News for hackers. Stuff that matters.
Re:Court: Violating a site’s terms of service isn’t criminal... by phkahler on Tuesday March 31, 2020 @01:16PM (#22739825)
"Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature," Bates wrote.

IMO that is the most important part of the ruling. You cant have criminal penalties and then delegate the definition of the crime to each website.

Lying or breaking TOS is different than hacking. You are granted access by the site, and it's no different than the access they grant every other user.

Re:Court: Violating a site’s terms of service isn’t criminal... by distances on Tuesday March 31, 2020 @01:31PM (#22739998)
> Lying or breaking TOS is different than hacking.

I think this is a good analogy: I accepted the terms, but I was lying. Sue me for lying then. TOS are not contracts for sure, as nobody is expected to actually read them and they aren't negotiatable.

Re:Court: Violating a site’s terms of service isn’t criminal... by chacham15 on Tuesday March 31, 2020 @04:15PM (#22742012)
> TOS are not contracts for sure

Please be careful when you make legal claims, especially when they probably arent true. IANAL but AFAIK most TOS fall under whats called a shrink wrap contract: https://en.wikipedia.org/wiki/Shrink_wrap_contract

Re:Court: Violating a site’s terms of service isn’t criminal... by distances on Tuesday March 31, 2020 @04:29PM (#22742189)
Yeah IANAL obviously. I'm from Europe and basically treat them as non-binding suggestions. In my layman's understanding they aren't valid as nobody reads or signs them, but be aware that your local court may decide otherwise if push comes to shove.
Re:Court: Violating a site’s terms of service isn’t criminal... by bawolff on Tuesday March 31, 2020 @09:19PM (#22744686)
IANAL but the article you link to claims that it is unclear in the usa if shrink wrap contracts are enforceable/real contracts.
Re:Court: Violating a site’s terms of service isn’t criminal... by phkahler on Tuesday March 31, 2020 @10:05PM (#22744909)
IANAL but I thought contracts needed acknowledgement from both parties. Mr software vendor, can you tell me weather or not your company has entered into a "shrink wrap" contract with my client? Or me? Or the honorable judge?
Re:Court: Violating a site’s terms of service isn’t criminal... by greendestiny_re on Wednesday April 01, 2020 @04:14AM (#22746720)
Please be careful when citing Wikipedia, it's notoriously shoddily written and is at best usable for finding primary sources. Wikipedia rated that article as "Start Class", which means it's far from complete or informative.
Re:Court: Violating a site’s terms of service isn’t criminal... by 2OEH8eoCRo0 on Tuesday March 31, 2020 @08:08PM (#22744240)
>The legal status of shrink wrap contracts in the US is somewhat unclear.
Re:Court: Violating a site’s terms of service isn’t criminal... by phkahler on Tuesday March 31, 2020 @10:12PM (#22744943)
The EULA is the only thing that claims clicking the "I Agree" button means anything other than "press here to install". If you reject the terms of the EULA and press the poorly labeled install button you haven't agreed to anything have you? What if the software company doesnt exist any more? Who is the other party to the so-called agreement?
Re:Court: Violating a site’s terms of service isn’t criminal... by tripzilch on Friday April 03, 2020 @07:18AM (#22768051)
"Shrink wrap contracts" haven't been a thing in the EU for many years. They're definitely not considered contracts, that's for sure.
Re:Court: Violating a site’s terms of service isn’t criminal... by abnry on Tuesday March 31, 2020 @01:41PM (#22740155)
Genuine question: if it isn't a contract, what legal purpose does a terms of service serve then? I assume any website serving a non-paying user has the right to terminate any services at any point, no reason given. A ToS might establish credibility among users as an open display of policy, but I don't see a legal purpose.
Re:Court: Violating a site’s terms of service isn’t criminal... by bilbo0s on Tuesday March 31, 2020 @01:48PM (#22740250)
Limits legal liability of the site.

Gives site reasons to bar users.

But I don't think it should give site the ability to prosecute users. That power should lie with the state. If a user hacks to get into a server, the state already has laws against that, just call the cops. But you can't point to a clause in your ToS saying, "User X broke term Y, which is hacking." No. The state defines what actions are hacking.

