Slashdot Mirror


Aaron's Law: Violating a Site's ToS Should Not Land You in Jail

Freddybear writes "Congresswoman Zoe Lofgren proposes a change to the Computer Fraud and Abuse Act (CFAA) which would remove the felony criminal penalty for violating the terms of service of a website and return it to the realm of contract law where it belongs. This would eliminate the potential for prosecutors to abuse the CFAA in pursuit of criminal convictions for simple violations of a website's terms of service."

29 of 246 comments (clear)

  1. Depends on... by Z00L00K · · Score: 5, Insightful

    If the violation of ToS is due to an illegal action like posting things that are illegal both for the location of the site and the poster it should still land into the legal system, but the large volume of ToS violations should at most render the offender a permanent banning from that site or in milder cases a temporary ban.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
    1. Re:Depends on... by Anonymous Coward · · Score: 4, Informative

      If something is illegal in it's own right, then it still remains illegal, even if it also happens to be a violation of the ToS.

    2. Re:Depends on... by SampleFish · · Score: 5, Insightful

      It doesn't depend on anything like that. If you broke a law in your land that is the law that applies. It doesn't matter if the TOS includes reference to a law. The TOS cannot change a law and should have no legal authority.

    3. Re:Depends on... by Capsaicin · · Score: 5, Insightful

      If the violation of ToS is due to an illegal action like posting things that are illegal both for the location of the site and the poster it should still land into the legal system.

      Say what?!

      No one is talking about removing ToS violations from the legal system. Rather the idea is that a breach of contract (such as violating a ToS) be dealt with under contract law, where imprisonment is unavailable as a remedy. While the mere breach of contractual terms would no longer be a crime in its own right, any crimes committed in effecting or pursuant to such a breach they would still be dealt with by the criminal justice system. Obviously.

      --
      Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
    4. Re:Depends on... by Anonymous Coward · · Score: 5, Interesting

      This is more along the lines of a sites ToS stating "You shall not offend anyone for any reason"
      This is justification for being banned from the site, NOT justification for going to prison.

      Currently, it is a federal crime to "offend someone for any reason" if that is listed in the sites ToS. Or to put it another way, all I have to do is claim your statement offends me and oops you just committed a felony.
      This change is simply trying to remove that insanity.

    5. Re:Depends on... by Jane+Q.+Public · · Score: 5, Insightful

      "It doesn't depend on anything like that. If you broke a law in your land that is the law that applies. It doesn't matter if the TOS includes reference to a law. The TOS cannot change a law and should have no legal authority."

      But that is exactly the issue here. Because the law as enacted was rather vague, some prosecutors have been claiming that violation of TOS means violation of the CFAA law... regardless of the fact that a TOS can vary widely from company to company or site to site.

      If so, that would mean, in effect, that a company (or just website) could write its own law by just putting it in the TOS... which is absolutely contrary to our customary legal principles and concept of justice here in the U.S.

      THAT is why we want it changed, and clarified.

    6. Re:Depends on... by Jane+Q.+Public · · Score: 4, Insightful

      "Seems like a big case of "DUH" to me."

      Tell it to the prosecutors, because some of them don't seem to understand that.

    7. Re:Depends on... by Zontar+The+Mindless · · Score: 4, Funny

      For that jaded Grammar Nazi who thinks he's seen it all...

      What is it with all the 's laws...

      *looks for something dull and rusty to gouge eyes out with*

      --
      Il n'y a pas de Planet B.
    8. Re:Depends on... by jonbryce · · Score: 5, Interesting

      In the UK for example, it is illegal to access a computer system without the owner's permission. You could argue that the TOS set out the terms under which the owner is prepared to give permission to access their system, and if you violate them, you don't have permission to access the site, and are therefore breaking the law. I guess it is much the same in the US.

      How do you deal with that? How do you draw the line between a website that is clearly open to the public and an intranet site that is only open to selected people?

