ago

The open Internet is not like any old public space. But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.

I don't see why we should sympathize with the 'ordinary' IP changers. I read a number of blogs plagued by persistent trolls. Why shouldn't the proprietors of these blogs have a legal tool available to deal with those who won't take a hint?

It comes up here from time to time. People strongly disagree with this or that poster being banned. That's fine, people can disagree. But what 'right' do you have to post on pg's site after he unequivicably tells you he doesn't want you to?

chacham152• 13 years ago

An issue is that an IP ban is not the same as giving a person notice that they are banned. For example, some consciously use tools which change their ip and or mac addresses on a regular basis; not for nefarius purposes, but simply to protect their privacy. These are the 'ordinary' IP changers in my experience. These people would never know that they've been banned from such a site if the site were to ban them in that way. The referenced case is different because the banned party was given direct legal notice.

runeks3• 13 years ago

But what 'right' do you have to post on pg's site after he unequivicably tells you he doesn't want you to?

No right. Similarly, a blogger has no 'right' to be able to keep a certain person from posting comments on his blog.

graycat14• 13 years ago

Sure, but what the heck is the proof that 3taps continued to abuse the Web site? That the Web site got traffic on the IP address they banned is not solid proof that 3taps was using their Web site.

mpyne5• 13 years ago

I assume you didn't read the article? 3taps used a proxy to show up to the website from a completely different IP.

Either way it's easy enough, just see if 3taps has data from the craigslist website that was after the effective date of the IP block and C&D letter being received.

dewiz• 13 years ago

> First, editorailized headlines are not allowed by site rules. (EDIT: The headline is now changed. It previously read, "Change your IP, go to jail" or something like that.)

sorry if I find this amusing, the article is also about rules and people interpretation of them, freedom to access information, broadly speaking freedom. As journalists are free to make up their title when reporting news, interpreting by their PoV, why are we not allowed to do same? Don't get me wrong, good rules are good (though yhey require trust), but that comment on this very news made me smile.

icebraining• 13 years ago

As journalists are free to make up their title when reporting news, interpreting by their PoV, why are we not allowed to do same?

We are, just not here.

mseebach2• 13 years ago

why are we not allowed to do same?

We are, just not in the link title field. From the guidelines: If you want to add initial commentary on the link, write a blog post about it and submit that instead.

crististm3• 13 years ago

"First, editorailized headlines are not allowed by site rules" - so you must be one of the know-it-all gods of HN that enforce ethical behavior on us, mere mortals.

crististm3• 13 years ago

So calling BS gets you the wrath of HN gods. What a bunch of self sufficient arrogants.

diminoten• 13 years ago

But the ruling doesn't threaten to ambiguously target people who just change an IP to get around an ordinary IP ban.

Doesn't it? What's stopping me from being prosecuted for accessing a site I've been banned from, as a person instead of (in this case) a business model?

aj700• 13 years ago

I don't understand. Does the article say that changing your ip is wrong and precedent-setting as such. Has Aaron, with all respect to him, left us ironically with the tyranny of true names? Legal precedent nationally across the US?

lotharbot7• 13 years ago

"Does the article say that changing your ip is wrong"

No.

The article says that circumventing a measure which you know was put in place to keep you out (in this case, an IP ban which followed a C&D letter) means you are intentionally committing "unauthorized access". Changing IPs just happened to be the method used to gain said unauthorized access.

If you tell me I'm banned from your store, and then I shave my beard and change my shirt specifically so you won't recognize me when I sneak back in, that would likewise be "unauthorized access". This doesn't mean shaving and changing my shirt is wrong, just that doing it for the purpose of accessing something the owners have told me not to access is illegal.

bigiain4• 13 years ago

Meanwhile, here in Australia:

http://www.abc.net.au/news/2013-07-29/geo-blocking-mps-commi...

"A federal parliamentary committee has recommended that consumers find ways to lawfully evade technology that allows IT companies to charge up to twice as much for their products in Australia."

" … said the report had made 10 recommendations to lower prices, included educating Australian businesses on how to bypass geo-blocks."

chii3• 13 years ago

even if evading geo-blocking is lawful in australia (whether it is or not is another question), services like Steam, if they detect that you did such a thing, have the option of revoking access to your account, and you lose out. And the amazing thing is, steam's revocation is completely legal (plus you also agreed to it in the EULA).

