Slashdot Mirror
Court Rules Sending Too Many Emails Is "Hacking"
An anonymous reader writes "An appeals court has ruled that having people send a company a lot of emails (in this case, a union protesting a company's business practices) qualifies as hacking under the Computer Fraud & Abuse Act. We're not even talking about a true DDoS action here, but just a bunch of protest emails. Part of the problem is that the company apparently set up their email to only hold a small number of emails in their inbox, and the court seems to think the union should take the blame for stuffing those inboxes."
The "problem" is that hacking and disrupting services is governed by the same laws, without much distinction. And it is disrupting services if the sender knew about or had reason to know about the limitation of the recipient.
What about a company sending a lot of emails to a person?
My physical mailbox at home is kind of small and when I go on vacation it can get full to the point of no longer being able to put more mail in. Do I get to go after Capital One or any/all of the other habitual mail spammers now? If not, why? Because this Act only covers electrons flowing through wires and not physical items physically limiting my mailbox?
If the company can't handle the consequences of its actions, it shouldn't act.
unfortunately a company is now a "super-person"
-immortal
-immoral
-and unaccountable if large enough
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
Here's the actual decision. First, the company's request for an injunction to stop the mail campaign, denied by the district court, is still denied. The claim under the Computer Fraud and Abuse act goes back to the district court, and can proceed there, but the appellate court makes no comment on the merits of that claim. The appellate court was only dealing with the issue of whether the Norris-LaGuardia act, which gives jurisdiction to the National Labor Relations Board when the behavior involved arises out of a labor dispute, preempted the Computer Fraud and Abuse Act . The appeals court decided that this isn't an NLRB matter, and goes back to the district court.
I'll disagree with what seems to be the consensus here, if they sent emails with the deliberate intent to bring down the mail server. It's a crude hack but it is taking advantage of a flaw in a system to cause damage.
It seems that they carried on emailing without actual malicious intent. However it looks like they were told that this would bring them down. That brings it down to recklessness. Does recklessly damaging a computer system count as hacking?
The law in question is called the Computer Fraud and Abuse act, and I'd say they're going with the angle of abuse. In this case, LIUNA seems to have been going for what amounts to a DDoS attack against the contractors phones and emails.
To generate a high volume of calls, LIUNA both hired an auto-dialing service and requested its members to call Pulte. It also encouraged its members, through postings on its website, to “fight back” by using LIUNA’s server to send e-mails to specific Pulte executives. Most of the calls and e-mails concerned Pulte’s purported unfair labor practices, though some communications included threats and obscene language.
Now, right or wrong, I can at least see the reasoning of the ruling, and this isn't just a clueless judge saying "Oh noes, they hax0r3d the company interwebs". LIUNA seems to have decided that they were going to use their membership and outside companies to shut down Pulte's communications. That they used individual members instead of a botnet to go after the email server seems irrelevant, the intent was clearly to beat the company into submission, not just to voice dissatisfaction. Had they not hired the guys with the autodialer it would have been much easier to believe they were just trying to make themselves heard.
Some bring out the best in others, some the worst. Some bring out far more.
Would the same amount of physical mail result in any legal actions against the union?
No? Then the judge is an idiot.
what's next voice mail full = hacking? parking lot full is = hacking as a Computer turns on the full sign?
If we comment too much on this post we might be hacking /.
I hate unions, and I still support the union here
I see no reason for them to exist, following the passage of the fair labor relations act. The CWA routinely harrased a number of IBM facilities, as if by using networking we were also communications workers, even though we were all salaried engineers and therefore exempt, according to the department of labor.
That said, I see the unions actions in this case as being no different than having a sit-in at a diner at the height of the civil rights movement, or a protest by the UAW blocking entry of workers into a manufacturing facility.
Now THAT said, sit-ins were civil disobedience, specifically in violation of the law, in order to DOS the court system into forcing a change in law (and which were successful in that). However, in accordance with law at the time, many of the protesters involved were in fact arrested, since the only way to try a point of law is to violate it, and then go to court over it to demonstrate why a reasonable person would do the same.
Whether the tactics used in this case constitute legal tactics of protest as a matter of process for collective bargaining, or if they constitute acts of criminal trespass on the effected communications systems really remains to be seen.
Either way, it's an interesting case.
-- Terry
Based on the rather skimpy information available to this writer, this may illustrate just another example of ignorant and uninformed judges running amok. No one should assume that judges are not petty, ignorant and power-mad just because they have been appointed or elected to that office. They can be and often are just as stupid as everyone else. Good luck with further appeals.