Slashdot Mirror
Company Using Proxy To Evade Craigslist Block Violated CFAA
WillgasM writes "Changing your IP address or using proxy servers to access public websites you've been forbidden to visit is a violation of the Computer Fraud and Abuse Act, according to a judge's broad ruling (PDF) during a case on Friday involving Craigslist and 3taps. Opponents argue that this creates a slippery slope that many unsuspecting web users may find themselves upon. With your typical connection being assigned an address dynamically, is an IP ban really a 'technological barrier' to be circumvented? How long until we see the first prosecution for unauthorized viewing of a noindex page?"
Probably a long time; the judge in the case rejected the slippery slope argument: 'There, and sprinkled throughout its earlier, ostensibly text-based, arguments, 3taps posits outlandish scenarios where, for example, someone is criminally prosecuted for visiting a hypothetical website www.dontvisitme.com after a "friend" — apparently not a very good one — says the site has beautiful pictures but the homepage says that no one is allowed to click on the links to view the pictures. Needless to say, the Court’s decision [regarding 3taps' actions]... does not speak to whether the CFAA would apply to other sets of facts where an unsuspecting individual somehow stumbles on to an unauthorized site.' Willful evasion of blocks for commercial gain, on the other hand ...
This is so fucked it's beyond belief...
Braindead, much?
Try posting to Slashdot without logging in and you'll see how popular IP address based blocking is.
Seems no difference than trespassing. Putting on a fake mustache, sunglasses, and a wig doesn't mean you can ignore the trespass order.
It's called a World Wide Web
It is NOT the United Websites of America, nor is it the Terrorist Url of Fuckingstan
Content should not be limited on the internet to one location, there is no valid acceptable reason to.
First they limit the market on which they distribute their product, then they advertise it everywhere ( ever seen 'this advertisement is not available in your country' ?), then it gets pirated in places where it is not available by any other means and then they have the nerve to complain that they are "losing" sales.
Banks / money and credit / debit cards / various payment options have penetrated all corners of the world, if you have internet access you have payment options, so you can pay for a service / product that somebody on the other side of the planet is selling. It's about time they wake up to the reality and adapt and stop trying to hold back the inevitable.
Being banned from a site is no different from being banned from a physical location. The security is week. You can come up with hypothetical around wearing a mask into the store. Someone comes into a store wearing a mask and is confused for a criminal. But at the end of the day, if a person tells you go away and you don't, judges are not going to be sympathetic.
Would this ruling still have been made if they hadn't also ignored the cease-and-desist letter sent to them by Craigslist?
systemd is Roko's Basilisk.
If I put up a web site that forbid anyone working for or on behalf of any TLA or law enforcement agency from accessing any publically accessible content on my site could I use CFAA against the government when they ignore my wishes and suck the whole thing into a NSA database?
3Taps responds:
"3taps Statement Regarding craigslist’s Misuse of the CFAA
At craigslist’s urging, a federal court has recently interpreted the Computer Fraud and Abuse Act (CFAA), known as the “worst law in technology,” to apply when an owner of a public website decides that it no longer wants an Internet user accessing its website. The court held that “the statute protects all information on any protected computer accessed ‘without authorization’ and nothing in that language prohibits a computer owner from selectively revoking authorization to access its website.” Order at 12. 3taps is obviously disappointed in the Judge’s ruling and believes that by making public information publicly available on the Internet, without a password, firewall, or other similar restriction, craigslist has authorized, and continues to authorize, everyone to access that information. 3taps believes that the CFAA was meant to protect private and confidential information and that it was never meant to be used to selectively criminalize accessing public websites and obtaining the public information found on those sites. Importantly, the Court noted that the “current broad reach of the CFAA may well have impacts on innovation, competition, and the general ‘openness’ of the internet . . . but it is for Congress to weigh the significance of those consequences and decide whether amendment would be prudent.” Order at 12. 3taps continues to urge Congress to clarify the scope of the CFAA so that companies like craigslist cannot use it as a tool to stifle competition, innovation, and access to public websites.