This whole thing is completely anti-consumer. The law needs to catch up and make sure that consumer has the same protection as physical goods.

bigiain4• 13 years ago

The optimist in me hopes this is a sign of "the law" doing its slow and steady "catching up". This was the report of a parliamentary inquiry - this was asked for and delivered to our lawmakers. If I were a business with a model predicated on geo-blocking and intending to do business with Australians, I'd be looking for a way to ensure by business model works _without_ that artificial barrier. (I'd suggest that like many consumer laws, you will no more be able to rely on click thru Eula clauses to enforce this than you can evade "fit for purpose" requirements in physical goods)

mehwoot• 13 years ago

That's a parliamentary committee. It isn't the law. In Australia, you can be charged with computer hacking at the lowest level for

Accessing data that is subject to an access control restriction (Commonwealth, ACT, NSW, Victoria).

I'm pretty sure that would fall well within what happened here, so let's not be too smug.

niels_olson• 13 years ago

If this applies to IP addresses, it should seem reasonably short work to show that it applies to physical addresses. In which case, patent trolls may quickly be a thing of the past.

chii3• 13 years ago

pray tell, why is that?

joshmn• 13 years ago

So proxies are illegal too!?

alan_cx2• 13 years ago

Well, it depends what you use them for.

dspillett2• 13 years ago

Not directly, but if they are used to get around legal limitations then yes.

There is no specific law covering this sort of thing which is why cases of this nature are often grey areas: it all depends on how you interpret/implement laws written to cover the physical world as you transcribe them to operate online. For instance gaining access to money by pretending to be in a country where you would qualify for a grant in, despite living elsewhere, is fraud - gaining access to resources online the same way using a proxy to pretend you come from somewhere else is the same thing.

As with many tools proxies themselves are not illegal (well, in most territories!) and have a great many legal uses, but they can be used as part of an attempt to get away with breaking the law.

teeja• 13 years ago

Seems clear to me that banning an IP address is nothing more than a ban on that IP address. The user could conceivably go to a library and use their IP to access the site. Since that's self-evidently a non-productive approach, the only way to communicate the block of an individual user is to affirmatively contact that user and obtain a signed recognition of that user's banning.

That may create a technical problem for the banner, but the method the judge chose simply ignores the fact that an IP address (unlike a ham radio license but exactly like a telephone number) is never attached to an individual.

lotharbot7• 13 years ago

In this case, the user knew they'd been banned due to the Cease and Desist letter they received.

graycat14• 13 years ago

Yes, but when that Web site gets traffic from the banned IP address, what is the evidence that the person who got the C&D letter was the one responsible for the traffic? The traffic could have been from any customer of the ISP used by the banned user.

alan_cx2• 13 years ago

So, on a shared internet connection, where many people might well use that one IP address, does this mean banning one person bans all?

dspillett2• 13 years ago

Basically yes.

Most sites that have found the need to implement bans by address consider this collateral damage to be worth it - in fact to get around it being difficult to IP-ban someone on an ISP that hands out variable addresses some will ban a whole range (first banning one address, then another, then another, and after several addresses in a range (something like a /20 or more - a /24 would not cover all but the smallest ISP's dynamic address pool) are banned the whole range gets the hammer, at least temporarily.

IPv6 will make a difference if its adoption means that the use of NAT drops considerably, but even if every device really does have a unique address there is still the problem of several users on the same device (implementing per-user addresses on a single device is never going to happen as it is just too much hassle for little or no gain).

mapt• 13 years ago

Hacker News implements permanent IP bans on anyone that performs tasks like reloading Chrome after the 15th HN tab opened for the day's reading crashes the core of the browser. When the browser reloads tabs, 15 concurrent connections are made at once, and the IP gets banned.

This is such a trigger-happy approach that a great number of legitimate users have found themselves IP banned, to the extent that a voluntary unban tool has been created: 1) open Tor for a different IP, and 2) go to http://news.ycombinator.com/unban?ip=<original ip address>.

By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things.