    9. Re:Depends on... by anagama · · Score: 4, Insightful

      Why? I mean seriously why does everything in America have to involve jail. Do you really think that makes us safer? Eventually somebody will do the math -- 35 years for TOS violations, 15 for rape -- and figure that rape looks like a better deal. You know, if your going to do the time, might as well do a crime to fit it. And that ultimately makes us all less safe. That's the problem with Americans' draconian attitudes.

      --
      What changed under Obama? Nothing Good
    10. Re:Depends on... by AmiMoJo · · Score: 5, Insightful

      ToS aren't even a viable contract IMHO. No-one reads them, if you edit them the web site rarely bothers to check before accepting your terms and quite often the terms are unenforceable anyway.

      We need to move to a system of standard ToS and EULA agreements defined in law that a web site or software vendor can apply to their products. That way we only have to deal with a handful of licenses which are known to be reasonable and will stand up in court.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    11. Re:Depends on... by Mitreya · · Score: 4, Insightful

      ToS aren't even a viable contract IMHO. No-one reads them, if you edit them the web site rarely bothers to check before accepting your terms and quite often the terms are unenforceable anyway.

      Many of them also include "we may change this ToS at any point of time", which is pretty much the opposite of a contract. For example, cell-phone companies could not enforce a mandatory fee for a paper-bill, because that technically constitutes a violation of the already established contract.

      Even better, some ToS state that it is YOUR responsibility to regularly visit their website to see if they changed it (i.e. they are not even responsible for notifying you of the change). So it better be unenforceable...

    12. Re:Depends on... by Mitreya · · Score: 4, Insightful

      How do you deal with that? How do you draw the line between a website that is clearly open to the public and an intranet site that is only open to selected people?

      An intranet site that is only open to selected people should have a frigging password protection. Hacking that is presumably a crime on its own accord

      Making a public website and putting a ToS file that says "this is a private internal site" should not be the way to go.

      If I bought a huge parking lot in the city and put a little sign that said "no trespassing" in the corner of the lot -- is that enough to prosecute anyone who steps across an unmarked border? (i.e. I have no fence marking my lot)

    13. Re:Depends on... by Mitreya · · Score: 4, Informative

      Why? I mean seriously why does everything in America have to involve jail. Do you really think that makes us safer? Eventually somebody will do the math

      Someone already has done the math

      Private prisons are a booming industry (instead of being an abomination that should not exist).
      Private prison contracts have clauses guaranteeing prison utilization (~90% or ~95%). Some states may be in danger of defaulting on their prison contract... so that's probably why.

    14. Re:Depends on... by IAmR007 · · Score: 5, Insightful

      Under this law you could make an incredibly abusive TOS: It is illegal to "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer." A definition of "protected computer" is anything connected to the Internet. You could easily write a TOS that forbid any access to a website, and merely loading the homepage would be illegal the way the law is written. Bypassing authentication is not required to break the law. Even worse, if there were no TOS at all, there would be no authorization given. Although it's way too broad, it's apparent why authorization was made the only consideration: If, conversely, if any data a server offered freely to public requests was termed authorized, then injection attacks could be said to be doing exactly what machine was programmed to do unless a TOS specifically detailed what was authorized input. That brings things right back to the TOS being able to define what is authorized. The law needs to be much more detailed to avoid being too broad, yet avoid "it's not a bug, it's a feature" type defenses.

  2. While I think this is ostensibly a good idea... by Omnifarious · · Score: 5, Informative

    While I think this is a good idea, I think that it's really too superficial. It very narrowly addresses a very specific problem with the law.

    There are two really great little tidbits I found online that talk about what the actual problems with the law are:

    The first link is actually a really great series that provides a very nice explanation for a lot of things about how criminal law works.

