Breaking past security systems. So like scraping publicly facing data might violate TOS, but you can't call it hacking. Using exploits to get the password hashes would be criminal hacking.

Its really not that clear and we will need to wait for the courts to figure out what means what.

For instance this: https://www.theguardian.com/technology/2013/mar/18/at-and-t-...

All they did was "scrape publicly facing data"

Yea, it also only talks about bypassing/breaking passwords, what if the user has a sticky note at their desk and the password is readily exposed. Is that considered hacking? Should be. Unauthorized access regardless of how irresponsible the owner of that account is. At the same time you do not need a ToS or banner saying that. (it still remains illegal to break/trespass into someone's home without a notice saying so!)

Slippery slope. I'd gander a guess this will continue to be a case-by-case call.

Welcome to the central failure of the CFAA: Hacking attempts should be treated as a normal part of life, and systems should be designed to resist hacking, but the law gets this exactly backwards. In a saner legislative setting, hacking would be like harmful radio wave interference, something which is both punishable in a court of law but also which devices are designed to consider in the course of normal operation.

Hacking attempts are treated as a normal part of life and systems are designed to resist hacking. Fortunately, we also have to law acting as an additional form of deterrent.

> hacking would be like harmful radio wave interference

DoS attacks specifically. I would argue that any other form of hacking should not be punishable and it should only be up to the devices to protect against them.

Some sort of civil court conflict type situation... at most ... and maybe not even that?

I moderated plenty busy forums that had rules and ToS, but I didn't think of violations as anything more than something that might lead to me terminating an account.

Now one greifer did have a habit of mass producing accounts quite cleverly and the parent company actually sued him in civil court, but that was unique and actually disrupted the entire site with griefing and such. They even got the ear of a local prosecutor who thought that disrupting the site might count as a criminal act. The griefer went away after that and nothing came of it other than filing a civil case and I belive some contact with the local prosecutor... dude agreed to go away forever.

But of course in the example they are talking about just creating a fake account and speaking more generally about ToS violations.

Seems to be a duck violation. If it looks like a crime and sounds like a crime ... admittedly not the best metric for equitable justice.

Hopefully nothing and laws like CFAA get trashed.