Re:Court: Violating a site’s terms of service isn’t criminal... by gentleman11 on Tuesday March 31, 2020 @02:46PM (#22741000)
I think they just act as notifications of official policy
Re:Court: Violating a site’s terms of service isn’t criminal... by danmg on Tuesday March 31, 2020 @01:46PM (#22740211)
Outside of limiting their own legal liability, it's a cargo cult.
Re:Court: Violating a site’s terms of service isn’t criminal... by abnry on Tuesday March 31, 2020 @01:56PM (#22740356)
Ah, so legal liability is to protect the company from prosecution?

It is not clear to me that a company needs to say they don't support illegal behavior by the users. It also isn't clear to me that a non-paying user can ever prosecute a website for refusing a service on the basis of the companies terms of service. If the company is already doing something illegal, then it is based on the current legal statutes that they can be prosecuted.

I probably don't understand legal liability here.

Re:Court: Violating a site’s terms of service isn’t criminal... by kd5bjo on Tuesday March 31, 2020 @02:30PM (#22740778)
It’s not just about criminal liability, but also civil. If one user of the site does something that harms another, it’s useful for the site to be able to show that one or both of the users were breaking the rules in an attempt to stay innocent in the jury’s eyes.

You can see similar effects all over the place. When was the last time you saw a hotel actually enforcing any of their pool rules? Some rules are there because the owner actually cares, but others are there so the owner can say “I warned you” if they’re ever in court. Telling the difference between the two is often quite hard.

Re:Court: Violating a site’s terms of service isn’t criminal... by derefr on Tuesday March 31, 2020 @05:49PM (#22743025)
> It is not clear to me that a company needs to say they don't support illegal behavior by the users.

Not just that they "don't support illegal behavior", but more specifically that if you give them your money for a service, and then use that service to do something illegal, then they want to be able to cancel your service while keeping the money you gave them for that service. (Or, similarly, if you buy a product from them, then use that product to do something illegal, they want to be off the hook for processing any potential refund on that product.)

It's sort of like the rule most companies have where swearing at the tech support worker allows them to hang up on you, when they'd otherwise be obligated to stay on the line. The TOS allows allows a company to, upon seeing that you've broken it, immediately claim everything in your account-receivable, and to close your account-payable without making it current.

Re:Court: Violating a site’s terms of service isn’t criminal... by gowld on Tuesday March 31, 2020 @02:04PM (#22740456)
The law is fuzzy. If a user breaks law while using a service, there's a question of whether the service was a willing participant or abbetor. ToS helps make a case that the service is not a willing participant or abbetor
Re:Court: Violating a site’s terms of service isn’t criminal... by bilbo0s on Tuesday March 31, 2020 @03:45PM (#22741664)
True, but it goes a bit further.

You also have to enforce the ToS. So Backpage or Craigslist personals are not able to just say, "We're not guilty of aiding prostitution. We tell users not to do that in our ToS."

No, as is the case with Backpage, they could still be held liable if they never actually removed anyone who was engaged in prostitution. It's not enough to say illegal things are not allowed and then look the other way. You have to say illegal things are not allowed, and come down hard on anyone doing those illegal things.

I don't remember the particulars since it was so long ago, but I believe craigslist went so far that they just removed any category that might be used for prostitution. In a court of law, that would be how you demonstrate that you're deserving of liability protection. Backpage was in a significantly different position, because they thought not enforcing anything would give them legal liability. Not smart.

Re:Court: Violating a site’s terms of service isn’t criminal... by bryanrasmussen on Tuesday March 31, 2020 @03:52PM (#22741735)
well, for a contract some sort of exchange has to have taken place. The website has given usage of the site, but the user has not given them payment. So yes, they don't have a breach of contract if they are refused access to the site - but wait! Some intrepid person could waste a lot of money arguing that all the personal data the site collected was of value and therefore an exchange happened that meant they could not just cancel access to the site, unless of course they also scrubbed that data etc. etc.
Re:Court: Violating a site’s terms of service isn’t criminal... by naasking on Tuesday March 31, 2020 @06:09PM (#22743236)
> I don't see a legal purpose.

The courts will hold a corporation accountable to its own terms of service, ie. if they, say, terminated an account against their own terms, then they could suffer penalties.

Re:Court: Violating a site’s terms of service isn’t criminal... by SkyBelow on Tuesday March 31, 2020 @05:16PM (#22742676)
What happens when this logic is applied elsewhere?

Lies for financial gain can become fraud. Is it acceptable to make it so lying for financial gain won't be a crime? What about lying for the sake of obtaining consent? Legal jurisdictions are starting to make this a crime, at least in limited instances (such as lying about use of certain birth control measures).

