Slashdot Mirror

← Back to Stories (view on slashdot.org)

Aaron's Law: Violating a Site's ToS Should Not Land You in Jail

Posted by samzenpus on from the last-time dept.

Freddybear writes "Congresswoman Zoe Lofgren proposes a change to the Computer Fraud and Abuse Act (CFAA) which would remove the felony criminal penalty for violating the terms of service of a website and return it to the realm of contract law where it belongs. This would eliminate the potential for prosecutors to abuse the CFAA in pursuit of criminal convictions for simple violations of a website's terms of service."

29 of 246 comments (clear)

  1. Depends on... by Z00L00K · · Score: 5, Insightful

    If the violation of ToS is due to an illegal action like posting things that are illegal both for the location of the site and the poster it should still land into the legal system, but the large volume of ToS violations should at most render the offender a permanent banning from that site or in milder cases a temporary ban.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    1. Re:Depends on... by SampleFish · · Score: 5, Insightful

      It doesn't depend on anything like that. If you broke a law in your land that is the law that applies. It doesn't matter if the TOS includes reference to a law. The TOS cannot change a law and should have no legal authority.

    2. Re:Depends on... by Capsaicin · · Score: 5, Insightful

      If the violation of ToS is due to an illegal action like posting things that are illegal both for the location of the site and the poster it should still land into the legal system.

      Say what?!

      No one is talking about removing ToS violations from the legal system. Rather the idea is that a breach of contract (such as violating a ToS) be dealt with under contract law, where imprisonment is unavailable as a remedy. While the mere breach of contractual terms would no longer be a crime in its own right, any crimes committed in effecting or pursuant to such a breach they would still be dealt with by the criminal justice system. Obviously.

      --
      Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
    3. Re:Depends on... by Jane+Q.+Public · · Score: 5, Insightful

      "It doesn't depend on anything like that. If you broke a law in your land that is the law that applies. It doesn't matter if the TOS includes reference to a law. The TOS cannot change a law and should have no legal authority."

      But that is exactly the issue here. Because the law as enacted was rather vague, some prosecutors have been claiming that violation of TOS means violation of the CFAA law... regardless of the fact that a TOS can vary widely from company to company or site to site.

      If so, that would mean, in effect, that a company (or just website) could write its own law by just putting it in the TOS... which is absolutely contrary to our customary legal principles and concept of justice here in the U.S.

      THAT is why we want it changed, and clarified.

    4. Re:Depends on... by Jane+Q.+Public · · Score: 4, Insightful

      "Seems like a big case of "DUH" to me."

      Tell it to the prosecutors, because some of them don't seem to understand that.

    5. Re:Depends on... by mysidia · · Score: 3, Insightful

      If the violation of ToS is due to an illegal action like posting things that are illegal both for the location of the site and the poster it should still land into the legal system, but the large volume of ToS violations should at most render the offender a permanent banning from that site or in milder cases a temporary ban.

      Evading the ban, or continuing to access the site after ordered not to, by the owner, should land you in jail :)

    6. Re:Depends on... by shentino · · Score: 3, Insightful

      It's like going to a restaurant.

      By default everyone is welcome.

      Now the management can kick you out for any reason they want, for violating rules (and techinically even if you don't)

      And unless/until that happens you're welcome.

      If you go back, however, it's trespassing.

    7. Re:Depends on... by anagama · · Score: 4, Insightful

      Why? I mean seriously why does everything in America have to involve jail. Do you really think that makes us safer? Eventually somebody will do the math -- 35 years for TOS violations, 15 for rape -- and figure that rape looks like a better deal. You know, if your going to do the time, might as well do a crime to fit it. And that ultimately makes us all less safe. That's the problem with Americans' draconian attitudes.

      --
      What changed under Obama? Nothing Good
    8. Re:Depends on... by anagama · · Score: 2, Insightful

      And just how much time could you be threatened with for that real world trespass? Days -- maybe a month or two at most. But apparently for digital trespass, the correct measure is virtually the rest of your life apparently.

