from the another-way-to-break-the-internet dept
As we reported here earlier, the Supreme Court is examining a CFAA case that could have far-reaching implications for well, just about anyone who uses any online service, website, platform, or device. The case deals with a cop who abused his access privileges to run unapproved searches of government databases in exchange for cash. Obviously, this is far from an ideal case to argue against overbroad readings of an overbroad law. But, given the abuses perpetrated under this law, non-ideal cases will have to do if we don't want to be turned into criminals by generous judicial interpretations of the phrase "unauthorized access."
Plenty of people and entities are lobbing briefs in the Supreme Court's direction, begging it to avoid criminalizing activities honest Americans participate in every day. It's not just about security research. But it definitely does affect researchers -- both those engaging in normal security research efforts, and those ignoring websites' terms of service in attempts to determine whether sites engage in biased practices.
The EFF's brief [PDF] focuses mainly on the negative effects on researchers -- security and otherwise. It points out security researchers are often threatened with CFAA prosecutions/lawsuits just because entities engaging in lax security practices don't like having their lapses noticed, much less pointed out publicly. These researchers perform a valuable public service.
Decades of experience have shown that independent auditing and testing of computers by members of the security research communityoften in a manner unanticipated and even disapproved by the computers ownersis particularly effective at discovering serious vulnerabilities in widely used software and devices.
But far too often they're punished for providing this service.
In 2008, the Massachusetts Bay Transit Authority (MBTA) invoked the CFAA to try to enjoin two independent security researchers from presenting truthful information about vulnerabilities in the MBTAs fare collection system at a security conference. And in United States v. McDanel, the government brought criminal CFAA charges against a defendant who discovered a security vulnerability, alerted the company, and then, when the company refused to fix the problem, alerted the companys customers
If arguments about security researchers are too esoteric, perhaps Orin Kerr's arguments [PDF] will hit closer to home. According to the Eleventh Circuit's interpretation of the CFAA, Kerr himself is a criminal.
Like the majority of American adults, I have a Facebook account. Facebooks terms of service require its users to [p]rovide accurate information about themselves. See Facebook Terms of Service, https://www.facebook.com/legal/terms/plain_text_ terms (last visited July 1, 2020). I recently violated that term by listing my home city as Sealand. Sealand is an offshore platform in the North Sea near England built during World War II to host anti-aircraft guns. Its not actually my home city. I list it only to make a point about the CFAA. But under the governments position, my joke is no laughing matter. It is a federal crime.
Interpreting the CFAA this way makes every website owner a jokester and every website user the punchline. If you think the thousands of federal laws are arbitrary, just wait until you run into the whims of the thousands of people running sites and platforms.
Part of the problem is that written restrictions placed on computers can be entirely arbitrary. These days, anyone can run a website. Anyone can buy a computer for another person to use. And the computer owners or operators can impose whatever restrictions they want. Their limits dont need to serve an important interest. They dont even need to make sense.
Kerr cites the Lori Drew case as a real world example of how the law can be abused by federal prosecutors. Back in 2006, a teen girl committed suicide after being duped into an online relationship with a nonexistent 16-year-old male.
The Drew prosecution started with a terrible tragedy in a suburb of St. Louis, Missouri. In October 2006, a 13-year-old girl named Megan Meier committed suicide. Meier had regularly used the social media networking site MySpace, a then-popular forerunner to todays Facebook. In the weeks before her death, Meier had communicated with a MySpace profile of what appeared to be a handsome 16-year-old boy named Josh Evans. The Evans account had befriended Meier, and Evans expressed his admiration and affection for Meier.
But the online friendship soured. In messages sent soon before Meier committed suicide, Evans had abruptly ended the relationship. According to one witness, the last message Evans had sent to Meier had said, Youre a shitty person, and the world would be a better place without you in it. Lauren Collins, The Friend Game, The New Yorker, Jan. 14, 2008.
An investigation into Meiers suicide revealed that Josh Evans did not exist. The account was fake. It had been created by a group that knew Meier and used it to learn what Meier was saying about her friend Sarah Drew. The senior member of the group was Sarahs mother, Lori Drew. Other participants included Ashley Grills, an 18-year-old employee of Mrs. Drew who actually devised the idea and used the account, and Sarah Drew herself.
