I strongly disagree. Facebook didn't have a relationship with Power Ventures, but it did have a relationship with its own users who granted Power Ventures access to their accounts. And while I admit it's not legally recognized yet, I firmly believe that users have an inherent Right to Delegate lawful access to 3rd-party software products and services[0].
I don't think the Power Ventures case had anything at all to do with unauthorized access. I think it was an attempt by Facebook to block users from exercising control over their own data.
For context, look at the DMCA claims Facebook also filed in that case. It's been a really long battle to fight against the DMCA's unconstitutional provisions against subverting DRM for legal reasons. We have a lot of precedent to see how companies use systems like the DMCA. And the way they commonly use them is not to go after pirates, it's for market lock in and to restrict legitimate users. To paraphrase Doctorow, there are really bad consequences when we allow a company to make it a federal offense to use a product in a way that doesn't make their shareholders money.
Treating ToS violations as a federal crime gives companies that ability on an even broader scale. It's legal to circumvent DRM? Oh, but our ToS blocks that. You exported your own data that you legally own? No, our ToS blocks that. You build a Matrix bridge for your DMs in my chat app and another competing service? Sorry, that's a federal offense now.
A company should not be allowed to arbitrarily invent new federal laws. At most, violating a ToS should be a civil offense, and companies like Facebook should be forced to sue their own users, not providers like Power Ventures.
I absolutely should be charged with unauthorized access, because the person who gave me access had no right to give me that access and I knowingly used a protected computer system against the wishes of the owner, for my own aims.
Replace the above with "medical records" or "banking information" or whatever you wish.
Just because someone gave me a password, doesn't mean I'm allowed to use it, even if THEY were allowed to use it.
First, the cop who gave you access didn't have the right to use it in the way they offered. They don't own the data. The "right" they're delegating to you isn't a lawful right they actually have to delegate.
This is a really big difference -- the problem in the scenario you propose isn't that a police company got hacked (in fact, I would argue it didn't). The problem is the police department illegally abused information and distributed that information to other people, and you willingly participated in that crime.
In contrast, all of the data access that was delegated to Power Ventures and all of the stuff that Power Ventures did with that data was stuff that users had the right to do.
Second problem, this would be illegal because of privacy laws around how the police are allowed to use your data, not because a company declared it so. I'm not saying you should have carte blanch privileges to violate any law just because another person violated that law first, I'm saying companies shouldn't have carte blanch privileges to make new laws.
To re-emphasize the point above, the problem in this scenario isn't that the police department got hacked. The problem is that people were performing illegal background checks. If the police officer didn't give you a password, and instead just did whatever background checks you wanted on their own without you ever touching the system, this would still be a crime. The system access isn't the important part.
Third, in the scenario you propose, both you and the cop would get in trouble. Hopefully, the cop would get in even more trouble than you. So when Facebook brings every user who "illegally" shared their password into court, then I'll entertain the notion that they think this is a real hacking case. Otherwise, why are we comfortable letting off all these willing accomplices to an unlawful entry case?
Thats why I don't agree with the article that contrasts the Facebook/Power Ventures case with the hiQ Labs case. These are fundamentally different. Power Ventures was using Facebook Users credentials to log on to facebook and I think thats a clear case of unauthorised access. Facebook had no direct relationship with Power Ventures and had not granted them access to those accounts at all.
In the hiQ Labs case they had legitimate access to LinkedIn and were just scraping publicly viewable information. It's jut that LinkedIn didn't like what they were doing with it.
Of course the SSA database access case from 2010 is an anomaly in this aspect. The user was authorised to access the data if doing so in the course of his work, and I think the police case from 2015 was ruled correctly. In both case they're reprehensible creeps, but they should be prosecuted as creeps, not as hackers.