ACLU Lawsuit Challenges Computer Fraud and Abuse Act (thestack.com)

An anonymous reader writes: The American Civil Liberties Union (ACLU) has filed a lawsuit with the U.S. Department of Justice contending that the Computer Fraud and Abuse Act's criminal prohibitions have created a barrier for those wishing to conduct research and anti-discrimination testing online. The ACLU have pursued the matter on behalf of a group of academic researchers, computer scientists and journalists seeking to remove that barrier to allow for third-party testing and research into potential online discrimination. In a public statement the ACLU contend: "The CFAA violates the First Amendment because it limits everyone, including academics and journalists, from gathering the publicly available information necessary to understand and speak about online discrimination."

Comments

Re:I don't follow

[Anonymous Coward]

One of the provisions makes it a felony for unauthorized access to a computer system. In most EULAs it spells out that reverse engineering is disallowed and creates an area of unauthorized access. Thus a security researcher trying to analyze a system is technically committing a felony under the CFAA as it doesn't make any exceptions. Even if the analysis is being performed completely locally on systems they own if say the OS is Windows or MacOS.

Re:How is it different for offline

[Fire_Wraith]

Probably the analogy would be the laws making it illegal to record abuses at places like food processing plants. There have been several states that have attempted to outlaw undercover video, after activists managed to get hired, and later released video of the horrible and illegal stuff that was going on in those plants. Or consider bans against recording the police on video, that wind up making any video recording of the police, even of the police committing a blatant crime, illegal.

That doesn't mean the law needs to go away entirely, but having some sort of affirmative defense should play a part, for instance.

The law is as broad as possible

[rsilvergun]

in it's definition of "Unauthorized". If you don't like how someone is using information you've made publicly accessible on your web site then it's suddenly "Unauthorized" and congrats, you're perl script just committed a felony for you. This isn't like walking into a house with it's doors unlocked. It's more like you wrote down advertised prices from billboards, aggregated the data, and when somebody notices you doing that doesn't make them look so good they throw you in prison.

This has been discussed multiple times on /.. It seldom comes up because most of us are working for large corps doing what we're told and so have a bit of the corporate veil to protect us. Someone trying to research a politically unpopular idea (racial profiling is being used to target minorities for expensive high risk loans and exclude them from cheaper low risk ones they otherwise qualify for) has to worry about this. If your study shows a pattern of abuse from on the part of a multi-billion dollar mortgage company expect to see some charges.

Re:The law is as broad as possible

[Facekhan]

If you make factual data public, you don't generally "own" it as in you don't have exclusive rights to it. You can't copyright a database of factual information. Basically the CFAA lets a firm make data public but then if someone uses a script to aggregate it, they can claim it was a felon. Just as an example, the CFAA could even apply to things like price comparison websites if a particular merchant doesn't want their public pricing information compared to their competitors.

Re:ACLU lawsuit

[frovingslosh]

You miss the point. they apparently are upset because the law applies to everyone. They apparently now believe in laws that apply to some people but not others.

Re:I don't follow

[PopeRatzo]

Well hell, now I have to delete my bitchy empowered female avatar, my ditsy teen schoolgirl avatar, my racist troll sockpuppets,

...and that was the end of his presidential campaign.

Re:That vile ACLU

[cavreader]

The law abiding citizens who happen to be gun owners are the ones who are ultimately tasked with upholding their gun rights. The efforts of the NRA just represent the non-violent method of upholding gun rights. And unlike the corporate lobbyists the NRA doesn't buy political support with money they buy political support with the number of voters they can deliver at election time. The anti-gun crowd is shrill at times and relish turning every gun related death into an extinction level event but they are vastly outnumbered by gun owners who only need to vote when they feel their gun ownership rights are being reduced.