Also come on, you can't reasonable describe that case as being about "guessing urls". It's the associated chat logs that really make the case.

What about guessing passwords? Should someone be prosecuted for just trying to bruteforce them until one works?

Guessing a URL is an attempt to access (potentially) privileged information which was not secured or authenticated to begin with.

A password is a lock you have to break. An unlisted URL is a sticky note that says "private" on the front of a 40" screen. It's literally impossible for that information to stay private. Someone will see it eventually.

How do you propose the line should be drawn?

there is a line drawn for such things. a fuzzy line. see:

https://en.wikipedia.org/wiki/I_know_it_when_I_see_it

same as this famous case, in which a supreme court justice is asked "what is and is not pronographie" - of course he realizes if he defines "what is not" people are going to make all kinds of porn right on the boundary (see: japanese pronographies where they do the filthiest imaginable things yet censor the sensitive books, making it SFW in the eyes of their law). this judge avoided that.

Anyways, parallel to the fact that filthy pronographies can be made a gorillion different ways, a "hack" may be manifested also a gorillion different ways. Itemizing such ways would be pointless. And also in the same vein, strictly defining a black and white line "this is legal, this is not" would cause hackers to freely exploit and cheese the legal aspect as hard as possible.. businesses and data miners and all these people would also freely exploit it, at massive scale and with massive funding, since it is officially legal. Thusly it must be kept an ambiguous definition as with pronographies, as with many things

To me, this is subjective, but the URL situation has a different feel than something like SQL injection. URLs are just references to certain resources - if it's left unsecured, the default assumption should be that any URL is public, can be seen by anyone, and can be manipulated in any ways. The exception is websites that put keys and passwords into their URL parameters, but if we're talking solely about the address part, it seems "public" to me. On the other hand, something like wedging your way into an SQL database looks like an intrusion on something private, that wasn't meant to be seen. It's like picking up a $100 bill of the street vs. picking even the flimsiest, most symbolic of locks to get to a $100 bill you can see in a box.

I don't think the question can be inverted like that, not meaningfully anyway. The CFAA specifically requires one to act knowingly. Accidentally navigating to a page you're not supposed to access isn't criminal.

>To me, this is subjective, but the URL situation has a different feel than something like SQL injection.

I don't think the url below is necessarily that different.

> GET wordpress/wp-content/plugins/demo_vul/endpoint.php?user=-1+union+select+1,2,3,4,5,6,7,8,9,(SELECT+user_pass+FROM+wp_users+WHERE+ID=1)

> if it's left unsecured, the default assumption should be that any URL is public, can be seen by anyone, and can be manipulated in any ways

It can be, but not lawfully so. It's not possible to accidentally commit a crime here, for example in the IRC logs related to the ATT case the "hackers" clearly understood that what they were doing wasn't something that AT&T would be happy with and that they would likely end up in court. They explicitly knew that what they were doing was exceeding authorized access.

> On the other hand, something like wedging your way into an SQL database looks like an intrusion on something private, that wasn't meant to be seen

I think you've reached the essence of it. Now, let's say you just accidentally find an open folder on a bank's website exposing deeply personal KYC information of their customers. Or even better, medical records in the case of a clinic.

Lets say those files are discoverable by guessing some URL in your browser, but not accessible to normal users just clicking around the website. If you start scraping the files, I think it's pretty obvious that you're intruding on something private that wasn't meant to be seen. Any reasonable person would realize that, right?

This is why I tried to make the clarification that I was referring to the address part of the URLs only, not the parametrized part. In my mind, something like /users?key=00726fca8123a710d78bb7781a11927e is quite different from /logins-and-passwords.txt. Although, parameters can also be baked into the URL body, so there's some vagueness to this.

> I think you've reached the essence of it. Now, let's say you just accidentally find an open folder on a bank's website exposing deeply personal KYC information of their customers. Or even better, medical records in the case of a clinic.

