Slashdot Mirror
EFF: Accessing Publicly Available Information On the Internet Is Not a Crime (eff.org)
An anonymous reader quotes a report from EFF: EFF is fighting another attempt by a giant corporation to take advantage of our poorly drafted federal computer crime statute for commercial advantage -- without any regard for the impact on the rest of us. This time the culprit is LinkedIn. The social networking giant wants violations of its corporate policy against using automated scripts to access public information on its website to count as felony "hacking" under the Computer Fraud and Abuse Act, a 1986 federal law meant to criminalize breaking into private computer systems to access non-public information.
EFF, together with our friends DuckDuckGo and the Internet Archive, have urged the Ninth Circuit Court of Appeals to reject LinkedIn's request to transform the CFAA from a law meant to target "hacking" into a tool for enforcing its computer use policies. Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use. LinkedIn would have the court believe that all "bots" are bad, but they're actually a common and necessary part of the Internet. "Good bots" were responsible for 23 percent of Web traffic in 2016. Using them to access publicly available information on the open Internet should not be punishable by years in federal prison. LinkedIn's position would undermine open access to information online, a hallmark of today's Internet, and threaten socially valuable bots that journalists, researchers, and Internet users around the world rely on every day -- all in the name of preserving LinkedIn's advantage over a competing service. The Ninth Circuit should make sure that doesn't happen.
EFF, together with our friends DuckDuckGo and the Internet Archive, have urged the Ninth Circuit Court of Appeals to reject LinkedIn's request to transform the CFAA from a law meant to target "hacking" into a tool for enforcing its computer use policies. Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use. LinkedIn would have the court believe that all "bots" are bad, but they're actually a common and necessary part of the Internet. "Good bots" were responsible for 23 percent of Web traffic in 2016. Using them to access publicly available information on the open Internet should not be punishable by years in federal prison. LinkedIn's position would undermine open access to information online, a hallmark of today's Internet, and threaten socially valuable bots that journalists, researchers, and Internet users around the world rely on every day -- all in the name of preserving LinkedIn's advantage over a competing service. The Ninth Circuit should make sure that doesn't happen.
Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use .
If I'm reading this correctly, I'm not so sure I agree with that last bit, about "violating terms of use". So all terms of use are null and void (if my browser can find it, it's publicly accessible, no matter what I have to agree to in order to get access to it?)? For example, if I have a website that stipulates you must agree not to disseminate the information made available to you by agreeing to these terms of use, you remain free to ignore that agreement?
Or are they saying that an automated script that can bypass a Term of Use agreement isn't hacking?
Ken
For now. You proles will lose everything.
Shouldn't a "good bot" abide by https://www.linkedin.com/robots.txt?
As far as I'm concerned, LinkedIn themselves are guilty of massive fraud and deception, by tricking users into providing email contacts so that LinkedIn can send invite spam supposedly from the user. It was a carefully designed "dark pattern" to increase their userbase early on.
Of course, by the time they eventually got sued over this, they were big enough to shrug off the financial penalty and keep making money off all the data they had collected illegitimately.
LinkedIn is a socially malignant business and deserves to be laughed out of any court for trying to use the rule of law to their advantage.
Who's a good bot? You're a good bot! Yes you are. YES YOU ARE!
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
. "Good bots" were responsible for 23 percent of Web traffic in 2016.
Nearly one-fourth of all internet traffic is from the innocently-named "Good bots"? That's kind of amazing.
Ken
Ironically enough, LinkedIn scrapes its users browser for known extensions. See https://github.com/prophittcorey/nefarious-linkedin for details.
So that'll be fewer bots, good or bad.
...not YET, anyway
If scraping is against your terms of use (aka robots.txt) and someone ignores that, what can you do but use the CFAA? It is the very definition of unauthorized access.
That’s strange. I don’t remember either Afghanistan or Iraq ever having the power to prevent me from accessing information on the Internet at any point in time.
Let's use a different example. Arrest records and mugshots on police agencies' websites. Let's say Jane Doe, born 1/1/1970 got arrested for a particularly heinous crime. Murder, or robbery at gunpoint.
Six months later, a court ruled her not guilty. She was able to petition to have the public arrest record on the Yoknapatawpha County Sheriff's office website deleted.
However, in the interim, it's been scraped and archived by database companies using the data for employer background checks. Every time she applies for a job with a large employer, her application either gets round-filed, or she has a lot of explaining to do.