This was abhorrent behavior by a bunch of adults who discovered the internet provided an avenue for the complete destruction of a person's life. But was it a criminal act? Local prosecutors said being an asshole isn't a crime, no matter how much we'd like it to be.
Despite intense public demand to punish Drew, Missouri state prosecutors declined to file charges. A law enforcement spokesperson explained that decision straightforwardly: Drews conduct mightve been rude, it mightve been immature, but it wasnt illegal.
With Drew facing intense criticism for her actions, the federal government stepped in with the CFAA in hand to engage in a prosecution for the clicks.
The terms of service gave prosecutors a hook. Because Josh Evans did not exist, using the account violated MySpaces terms of service. According to prosecutors, this rendered every use of the Evans account an unauthorized access in violation of 18 U.S.C. 1030(a)(2). And because MySpaces computer servers were in Los Angeles County, federal prosecutors could bring charges in California even though everyone involved was in Missouri.
Ultimately, Drew was only convicted of misdemeanors. But the feds did such a good job convincing everyone she had broken the law that jury members expressed disappointment in their own verdict.
This -- along with Kerr's example about lying to Facebook about his personal info -- is the reality facing everyone if the Supreme Court decides the Eleventh Circuit is right about this and every other circuit that disagrees with it is wrong. It won't just be the Lori Drews of the world at the mercy of federal prosecutors. It will be everyone who ignores certain parts of terms of service agreements or engages with sites in ways the owners' did not anticipate or explicitly approve.
Filed Under: cfaa, scotus, security, security researchers, supreme court, terms of service
Read more from the original source:
- The Principality of Sealand - Become a Lord, Lady, Baron or ... - December 8th, 2016 [December 8th, 2016]
- SeaLand Toilets - Motorhome, RV & Marine - PPL Motor Homes - December 23rd, 2016 [December 23rd, 2016]
- Schedules - SeaLand - December 28th, 2016 [December 28th, 2016]
- Sealand man jailed for high speed police chase near Chester - LeaderLive - February 10th, 2017 [February 10th, 2017]
- sealand | eBay - February 15th, 2017 [February 15th, 2017]
- Floatplane fuselage donated for entrance feature - Campbell River Mirror - February 22nd, 2017 [February 22nd, 2017]
- Burglar in 'lunatic' Flintshire police chase jailed - Daily Post North Wales - February 23rd, 2017 [February 23rd, 2017]
- Did you get married in this Sealand church? - Daily Post North Wales - March 1st, 2017 [March 1st, 2017]
- Global Camping Toilet Market 2017 By Manufacturers Zodi, Camco, SeaLand, Thetford Marine - NetDugout - March 2nd, 2017 [March 2nd, 2017]
- Sealand Natural Resources, Inc. (OTCMKTS:SLNR) Files An 8-K Unregistered Sales of Equity Securities - Market Exclusive - March 2nd, 2017 [March 2nd, 2017]
- Sealand - The Principality of Sealand - March 8th, 2017 [March 8th, 2017]
- Sealand of the Pacific - Wikipedia - March 11th, 2017 [March 11th, 2017]
- Gardening club launch at Sealand and Queensferry Dementia Caf - Deeside.com - April 8th, 2017 [April 8th, 2017]
- Sealand - The Principality of Sealand - thoughtco.com - April 8th, 2017 [April 8th, 2017]
- Malawi govt over paid farm input suppliers by K61billion - Nyasa Times - June 7th, 2017 [June 7th, 2017]
- About Sealand - June 7th, 2017 [June 7th, 2017]
- How Are Analysts Interpreting Sealand Natural Resources Inc (SLNR)'s Relative Strength? - Nelson Research - June 8th, 2017 [June 8th, 2017]
- Inquiry date for Chester flood plain homes plan - ChesterChronicle.co.uk - June 14th, 2017 [June 14th, 2017]