  3. Felony Abuse by velvet_stallion · · Score: 5, Insightful

    It is high time we rollback the number of crimes that result in felony convictions. The "Get Tough On Crime" era only resulted in overstretched state budgets and the creation of an entire underclass of citizens who are barred from certain employments, voting, etc. just because politicians sought to score political points in order to get re-elected. There is a very stark contrast to what the term "felon" implies with regards to the seriousness or violence of the crime, and the rather lackadaisical manner in which it is applied in the legal context.

    1. Re:Felony Abuse by anagama · · Score: 4, Insightful

      Get off your Smug Horse because that's not how it works -- even with the "six month" plea agreement he could have spent years in jail, maybe decades:

      Some have blithely said Aaron should just have taken a deal. This is callous. There was great practical risk to Aaron from pleading to any felony. .... More particularly, the court is not constrained to sentence as the government suggests. Rather, the probation department drafts an advisory sentencing report recommending a sentence based on the guidelines. The judge tends to rely heavily on that "neutral" report in sentencing. If Aaron pleaded to a misdemeanor, his potential sentence would be capped at one year, regardless of his guidelines calculation. However, if he plead guilty to a felony, he could have been sentenced to as many as 5 years, despite the government's agreement not to argue for more. Each additional conviction would increase the cap by 5 years, though the guidelines calculation would remain the same. No wonder he didn't want to plead to 13 felonies. Also, Aaron would have had to swear under oath that he committed a crime, something he did not actually believe.

      http://cyberlaw.stanford.edu/blog/2013/01/towards-learning-losing-aaron-swartz-part-2

      --
      What changed under Obama? Nothing Good
  4. Too little too late by dyingtolive · · Score: 4, Insightful

    Fantastic fucking idea. You know what would have made it better? If it never was a felony to begin with.

    Don't mod this up. Common sense doesn't need moderation points. I'm venting.

    --
    Support the EFF and Creative Commons. The war is coming, and they're supporting you...
  5. Re:I'm confused... by fnj · · Score: 4, Insightful

    Aren't violations of contracts (like ToS) subject to civil law instead of criminal law?

    A law, duly enacted, which makes it a felony to violate such ToS, makes criminal procedure apply. That law has to be fixed, and then that particular violation of contract will revert to the normal civil procedure.

  6. Conduct of Federal Prosecutor Carmen Ortiz by CuteSteveJobs · · Score: 5, Interesting

    Yes, the law is supposed to distinguish between a non-criminal civil dispute between two private parties (Aaron and JSTOR) and a crime which is "an act so horrendous it is against society" - I am paraphrasing a law professor. Aaron's acts don't come close to that. Yet there he was looking at prison.

    ArsTechnica has a good article on this case, which quotes Columbia law professor Tim Wu on the appalling behavior of federal prosecutor Carmen Ortiz:
    In our age, armed with laws passed in the nineteen-eighties and meant for serious criminals, the federal prosecutor Carmen Ortiz approved a felony indictment that originally demanded up to thirty-five years in prison. Worse still, her legal authority to take down Swartz was shaky. Just last year, the Ninth Circuit Court of Appeals threw out a similar prosecution. Chief Judge Alex Kozinski, a prominent conservative, refused to read the law in a way that would make a criminal of “everyone who uses a computer in violation of computer use restrictions—which may well include everyone who uses a computer.” Ortiz and her lawyers relied on that reading to target one of our best and brightest... The prosecutors forgot that, as public officials, their job isn’t to try and win at all costs but to use the awesome power of criminal law to protect the public from actual harm... Today, prosecutors feel they have license to treat leakers of information like crime lords or terrorists. In an age when our frontiers are digital, the criminal system threatens something intangible but incredibly valuable. It threatens youthful vigor, difference in outlook, the freedom to break some rules and not be condemned or ruined for the rest of your life.
    http://arstechnica.com/tech-policy/2013/01/opening-arguments-in-the-trial-of-public-opinion-after-aaron-swartz-death
    http://www.newyorker.com/online/blogs/newsdesk/2013/01/everyone-interesting-is-a-felon.html
    http://www.guardian.co.uk/commentisfree/cifamerica/2009/nov/17/silverglate-three-felonies-book