      --
      What changed under Obama? Nothing Good
    9. Re:Depends on... by AmiMoJo · · Score: 5, Insightful

      ToS aren't even a viable contract IMHO. No-one reads them, if you edit them the web site rarely bothers to check before accepting your terms and quite often the terms are unenforceable anyway.

      We need to move to a system of standard ToS and EULA agreements defined in law that a web site or software vendor can apply to their products. That way we only have to deal with a handful of licenses which are known to be reasonable and will stand up in court.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    10. Re:Depends on... by Mitreya · · Score: 4, Insightful

      ToS aren't even a viable contract IMHO. No-one reads them, if you edit them the web site rarely bothers to check before accepting your terms and quite often the terms are unenforceable anyway.

      Many of them also include "we may change this ToS at any point of time", which is pretty much the opposite of a contract. For example, cell-phone companies could not enforce a mandatory fee for a paper-bill, because that technically constitutes a violation of the already established contract.

      Even better, some ToS state that it is YOUR responsibility to regularly visit their website to see if they changed it (i.e. they are not even responsible for notifying you of the change). So it better be unenforceable...

    11. Re:Depends on... by Mitreya · · Score: 4, Insightful

      How do you deal with that? How do you draw the line between a website that is clearly open to the public and an intranet site that is only open to selected people?

      An intranet site that is only open to selected people should have a frigging password protection. Hacking that is presumably a crime on its own accord

      Making a public website and putting a ToS file that says "this is a private internal site" should not be the way to go.

      If I bought a huge parking lot in the city and put a little sign that said "no trespassing" in the corner of the lot -- is that enough to prosecute anyone who steps across an unmarked border? (i.e. I have no fence marking my lot)

    12. Re:Depends on... by IAmR007 · · Score: 5, Insightful

      Under this law you could make an incredibly abusive TOS: It is illegal to "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer." A definition of "protected computer" is anything connected to the Internet. You could easily write a TOS that forbid any access to a website, and merely loading the homepage would be illegal the way the law is written. Bypassing authentication is not required to break the law. Even worse, if there were no TOS at all, there would be no authorization given. Although it's way too broad, it's apparent why authorization was made the only consideration: If, conversely, if any data a server offered freely to public requests was termed authorized, then injection attacks could be said to be doing exactly what machine was programmed to do unless a TOS specifically detailed what was authorized input. That brings things right back to the TOS being able to define what is authorized. The law needs to be much more detailed to avoid being too broad, yet avoid "it's not a bug, it's a feature" type defenses.

    13. Re:Depends on... by History's+Coming+To · · Score: 3, Insightful

      Precisely. Yes, I agree with the general idea that this should generally be a civil matter, but there are cases where jail time is appropriate. I'm pretty sure there are clauses in my online banking T&C which would be considered serious fraud if I breached them. The problem is prosecutors trying to set themselves up as "internet specialists" by pushing for convictions under unsuitable laws instead of going for the simple, pre-existing (but less interesting on a CV/resume) fraud laws.

      --
      Please consider this account deleted, I just can't be bothered with the spam anymore.
  2. Re:Just make assholes illegal! by lister+king+of+smeg · · Score: 2, Insightful

    no the power will get to who ever is in the chair and turn them into an a-hole. power corrupts.

    --
    ---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.
  3. Felony Abuse by velvet_stallion · · Score: 5, Insightful

    It is high time we rollback the number of crimes that result in felony convictions. The "Get Tough On Crime" era only resulted in overstretched state budgets and the creation of an entire underclass of citizens who are barred from certain employments, voting, etc. just because politicians sought to score political points in order to get re-elected. There is a very stark contrast to what the term "felon" implies with regards to the seriousness or violence of the crime, and the rather lackadaisical manner in which it is applied in the legal context.

