Slashdot Mirror


ACLU Lawsuit Challenges Computer Fraud and Abuse Act (thestack.com)

An anonymous reader writes: The American Civil Liberties Union (ACLU) has filed a lawsuit with the U.S. Department of Justice contending that the Computer Fraud and Abuse Act's criminal prohibitions have created a barrier for those wishing to conduct research and anti-discrimination testing online. The ACLU have pursued the matter on behalf of a group of academic researchers, computer scientists and journalists seeking to remove that barrier to allow for third-party testing and research into potential online discrimination. In a public statement the ACLU contend: "The CFAA violates the First Amendment because it limits everyone, including academics and journalists, from gathering the publicly available information necessary to understand and speak about online discrimination."

43 of 76 comments (clear)

  1. I don't follow by mark-t · · Score: 1

    I read the article... it says that the CFAA somehow prevents people from doing legitimate research, but fails to even give a single example of actually how this happens. How does the law that is supposed prevent computer fraud stop a person from doing research, exactly?

    1. Re:I don't follow by Anonymous Coward · · Score: 5, Informative

      One of the provisions makes it a felony for unauthorized access to a computer system. In most EULAs it spells out that reverse engineering is disallowed and creates an area of unauthorized access. Thus a security researcher trying to analyze a system is technically committing a felony under the CFAA as it doesn't make any exceptions. Even if the analysis is being performed completely locally on systems they own if say the OS is Windows or MacOS.

    2. Re:I don't follow by Anonymous Coward · · Score: 1

      Sure but how is any of that related to research into potential online discrimination?

    3. Re:I don't follow by PRMan · · Score: 2

      They need to lie and say they are black or lie about their zip code in order to see if there is any disparate treatment. They can't do this with the CFAA as it is technically illegal, since they are lying about their identity.

      --
      Peter predicted that you would "deliberately forget" creation 2000 years ago...
    4. Re:I don't follow by mark-t · · Score: 2

      Thus a security researcher trying to analyze a system is technically committing a felony under the CFAA as it doesn't make any exceptions

      It doesn't have to make exceptions.... the law prohibits *UNAUTHORIZED* access to a computer system. If you own the computer system yourself, then who else is supposedly supposed to be authorizing you to access it? If someone else controls authorization to access to some piece of property, then by definition that property belongs to THEM. Unless there is another law that also prohibits private people from owning personal computers, the CFAA does absolutely nothing to stop anyone from accessing anything that they want on the devices that they have purchased for themselves. As a secondary point, how the hell would they supposedly even know, anyway?

    5. Re:I don't follow by BitterOak · · Score: 1

      They need to lie and say they are black or lie about their zip code in order to see if there is any disparate treatment. They can't do this with the CFAA as it is technically illegal, since they are lying about their identity.

      Why can't these researchers simply hire some black people? Why do they need to commit fraud to do their research? And if I'm offering an online service or business, why should I be compelled to offer my computing resources to assist in your research, noble though your research goals may be?

      --
      If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
    6. Re:I don't follow by Anonymous Coward · · Score: 1

      Seems like they could just temporarily "identify as" black or "identify as" poor, since Western Civilization now tells us that things like gender and race have no basis in concrete reality.

    7. Re:I don't follow by PopeRatzo · · Score: 3, Funny

      Well hell, now I have to delete my bitchy empowered female avatar, my ditsy teen schoolgirl avatar, my racist troll sockpuppets,

      ...and that was the end of his presidential campaign.

      --
      You are welcome on my lawn.
    8. Re:I don't follow by mark-t · · Score: 1

      Of course you can.... if you do a proper survey of other people, and compare their results... with their permission, of course.

    9. Re:I don't follow by mark-t · · Score: 2

      ...since Western Civilization now tells us that things like gender and race have no basis in concrete reality.

      Things like that have no lawful basis for certain types of discrimination, but it is wholly erroneous to say they have no lawful basis in concrete reality.

      One example of a legal type of discrimination based on sex would be one's right to discriminate on the gender of a person that they may want in a roommate, when the roommate shares any of either a bedroom, bathroom or kitchen with the other person. One is obviously not required to discriminate based on sex for those reasons, of course, but it is but one example of where it is entirely legal to discriminate based on gender.