While we disagree with the Court’s interpretation of the CFAA, we of course respect the Court’s ruling. Accordingly, 3taps will adhere to the current interpretation of the law and will immediately cease all access to craigslist’s servers. (Significantly, 3taps only began accessing craigslist’s servers because, as alleged in 3taps’ antitrust counterclaim, craigslist interfered with 3taps’ ability to source content through general search engines.)
Although craigslist may use the CFAA as currently interpreted to prevent 3taps from accessing its servers, 3taps can continue to function because directly accessing these servers is only one of three ways in which the information in question can be obtained. The other two, crowdsourcing and public search results, require no such access to craigslist’s servers and thus obviate the need to engage in conduct that may implicate the CFAA.
Going forward, 3taps will operate based on its understanding that if it does not access craigslist’s servers, it has a right to collect public information originally posted on craigslist’s website. In particular, 3taps reasserts four fundamental points:
3taps does not now scrape craigslist’s servers, and therefore, cannot be in violation of the CFAA.
3taps' indexing and caching of exchange posting data reduces (rather than increases) the net computing resources expended by craigslist and other publishers to deliver complex search results to end users.
As the Court previously held, craigslist cannot rely on its current Terms of Use to claim the right to enforce copyrights associated with user-generated ads posted on its website.
The United States Patent and Trademark Office recently confirmed that craigslist cannot trademark a peace sign – even if that peace sign is purple. See http://ttabvue.uspto.gov/ttabvue/ttabvue-77956067-EXA-24.pdf. 3taps and others cannot be harassed for using the peace sign to indicate where information was sourced.
3taps will hold a public event to demonstrate to any interested party that it is possible (despite assertions to the contrary) to obtain public information on the Internet without reliance on accessing a particular source website. 3taps believes that, by no
When judges write their rulings -- or rather their employees write their rulings -- the document may go onto a few peoples' desks before release. The more complicated the ruling, the more this is likely as judges don't like things getting overturned. Lots of overturned on appeal looks bad, apparently. Well, it may time for judges to get their rulings to pass some elementary technical review.
---- The above post was generated by the Turing Institute. Maybe.
It seems like Craigslist had to pass two hurdles to get to this result. First, they sent a cease and desist letter to 3taps which effectively withdrew authorization to use their website for scraping. Second, they put up a technological barrier (albeit a token one) to prevent 3taps from scraping. 3taps subsequently ignored the cease and desist letter willfully, as demonstrated by their use of proxies. I don't think 3taps has any legs to stand on.
Anyone who uses a proxy does not have to worry about violating the CFAA unless they are doing it specifically to get somewhere they have been explicitly banned from. 3taps apparently was taking ads from Craiglist and pawning them off on some other website. Sorry, you can't ethically do that any more than I could scrape comments off of this site and pass them off as coming from pishpot.org.
I do think that it is inane to call this a criminal matter, however. As it was inane in the Schwarz/JSTOR case too. Over-criminalization is a general problem.
You know what this means.
Someone has already taken the dontvisitme.com domain, as of 2013-03-19. But that doesn't mean we can't set up other similarly-named sites with the exact scenario detailed in the judge's decision here, and using this exact case as precedent to get a judgement against anyone that stumbles into the honeypot.
Remember, saying something bad won't happen because it's just too farfetched is a nearly 100% effective way of making that exact scenario happen. It's the same reason "Rule 34" works. When someone hears your bad idea, they implement it. It's our turn, Internet. Let's implement this and make him eat his words. Bonus points if we can trap this exact judge in the honeypot personally. That's when we can file suit against the judge to get him kicked off the bench and disbarred for being a complete tool.
So, I set up a few firewall rules to block connections from the NSA and then they circumvent that block, then whammo on them with the CFAA.
Captcha: erection
mod up
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
Isnt it simple enough to require registration for access to the data to be denied to whomeever??
