As a practical matter I'm not worried about clicking a link that's been clicked tens of thousands of times today.

There's enough ambiguous laws they could likely come after anyone who accesses it if they wanted but given the facts of the situation I doubt they'd be able to make anything stick and it would be a giant PR snafu.

What about panning the camera to the right when there just may happen to be a drug deal you didn't notice happening to the left?

I'm not telling people what to do or not do. Only expressing my own fear!

>> I doubt they'd be able to make anything stick and it would be a giant PR snafu.

Both of those are true, however your life would still be massivly impacted and you would still be out thousands of dollars in legal fees with almost no hope of collecting them

Also better hope they do not find any other things in your life to charge you with, and you do not respond to any question in a way that could be seen as a lie, or about 100 other ways a federal agent can fuck you.

No it is best to simply avoid the system instead of putting your faith that "everything will work out in the end"

The only people that win in criminal cases are the courts, law enforcement, and the lawyers. as even if you "win" you lose

In theory your life could be massively impacted at random by such organizations, that's just how the justice system works.

I think the risk here is very very low to consider such a wildcard situation.

I believe there is precedent that you’re allowed to enter any computer system until you’re specifically warned. It’s a bit like traveling through open land, you can’t get in trouble for trespassing until you’ve been warned that you’re entering private property.

IANAL.

Absolutely untrue. In the US, the law is written such that you may only legally access a system that you own or have explicit authorization from the owner to access. It mirrors common law where you're not generally allowed to enter someone else's home even if they leave the door unlocked.

You can, of course (and plenty of people do), debate the specific application of the word, "access" in the context of computer networks.

So accessing a web site is illegal? I rarely see explicit "you are allowed to access the HTML files on this server" anywhere.

It can be if it was not intended to be public.

It's really not much different than walking around outside. You can walk in an unlocked retail store and it's okay, but if you walk into your neighbors bedroom it's not okay.

People on message boards really want to believe there's a black -letter rule about what you can and can't do, but that's not how our criminal codes work. These cases will come down to the state of mind of the person accessing the website, as well as an argument about what a reasonable person would conclude upon reading what's on that website.

I think programmers especially like to view law through the lens of rules they could implement in code. Often they think it can be hacked by violating the spirit of the law while upholding the letter. Law in reality is a much more human thing that takes into account intention on the party of both legislators making the law and the people it is being applied to. Good thing too.

Is this that makes me think attempts to codify law on some blockchain is a doomed exercise most of the time.

This can be a Good Thing, but it depends a lot on the courts not being lazy and taking shortcuts. When I was in front of a judge there was no disagreement as to the material facts of the case, but my guilt and my sentence were decided based on the Court's determination of my intent. The only evidence the court had regarding my intent was my own testimony and the differing hypothesis provided by the police officers I'd had a verbal disagreement with at the scene. Guess whose story they went with.

I think some programmers try to think in the mindset of what laws would/wouldn't be violated if you could somehow fuzz-test a particular aspect of the court system.

I.e., if instead of an individual case, you could generate a million people who all tried to do every potential variation of breaking the law in that way, then what would the curve of the resulting judgements look like?

Yes, and opening an unlocked door will still qualify as breaking and entering if you don't have permission to enter it. Just like taking something that isn't yours is still theft even if you find it in a public space.

The crime isn't circumventing the locks. It's accessing what you don't have the right to access.

What determines what's a retail store and what's a house? Zoning? What if a place is zoned multipurpose commercial/residential, where there are both public offices and private apartments occupying undifferentiated sibling units of the same building? I would assume there would have to be some common-sense or explicit claim being made that a place is private property.

It doesn't really work that way. The entirety of the situation is taken into account.

What matters is what you knew, what you should have known, what you could be expected to know, what you were told, what you observed, what you were thinking, what actions you took, and why you did it, etc.... and how all of these things line up with your local laws which will vary to a degree.

If you walked into the place confused because it wasn't clear what was a home and what was a business, that might be a valid way to demonstrate a lack of intent. But it wouldn't be because of zoning, it would be because of it way it appeared to you.

Sure, that's what's important after-the-fact if someone's getting mad at you. But that's very murky territory—the kind individuals constantly wander into because of conflicting motivations, but which corporations tend to stay well clear of.

Let's instead talk about legal liability, and how corporations seek to discharge it in their delivery of products/services.

If I'm programming a political auto-dialer, there are rules about which numbers it's legally allowed to call, and which numbers it legally cannot. It can't call people's cell-phones, for example. If I don't want to get the people who buy one of these things in trouble (and then get sued by them), I have to program this device to follow these rules.

In such a case, it's not a matter of resolving the mens rea from committing such an act anyway; it's a question of how to avoid getting into a situation where my motivations (or the motivations of the purchaser) could ever possibly come into question. I don't want to come into court with a defense; I want to be bulletproof from being brought into court.

So, now, an analogy: if I'm programming a lifelogging-drone-as-a-service that people pay to follow them around all the time they're in "public space"—which, from what I recall, includes commercial spaces without access restrictions, e.g. retail shops, but does not include private residences—then what rules must I program this drone to follow about "what constitutes a public space", to avoid me (or a customer) ever being brought into court on charges of surveilling private property? (It's okay if such rules are next-to-impossible to resolve from the limited sensory data + local regulatory databases the drone has access to. The point isn't to construct such a drone; just to speak of more cut-and-dry case replacement for a human actor.)

Third parties do not typically have legal liability for how their customers use their products, but this a murky area that I am sure has tons of edge cases and exceptions depending on product, industry, and local regulations.