    10. Re:I don't follow by Intron · · Score: 2

      I read the article... it says that the CFAA somehow prevents people from doing legitimate research, but fails to even give a single example of actually how this happens. How does the law that is supposed prevent computer fraud stop a person from doing research, exactly?

      How's this?

      https://www.databreaches.net/c...

      Or this?

      http://www.computerworld.com/a...

      --
      Intron: the portion of DNA which expresses nothing useful.
    11. Re:I don't follow by mark-t · · Score: 1

      As I said, I know what the CFAA is, but I don't see how it prevents people from doing otherwise lawful research for instance... At most, it only prevents you from doing research with someone else's data.... but then a good researcher that was not being lazy would collect their own data, and not rely on data that did not belong to them anyways.

    12. Re:I don't follow by Mashiki · · Score: 1

      If you're trying to reconfirm an existing conclusion using their data first, then your own is the best option to see if everything is the same. Remember, the story on /. not more then a few months ago showing that ~60% of studies couldn't be reproduced even using the same methodology as the original?

      --
      Om, nomnomnom...
    13. Re:I don't follow by Hentes · · Score: 1

      They want to use bots on sites. The CFAA is irrelevant in my opinion as they would still be in breach of the ToS.

    14. Re:I don't follow by tepples · · Score: 1

      The view under the DOJ's interpretation of the CFAA is that online roleplay is illegal on sites whose written terms of service explicitly forbid online roleplay.

  2. Re:That vile ACLU by Anonymous Coward · · Score: 2, Insightful

    The ACLU would be great if they weren't so selective about the civil liberties they defend.

  3. Invent a new crime. by HornWumpus · · Score: 1

    My life's ambition has long been to invent a new crime. People will say 'that has to be illegal', it will be made illegal after I do it.

    The computer fraud and abuse act ruins that. Anything a federal judge doesn't like, crime...ipspostfacto, schmipspostfacto.

    --
    John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    1. Re:Invent a new crime. by Fire_Wraith · · Score: 2

      The CFAA is the "X with a computer" of criminal law, where X is just about anything they want to enforce it as. And that's the problem. It's stupid and BS for patents, and it shouldn't be any more valid in criminal cases.

    2. Re:Invent a new crime. by HornWumpus · · Score: 1

      If you do something with your own computer that a federal judge decides, after the fact, is a crime, it's a crime.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
  4. How is it different for offline by u19925 · · Score: 2

    If you go to doctor's office and start video recording everyone to collect data on discrimination, will it allow it? Same way, website can limit recording of publicly available information. Doctor's office will also ask you provide true information just like websites do. I don't see much difference between the two. There are many private clubs which limit do the same. I don't see Facebook, Twitter any different than YMCA etc where if I want to be in, I have to become member, pay, provide my true information and then can do limited recording. If you ask online sites to allow fake id, unlimited recording, then why not doctor's office, gyms, hotels etc?

    1. Re:How is it different for offline by Fire_Wraith · · Score: 5, Interesting

      Probably the analogy would be the laws making it illegal to record abuses at places like food processing plants. There have been several states that have attempted to outlaw undercover video, after activists managed to get hired, and later released video of the horrible and illegal stuff that was going on in those plants. Or consider bans against recording the police on video, that wind up making any video recording of the police, even of the police committing a blatant crime, illegal.

      That doesn't mean the law needs to go away entirely, but having some sort of affirmative defense should play a part, for instance.

    2. Re:How is it different for offline by DarkTempes · · Score: 1

      I assume you'd have to pay without insurance but I can't see any reason why you couldn't use any name you like at a doctor's office.
      It's not like they do background checks. And celebrities go to hospitals under pseudonyms sometimes, right?
      IANAL but, as long as you paid your bill, I assume it wouldn't be fraud.

      Any sane person can see the CFAA is broad and overreaching and I get the feeling that this is just another angle the ACLU thinks might work to attack it.

      Did we really need a specific law for computer-related crimes? Are existing definitions for things like fraud/wire fraud and property damage not good enough?
      And does it even actually help deter crime in any way? I certainly haven't noticed fewer phishing attempts in my spam box...