    Academic publishers have been price gauging universities and students for a long time, but to their credit at least JSTOR had the brains to tell the feds to back off. Oritz should have listened to them. Their behavior is merely greedy. Hers is unforgivable: there is no place in government for public officials who abuse their power and harm the public for their own personal advantage.

    http://www.guardian.co.uk/science/2012/apr/24/harvard-university-journal-publishers-prices
    http://enculturation.gmu.edu/knowledge-cartels
    http://boingboing.net/2010/01/03/prescription-for-con.html
    http://academhack.outsidethetext.com/home/2012/ending-knowledge-cartels/

  7. Re:No one reads the TOS. by c0lo · · Score: 4, Insightful

    I have a document in my backpack; my personal ToS. It states that everyone who shakes my hand must give me $20. By shaking, they agree.

    Even if they were it still fails for lack of consideration: the other party suffers a detriment both in paying $20 and in shaking your hand, so the consideration only flows in the same direction ... twice. :p

    Easy fix: switch the places between the hand and the ToS... put the hand in the backpack (detach it if necessary) and offer the ToS to be shaken.

    --
    Questions raise, answers kill. Raise questions to stay alive.
  8. Re:Great cases make bad law by seebs · · Score: 5, Insightful

    That is some serious bullshit there. The "guilty conscience" thing? Seriously, that's just crap. That is not how people work, and that is not how reality works. There are lots of people who know perfectly well that there is a law they have technically broken, but who do not feel guilty about it at all -- but who might not be surprised to face jail time if a prosecutor happened to pick them to make an example of. The problem with this, apart from the victim-blaming, is that you're assuming that "violated a law" and "guilty" are the same thing in any kind of ethical sense. Similarly, "he knew he was guilty, so the probation he would have recieved was deserved."

    This doesn't logically follow, because "deserve" is a moral claim, but you're basing it on the legal system. Legal systems are not moral systems. You can quite easily be fully aware that you have done a thing which is prohibited by a law, but not feel that you deserve jail time for it. Or you might feel that a misdemeanor charge that's in some way related to what you did is justified, but that multiple felony counts aren't.

    The fact is, nothing he did merits years of jail time, and the claim that the prosecutor was "asking for" six months minimum security is highly misleading at best. They were, quite clearly, aiming to make an example of him. Look at previous cases Ortiz prosecuted against people who could afford defense teams, and tell me how "deserved" those outcomes were.

    Long story short, even if we ignore the fact that he was depressed, this was a crazy thing and your attempts to make it look less crazy are disturbing. The just world fallacy is called a fallacy because it is not actually valid reasoning. Your attempts to make yourself feel okay with the world by pretending that what happens is okay and justified are unpersuasive at best. And yet. We know he was depressed, and we know a fair amount about what depression does to people's ability to evaluate things and make decisions. It's bad enough that prosecutors are trying really hard to make dramatic examples of people by going after huge piles of charges without regard to the actual severity of the underlying acts; cherry-picking for depressed people because they're easier to bully is despicable. So's trying to defend it.

    --
    My blog: http://www.seebs.net/log/ --- My iPhone/iPad app: http://www.seebs.net/seebsfrac/
  9. Re:Unfortunately, this "law" cost a life by Anonymous Coward · · Score: 5, Informative

    The system didn't do him in. PEOPLE caused his death. By taking away all other acceptable options.
    The powers that be decided he must be "MADE AN EXAMPLE OF". Because "minor maybe crime" on a "computer" (ooo scary! hackers! cyber! oh nos!).

    And he was smart enough to realize just how totally screwed he was. Now and in the decades coming of his future.
    He took the only option left to anyone who doesn't like rape and a ruined life plus being billed for it. Death.

    And the powers that be. Will never miss one night of sleep over it. Nothing will ever happen to them. And they will continue to do this to other people.