Criminal trespass is dealt with on a very limited basis by police officers seeking to uphold short-term civic order, correctively rather than retributively. If it became a strict-liability crime about pursuing criminals and punishing them with decades of jailtime, we would have an unworkable system where the harm of criminalization obviously outweighed the harm of being in a place that was technically off-limits. That is basically the case in most permutations of the CFAA. This happens to be a corporate defendant in a civil suit with an unambiguous C&D... but beware any broader interpretion of the thing while it still has criminal penalties attached.

bennyg• 13 years ago

Even a wget on HN will do the same. I did it for shits and gigs one time and found my IP banned before it finished running.

bradleyjg3• 13 years ago

By extending their argument from "IP block and C&D" (something I accept may be valid here as a civil violation) to merely "IP block", the court may have just found that 1) is a crime independent of any malice or damages, among other things.

I don't read the opinion to say that. In fact, I'd say that the court put more weight on the C&D than the IP ban (contra Prof. Kerr who reads the statue as giving primacy to the technological measure). Though admittedly the analysis is rather short.

3taps doesn't argue it thought it got caught up in an over aggressive automated filter. It knew Craigslist didn't want it to access its website and did anyway. I don't see why slippery slope arguments ought to let them off the hook. Though I agree a civil forum is generally the best for this sort of thing.

tptacek• 13 years ago

I don't think this is true. The crimes normally charged in the CFAA bundle have mens rea requirements; you can't accidentally commit wire fraud by using Tor. At a minimum, to charge a CFAA felony, a prosecutor would have to establish both substantial damages (easier) and recklessness (harder); that's for the lesser of the two CFAA felonies, the greater of which specifically requires intent.

EtienneK• 13 years ago

Does everyone in the States have a static IP address? Here where I live, every time you reconnect to the internet you get a new IP.

pdonis10• 13 years ago

It depends on your ISP and what kind of service you have. Most providers of high speed internet (meaning cable or fiber optic) these days don't change your IP very often, so although it's technically not "static" (meaning, there is no guarantee that it will stay the same), it ends up being more or less the same thing in practical terms.

graycat14• 13 years ago

Not really: For whatever reason, my electric company commonly drops power for a second or so about once a week. How do I know? Because then the clock on my microwave oven just blinks not knowing what time it is.

Well, that one second power drop also causes my cable modem to forget the IP address it was assigned via DHCP by my ISP.

So, the guy with the C&D letter can tell the Web site that traffic on the banned IP address was no good evidence that the traffic was from him and, instead, could have been from any customer of the relevant ISP.

Moreover, the ISP could assign the IP address the Web site banned to just any customer not involved in the C&D letter, etc. Then the Web site would ban that person; I hope that person would not get charged with a crime.

mpyne5• 13 years ago

Most have dynamic addresses, but business/corporate networks do tend to have static blocks from what I understand. Remember static IP used to be required to use SSL/TLS at all, and still is required if you want to support XP clients.

icambron2• 13 years ago

IANAL, but I'd have guessed that the answer to Kerr's first question -- does an IP address block constitute a "technological barrier?" -- would be no. My reasoning is this: IP addresses change all the time and so a normal, unsophisticated user could, perhaps even unwittingly evade the barrier without any sort of technological workaround. If you could accidentally do it in the course of your day, it's doesn't pass muster as a "barrier".

Imagine you had a building complex with many roads leading to it and you want to forbid motorcycles from entering it. You set up a blockade on one of those roads, and have a security guard turn away motorcycles. But there are all these other roads leading to the complex without blockades. Normal, every day people roads just like the one that has a blockade, and anyone could use them to drive in on a motorcycle. Does that constitute a barrier that's being circumvented?

That's all all directed at that narrow question. For the record, I don't think you should be allowed to use a website when the owners have asked you not to, but I do see how it's pretty different than, say, brute forcing the SSH password. And so that narrower question might have some impact on what charges their guilty of.

pdonis10• 13 years ago

IP addresses change all the time

IP addresses assigned by ISPs do, yes. But as I understand it, the IP addresses Craigslist banned in this case were the ones assigned to 3Taps' domain name based on DNS records. That's a different situation.

icambron2• 13 years ago

That's a reasonable point.

szuhanchang• 13 years ago

How does the Citizens United ruling factor into this?

Basically, I'm wondering if a valid defense would be to say that although 3Taps as a company was banned from using Craigslist, individual employees and separate companies were not.

As a result, the subsequent retrievals of information by individual employees / a separate company out of their own volition and not using company resources constitute legal access of Craigslist.

The information legally gathered by the separate entities were then passed back to the company, so 3Taps never actually accessed Craigslist after the ban.