It might make casual access for everyone else more bothersome (hasnt THAT already happened?)
and more work for the company to vet those they allow access to - like verifiable IPs or email addresses (like block yahoo mail accounts used for registration? Why are these things restricted in the first place when they also might be put out in encrypted form and the decryption given only to those with authorized access??? Decoder Apps, etc...
Its not rocket science is it ?
You can bet that scamartists will try to use any laws to their advantage and bring lawyers into pla and extort monies.
What part of "forbidden to access" and "unauthorized access" don't you fucking idiots not understand?
3Taps was banned from Craig's List. Craig's List took the steps it could to prevent 3Taps from accessing their site including telling 3Taps to stop and sending a Cease and Desist letter. 3Taps ignored the letter and took steps to access the site after they had been specifically told they are not authorized to access the site.
If one is told one is not welcome in a store or bar and one goes in anyways, one can get arrested. If you were to tell someone they are not welcome in your house and they have no legal right to enter your house, you can have them arrested for trespassing and possibly breaking and entering.
Their premise is the current case is not bad enough for opposition, and only some hypothetical future case is bad enough for opposition. It's a form of strawman argument.
Not everyone on a blacklist is guilty. If one person on your work network gets blacklisted from a site, it will hit everyone on that network. Sometimes sites will even blacklist whole IP ranges because too many IPs in the range have been engaged in something malicious, but that doesn't mean that every IP in the range is doing something wrong. And as the summary points out, IPs are allocated dynamically, and not intended to be used as authentication of a real-life identity. Your IP might be blacklisted for actions taken by someone who used that IP previously. And even if you are banned for good reason, it may be that you received an automated ban because your computer was infected with some malware. Once you clean off the malware, you might be fine.
Yet you're telling me that, if I try to bypass a blacklist for any reason, I'm committing fraud?
They violated a cease and desist letter, so if that can carry any penalty, hit them with it. But there should not be any criminality applied to changing or obscuring your IP address.
The judge imposes his own idiosyncratic and draconian notions of what constitutes 'authorization' to access a page, while claiming to avoid doing so, dismissing the idea that absence of technical constraints on accessing a page might constitute authorization. And he imagines that accessing web resources is like visiting a store open to the public -- one 'enters' a website only through the home page (the doorway into the store). If the home page contains a notice, that is equivalent to posting a sign at a store entrance, as though hyperlinks always link only to home pages, and a human being always reads any notices posted on those home pages. And so he mocks the idea that one might follow a link to material on a website without being aware of its being on that website, and then be held accountable for what he himself has said would be unauthorized access.
I can see how Craigslist can claim civil damages from the other company by taking its advertisements away. If you think about it, they are basically robbing their business and costing them money. However, making these criminally enforceable means that you can go to jail because a private individual or company makes a rule that you don't follow. I think Craigslist has a legitimate civil claim here. This company is a parasite and is disrupting their business. However, it is not a 'criminal' activity. By all means take their money. But a perp walk for this?
This means that if you work for one of those companies that only allows specific software on your computer and you are a developer and need something else. You have a deadline and need to get something done, so you ignore the rule. Instead of simply risking termination for violating company policy for installing the wrong version of Eclipse, you risk being sent to jail. or... lets say you use a generic script you got off the internet at company A. You go to company B and you use the same generic script. Company A can now criminally charge you for taking their intellectual property?
Then think about the extensions of this... companies are now more commonly issuing employment agreements online. You sign them with a digital signature. The agreement can say in the bottom 'you can't talk about this agreement'. I never sign those. If I am interviewing for a job and they ask why I am quitting and I say 'I dont want to sign the new employment agreement and here is why' (I have done this), I am technical breaking a criminal law even if I did not agree to the agreement. This agreement is criminally enforceable only because they issued it online instead of on paper.