To your example: You can buy drones today that will follow people around. The person who uses it is generally responsible for using it to film legally.

Mind you, I said "camera drone as a service", which is not the same idea as a camera-drone IoT device product with cloud-subscription features. (Instead, it's stupider!)

You know how a politician might hire a PR firm to produce a "day in the life of" documentary about them? Part of the PR firm's job would be to handle any negotiation of the local legal terrain required to get filming rights for locations, and likeness rights for other people appearing in the film. If they couldn't get such rights, it would also be part of their job to inform the customer of what things they now can't film, so that the customer could either make the choice to just leave some parts of their day un-filmed; or to re-arrange their schedule so that only legally-filmable events are on the roster for that day.

A hypothetical "camera drone as a service", in my mind, would be that, but handled mostly by an AI, maybe with OnStar-like interactive support if you get into an edge-case. (Again, it's a stupid idea! It's a thought-experiment, not a viable startup. :)

There are many services where part of the service you're paying for, is the service provider's expertise in navigating the local legal landscape in their own regulatory domain of expertise. In fact, that's entirely the point of some services: anyone can do their own accounting in a technical sense, but you pay an accountant because they know how to do your accounting in a way that complies with all your local regulations.

So, again: if one of the legal requirements of the CDaaS service is to automatically avoid (or at least not-surveil) any private property—then what would the rule for that look like?

I did notice that you said "as a service". That doesn't change the situation, really. The person who films is responsible for making sure they film legally. The added "on behalf of a customer" probably doesn't make a difference, unless your local laws care about whether your filming is commercial or not.

Changing the technology from 35mm film to VHS Camcorder to AI powered drone doesn't make a difference. Adding abstractions between the lens and the operator makes no difference. If your organization films with cameras, it should make sure it does so legally.

> So, again: if one of the legal requirements of the CDaaS service is to automatically avoid (or at least not-surveil) any private property—then what would the rule for that look like?

If you have determined that you need to "avoid private property" in order to comply with the law, then the rule you'd want to implement is "don't film private property".

Law is not really "rule-based" in the sense engineers tend to expect it to be

Yes. This is why weev went to prison. https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

tldr: AT&T has an account status page that, for mobile devices, did not require any authorization. Something like /status?phone=8367492738 and you see the account data for that phone. It was guarded by a password if you navigated to it on a desktop/laptop, but it was unsecured if you navigated to it with a mobile device.

He spoofed the user agent string to make his laptop say it was a phone (this is extremely common, there is a button in your browser to do this in one click, and the spec that defines UA string specifically says not to use it for authorization for this exact reason), and dumped the account details from every url.

Despite these being pages publicly accessible on the open internet, he went to jail for years for unauthorized access under the CFAA

Well, I mean, that and (I'm sure) the fact that he was a notorious asshole and the authorities would rather make an example out of him than out of a more sympathetic defendant

> I believe there is precedent that you’re allowed to enter any computer system until you’re specifically warned.

Didn't work that well for weev

I'm having a chuckle from comments on Reddit: “It's an IPv4 address pointing directly to the camera, not so sure that there are any logs.”

Wonder how many of the VPN-employing folks in fact use something like NordVPN and pay for it with their credit card.

This is amusing to read because they largely/all seem to be AT&T mobile IPs, which get allocated from an absurdly sized pool with barely working geoip.

Well AT&T does own an entire /8 block (12.0.0.0/8) so they certainly have plenty to choose from

I guess for clarification what I mean is mobile pools are generally heavily mixed/NATed/etc all over the place, and the reddit OP claims that they're all hidden VPNs or something due to geo - mobile IP space geo literally does not work half the time and is an absolute mess. They're almost certainly just hotspots or an LTE SIM attached to the cameras with nothing else hiding it.

I use nordvpn that I purchased with a credit card. Before using it I would get notices from my ISP for pirating but not anymore.

As far as I'm concerned it just makes me not the lowest hanging fruit and that's good enough for me. Even if they wouldn't cut off my service from those notices I consider it worth $50 a yearfor peace of mind. Plus it comes in handy for getting around some geo restrictions.

Case in point: thinking that any of this is relevant in a thread about people logging into government-setup cameras.

Btw, you might want to look into what came out of this story: https://medium.com/@derek./how-is-nordvpn-unblocking-disney-... — it's mostly guesswork but I'm not sure how a company buys 32 million residential ips otherwise.

I have special insight into this situation (including both companies named within) and it is exactly as the article implies. These people are printing money on the backs of regular (unsuspecting) people, and nobody asks questions because of the amount of money involved. To be quite honest, this is what I imagine the fine line must look like, which exists between things that don't need regulation and things that do. That fine, fuzzy line of "These people are obviously up to some hinky bullshit and lying-not-lying to everybody involved".

> Anybody else afraid to click some of the links in that post until you hear about legality of accessing (and controlling!) a DEA camera that's likely part of an active investigation?

In Tor (or Tails), we trust.

I'm not sure I've heard anything like "random web surfer who visits site charged with X" when they're not already the focus of some investigation or something.

Plenty of law related to tech that gets stretched to absurdity out there but I haven't seen anything to make me think hitting a rando site is a real risk in the US.

I know what your risk-management matrix says, but there's a whole world out there to explore, buddy!

Only 350m people in the world need to worry, the rest of us are outside of your (legal) jurisdiction.

Ohhh boy, do I have some bad news for you...

Good Luck, I'm Behind 7 Proxies.

That's why VPNs exist.

I am, I can see the DEA or other Federal Agencies doing to me something like they did to Aaron Schwartz and abusing the CFAA to claim simply clicking a link is "Exceeding authorized access"