One can even look at social engineering, which is considered a form of hacking, that specializes in lying to people or presenting false narratives.

These all seem edge cases that still need to be handled.

Re:Court: Violating a site’s terms of service isn’t criminal... by stickfigure on Tuesday March 31, 2020 @05:36PM (#22742883)
> Lies for financial gain can become fraud.

You just answered this for yourself. This edge case is already handled by the criminal fraud statutes.

Re:Court: Violating a site’s terms of service isn’t criminal... by wang_li on Tuesday March 31, 2020 @10:19PM (#22744962)
Contracts don’t have to be negotiable.

https://legaldictionary.net/adhesion-contract/

Re:Court: Violating a site’s terms of service isn’t criminal... by alasdair_ on Tuesday March 31, 2020 @02:03PM (#22740441)
>You cant have criminal penalties and then delegate the definition of the crime to each website.

How does this differ from criminal trespass, where each landowner can define permitted use versus trespassing however they wish?

Re:Court: Violating a site’s terms of service isn’t criminal... by infogulch on Tuesday March 31, 2020 @02:34PM (#22740839)
A webmaster can deny any kind of access they don't want by just not serving to them, just like a landowner can put up a fence. People on the outside can still look over the fence from a public space perfectly legally, like a webmaster serving their homepage to everyone, and the landowner can't demand of people outside the fence, for example, "You can look over the fence, but only if you don't make a mean face at me". If you don't want people to look at all, well, don't make it public and put up a wall instead, and require authorization to enter.

If the landowner voluntarily allows someone inside, they can have pretty arbitrary rules about what people are allowed to do inside (in addition to the actual law), but the only real recourse they have to enforce their arbitrary rules once broken is to evict an offender to the outside. They don't get to pretend that their arbitrary rules are suddenly laws punishable as if they were a crime.

Re:Court: Violating a site’s terms of service isn’t criminal... by wang_li on Tuesday March 31, 2020 @10:22PM (#22744976)
> A webmaster can deny any kind of access they don't want by just not serving to them

You’d think that but Microsoft just lost a lawsuit over some company scraping LinkedIn that they tried to block.

Re:Court: Violating a site’s terms of service isn’t criminal... by infogulch on Tuesday March 31, 2020 @10:47PM (#22745104)
Building a fence, and then leaving an open gate with a sign saying "Anyone that wants to look at my garden can come in, as long as you pinky promise not to take pictures", and then proceeds to leave it unmonitored, does not give the landowner the right to prosecute people under the law for having a photo of the garden. (Watch me be wrong about this :P)

Or more plainly, it's the webmaster's own responsibility to "just not serve" if they don't want it to be served, and their failure to implement their own desires as software doesn't suddenly give them carte blanche to claim whatever they want was breaking the law.

In this case, the data is effectively public. Sure you have to "tell them your name" and "agree to ToS", but neither of those requirements are binding the applicant to tell the truth. So Microsoft chose a method of authorization that is unfit for the purpose of keeping people they don't want to have access out of their system. "But but but how else would they keep people off?" I don't know, but it doesn't matter. Make people sign a contract under supervision of a notary, or validate their drivers license, or whatever. The fact that Microsoft is too lazy to implement a solution that effectively implements their desired policy isn't material to what the actually implemented policy enables.

Re:Court: Violating a site’s terms of service isn’t criminal... by Dylan16807 on Tuesday March 31, 2020 @02:18PM (#22740625)
The only criminal act in trespassing is coming back after being banned. Whatever you did to get banned is not a criminal issue.

And as far as I know trespassing bans have to be a manual blacklist or whitelist. You can't define some arbitrarily complex behavior that makes you into a trespasser. Maybe I'm wrong on that?

Re:Court: Violating a site’s terms of service isn’t criminal... by alasdair_ on Tuesday March 31, 2020 @02:32PM (#22740807)
>You can't define some arbitrarily complex behavior that makes you into a trespasser. Maybe I'm wrong on that?

I've seen plenty of trespassing signs with statements mentioning specific times of day, like "after sunset" or "after midnight until 8am". I assume these are legally binding but I don't know for sure.

Re:Court: Violating a site’s terms of service isn’t criminal... by iamatworknow on Tuesday March 31, 2020 @02:43PM (#22740962)
IANAL, but I think it comes down to the trespasser being informed in some way that the property is private and they're not welcome. If I'm kicked out of a store, for example, the owner or one of their agents has informed me that I'm no longer welcome on that property, so trespass happens if I try to come back. In the case of someone's property that has conspicuous no trespassing signs, the sign serves to inform me I'm not welcome.

