[pyre]

  | The same law that says that anyone using a fake
  | middle name on Facebook is committing a federal
  | felony.

Federal prosecutors tried to get this interpretation through the courts with that mother that drove her daughter's 'rival' to suicide via MySpace. It didn't work. The judge threw it out, rightly stating that interpreting breach of ToS as a Federal crime effectively allows companies to set the bar for what is a Federal crime (e.g. "You must always access this website while standing on one leg or else we revoke your permission to use it! Now you're a 'hacker' with a felony conviction. Have a nice day.").

[AnthonyMouse]

It should be pointed out that unless the case went to the Supreme Court, a different circuit could yet come to a different conclusion, so better to fix it nationwide through Congress than risk some other court siding with prosecutors (and that defendant having to argue it to a different circuit's appellate court even if the court comes to the same conclusion).

Also:

>interpreting breach of ToS as a Federal crime effectively allows companies to set the bar for what is a Federal crime

Reminds me of something Larry Lessig said during his speech last Tuesday: The alternative interpretation is that it's a violation when someone violates code-based restrictions, right? So you're still allowing companies to set the bar for what is a Federal crime, they just have to do it in code instead of in contract. Write some nominal piece of code whose stated purpose is to prevent the thing you want to prohibit, even if it's facile and trivially bypassed, and now bypassing it is apparently back to being a federal crime again. Is this really something we want to allow? Shouldn't the law require prosecutors to prove there was some actual harm before we go throwing people in federal prison?

[rhizome]

It should be pointed out that unless the case went to the Supreme Court, a different circuit could yet come to a different conclusion

Sorry to pedant, but a case will typically not get to the Supreme Court at all unless two circuits come to different conclusions.

http://en.wikipedia.org/wiki/Circuit_split

[Natsu]

If we're really going to be pedantic, it won't get to the Supreme Court unless they grant a petition for a writ of certiorari or it's one of those rare, few types of cases where the US Constitution says the Supreme Court has original jurisdiction.

They do deny most such petitions, though, and resolving circuit splits is one reason they might grant cert.

[rhizome]

Circuit splits are by far the most common way of getting cert. They don't grant cert to every circuit split, but most of what they do, however...

[Natsu]

Indeed, and I should probably clarify one thing from what I wrote above: if the Supreme Court had original jurisdiction over a case, it would start with them, rather than being appealed to them. There aren't a lot of cases like that, though.

[AnthonyMouse]

>Sorry to pedant, but a case will typically not get to the Supreme Court at all unless two circuits come to different conclusions.

I don't see how that is inconsistent with what I posted.

[rhizome]

The difference is that your point was based on a single circuit ruling, where it's pretty much required that the "another circuit ruling differently" happen before it's even possible to get to the SC. That is, unless the "another circuit" is the third or more circuit to split on the law, it won't get to the SC at all (pretty much, see elsewhere here) before there's a second, different, verdict, obviating the "unless" in the sentence I quoted. Again, pedantry.

[AnthonyMouse]

>The difference is that your point was based on a single circuit ruling, where it's pretty much required that the "another circuit ruling differently" happen before it's even possible to get to the SC.

It isn't a requirement that there be a circuit split before the Supreme Court will take a case. You're certainly right that a circuit split makes it a lot more likely they'll take it, but that doesn't make it a prerequisite. They've been known to take important cases of first impression without it. If we're going to be pedants then we have to be pedantic, right?

[rhizome]

I never said it was a prerequisite, "pretty much required" is not "requires," and have gone out of my way to couch my point with wiggle room. Yes, it's not required, but these days it's pretty much all they work on. It's just an observation based on historical behavior, not an analysis of the various paths by which a case can make it there.

[snowwrestler]

The law depends on reasonable interpretations of intent and harm, not tricks of code. If your nominal piece of code "protects" something that is reasonably understood to be public, and if access cannot reasonably be interpretted to cause harm, then the code does not create a federal crime.

But, wait, isn't that unworkably fuzzy? Who gets to decide what is reasonable? Ultimately the answer would be a judge or jury of your peers.

[AnthonyMouse]

>The law depends on reasonable interpretations of intent and harm, not tricks of code. If your nominal piece of code "protects" something that is reasonably understood to be public, and if access cannot reasonably be interpretted to cause harm, then the code does not create a federal crime.

Can you cite any court opinion interpreting the CFAA that says anything resembling that?

