Slashdot Mirror
EFF: Accessing Publicly Available Information On the Internet Is Not a Crime (eff.org)
An anonymous reader quotes a report from EFF: EFF is fighting another attempt by a giant corporation to take advantage of our poorly drafted federal computer crime statute for commercial advantage -- without any regard for the impact on the rest of us. This time the culprit is LinkedIn. The social networking giant wants violations of its corporate policy against using automated scripts to access public information on its website to count as felony "hacking" under the Computer Fraud and Abuse Act, a 1986 federal law meant to criminalize breaking into private computer systems to access non-public information.
EFF, together with our friends DuckDuckGo and the Internet Archive, have urged the Ninth Circuit Court of Appeals to reject LinkedIn's request to transform the CFAA from a law meant to target "hacking" into a tool for enforcing its computer use policies. Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use. LinkedIn would have the court believe that all "bots" are bad, but they're actually a common and necessary part of the Internet. "Good bots" were responsible for 23 percent of Web traffic in 2016. Using them to access publicly available information on the open Internet should not be punishable by years in federal prison. LinkedIn's position would undermine open access to information online, a hallmark of today's Internet, and threaten socially valuable bots that journalists, researchers, and Internet users around the world rely on every day -- all in the name of preserving LinkedIn's advantage over a competing service. The Ninth Circuit should make sure that doesn't happen.
EFF, together with our friends DuckDuckGo and the Internet Archive, have urged the Ninth Circuit Court of Appeals to reject LinkedIn's request to transform the CFAA from a law meant to target "hacking" into a tool for enforcing its computer use policies. Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use. LinkedIn would have the court believe that all "bots" are bad, but they're actually a common and necessary part of the Internet. "Good bots" were responsible for 23 percent of Web traffic in 2016. Using them to access publicly available information on the open Internet should not be punishable by years in federal prison. LinkedIn's position would undermine open access to information online, a hallmark of today's Internet, and threaten socially valuable bots that journalists, researchers, and Internet users around the world rely on every day -- all in the name of preserving LinkedIn's advantage over a competing service. The Ninth Circuit should make sure that doesn't happen.
Using automated scripts to access publicly available data is not "hacking," and neither is violating a website's terms of use .
If I'm reading this correctly, I'm not so sure I agree with that last bit, about "violating terms of use". So all terms of use are null and void (if my browser can find it, it's publicly accessible, no matter what I have to agree to in order to get access to it?)? For example, if I have a website that stipulates you must agree not to disseminate the information made available to you by agreeing to these terms of use, you remain free to ignore that agreement?
Or are they saying that an automated script that can bypass a Term of Use agreement isn't hacking?
Ken
Shouldn't a "good bot" abide by https://www.linkedin.com/robots.txt?
As far as I'm concerned, LinkedIn themselves are guilty of massive fraud and deception, by tricking users into providing email contacts so that LinkedIn can send invite spam supposedly from the user. It was a carefully designed "dark pattern" to increase their userbase early on.
Of course, by the time they eventually got sued over this, they were big enough to shrug off the financial penalty and keep making money off all the data they had collected illegitimately.
LinkedIn is a socially malignant business and deserves to be laughed out of any court for trying to use the rule of law to their advantage.
Who's a good bot? You're a good bot! Yes you are. YES YOU ARE!
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
. "Good bots" were responsible for 23 percent of Web traffic in 2016.
Nearly one-fourth of all internet traffic is from the innocently-named "Good bots"? That's kind of amazing.
Ken
Ironically enough, LinkedIn scrapes its users browser for known extensions. See https://github.com/prophittcorey/nefarious-linkedin for details.
...not YET, anyway
Let's use a different example. Arrest records and mugshots on police agencies' websites. Let's say Jane Doe, born 1/1/1970 got arrested for a particularly heinous crime. Murder, or robbery at gunpoint.
Six months later, a court ruled her not guilty. She was able to petition to have the public arrest record on the Yoknapatawpha County Sheriff's office website deleted.
However, in the interim, it's been scraped and archived by database companies using the data for employer background checks. Every time she applies for a job with a large employer, her application either gets round-filed, or she has a lot of explaining to do.
What's worse, in the state of Winnemac, there are six Jane Does with that same birthday, all of which have the same record in their background check database...
Does information still want to be free?
"Robots.txt" is something you have to know is there. No "hacking" is required to avoid it or bypass it. If you don't know its there, it doesn't exist. Once you know it is there, and then fail to abide by the terms and conditions, then maybe it qualifies as a violation which should be a felony under CFAA. As was written above, the request LinkedIn placed was poorly worded.
Put the information behind a free login or a paywall. Or sue them in civil court instead of abusing criminal statutes that were never meant to apply to publicly available information.
Seriously what kind of idiot buys into an outfit that has as a basis of operation, asking for something that in most places will get you fired?
? I started to sign up, and when they asked for my password it was 1FuckYouLinkedin!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Don't put it on the Internet!
PERIOD!
I don't give a flying inverse sideways hate-fuckathon HOW secure you're promised it is.
In the end, YOU are responsible for disseminating it.
If you put it online in ANY capacity whatsoever, it WILL be compromised and it WILL be disseminated without your say-so.
END OF DISCUSSION!
Chas - The one, the only.
THANK GOD!!!
Just go to your local politician and buy a law. You can make anything illegal!! (Outlaw Lobbyists).
I'm thinking LinkedIn is wrong here, but a simple, clear-cut, and correct statement of public policy is more difficult than it first appears.
"accessing publicly available information" sounds pretty clear and simple, but the more I think about it, the murkier it becomes. Suppose in each of the following scenarios the data is by the owner's terms not to be accessed by bots and:
A) The system pops up a user/ password dialog before allowing access. User "admin" and an empty password works
B) The system pops up a user/ password dialog before allowing access. User "admin" and password "password" works
C) The system pops up a user/ password dialog before allowing access. User "admin" and password "correct horse battery staple" works
D) The system pops up a user/ password dialog before allowing access. Sending 17,000 requests each with a password that consists of a million null bytes followed by carefully crafted machine code to overwrite memory sometimes works
The thing is, ANY data that has been hacked over the internet was accessible to the public, if they public tried hard enough, and was clever enough in defeating access control measures. That makes it difficult to legistlate a bright-line rule.
The DNC did not have their emails available for all to see on the Internet with no access comtrlls. They were taken via unauthorized access and then republished without their permission to the Internet. So it’s basically nothing like this case at all. But don’t let pesky things like “facts” get in your way.
what about have links under a pay wall with no login needed and changing any one that hit's the paid zones with out paying as a hacker?? even when they can get to them from the out site with not even needing to go the you must pay page. And what if that paid zone was something like /docs or some other common name that some bots just auto scan for when indexing the web?
make it an felony crime with court overview of contract and one that you have hunt on a web site does not count.
WikiLeaks did.
In Soviet Washington the swamp drains you.
Could they argue that the contents of their site are covered by copyright and that scraping the site and using that info for commercial purposes, or acting to republish the material is a violation? Ordinarily I side with the freedom of access on these things, but really outside actors scraping the data from Linkedin threatens their business. I don't really want my data on Linkedin if it's going to get misused by third parties. Somehow fraud is always the end result of too much personal information being too accessible.
Either you're confused or your inability to grasp the english language has turned what I'm sure made sense in your head into gibberish as you typed it.