At least that's what the cops told me one time when I was a kid and got busted exploring in the woods and missed the property owner's "POSTED" signs...

Re:Court: Violating a site’s terms of service isn’t criminal... by throwaway17_17 on Tuesday March 31, 2020 @03:03PM (#22741181)
This is the commonly excepted folk advice people are given, however, most state laws (US) take no account of so called posted signs. There is a ‘mens rea’ requirement that for trespassing would typically require only that the trespasser knew they were on land that did not belong to them (this issue is easier to muddy if the trespassing occurs on ‘public’ lands/property).

But the statutory basis for trespassing is most often just the act of crossing into land without prior express permission.

Re:Court: Violating a site’s terms of service isn’t criminal... by iamatworknow on Tuesday March 31, 2020 @03:20PM (#22741372)
I wanted to make sure I wasn't talking out of my ass about the posted signs, so I looked up the regulations for where I was from (New York): https://www.dec.ny.gov/regulations/2442.html#posted

But to be clear about my anecdote, I wasn't doing anything wrong and wasn't actually arrested. My family's property bordered the property I "trespassed" on, and the guy called the cops on me, a 10 year old, instead of just telling me to leave. The cop showed up and basically just scared me and said he didn't want to come back out there.

Re:Court: Violating a site’s terms of service isn’t criminal... by throwaway17_17 on Tuesday March 31, 2020 @02:35PM (#22740857)
That would depend on the jurisdiction. Typically in the US, most states define two separate criminal statutes for each situation:

1) Criminal Tresspassing - typically defined as the entering the property of another without express permission from the owner (this tends to include intruding via drone these days)

2) Remaining or Reentry after forbidden - which is for those cases where entry was permitted, but the owner subsequently revoked that permission.

Re:Court: Violating a site’s terms of service isn’t criminal... by alasdair_ on Tuesday March 31, 2020 @02:44PM (#22740978)
>this tends to include intruding via drone these days

Can you elaborate on this point? There are a LOT of FAA rules and federal laws that allow aircraft to fly over your property without your permission. I could see the argument for a ground-based device or perhaps an extremely low-flying drone but not for general drone use.

Of course, there are other laws (like requiring line of sight, not flying over humans or livestock, etc.) that are probably broken by anyone flying a typical non-commercial light drone over someone else's property at a level low enough to be annoying.

Re:Court: Violating a site’s terms of service isn’t criminal... by throwaway17_17 on Tuesday March 31, 2020 @02:59PM (#22741142)
I happen to have this handy from a Motion:

Laws traditionally related to state and local police power – including land use, zoning, privacy, trespass, and law enforcement operations – generally are not subject to federal regulation. Skysign International, Inc. v. City and County of Honolulu, 276 F.3d 1109, 1115 (9th Cir. 2002). State and Local Regulation of Unmanned Aircraft Systems (UAS) Fact Sheet Federal Aviation Administration Office of the Chief Counsel, 2015.

Re:Court: Violating a site’s terms of service isn’t criminal... by luckylion on Tuesday March 31, 2020 @04:02PM (#22741858)
> 1) Criminal Tresspassing - typically defined as the entering the property of another without express permission from the owner (this tends to include intruding via drone these days)

You generally need to be aware of it though, right? Wandering in the woods won't get you in violation if you accidentally cross property boundaries, there needs to be a fence or at least a sign informing anyone about the blanket "No Trespassing"?

Re:Court: Violating a site’s terms of service isn’t criminal... by bilbo0s on Tuesday March 31, 2020 @05:36PM (#22742882)
Awareness is not really necessary. Even in the absence of a fence and "No Trespassing" sign, they can still get you for criminal trespass. If, for instance, you go onto old lady Johnson's lawn and help yourself to all of the spinach in her garden or the roses in her rosebush. (Well, assuming she wants to press charges that is.) She doesn't have to have a fence or "No Trespassing" sign.
Re:Court: Violating a site’s terms of service isn’t criminal... by alasdair_ on Tuesday March 31, 2020 @06:42PM (#22743542)
That's theft or destruction of property.
Re:Court: Violating a site’s terms of service isn’t criminal... by bilbo0s on Tuesday March 31, 2020 @08:11PM (#22744263)
That's why they'd charge you with misdemeanor theft and criminal trespass. (Unless for some reason old lady Johnson's flowers and veggies were extraordinarily valuable on the open market.) If old lady Johnson is the prosecutor's grandma, you'll also likely see a disorderly conduct charge. And you'd better hope you don't live in a jurisdiction with robust menacing statutes.

