I don't think people are understanding.

There are norms and expectations for participating with the public internet; on the one hand, there's an expectation of good faith, and you're not being a good neighbor if you DOS a site with your crawler or scraper. On the other hand, it's technically legal to access any authorized content being served by a server, and laws like CFAA, the providers TOS, and other regulations shape the legal regime in which websites operate. In much the same way that there are different legal ramifications for behavior in public and behavior in private, the Supreme Court in the US has distinguished between Gate Up websites and Gate Down websites; in the former, then the technical operation and protocols largely govern the legal framework, while in the Gate Down scenario, the server operator can impose a contract - terms of service - which legally constrains the user to expected use.

You cannot set up a trap, in public, doing something deliberately malicious intended to cause harm, like consuming time, money, compute, etc. The law explicitly forbids that.

You can, however, use something like logins or paywalls, the equivalent of putting up a no trespassing sign, and require people behind the gate agree to things like "no scraping allowed" or whatever other terms and conditions you want to apply, and make any interactions in the Gate Down domain fully consensual and legal. You can deploy this software in such a private context, and that's actually a good thing, just like honeypots and such set up to tangle hackers and waste time.

It'd be just like setting up an obstacle course on a public highway - certain domains are regulated by certain legal frameworks, and the public internet has such a regulatory and technical framework. The price you pay for publishing something to the public is the implicit permission and authorization you grant to anyone or anything that connects over the protocol by which you're serving content.

Platforms conveniently failed to educate users of the consequences of their choice to publish content to the public internet. By choosing a Gate Up model, YouTube, Reddit, Facebook, Twitter, and so on imposed unfettered access within the legal constraints determined by the Supreme Court, technical protocols, CFAA, DMCA, and other factors. hiQ vs LinkedIn , https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn , established the legality of scrapers and crawlers, and determined the legal conditions by which your site is public or private.

Running Nepenthes in public is effectively operating malware, however morally justified it might feel.

Please provide a citation for a law that proscribes me from publically offering a service which consumes time while it is voluntarily engaged with.