Extension of this. You sign an online separation agreement with Company A. They give you a bad reference. your prospective employer asks you about this and you tell them your side of it. Are you technically violating a crime if the separation agreement says you can not say anything negative about the company? Lets say a future employer is competing with a previous employer from 5 years ago. You want to help your new employer win a contract. You know some people on their previous company are bad at 'X'. So your company presses 'X' and says we are better than these guys. Are you committing a felony now?
It is very common for companies to claim everything they make you sign as 'their intellectual property'. In the past the worst they can do is sue you and this costs them money. If they make you use a digitial signature this becomes criminally enforceable.
Despite posing to contrary, Craigslist has been in overjealous position for some time. There is fine line between protecting your business/IP and vehemently preventing anyone from extending on your service, even when they give you credit.
For example, CL has been going after any service that would display CL postings in a different matter (ordered list etc), even when those sites do not scrape full content, duly link the ad back to CL for full details etc. In a nutshell, CL doesnt want anyone else to access their system in programmatic manner, even if they give credit back to CL, does not want to sell such access for decent price, except for the end users that THEY decide will get in.
On the surface, that may look ok, technically, but using all sorts of crappy laws to prevent any extension is sort of what Microsoft does to others.
> that one might follow a link to material on a website without being aware of its being on that website, and then be held accountable for
You think they weren't aware that their business model was scraping craigslist? They were most certainly aware of which site they were scraping. When they signed for the certified C&D letter, they were well aware that they were doing so over the objections of the owner.
To me, this is exactly like criminal trespass. The fact that they set up proxies in attempt to hide their actions is further evidence that they knew what they were doing was wrong.
Fyi, the phrase is "over zealous". Carry on.
Have gnu, will travel.
Their website is on the public internet, but then again so is your front gate.
I don't get to walk through that gate despite being told "Get Off My Lawn(tm)" by you because "your gate is on the public highway!!".
So you can go to their website ONLY IF you do not ask it to do anything for you (which was what they asked you to stop visiting their site). So no "HTTP GET" request.
I agree with your post. This case is plain old criminal trespass.
I have to comment on your subject line. Some slopes are known to be slippery, so it's valid to be concerned that "if you authorize the NSA to do X, they may well stretch the limits to Y".
To me it seems "no trespassing" isn't a correct example. I like to think of it as more a store front window on a public street. Any passer by can look in. People may come to this street just to look in the window to see what is on display. Some might even want to copy, take notes or even pictures on what is on display in this window. Maybe the store doesn't like that, so it has build a robotic facial recognition system that move blockers in the way of people who they don't want peeking in. Now someone who has been blocked come along, wearing a mask and it fools the blocking system, are they breaking the law?
No. They do no such thing. I just posted an ad, and they don't even ask you to agree to a TOS before posting, nor do they have a notice assigning your copyright to them. They have no claim, and the judge is an ignorant buffoon.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I'm sorry, it's the craigslist website on the WHAT?
The you-know-what isn't some private company intranet. The whole lot of you knows damn well what "in the wild" means.
If we're walking in my yard, it's my authority to tell you "Your dog can't poop here." but we go into the grassy park superhighway and that's gone.
Although, authority or not, I'm still gonna say it: "Get off my internet."
In other words they have a license to copy your copyrighted works. Craigslist does not own the copyright. They merely have permission to copy it. They also claim the right to stop unauthorized copying, but since they don't own the copyright, only the poster can claim copyright infringement. Craigslist has no leg upon which to stand. Period.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I don't think that's necessarily true. If a media company can hire a firm to send DMCA notices on their behalf, an individual can "hire" Craigslist to police your copyrighted ad for you.
Dude, they explicitly state that you authorize them to go after anyone culling their database, even if it's your posting. That's exactly what they did.
The more vague and broad a law is the more inconvenient people we can incarcirate! We should strive to make sure the dirty peasants know that the moment they get out of line we will slam the book against them with as many vaguely defined crimes as possible!
But... the future refused to change.