I guess if I try to distill my thoughts down, what I really mean is that there should be a minimum standard of care for private data. At some point, if being able to read restricted data is so frictionless, the fault should lie with the entity that has no regard for its information, rather than the person who found out about it. If a hospital leaves a box full of sensitive patient data in the director's office, and getting to it requires even the minimal amount of trespassing, the fault is on whoever did so. But if they leave that box tucked away in the corner of a parking lot, can you really fault some curious passer-by that looked around the corner, saw it and picked it up? Of course, there's a lot of fuzziness between the two, but in my mind, stumbling into private data by finding an undocumented address doesn't clear the same bar as bruteforcing or using a security vulnerability to gain access to something that's normally inaccessible.

And everyone who doesn't have wool for brains knows to not carry large rolls of cash around in a bad part of town, but we can still hold the mugger at fault.

That's literally the current state of things.

This has never happened in the US on the federal level. Unless your definition of "getting burned" is a nasty email from a clueless non-LE government worker.

> We are literally having this discussion on URLs because of famous cases where people DID face unfair treatment

I don't think any reasonable person can read through the court filings in those (Auerheimer, Swartz) cases and agree with the claim that there was unfair treatment wrt the application of the CFAA, or that the CFAA was unfair because it covers those cases.

I totally understand how someone who has not spent time familiarizing themselves with the actual details of the cases might be under the opposite impression; they are frequently misrepresented by people with agendas and nerds who mistakenly understand judicial process as a "Captain Kirk vs Computer" scenario.

There's a trend in communities like HN to claim that the CFAA is bad because Swartz deliberately broke the law while he engaged in some pretty cool civil disobedience. That's not reasonable. Two things can be true at once: what Swartz did was in fact cool and laudable, it still shouldn't be legal. Similarly, a reasonable person might consider it cool and laudable to punch a nazi, doesn't mean it should be legal.

In any case, there's also a trend of misrepresenting the potential penalties involved. On HN, you'll see people posting about how Swartz was facing 30 years in prison, which is an outright lie. Swartz had, in fact, behaved as described in the indictment; he had two plea deals on the table. One for 6 months with the opportunity to argue for further leniency from the judge, and another for 4 months outright. Lawyers familiar with the case have stated that it was very likely that he wouldn't have gone to prison at all.

Swartz killed himself, so the CFAA must be bad, but it's probably realistic to assume that Swartz did not kill himself because he was scared of spending a few months in prison. He was likely seriously mentally ill, and a victim of the poor state of the US healthcare system, not of the CFAA or the DOJ.

>Two things can be true at once: what Swartz did was in fact cool and laudable, it still shouldn't be legal. Similarly, a reasonable person might consider it cool and laudable to punch a nazi, doesn't mean it should be legal. We live in an age where people call other people Nazis as if uttering the accusation gives them a free pass to infringe on the rights of those people. Even if it could be proven to be true, the facts would not grant them any such right.

Theft and unprovoked assault are neither cool nor legal. I don't care if we're talking about absolute assholes, either. For each and every one of us, there is probably someone in the world who thinks that they should have our property and have the right to attack us.

>Swartz killed himself, so the CFAA must be bad, but it's probably realistic to assume that Swartz did not kill himself because he was scared of spending a few months in prison. He was likely seriously mentally ill, and a victim of the poor state of the US healthcare system, not of the CFAA or the DOJ.

Idk that much about this case. It seems to me that Swartz was in a hell of a lot of trouble, that could have gotten him a prison term along with financial and career ruination. He clearly should not have killed himself but that kind of stress can make people lose sight of the future.

"prosecution based on accessing URLs" is a dishonest way of describing this case. It's a prosecution based on accessing URLs with malicious intent, while the persons responsible knew they were not intended to access said URLs.

That's like saying "prosecution based on walking through a doorway". Well yeah, except it was the middle of the night and the door to someone else's house had been accidentally left unlocked.