Would this work, and why / why not?

graycat14• 13 years ago

An IP address does not for long accurately identify a computer or a person. E.g., Internet service providers (ISP) make heavy use of dynamic host connection protocol (DHCP) which assigns a new IP address for each new connection from a user. And, for a user permanently connected via a cable modem, losing power to the modem commonly causes it to forget it's assigned IP address and when power is on again to request a new IP address from the ISP. Also, commonly ISPs change user IP addresses for whatever reasons without notice. Really, a user often doesn't know what IP address he is using.

Fixed IP addresses are important for servers but not for users. And due to the fact that with 32 bit IP addresses there are only about 4 billion IP addresses to serve the whole Internet, ISPs commonly assign a new IP address for each connection and may have fewer IP addresses than paying customers.

A Web site has no easy way to know that a specific IP address is from a specific computer or a specific person. And, indeed, just by having electric power go out, the user's computer will likely be using a new IP address.

So, for a Web site to block an IP address does not block a specific computer or specific user. So, a user can just say,

"That you got some traffic from that IP address is no evidence that I accessed your Web site. That traffic could have been from any customer of my ISP."

Next, there is a problem with screen scraping: The way the Web works, with HTTP, HTML, and CSS, when a Web site sends a Web page to a user, what is sent is essentially just simple, plain text. Then screen scraping is just keeping what was sent. The Web site sent the text; the user just kept a copy; keeping a copy at least until the original changes is a standard performance feature of Web browsers. So, it's standard for a user to have and keep a copy of what the Web site sent.

The Web site freely sent the data as just simple text; if the Web site doesn't want people to have that data, then the Web site should not send that data to people.

graycat14• 13 years ago

Quite broadly, that the Web site got traffic from the banned IP address is not solid evidence that the person who got the C&D letter accessed the Web site. The Web site will need better evidence than traffic from the banned IP address.

systemtrigger• 13 years ago

I'm confused then because according to founder Greg Kidd 3taps does not get its data by scraping Craigslist:

"...We didn't get the data from them anyways. We're finding it from other sources which have already indexed it like Google, like Bing, like other search engines that are out there."

http://www.youtube.com/watch?v=6Rf6JrSYZ4U#t=27m32s

pdonis10• 13 years ago

If you read the fine print (which is in various documents linked to on 3Taps' website), you find that it's not quite as simple as that. 3Taps started out getting the data from Google; but when Craigslist found out what they were doing, they restricted Google's access in a way that made it necessary for 3Taps to scrape Craigslist's site directly.

It's notable that, in these documents (which are written by 3Taps), the fact that Craigslist sent them a C&D letter is never mentioned. So it's not clear where, exactly, in the process the C&D letter came in.

hmottestad• 13 years ago

At college we discussed what an IP is. An IP has two parts, the identification and the location.

If you change your IP to mask your identity, then you are telling the server you are someone else, however if you change IP to mask your location you are only saying you are somewhere else.

epo• 13 years ago

Your college explanation was so skimpy as to be useless. An IP, at best, identifies a particular endpoint at a particular point in time, consider dynamically allocated IP addresses or virtual machines with externally visible IPs.

Whoever allocated the IP may have records showing which telephone line was allocated that IP at a particular time. That might narrow it down to a residence, building or office.

But this is all irrelevant. As I understand it, there was a court order forbidding 3taps to access a particular service. Additionally their IP was blocked. Changing IP to try and circumvent the ban is the kind of thing a 13 year old thing might think was clever and 3taps should be slapped down very hard for this it is, in effect, contempt of court.

andybak• 13 years ago

Just trying to understand how far this could be pushed.

Would it be possible in a future case that a judge could deem 'not providing an API' a technological barrier to programmatic access and therefore hold that screen-scraping is in violation of the CFAA?

zby• 13 years ago

IRC ops must now be celebrating.

crb002• 13 years ago

Craigslist asked 3taps not to use their IPs to connect. 3taps complied and stopped using those IPs. What's the beef?

lotharbot7• 13 years ago

Craigslist asked 3taps not to use their data. 3taps continued to use CL's data, even going so far as to circumvent a security measure (the IP block -- weak, but still technically a security measure).

The court decision, which is linked elsewhere in this discussion, consistently connects the IP ban to the C&D letter. They don't seem particularly concerned with the details of how 3Taps accessed the data, only that 3Taps intentionally accessed data whose owners had clearly revoked access.

Court Holds That Circumventing IP Address Ban Is “Access Without Authorization”

Related Stories