>But, wait, isn't that unworkably fuzzy? Who gets to decide what is reasonable? Ultimately the answer would be a judge or jury of your peers.

Or more likely your local prosecutor, since the vast majority of cases never go to trial. And given that, shouldn't we try to do better than "unworkably fuzzy"?

[snowwrestler]

What I am describing in my first sentence is an aspect of U.S. law in general. If you can cite precedent that disagrees with my second sentence, I'd be very interested to read it.

All law is fuzzy because human concepts of morality and right and wrong are fuzzy. That is why we rely on human judges and juries to interpret them.

[AnthonyMouse]

>What I am describing in my first sentence is an aspect of U.S. law in general. If you can cite precedent that disagrees with my second sentence, I'd be very interested to read it.

How about the DMCA prohibition on circumvention of DRM in light of the process set out in 17 U.S.C. 1201(a)(1)(C) regarding the Librarian of Congress exempting DMCA circumvention from criminal liability in specific circumstances. The very existence of the latter admits a violation of your second sentence, because if the law did not prohibit such things in the general case then there could never be anything to request an exemption for. And the possibility of an exemption being granted doesn't disprove the point because any act falling into your category when the "code" is DRM remains prohibited unless an explicit exemption is both applied for and granted, and then renewed every three years. The exemption for jailbreaking phones that recently expired provides a concrete example of that not happening.

>All law is fuzzy because human concepts of morality and right and wrong are fuzzy. That is why we rely on human judges and juries to interpret them.

This is a popular refrain used in response to engineering types who naively expect the law to be so fully specified that it can be subject to mathematical analysis or proved to be internally consistent, etc. And it's true that for pragmatic and practical reasons we can't have laws that are perfectly clear and utterly unambiguous. But that doesn't mean we can't have laws that are more clear and less ambiguous, especially where the starting point is something as overly broad and unclear as the CFAA.

[eurleif]

>Write some nominal piece of code whose stated purpose is to prevent the thing you want to prohibit, even if it's facile and trivially bypassed, and now bypassing it is apparently back to being a federal crime again.

I'm not sure what I think about this, but here's a real-world analogy to consider. Suppose I have a storefront, and I keep the doors unlocked, but I put a small sign on the door saying you can't enter unless I've issued you a membership card. Should it be a crime to enter without one? Probably not. Now let's say I get a card reader-based lock, so you can't enter without a card. Even if the lock is easily bypassed (let's say I've left a window open), isn't it reasonable to consider it a crime to do so?

[InclinedPlane]

That's hardly an apt comparison. People are wary about unlawful trespass on private property and there are numerous and typically obvious signals which people use to understand which private property is out of bounds for entering without explicit permission and which private property has implicit permission to do so. More so, a sign specifically detailing the rules necessary for entering would make this even more clear and there would be little or no reasonable defense against someone who went out of their way to break those rules. And it would be a crime to do so, either unlawful entering, breaking and entering, or trespass, depending on the specific circumstances. However, these are local misdemeanor crimes, not federal felonies. Though if someone walked through an obvious hole in a fence in order to intentionally bypass the security on, say, an army base that could be a felony.

The internet includes just as varied a spectrum of activities as does private property, so the implications and consequences of violating the ToS for a given site are, or should be, equally varied.

[analog]

For what it's worth in the UK that would still be trespass, a civil offence. If you had intent to burgle that would be a crime, but if you had no criminal intent it would stay a civil matter.

Edit: removed incorrect example - thanks seebee

[seabee]

Not since 6 months ago: http://www.justice.gov.uk/news/features/2012/squatting-new-c...

[analog]

Ah thanks, I wasn't aware of that. Squatting was a bad example then, but in general if you have no criminal intent it would still be a civil offence.

[ensignavenger]

So in the UK if someone trespasses on your property, you can't call the cops to have them removed, you have to file a lawsuit?

[analog]

Well, before the squatting laws were changed, effectively yes. You had to go to court, get a court order, then if they ignored that then bailiffs and possibly police.

Edit: squatting was I believe a special case as squatters gained rights as residents. If you are asked to leave and don't, I believe the police could then be asked to remove you.

[intended]

I think 2012 was the year that real world analogies for digital cases stopped being seen as useful for discussion of legal issues.

The Simple or complex circumvention of rules, which cannot themselves be considered valid expectations of usage, should be weak grounds for prosecution.