    1. Re:Felony Abuse by anagama · · Score: 4, Insightful

      Get off your Smug Horse because that's not how it works -- even with the "six month" plea agreement he could have spent years in jail, maybe decades:

      Some have blithely said Aaron should just have taken a deal. This is callous. There was great practical risk to Aaron from pleading to any felony. .... More particularly, the court is not constrained to sentence as the government suggests. Rather, the probation department drafts an advisory sentencing report recommending a sentence based on the guidelines. The judge tends to rely heavily on that "neutral" report in sentencing. If Aaron pleaded to a misdemeanor, his potential sentence would be capped at one year, regardless of his guidelines calculation. However, if he plead guilty to a felony, he could have been sentenced to as many as 5 years, despite the government's agreement not to argue for more. Each additional conviction would increase the cap by 5 years, though the guidelines calculation would remain the same. No wonder he didn't want to plead to 13 felonies. Also, Aaron would have had to swear under oath that he committed a crime, something he did not actually believe.

      http://cyberlaw.stanford.edu/blog/2013/01/towards-learning-losing-aaron-swartz-part-2

      --
      What changed under Obama? Nothing Good
  4. Too little too late by dyingtolive · · Score: 4, Insightful

    Fantastic fucking idea. You know what would have made it better? If it never was a felony to begin with.

    Don't mod this up. Common sense doesn't need moderation points. I'm venting.

    --
    Support the EFF and Creative Commons. The war is coming, and they're supporting you...
  5. Re:I'm confused... by fnj · · Score: 4, Insightful

    Aren't violations of contracts (like ToS) subject to civil law instead of criminal law?

    A law, duly enacted, which makes it a felony to violate such ToS, makes criminal procedure apply. That law has to be fixed, and then that particular violation of contract will revert to the normal civil procedure.

  6. Profit by Improv · · Score: 3, Insightful

    I'd probably draw a distinction between when money changes hands relating to TOS-violations, and otherwise. There need to be tools to fight botters, for example.

    --
    For every problem, there is at least one solution that is simple, neat, and wrong.
  7. You know we have a problem when... by Anonymous Coward · · Score: 2, Insightful

    You can get more time for breaking a ToS than for...

    - Manslaughter
    - Robbing a bank
    - Child porn with intent to distribute

    among other things. Pathetic.

    http://thinkprogress.org/justice/2013/01/14/1441211/killers-slavers-and-bank-robbers-all-face-less-severe-prison-terms-than-aaron-swartz-did/

  8. Re:No one reads the TOS. by c0lo · · Score: 4, Insightful

    I have a document in my backpack; my personal ToS. It states that everyone who shakes my hand must give me $20. By shaking, they agree.

    Even if they were it still fails for lack of consideration: the other party suffers a detriment both in paying $20 and in shaking your hand, so the consideration only flows in the same direction ... twice. :p

    Easy fix: switch the places between the hand and the ToS... put the hand in the backpack (detach it if necessary) and offer the ToS to be shaken.

    --
    Questions raise, answers kill. Raise questions to stay alive.
  9. Unfortunately, this "law" cost a life by Taco+Cowboy · · Score: 2, Insightful

    I agree that there are way too many "laws".

    It's just unfortunate that in this case this particular "law" cost the life of a very promising young guy.

    The damn system did him in.

    --
    Muchas Gracias, Señor Edward Snowden !
  10. Repeat after me: by CuteSteveJobs · · Score: 3, Insightful

    The Terms of Service are a contract. For breach of a contract you are entitled to economic damages*. You are not entitled to throw the other party in jail. Only the government can imprison people and only when the breach is criminal. See post below.

    *JSTOR could have sued him for lost earnings or copyright, but chose not to.

  11. Re:Great cases make bad law by seebs · · Score: 5, Insightful

    That is some serious bullshit there. The "guilty conscience" thing? Seriously, that's just crap. That is not how people work, and that is not how reality works. There are lots of people who know perfectly well that there is a law they have technically broken, but who do not feel guilty about it at all -- but who might not be surprised to face jail time if a prosecutor happened to pick them to make an example of. The problem with this, apart from the victim-blaming, is that you're assuming that "violated a law" and "guilty" are the same thing in any kind of ethical sense. Similarly, "he knew he was guilty, so the probation he would have recieved was deserved."

    This doesn't logically follow, because "deserve" is a moral claim, but you're basing it on the legal system. Legal systems are not moral systems. You can quite easily be fully aware that you have done a thing which is prohibited by a law, but not feel that you deserve jail time for it. Or you might feel that a misdemeanor charge that's in some way related to what you did is justified, but that multiple felony counts aren't.