- sealand toilet | eBay - June 14th, 2017 [June 14th, 2017]
- Unusual Activity Spotted in Sealand Natural Resources Inc (SLNR) - BVN - June 16th, 2017 [June 16th, 2017]
- Sealand Natural Resources Inc (SLNR) Moving -40.00% in Session - BVN - June 17th, 2017 [June 17th, 2017]
- Pivot Points in Focus: Sealand Natural Resources Inc (SLNR) - Nelson Research - June 21st, 2017 [June 21st, 2017]
- Independence Day 2017 SeaLand & Port Schedule - American Journal of Transportation - June 27th, 2017 [June 27th, 2017]
- Flooding on Chester's Sealand Road after downpour - ChesterChronicle.co.uk - July 14th, 2017 [July 14th, 2017]
- Chester floodplain housing scheme unanimously rejected - ChesterChronicle.co.uk - August 6th, 2017 [August 6th, 2017]
- 150 years of the Shipping Forecast: The magic and poetry of Dogger, Fisher and German Bight - Country Life - August 25th, 2017 [August 25th, 2017]
- Sealand - Wikitravel - August 25th, 2017 [August 25th, 2017]
- About Us - Principality of Sealand - August 25th, 2017 [August 25th, 2017]
- About - Principality of Sealand - February 6th, 2018 [February 6th, 2018]
- Principality of Sealand - Wikipedia - June 5th, 2018 [June 5th, 2018]
- Sealand | MicroWiki | FANDOM powered by Wikia - July 29th, 2018 [July 29th, 2018]
- Sealand The Mystery Solved - Part One - YouTube - August 30th, 2018 [August 30th, 2018]
- Sealand Marine Toilet Parts | West Marine - September 16th, 2018 [September 16th, 2018]
- Search for a route - sealand.com - September 16th, 2018 [September 16th, 2018]
- About Sealand - Become a Lord, Lady, Baron or Baroness - October 16th, 2018 [October 16th, 2018]
- SeaLand is now Dometic | Dometic - Mobile living made easy. - November 24th, 2018 [November 24th, 2018]
- Sealand | Dynamic Ship Simulator III Wiki - dss-iii.wikia.com - December 5th, 2018 [December 5th, 2018]
- Sealand | Fifth World Wiki | FANDOM powered by Wikia - December 5th, 2018 [December 5th, 2018]
- Vacuflush Parts and Systems for marine and RV toilets. - January 11th, 2019 [January 11th, 2019]
- Sealand | West Marine - January 11th, 2019 [January 11th, 2019]
- Sealand | Hetalia Archives | FANDOM powered by Wikia - January 11th, 2019 [January 11th, 2019]
- About Sealand | The Principality Of Sealand - January 11th, 2019 [January 11th, 2019]
- Sealand Marine - 4 Locations Across Nebraska and South ... - May 14th, 2019 [May 14th, 2019]
- Surfer cleans his playground by turning pollution into functional fashion - East Coast Radio - October 1st, 2019 [October 1st, 2019]
- Hefty bill for Sealand farmer who ignored warnings to clear waste off his land - LeaderLive - October 1st, 2019 [October 1st, 2019]
- IN PICTURES: Terry is first person to complete nine-mile swim from Sealand to Dovercourt - Harwich and Manningtree Standard - October 1st, 2019 [October 1st, 2019]
- Great Escapes: The Pristine Shores and Year-Round Charm of Denmarks North Sealand - Barron's - October 1st, 2019 [October 1st, 2019]
- Terra Firma Imagines a Tiny Country Surviving the Rising Waters - TheaterMania.com - October 14th, 2019 [October 14th, 2019]
- Appeal launched over refusal of plans to store cars and caravans on green barrier land in Sealand - LeaderLive - October 14th, 2019 [October 14th, 2019]
- Queues on Sealand Road in Chester due to water works - Cheshire Live - October 14th, 2019 [October 14th, 2019]
- Coleg Cambria volunteers clean-up streets and rivers of Deeside for community event - Deeside.com - October 16th, 2019 [October 16th, 2019]
- Review: In Terra Firma, a Wee Wet Country on the Brink - The New York Times - October 16th, 2019 [October 16th, 2019]
- Appeal launched over refusal of plans to store cars and caravans on green barrier land in Sealand - Deeside.com - October 16th, 2019 [October 16th, 2019]