>Idk that much about this case. It seems to me that Swartz was in a hell of a lot of trouble, that could have gotten him a prison term along with financial and career ruination. He clearly should not have killed himself but that kind of stress can make people lose sight of the future.

Swartz had good lawyers; he was certainly aware that he wasn't in big trouble. He was facing neither financial nor career ruination. The damages he had caused were far from enough to result in financial ruination. The charges had made him even more of a celebrity and would've been a boost to his career.

https://volokh.com/2013/01/14/aaron-swartz-charges/

https://volokh.com/2013/01/16/the-criminal-charges-against-a...

Orin Kerr, a top subject matter expert addressed this extensively. In the second part he also offers the best criticism of CFAA, which is that it's almost entirely redundant given the existence of very broad wire fraud statute.

And for what it's worth, Swartz had been spending a lot of time thinking about suicide for years before the whole JSTOR debacle http://www.aaronsw.com/weblog/dying

Find out that it works, and then proceed to look up various other people? Whether you're fine depends entirely on whether or not you genuinely believe that you're supposed to be accessing that stuff.

Sometimes a URL can have a password in it.

But when it's just a sequential-ish ID number, you have to accept that people will change the ID number. If you want security, do something else. No prosecuting.

As a pragmatic matter, I do completely understand where you're coming from (my second paragraph). In a sense, if one can get to the point of being convicted they have been kind of fortunate - it means they didn't kill themselves under the crushing pressure of a team of federal persecutors whose day job is making your life miserable.

If your goal is to deliberately "poison" their data as suggested before, it's kind of obvious that you are knowingly causing the transmission of information in an effort to intentionally cause damage to a protected computer without authorization to cause such damage.

>Trying to tie some nebulous TOS to a situation that the manufacturer has deliberately created reeks of the same type of website-TOS shenanigans courts have (actually!) struck down.

This has very little to do with the TOS though, unless the TOS specifically states that you are in fact allowed to deliberately damage their systems.

And no, causing damage to a computer does not refer to hackers turning computers into bombs. But rather specifically situations like this.

Deliberately inserting bad data to mess with their analytics does in fact fit that definition.

I would read that definition as applying only to their computer system - the one you aren't authorized to access. This means the integrity of data on their system has not been affected, even if the source of that data isn't what they'd hoped.

As I said, the law contemplates a different call out for fraud. This would not be needed if data integrity was meant to be construed the way you're claiming.

(For reference I do realize the law is quite unjust and I'll say we'd be better off if the entire law were straight up scrapped along with the DMCA anti-circumvention provisions)

What specific activities does it unjustly criminalize?

But if you're not - the fact it's putting a chilling effect on this activity right here is a problem.

Another big problem is the complete inequity. It takes the digital equivalent of hopping over a fence and turns it into a serious federal felony with persecutors looking to make an example of the witch who can do scary things (from the perspective of suits).

Another glaring problem is that if the types of boundaries it creates are noble, then why does it leave individuals powerless to enforce such boundaries against corpos, being easily destroyed by clickwrap licenses and unequal enforcement? Any surveillance bugs/backdoors on a car I own are fundamentally unauthorized access, and yet I/we are powerless to use this law to press the issue.

>But if you're not - the fact it's putting a chilling effect on this activity right here is a problem.

I've personally had my own CFAA-related criminal troubles in the distant past, but I still have a hard time seeing the big problems with CFAA so often touted on HN.

The activity of childish vandalism by flooding Mazda servers with garbage data? There's no chilling effect on simply not sending any data to Mazda.

The activity which was proposed earlier was explicitly malicious in intent, why shouldn't there be a chilling effect put on it? Do you not think the government should generally protect you from people taking explicitly malicious actions aimed at causing you harm?

In this context it is the motivation that makes the crime. You could absolutely modify your car in a way where the data sent to mazda is replaced with zeroes or random data, but you would need to do so in good faith.