    The fact is, nothing he did merits years of jail time, and the claim that the prosecutor was "asking for" six months minimum security is highly misleading at best. They were, quite clearly, aiming to make an example of him. Look at previous cases Ortiz prosecuted against people who could afford defense teams, and tell me how "deserved" those outcomes were.

    Long story short, even if we ignore the fact that he was depressed, this was a crazy thing and your attempts to make it look less crazy are disturbing. The just world fallacy is called a fallacy because it is not actually valid reasoning. Your attempts to make yourself feel okay with the world by pretending that what happens is okay and justified are unpersuasive at best. And yet. We know he was depressed, and we know a fair amount about what depression does to people's ability to evaluate things and make decisions. It's bad enough that prosecutors are trying really hard to make dramatic examples of people by going after huge piles of charges without regard to the actual severity of the underlying acts; cherry-picking for depressed people because they're easier to bully is despicable. So's trying to defend it.

    --
    My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
  12. Re:While I think this is ostensibly a good idea... by Omnifarious · · Score: 3, Insightful

    And you demonstrate his point perfectly. How many people know that collecting stray bird feathers lying on the ground might get them jail time? Is that an intended consequence of the law? It sounds like you know that regulation better than anybody and don't even care about any wider implications that will have surprising and awful effects, just like the bureaucrat guy in the comic.

    As for the turtle example, the comic author explicitly gives the common snapping turtle as an example. A non-endangered species. State X passes a law about the snapping turtle at time T. And time T + 10 he does a vendor audit and after a lot of effort realizes that one of his vendors is now in a jurisdiction in which its illegal for them to sell him common snapping turtles. Unfortunately, the feds noticed at time T + 1. Oops, he's guilty and intent has nothing to do with it because the law isn't written that way.

    --
    Need a Python, C++, Unix, Linux develop
  13. Re:Is there a larger issue here though? by Rich0 · · Score: 4, Insightful

    Frankly I'd get rid of all contracts of adhesion. Contracts should only have the force of law if they are original creative works authored by both parties. For standard transactions like buying homes/etc you can use a form-based contract, but only if it is embedded in a law (ie the government explicitly approves all standard contracts and their terms).

    Really this amounts to nothing more than actually enforcing the whole "meeting of the minds" bit which is supposed to be at the center of contract law anyway. There is no meeting of the minds when your boss says "sign this or I will fire you" or whatever.

  14. Re:any trespassing cases based on odd store rules? by Rich0 · · Score: 4, Insightful

    Store rules are actually a good way of looking at this sort of thing.

    If you do something really obnoxious in a store they can ask you to leave. If you refuse to do so they can call the police. You can of course sue the store for discrimination, and the police might not even make you leave if the basis for the removal is so egregious.

    Website TOS's should be similar. If somebody doesn't like what you're doing on their website they should ask you to leave, and if you cooperate then no crime has occurred. Unfortunately that isn't what this law was being used for - imagine if you wear a hat in a store that has a "no hats" policy and the owner just called the police, and they showed up, and then charged you with a felony for violating the store rules.

    Trespassing is only trespassing if somebody actually asks you to leave. Now, if you walk into a store and set fire to it then you can be arrested on the spot, but not for trespassing.

  15. Re:Is there a larger issue here though? by suomynonAyletamitlU · · Score: 4, Insightful

    I have often thought that a binding TOS / EULA should be mandated to take the following form, with very clear language:
    >>
    You agree not to distribute a bazillion copies of our software [Yes] [x No]
    You agree that we own your content [Yes] [x No]
    You agree that we are not liable for damage [Yes] [x No]
    You agree to not sue us if we lose your credit card information [Yes] [x No]

    I'm sorry, it seems we cannot agree on a contract. In particular, these terms are mandatory:
    * You agree not to distribute a bazillion copies of our software
    * You agree that we are not liable for damage
    * You agree not to sue us if we lose your credit card information
    The following would be stored as a user preference:
    * You agree that we own your content: NO (Note: May limit functionality)