- Global Smart Container Market Set to Reach $5.74 Billion by 2024 - Asia-Pacific Expected to Grow at the Highest CAGR - PRNewswire - December 18th, 2019 [December 18th, 2019]
- Panerai Celebrates the Year of the Rat With Sparsello-Decorated Luminor Sealand - HYPEBEAST - December 18th, 2019 [December 18th, 2019]
- Former football star and Telegraph photographer Gary Talbot dies at 82 - Lancashire Telegraph - December 27th, 2019 [December 27th, 2019]
- SeaWorld Prisoner Kyuquot the Orca Needs Our Help! - The Union Journal - December 27th, 2019 [December 27th, 2019]
- Somaliland in the Guide to the 'almost countries' of The World - MENAFN.COM - December 27th, 2019 [December 27th, 2019]
- All the shops and businesses Chester said goodbye to in 2019 - Cheshire Live - January 2nd, 2020 [January 2nd, 2020]
- Easter eggs are already on sale in Plymouth - Plymouth Live - January 2nd, 2020 [January 2nd, 2020]
- This is what was happening in Chester as the 1990s dawned - Cheshire Live - January 2nd, 2020 [January 2nd, 2020]
- Chinese New Year Gifting 2020: From Gucci to Faberg, Rats & Mice Galore | Jewellery | Watches & Jewellery - Luxury London - January 14th, 2020 [January 14th, 2020]
- Sealand Community Council to decide three new positions by co-option | The Leader - LeaderLive - January 30th, 2020 [January 30th, 2020]
- Roadworks in and around Flintshire over the next few days - Deeside.com - February 24th, 2020 [February 24th, 2020]
- Photographer from Deeside on 'cloud nine' with accolade - LeaderLive - February 24th, 2020 [February 24th, 2020]
- China firms in $10 billion share sale rush as funding rules eased amid virus worries - Reuters - February 24th, 2020 [February 24th, 2020]
- Sealand reduces transit time between Chile and the US for table grapes - FreshPlaza.com - February 24th, 2020 [February 24th, 2020]
- The 72 businesses with a five star food hygiene rating in Flintshire - Daily Post - March 16th, 2020 [March 16th, 2020]
- More than three weeks of overnight closures on Cheshire roads to start - Cheshire Live - March 22nd, 2020 [March 22nd, 2020]
- Flintshire man who went to see son play in band in Chester caught drink-driving on way home - The Chester Standard - March 22nd, 2020 [March 22nd, 2020]
- Heres Why Sealand Capital Galaxy (LON:SCGL) Must Use Its Cash Wisely - Simply Wall St - March 22nd, 2020 [March 22nd, 2020]
- Man charged with alleged offence under new Covid 19 legislation following incident in Deeside on Thursday - Deeside.com - April 9th, 2020 [April 9th, 2020]
- SeaWorld trainer torn limb from limb by killer whale turned 'psychotic' by captivity - Mirror Online - April 26th, 2020 [April 26th, 2020]
- Revamped Aldi Chester store to open its doors next week - The Chester Standard - May 11th, 2020 [May 11th, 2020]
- Weekly Update: Global Coronavirus Impact and Implications on Fresh and Naturally Fermented Birch Juice Market Analysis, Trends, Forecast, 2019-2025 -... - June 1st, 2020 [June 1st, 2020]
- Residents urged to take care after house fire in Sealand - LeaderLive - June 1st, 2020 [June 1st, 2020]
- Someone has used a chainsaw to cut down a tree in Garden City which blocked Welsh Road - Deeside.com - June 9th, 2020 [June 9th, 2020]
- Covid-19 Impact on Global Coriolis Mass Flowmeters Market (2020-2026) | Potential growth, attractive valuation make it is a long-term investment | Top... - June 25th, 2020 [June 25th, 2020]
- Sales in the Birch Water Market Expected to Grow as Demand from End-Use Industries Gathers Pace 2017 2025 - Jewish Life News - July 10th, 2020 [July 10th, 2020]
- Breaking down the top 10 LB recruits in Vanderbilt history - 247Sports - July 12th, 2020 [July 12th, 2020]