Of course, when the activity is explicitly malicious as stated above ("poison their databases and statistics with fake data") it's not surprising that you'd be in violation of the law.

>Another big problem is the complete inequity. It takes the digital equivalent of hopping over a fence and turns it into a serious federal felony with persecutors looking to make an example of the witch who can do scary things (from the perspective of suits).

I just don't think this is actually happening. The cases often spoken of here are Auernheimer and Swartz.

I have a hard time believing that anyone can read the court files in the Auernheimer case and argue in good faith that such behavior should be legal. Among other things, the court papers contain a chat log of the co-conspirators discussing how to they should use the data they've scraped from buggy AT&T site to spam AT&T customers with malware. In the end that was too complicated, so they arrived at trying to leak the data in most damaging way possible to hurt AT&T share prices.

Swartz performed an admirable act of civil disobedience and faced up to 6 months in prison for that (realistically, he'd most likely never have spent a day in prison). I think what Swartz did is admirable, but that doesn't mean what he didn't shouldn't have been illegal. Just as what Snowden did was admirable, but legalizing such activities would have catastrophic consequences.

>Another glaring problem is that if the types of boundaries it creates are noble, then why does it leave individuals powerless to enforce such boundaries against corpos, being easily destroyed by clickwrap licenses and unequal enforcement?

I feel like this is conflating the problems that CFAA seeks to address with a completely different set of problems.

Corporations are bound by the CFAA just as much as you are, it's just that companies are rarely in the business of doing this sort of crime. Just as companies are rarely in the business of selling heroin.

> Any surveillance bugs/backdoors on a car I own are fundamentally unauthorized access, and yet I/we are powerless to use this law to press the issue.

The fact that CFAA mostly does not address these particular issues is not a problem with the CFAA, people (or companies!) buying devices with software they don't like was never something CFAA was intended to address.

There are reasonable, effective legal solutions to surveillance like this, like the GDPR.

In general in this argument here and our previous argument, you're focused solely on intent to the exclusion of analyzing actual actions. You're then attributing malevolence to the intent of the individuals acting, while giving a pass to the companies (in this case Mazda) that is also operating with malicious/adversarial intent. You're missing that criminality also revolves around specific actions - in this case unauthorized access.

> people (or companies!) buying devices with software they don't like was never something CFAA was intended to address.

It most certainly addresses this. If I loaded up a PC with a remote access trojan, sold it on the used market, and then spied on the buyer, I would be looking at a CFAA prosecution. This is exactly what companies are doing with embedded spyware, yet it's not prosecuted.

Practically any device connected to the internet is a "protected computer". The only case I can think of where the defendant prevailed on their argument that the computer in question was not a "protected computer" was US v Kane. In that case the court held that an offline Las Vegas video poker machine was not sufficiently connected to interstate commerce to qualify as a "protected computer".

> You own the device, so anything you do within that device is authorized

You're very clearly describing a situation where at least some of the things you're doing aren't happening on your own device.

>I do know that the CFAA essentially gets interpreted to mean whatever the corpos want it to mean - it's basically an anti-witch law

FWIW this is simply not true. The essence of the CFAA is "do not deliberately do anything bad to computers that belong to other people".

The supreme court even recently tightened the definition of "unauthorized access" to ensure that you can't play silly games with terms of service and the CFAA. https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf

However, it's worth clarifying that the important detail isn't generating the data, but sending it. Particularly the clearly stated malicious intent of "poisoning" their data.

This seems like exactly what the lawmakers writing CFAA sought to criminalize, and is frankly much better justified than perhaps the bulk of things they tend to come up with.

>(A) knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Doesn't seem exactly unfair to me, even if facing federal charges over silly vandalism is perhaps a bit much. Of course, you'd realistically be facing a fine.

>(A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government; or

>(B) which is used in interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States.

As anecdote, while buying a new car I signed a statement that I'm not going to resell it to russia.