What's worse, in the state of Winnemac, there are six Jane Does with that same birthday, all of which have the same record in their background check database...
Does information still want to be free?
Seriously what kind of idiot buys into an outfit that has as a basis of operation, asking for something that in most places will get you fired?
? I started to sign up, and when they asked for my password it was 1FuckYouLinkedin!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Don't put it on the Internet!
PERIOD!
I don't give a flying inverse sideways hate-fuckathon HOW secure you're promised it is.
In the end, YOU are responsible for disseminating it.
If you put it online in ANY capacity whatsoever, it WILL be compromised and it WILL be disseminated without your say-so.
END OF DISCUSSION!
Chas - The one, the only.
THANK GOD!!!
Kill an Iraqi and save the Internet!
(Is Ajit Pai Iraqi?)
I don't read your sig. Why are you reading mine?
They are scraping Linkedin data from private individuals who probably don't know their information was made public.
So Linkedin was wrong, and those scraping your private now public information for profit are wrong.
Maybe not a violation of federal law, but EFF should be hamstringing the fuckers doing the scraping too.
Finally: for those who still think your information is private, you are very wrong.
LinkedIn (owned by Microsoft) did the same thing with Bing, using a bot to scrape Google's public search results.
The first step is to throw Microsoft's upper management in prison, and then we can decide what to do next.
It isn't a crime in real life, either. That's why we need better control over what is publicly accessible. Public records are one thing, corporate TOSes are another.
Just go to your local politician and buy a law. You can make anything illegal!! (Outlaw Lobbyists).
I'm thinking LinkedIn is wrong here, but a simple, clear-cut, and correct statement of public policy is more difficult than it first appears.
"accessing publicly available information" sounds pretty clear and simple, but the more I think about it, the murkier it becomes. Suppose in each of the following scenarios the data is by the owner's terms not to be accessed by bots and:
A) The system pops up a user/ password dialog before allowing access. User "admin" and an empty password works
B) The system pops up a user/ password dialog before allowing access. User "admin" and password "password" works
C) The system pops up a user/ password dialog before allowing access. User "admin" and password "correct horse battery staple" works
D) The system pops up a user/ password dialog before allowing access. Sending 17,000 requests each with a password that consists of a million null bytes followed by carefully crafted machine code to overwrite memory sometimes works
The thing is, ANY data that has been hacked over the internet was accessible to the public, if they public tried hard enough, and was clever enough in defeating access control measures. That makes it difficult to legistlate a bright-line rule.
Unless you work for Trump and access WikiLeaks...
In Soviet Washington the swamp drains you.
I won't weigh in on whether they're good or bad, but LinkedIn has its own bots that it used to trawl commercial web sites for user profile info... the output of which it uses to create "shell accounts" on LinkedIn, then issue emails to the lucky winners inviting them to sign up and claim their profile.
no dumbass
what about have links under a pay wall with no login needed and changing any one that hit's the paid zones with out paying as a hacker?? even when they can get to them from the out site with not even needing to go the you must pay page. And what if that paid zone was something like /docs or some other common name that some bots just auto scan for when indexing the web?
From the story summary: "... the culprit is LinkedIn."
From the parent comment: "LinkedIn is a socially malignant business..."
LinkedIn is no longer LinkedIn. It is now Microsoft: "LinkedIn notifications directly within Windows 10".
Windows 10 is now gathering information for LinkedIn. The worst spyware ever made has become worse!
DUH
The linked "good bots" list has at least two BAD bots among their list of the GOOD bots that create the most traffic.
Both ahrefsbot and semrushbot are SEO spammers according to their own web sites,you know the people who try to break search engines to get their own advertising sites listed before the actual information you search for... I've had to look them up after they showed up in the logs on my web server, and as a result, I have both of them blocked (along with a bunch of other bad bots).
make it an felony crime with court overview of contract and one that you have hunt on a web site does not count.
You have freedom? Where? You guys seem to be quite lacking in the Freedom department lately...
Could they argue that the contents of their site are covered by copyright and that scraping the site and using that info for commercial purposes, or acting to republish the material is a violation? Ordinarily I side with the freedom of access on these things, but really outside actors scraping the data from Linkedin threatens their business. I don't really want my data on Linkedin if it's going to get misused by third parties. Somehow fraud is always the end result of too much personal information being too accessible.
Either you're confused or your inability to grasp the english language has turned what I'm sure made sense in your head into gibberish as you typed it.