Point is, any prosecutor can start stacking these charges and land you in a world of hurt for whatever reasons they please.

I remember vividly a night in college when I got a ticket for underage drinking at a house party. I was wishing I had gone with my friends to a bar downtown. Until they got back later that night and I found out that a bunch of them got cited for underage drinking, disorderly conduct, and also got forgery charges. (Because of the fake id's they used to enter the bar.) In essence, they had done the exact same thing I did, only difference being the cops that busted the house party didn't search everyone and find fake id's on us. All those other charges were totally unnecessary, but they got stacked on anyway because the prosecutor and/or cops wanted to be hard asses.

Re:Court: Violating a site’s terms of service isn’t criminal... by emiliobumachar on Tuesday March 31, 2020 @02:21PM (#22740664)
Presumably not very different. I assume you also cannot have individual customers fined and jailed for violating clause 336b of the 30-page contract everyone signs without reading before stepping into your store. And if you can, that's messed up.
Re:Court: Violating a site’s terms of service isn’t criminal... by jMyles on Tuesday March 31, 2020 @02:13PM (#22740551)
That is not in keeping with the tradition of trespass, and is probably a similar mistake in the (relatively few) jurisdictions that have tried to craft such a framework.

Also, using biblical proportions to describe undesirables traversing your land is melodrama in the extreme.

Re:Court: Violating a site’s terms of service isn’t criminal... by michaelmrose on Tuesday March 31, 2020 @07:30PM (#22743958)
In practice people are convicted of criminal trespass when they have either obviously entered unlawfully or have entered lawfully and have been told to leave and have not done so.

If a property posts a sign or sends a letter that only people wearing green may enter. If we allowed the owner to prosecute people found to be on the premises without the correct color even if they leave immediately upon being asked to we would indeed be letting the property owner enforce their whims within the scope of their property with punishments handed down by official channels.

In practice this is basically impossible in most or probably all jurisdictions although probably untested in virtually all instances. Basically almost nobody would press such a case and if they did the local government would be unlikely to pursue such charges or succeed in them if pursued.

Such matters are inherently local and subject to local laws but lets look at the city of Seattle as an example. In Seattle you can call the cops if people are on your property and wont leave however even in that obvious case prosecution is unlikely unless some other crime is committed in the process. The city pursuing a case against people that merely broke your personal rules for conduct on your premises isn't explicitly mentioned not because it is allowed but because it is beyond the pale of absurdity.

Reading for example the guidance provided by the city of Seattle I read that local businesses partner with law enforcement to remove bad actors according to the contact trespass program.

>The Contract Trespass Program is an agreement among private property owners, businesses and the police department to regulate conditions of entry onto their private property. This can include prohibiting people on the property altogether, or it might involve allowing people onto the property only under certain conditions.

The conditions that can be enforced through the Contract Trespass Program are listed in the agreements

and posted on the premises. By signing a contract with the police department, property owners agree to let police officers

warn and then arrest people who continue to violate the conditions

when the owners are not present.

They enumerate the reasons they will cooperate in removing parties and arrest people who have been warned by authorities that they are in violation.

Looking further into the matter businesses don't HAVE to participate in the contact trespass program but they are told that

>Officers may still arrest for violations of SMC 12A.08.040 (Criminal Trespass) on private property regardless of a trespass warning agreement if someone with the authority to set the conditions of entry or revoke the privilege to be on the property has previously warned the individual of the trespass violation and will testify as a witness

They might arrest people who have been previously warned if they are still there when the cops arrive

They are further warned that

>For a successful prosecution, someone with the authority to control the conditions of entry and revoke the privilege to be on the property must testify that the person (1) knew or should have known the conditions of entry, (2) violated the conditions of entry or had their privilege to enter the property revoked, and (3) the person refused to stop the unlawful behavior or leave or they returned to the property after having their privileges revoked. Property owners are encouraged to keep detailed records of the interactions with trespassers on their property.

Please note especially

>the person refused to stop the unlawful behavior or leave or returned to the property after having their privileges revoked

In summary the two situations are exactly alike in the alternate universe in which trespassing is used in that fashion but instead of suggesting a weakness in the defense of such CFAA act cases it suggests that were trespassing laws used in such a fashion they ought to be challenged under the same premise.