[OJFord]

> the reality is that scraping is legal, always possible, but difficult.

> This particular case is a bit harder since it's not purely using public data, but may still qualify since it's likely scraping with legally-obtained credentials.

No, it's easy: they're employees, they can be told they're not allowed to do that. Doesn't matter if the app's legally allowed to exist or not.

[pc86]

They can always tell their employees they're not allowed to do something, and punish the ones that do. I think it's an important distinction though that whatever they tell their employees, the app isn't doing anything wrong in a legal sense. So still legal, possible, and difficult.

[OJFord]

And I don't think there's anything illegal about the employer making it more difficult; that may well be the cheapest/easiest way of stopping employees using it.

[messe]

There's nothing illegal about it, but that doesn't mean that making life harder for your employees trying to make sure the hours they're working are legal is moral.

EDIT: I welcome anyone who wants to justify this ethically.

[OJFord]

Agreed. I haven't commented on morals, ethics, or even witb judgement on what ought to be legal or not.

[TallGuyShort]

I'm not sure I interpret the article or the parent comment as saying American Airlines isn't allowed to do this. They're just making life harder for their employees and dont seem to be addressing the problem they're working around. It's just a little whistleblowing that they're a shitty employer.

I think what the parent comment is trying to say is that their description of their approach here as "sophisticated bot detection" is a little bit like someone calling me a hacker because I have my terminal open during the flight. There is an intentional use of words here trying to make the app developer sound like the bad guy.

[ethbr0]

This is the company that is also currently sueing ThePointsGuy over an app that helps you manage your AAdvantage (loyalty) points.

Suffice it to say, American Airlines IT are apparently a bunch of dicks.

[ceejayoz]

Helps you maximize your AAdvantage points, which isn't entirely in AA's interest.

[GauntletWizard]

While I see the logic in that a lot more, logical != Ethical.

[Brian_K_White]

You know, employees are not actually property, and there are actually limits on what an employer can tell an employee.

Everything an employer might possibly try to say about using any other software or tools to collect, handle, and redisplay "their" data, applies exactly the same to a blind employees screen reader.

Hell it applies to glasses.

Thank deity for blind people and other disabilities making it actually illegal to be as huge dicks as some companies would be if they could be.

I do not understand the the desire to even try to defend AA's position here, but am glad it's a failed attempt at least.

[OJFord]

I'm not sure why it reads as 'defending [the employer]'s position', but that's not my position, I don't care at all. (I'm not American, I may very well never have anything to do with the airline even as a customer.)

If you are its employee, jolly good luck to you with your 'well if I were blind what I've been provided with while not blind would not be adequate and I might need to use a different tool to this which works similarly' argument.

[Brian_K_White]

"I'm not sure why it reads as 'defending [the employer]'s position'"

Saying that the employer has the right to dictate those terms is literally and explicitly doing nothing else but defending their position that they have the right to dictate those terms.

[DiggyJohnson]

You’re making the classic mistake of confusing explanation for defense. It happens all the time with the Ukraine crisis as well.

[Brian_K_White]

I grant that's possible.

[OJFord]

They can 'dictate those terms' - doesn't mean I think it's good! (Doesn't mean I don't either, I haven't commented on it!)

[lostdog]

But they also deserve to have access to their work schedules, and I bet a good lawyer could argue that "access" should be interpreted broadly here.

[dpifke]

Presumably the non-public data is being scraped using the employees' credentials (i.e. username and password).

It is perfectly reasonable for an employer to have a policy which states, "do not give your work username and password to a third party." I can't imagine a court ordering otherwise.

Providing an API for this data is a non-trivial amount of work, involving significant technical and compliance challenges. Employee schedules would be useful as a signal for trading in AA stock. How do you enforce that the third party is properly protecting that information, e.g. during SEC-mandated blackout periods around earnings?

The union might be able to negotiate for AA to hire lawyers and IT staff to work on such an API, but I really can't see the employees being automatically entitled to it.

[dkonofalski]

If the scraping is happening "on-device", though, then they're not providing their details to a third party. They're simply accessing their schedules. Otherwise, pulling up their schedules in any web browser would be considered giving their credentials to a third party since that's basically what's happening here. It would be like logging in to the aa.com employee site and then installing a Chrome extension that reads the page that was downloaded. Nothing is given to the Chrome extension in terms of credentials, only page content.

[dpifke]

It might be possible to build this app in a way that none of the information ever leaves the device. I would be very surprised if that was the case here.

Most large IT departments have a list of approved browsers and browser extensions. The scenario you described would fall under the same policy. If Chrome uploaded the content of intranet web pages to Google, I expect it would be banned as well.

[dkonofalski]

>It might be possible to build this app

Not only is it possible to build it this way but I think it's far more likely that it already is built this way. Since the app is pulling up schedules for individual users, there's no benefit to scraping the info on a server or caching any of it as it would be unique for each user. There's no reason for that info to leave the device. The content is pulled, formatted, and then displayed in a style that matches the rest of the app. This can easily be done on-device and would be less efficient to do off-device.

>Most large IT departments have a list of approved browsers and browser extensions.

This is completely irrelevant considering this is being done on mobile devices. On iOS, at least, it's all webkit and done within the app itself. I was just using Chrome as an example for how this process is done without sending the credentials to a third party. Unless the company wants to ban people checking their own schedules, there's no way they can stop someone from logging in to a web browser and having the content scraped. As an example, let's say they only allowed Microsoft Edge as the "approved" browser and they didn't allow any Edge extensions to be installed. The user can still pull up the page in Edge, save the content once it's loaded, and feed the folder/HTML file to the app to scrape the content. There's literally no way for them to prevent this other than by severely obfuscating the content (e.g., randomly adding invisible characters into strings to prevent string searches or adding bogus HTML elements to prevent searches for element patterns) or ceasing access to it completely.

[dpifke]

Looking at the privacy policy[0], the app does send some information to backend servers, specifically "flight related information." If the employees' "flight related information" is not publicly available, I can see AA having a legitimate issue with it.

But the scraping does appear to happen on-device, and it claims the password is not transmitted, so that's better than I initially thought.

[0] https://www.iubenda.com/privacy-policy/40331177

[bryanrasmussen]

>It might be possible to build this app in a way that none of the information ever leaves the device. I would be very surprised if that was the case here.

I'm doing some similar stuff to automate an app for personal use, I might at some point turn it into a paid for app, when I do so I would actually have to redesign the application to send personal information off the device. Which I suppose I would not do.

[gnopgnip]

AA Flight attendants are in a union working under a collective bargaining agreement. The employer can’t just change this unilaterally.

[dzhiurgis]

Mere threat to strike for a day would make AA to buy out developer for millions of $.

[bronco21016]

Airline workers are covered under the Railway Labor Act in the US. They can’t just strike because they’re unhappy. There’s a long drawn out process before a strike can happen. See recent threats of railway workers striking in the US.

[LegitShady]

>No, it's easy: they're employees, they can be told they're not allowed to do that. Doesn't matter if the app's legally allowed to exist or not.

They're unionized employees. Someone running a company looking to make their life harder for no reason needs to think five times before they start making arbitrary and baseless demands for changes in policy. It could end up costing you tens of millions of dollars because you forgot that employees are still people and your demands will be met with demands in return.