    3. Re:How is it different for offline by david_thornley · · Score: 1

      I'd say we do need specific laws for some computer-related crimes. One would be unauthorized access, provided we define "unauthorized" in a reasonable manner. Logging in with a supplied account name and password should not count, for example, no matter for what purpose. Fraud normally requires proof of harm, as does property damage. Someone hacking into a computer system may not do visible harm, but we really are better off if it's illegal.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  5. The law is as broad as possible by rsilvergun · · Score: 3, Informative

    in it's definition of "Unauthorized". If you don't like how someone is using information you've made publicly accessible on your web site then it's suddenly "Unauthorized" and congrats, you're perl script just committed a felony for you. This isn't like walking into a house with it's doors unlocked. It's more like you wrote down advertised prices from billboards, aggregated the data, and when somebody notices you doing that doesn't make them look so good they throw you in prison.

    This has been discussed multiple times on /.. It seldom comes up because most of us are working for large corps doing what we're told and so have a bit of the corporate veil to protect us. Someone trying to research a politically unpopular idea (racial profiling is being used to target minorities for expensive high risk loans and exclude them from cheaper low risk ones they otherwise qualify for) has to worry about this. If your study shows a pattern of abuse from on the part of a multi-billion dollar mortgage company expect to see some charges.

    --
    Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
    1. Re:The law is as broad as possible by mark-t · · Score: 1

      Obviously you don't own the information on someone else's website though... even if they made the information public.

      My question remains... how does this law prevent lawful research?

      Or does it just prevent lazy research?

    2. Re:The law is as broad as possible by Facekhan · · Score: 3, Informative

      If you make factual data public, you don't generally "own" it as in you don't have exclusive rights to it. You can't copyright a database of factual information. Basically the CFAA lets a firm make data public but then if someone uses a script to aggregate it, they can claim it was a felon. Just as an example, the CFAA could even apply to things like price comparison websites if a particular merchant doesn't want their public pricing information compared to their competitors.

    3. Re:The law is as broad as possible by Facekhan · · Score: 2

      The other issue concerns employee use of employer owned systems. There have been cases where employees have been prosecuted for violating a purely civil agreement between them and their employer about the systems they have access to.

      In general the law should not criminalize a civil contract violation or in the case of EULA's and Acceptable Use policies, it is questionable whether they are even valid contracts. This is especially true when the law in question is very one sided in favor of big companies using the threat of prosecution against researchers and employees and customers. I can't get the FBI to prosecute Comcast for turning on their public Wifi network on my router, even though it does potentially violate the CFAA.

    4. Re:The law is as broad as possible by mark-t · · Score: 1

      If the information is public, then there is no way to even necessarily know it was obtained in the first place from a website, let alone that a scraper may have been used.

    5. Re:The law is as broad as possible by Agripa · · Score: 1

      It does when the US Department of Justice says it does and that is how they have been using it.

    6. Re:The law is as broad as possible by tepples · · Score: 1

      Firstly, that they will have written this usage into your contract, which may have been changed without you signing anything.

      You signed the check for another month of service. I haven't known Comcast to get into the ETF game.

      I would expect this to mean that they are administering your internet connection. Therefore, they are responsible for the data your modem requests

      I thought every packet was tagged with whether it is destined for Comcast's hotspot or for the subscriber. So the person who authenticated to the captive portal on the xfinitywifi SSID is responsible for that data, not you.

  6. Re:ACLU lawsuit by MasseKid · · Score: 2

    As opposed to what? Armed revolution? Protesting with Signs? I mean what do you think they are supposed to do but take violations of the constitution to the courts and using the check and balances system as designed?

  7. Re:ACLU lawsuit by frovingslosh · · Score: 3, Informative

    You miss the point. they apparently are upset because the law applies to everyone. They apparently now believe in laws that apply to some people but not others.

    --
    I'm an American. I love this country and the freedoms that we used to have.
  8. Re:ACLU lawsuit by Intron · · Score: 1

    No. They look for cases they can win to overturn unjust laws. They aren't going to go to court with a teenage hacker who broke into NORAD.

    cf. Broderick v. USAF, 1963

    --
    Intron: the portion of DNA which expresses nothing useful.
  9. Re:That vile ACLU by cavreader · · Score: 4, Insightful

    The law abiding citizens who happen to be gun owners are the ones who are ultimately tasked with upholding their gun rights. The efforts of the NRA just represent the non-violent method of upholding gun rights. And unlike the corporate lobbyists the NRA doesn't buy political support with money they buy political support with the number of voters they can deliver at election time. The anti-gun crowd is shrill at times and relish turning every gun related death into an extinction level event but they are vastly outnumbered by gun owners who only need to vote when they feel their gun ownership rights are being reduced.