    The wheels of the american justice machinery grind exceedingly slow and very fine.
    Beware you don't get caught in them. Or else death is the only logical option open to you. Unless handcuffs, bars, rape and abuse is your thing.

  10. Re:Unfortunately, this "law" cost a life by gmuslera · · Score: 5, Interesting

    The "because" probably was more related to that he was a major voice behind the efforts of against sopa/pipa and other movements. That minor maybe crime was the excuse to get it and then try to make an example, you know, like rape charges by someone associated with the CIA. If you go against or scare them, somehow, even for a parking ticket, you will get into deep shit. Taking away a particular tool that they used once don't mean that they are stopped from using them, or any of the other alternatives.

  11. Is there a larger issue here though? by popo · · Score: 5, Interesting

    A larger problem however is the expectation of non-legal laymen to read and agree to what are ostensibly binding TOS contracts.

    I have seen TOS contracts that (in non-digital format) would be dozens of pages long. Users simply click "Ok" with the assumption that "There's probably nothing bad in there". But this assumption is clearly false in a large number of cases when one considers privacy and security clauses.

    I have seen "Digital trespassing" (which are protected by the DMCA) buried in the TOS carrying agreed monetary damage amounts.

    Consider that a TOS could expressly forbid users to use AdBlock and consider all users of AdBlock to be digital trespassers. You say "Bollocks" (as would I, for the record) but that doesn't change the fact that a TOS can say whatever it wants and the law has already decided that online consent to contracts can be binding. (Not to confuse the greater issue with the legality of this one example of course.)

    The issue ultimately comes down to:
    1) The expectations of lay-people to understand and agree to complex, binding agreements, the vast majority of which are never read.
    2) The binding nature of a click-to-sign agreement.

    --
    ------ The best brain training is now totally free : )
    1. Re:Is there a larger issue here though? by Rich0 · · Score: 4, Insightful

      Frankly I'd get rid of all contracts of adhesion. Contracts should only have the force of law if they are original creative works authored by both parties. For standard transactions like buying homes/etc you can use a form-based contract, but only if it is embedded in a law (ie the government explicitly approves all standard contracts and their terms).

      Really this amounts to nothing more than actually enforcing the whole "meeting of the minds" bit which is supposed to be at the center of contract law anyway. There is no meeting of the minds when your boss says "sign this or I will fire you" or whatever.

    2. Re:Is there a larger issue here though? by suomynonAyletamitlU · · Score: 4, Insightful

      I have often thought that a binding TOS / EULA should be mandated to take the following form, with very clear language:
      >>
      You agree not to distribute a bazillion copies of our software [Yes] [x No]
      You agree that we own your content [Yes] [x No]
      You agree that we are not liable for damage [Yes] [x No]
      You agree to not sue us if we lose your credit card information [Yes] [x No]

      I'm sorry, it seems we cannot agree on a contract. In particular, these terms are mandatory:
      * You agree not to distribute a bazillion copies of our software
      * You agree that we are not liable for damage
      * You agree not to sue us if we lose your credit card information
      The following would be stored as a user preference:
      * You agree that we own your content: NO (Note: May limit functionality)

  12. Re:any trespassing cases based on odd store rules? by Rich0 · · Score: 4, Insightful

    Store rules are actually a good way of looking at this sort of thing.

    If you do something really obnoxious in a store they can ask you to leave. If you refuse to do so they can call the police. You can of course sue the store for discrimination, and the police might not even make you leave if the basis for the removal is so egregious.

    Website TOS's should be similar. If somebody doesn't like what you're doing on their website they should ask you to leave, and if you cooperate then no crime has occurred. Unfortunately that isn't what this law was being used for - imagine if you wear a hat in a store that has a "no hats" policy and the owner just called the police, and they showed up, and then charged you with a felony for violating the store rules.

    Trespassing is only trespassing if somebody actually asks you to leave. Now, if you walk into a store and set fire to it then you can be arrested on the spot, but not for trespassing.