Technically you could do that, but nobody did that. As you rightly point out, the person who owns the copyright is the poster, and they would have to complain. Of course, this is where craigslist and the posting person are at odds, since the posting person wants their ad seen by as many people as possible. It is to their advantage to have it replicated.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
No. They do no such thing. Read the wording again. It says they can go after unauthorized copying. Again, they have no authorization system, so it is all authorized. Period.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Nobody did that? I think that's part of what's in question.
You also expressly grant and assign to CL all rights and causes of action to prohibit and enforce against any unauthorized copying, performance, display, distribution, use or exploitation of, or creation of derivative works from, any content that you post (including but not limited to any unauthorized downloading, extraction, harvesting, collection or aggregation of content that you post).
They offer that "service" for free. It's to the user's advantage to have their ad plastered all over the web, but they could still implicitly accept a contract that waives that. And not everyone necessarily wants their ad elsewhere.
Authorization means that the owner has given you permission. Period. It has NOTHING to do with technical controls. The means of notification of authorization (or lack thereof) are immaterial. As soon as they received the C&D letter they were unauthorized and knew it. Stop pretending it is otherwise.
Nowhere is it even suggested that any craigslist poster went to court over this issue.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Again. No, they were not. Now seriously. Off you go ...
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
You must be reading what you wrote differently than I am. I don't see the word court in either of our posts. I thought by "Nobody did that" you were referring to "an individual can "hire" Craigslist to police your copyrighted ad for you"
Yes, this scenario is criminal trespass in all states.
Some states define criminal trespass as entering after having received due notice that you are not welcome. They acknowledge they were so notified.
Other states define criminal trespass as entering with the intent to perform an unlawful act. Again, they entered the system with the intent to commit an unlawful act, to wit copyright infringement, unfair competition, etc.
So yeah, it's a plain and ordinary case of criminal trespass. The only thing slightly interesting is that they had been notified they were not welcome to enter a web property as opposed to a brick and mortar store or other place.
ah yes! the magical field of the copyright-particle. it "somehow" just knows where to stop. be it a mountain range, a river, some ocean coast line or some arbitrarily draw line drawn with a british ruler thru the dessert. ... makes no sense. anybody making advertisement should be happy if it is distributed for free?
if we could somehow harness this fantastical particle, we could create attracting and repulsing fields that from one point in space to the next drop from a maxium to ZERO. imagine the sh1t one could do.
i'm sorry if i'm violating any laws here(*), but for me the computer is a copy machine. the internet is a universally agreed upon network that links COPY MACHINES!
(*)im not enticing anyone to break the law here, just saying in my quest to simplify (and understand) the world, i have convinced myself to ignore certain illogical things.
also putting a copyright on a ADVERTISMENT is errr
the internet is the library that will keep your books forever safe, with the caveat that anyone can freaking use the copy-machine there. if you don't like that perpetual backuping and copying going on in the internet library, don't put it here.
i see raised hands? yes a cd-player i also a copier because it is a computer, albeit a specialized and limited one.
let's keep things simple. life is hard enough as it is (or not). now please exit the stadium in an orderly fashion.
if the cops try to use different IPs they are breaking the law. ahhahhaa
Liberty freedom are no1, not dicks in suits.
You are an awesome troll.
War doesn't show who is right - just who is left.
enter a web property as opposed to a brick and mortar store or other place.
Crippling unnoticed fallacy: there's no such thing as web property. Otherwise, where's the web deed? Where's the web plat book?
(And don't try to cite the DNS system. The DNS system confers no ownership.)
Welcome to the Panopticon. Used to be a prison, now it's your home.
If there is a single slippery-slope argument about anything, anywhere, that isn't a strawman in disguise, please reply with it.
slippery-slope arguments are defined by the up-front concession that the current issue is not a serious problem. I think you are confusing a slippery-slope argument made now (always weak) with the encapsulated argument made in the hypothetical downhill future (probably valid, and no longer a slippery-slope argument because it is contemporary).
If I were a troll at all then you would indeed be correct ;-)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
You prorved that here running from this http://tech.slashdot.org/comments.pl?sid=4117625&cid=44647137