  10. Re:That vile ACLU by Anonymous Coward · · Score: 1

    the Gun Manufacturers aka NRA is doing enough to defend their interpretation of the second amendment.

    No, please, don't hold back. Tell us exactly how you feel.

  11. Re:ACLU lawsuit by dgatwood · · Score: 1

    I think you mean 1983. 1963 was the Dr. Who episode with the same title.

    --

    Check out my sci-fi/humor trilogy at PatriotsBooks.

  12. It's All about intent by JimSadler · · Score: 1

    To be guilty of a crime one must intend to commit the crime but also there must be evil implied. A person who hacks into computers or networks with a real intention of doing good has no criminal liability if police and courts support the concept in law of intent. Here is a common type of issue that makes law enforcement next to impossible. There are many sites, such as Craig's List that have sections in which supposed prostitutes solicit business. Yet simply asking for money for sex is usually not what it appears to be. A person may post only to collect names, pics and cell phone numbers and also steer men to certain sites such as supposedly safe sites to insure the trick is not a maniac. Just because they claim to solicit as prostitutes is not at all related to their intentions as many of them have never prostituted themselves ever in their entire lives. This puts modern law enforcement in a real bind. We are at the point at which a girl can offer a man sex fro $200. and actually has no intention of breaking any laws at all. That makes her equal to a female cop who also solicits tricks and then arrests the guy who says yes. Fraud schemes could also make use of such a tactic in that the absurd offer is only made to create a list of greedy gullible people and the list is then sold to other fraud groups with no intention by the first group to ever defraud anyone. Imagine what such tactics can do to keep the courts in totally overwhelmed burdens of pseudo cases.

    1. Re:It's All about intent by david_thornley · · Score: 1

      Crimes do not necessarily require criminal intent. It's illegal to kill someone even if you weren't trying to kill them. It's criminal to be criminally negligent even if it was out of laziness rather than malice.

      Solicitation to commit a criminal activity is mostly illegal by itself. Police are allowed to participate in some illegal activities while running sting operations, so a police officer could solicit, although aggressive solicitation would probably constitute entrapment.

      --
      "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  13. Re:Wow it isn't even the weekend yet by Anonymous Coward · · Score: 1

    and the SJW articles are beginning.

    While the ACLU is indeed concerned with social justice, I'm not sure that they've ever formally espoused a position that qualifies for the "SJW" label, which would seem to require saying that people who say mean dumb things on websites should be banned from the internet forever, and further that the SJW faction exclusively gets to decide what constitutes "mean" and "dumb". Free speech being our single most cherished civil liberty, it's conceivable that some, if not all, members of the ACLU may actually be opposed to prosecuting thoughtcrime the way SJWs want.

  14. Re:ACLU lawsuit by cayenne8 · · Score: 1
    Ok, I"m game.

    WFT is "online discrimination"?

    How does someone know your color online and prevent you from viewing a site, etc?

    Seriously? I would think "online" is the ultimate in color blind territories.....

    --
    Light travels faster than sound. This is why some people appear bright until you hear them speak.........
  15. Re:That vile ACLU by Coren22 · · Score: 1

    At least their interpretation doesn't require new grammar rules no one else uses.

    --
    APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
  16. Soap, ballot, and jury box by tepples · · Score: 1

    On Slashdot, you occasionally see comments that refer to three "boxes" used in nonviolent defense of liberty: soap box, ballot box, and jury box. Respectively, these refer to petitioning the government, voting out the bastards who disregard said petitions, and challenging constitutionality of legislation. But some people are opposed to use of the jury box as a substitute for the soap box and ballot box. They use "activist judges" as an epithet for those who use the power of judicial review in a way that they don't like. The problem is that the present campaign finance environment encourages use of the jury box, as it is perceived as the box least subject to manipulation by plutocratic rent-seekers.

  17. Re:That vile ACLU by cavreader · · Score: 1

    They could drive down the street and run their daughters over with the car and back up over them just to make sure. Same end result.