Supreme Court Leaves Troubling CFAA Rulings In Place: Sharing Passwords Can Be Criminal Hacking

from the congress-fix-this-shit dept

For many, many years now, we've talked about problems with the CFAA -- the Computer Fraud & Abuse Act -- which was passed in Congress in the 1980s in response to the Hollywood movie War Games (seriously). It was a messed up moral panic back then, and over the years it's been abused widely in both civil and criminal cases to define almost anything as hacking. Over the past few years we've been following two cases in particular related to the CFAA: the David Nosal case and the Power.com case. Both involved fairly twisted interpretations of the CFAA -- and, unfortunately, the 9th Circuit found both to be okay. And, unfortunately, this week, the Supreme Court declined to review both cases, meaning they remain good (if stupid) law in the 9th Circuit (which will likely influence cases elsewhere).

I won't go into all of the background in both cases, but the super short version is that under the Facebook v. Power ruling, it's a CFAA violation for a service to access a website -- even if at the request of users -- if the website has sent a cease-and-desist. That shouldn't be seen as hacking, but the court said it's "unauthorized access." Power was a service that tried to help consolidate different social networks into a single user interface for users -- and lots of people found that valuable and signed up for the service. But, Facebook didn't like it and sent a cease-and-desist to Power. Power figured that since users were asking it to continue and they were the ones who had the accounts, it was okay to continue. The court, unfortunately, claimed that it was a CFAA violation -- the equivalent of "hacking" into a system (despite having legit credentials) just because of the cease-and-desist.

In the Nosal case, the court said that merely sharing your passwords can be a CFAA violation. In that case a guy looking to compete with his old firm had someone still there share a password so he could log in and get customer info. That may be unethical and problematic -- but should it be the equivalent of computer hacking? While the 9th Circuit had rejected an even broader interpretation of the CFAA that would say merely violating a terms of service became "unauthorized access" it said okay to the password sharing one.

There was some hope that the Supreme Court would hear these cases and explain that these rulings stretched the CFAA to dangerous degrees. Unfortunately, that's not the case.

And so we're back where we've been for a few decades now: talking about why Congress needs to reform the CFAA and fix these problems that leave the law wide open to abuse -- especially in an era where so many people use dozens of services, and sometimes do things like share passwords or ask others to log into sites for them. These should never be seen as "hacking" violations, but in the 9th Circuit, they are.

Filed Under: cease & desist, cfaa, david nosal, passwords, scotus, supreme court
Companies: facebook, power

Power.com Says Facebook Can't Block Access To User Data

from the seems-like-a-tough-claim dept

Earlier this year, we had trouble understanding Facebook's reasoning for suing Power.com, a site that tried to aggregate a variety of social network sites into a single interface (something that seems rather useful). However, Facebook insisted that it violated its copyright, and in a slightly troubling ruling in the case, the judge seemed to find that any scraping could be copyright infringement, even if the scraping was just to get at non-infringing content. The court's argument was that in order to get at the non-infringing content, you first have to scrape the infringing content too.

Now the case is getting odder, as Power.com has countersued Facebook, claiming that Facebook is "unlawfully withholding the data that users own (as stated in Facebook’s own ToS)." Of course, if that's true, I'm not sure if Power.com has the standing to make that claim. Wouldn't that be an issue for the user to raise themselves? Besides, I don't think there's any rule that even if a site lets you retain the copyright on content that it needs to make it easy to access. So now we have lawsuits coming from both sides that don't make much sense. The two sites should just learn to play nicely with each other.

Filed Under: copyright, data, ownership, scraping
Companies: facebook, power

Can Scraping Non-Infringing Content Become Copyright Infringement... Because Of How Scrapers Work?

from the this-seems-troubling dept

Earlier this year, we couldn't figure out how Facebook's lawsuit against Power.com made any sense. Power.com tried to aggregate various social networking accounts in a single place, so you could manage them all at once through a single interface. Yet Facebook charged the company with all sorts of complaints, including copyright and trademark infringement, unlawful competition and violation of the computer fraud and abuse act. Power.com asked for the case to be dismissed, but last month the judge sided with Facebook, but did so in a troubling way, by basically suggesting that since Facebook's terms of service prohibited these uses, it made it copyright infringement. Michael Scott points us to lawyer Jeff Neuberger's take on the ruling, and separately Tom O'Toole has a good analysis of the ruling. Neuberger states the following:

Judge Fogel concluded that the allegations of the complaint made out a sufficient claim of copyright infringement because Power Ventures "need only access and copy one page to commit copyright infringement." The court also found that the ToU prohibited downloading, scraping or distributing content from the Facebook Web site content except that belonging to the user, and that in any event, using automated methods, i.e., "data mining, robots, scraping, or similar data gathering or extraction methods" to access any content were also prohibited by the ToU. Thus, the court found that the allegation that Power Ventures accessed Facebook via automated means constituted made out a claim of direct copyright infringement, while the allegation that Facebook users utilized the Power.com interface to access their own profile pages made out claim of secondary copyright infringement.

Thus, because the terms of service said you can't do any automated scraping of the site, it's suddenly infringing? Even worse, the court found that even though the data being used by Power.com isn't owned by Facebook (it's the users') the scraping was still copyright infringement, because in order to scrape the non-infringing content, Power.com had to first "scrape" the whole page. O'Toole explains:

OK, so far the court has found that Power.com made unauthorized copies of the Facebook Web site. What about the fact that Facebook does not own the copyright in its users' profile data? Facebook surmounted this hurdle by arguing that the content of the Facebook page that surrounded the user's data is copyrightable and is owned by Facebook. According to Facebook, the Power.com scraper operated in a manner that required it to copy the entire Web page in order to extract the user's profile data....

Note that the court is conditioning its ruling on the assertion that the Power Ventures scraper necessarily copied the entire Web page before it processed the page and extracted the profile data. That comports with my (limited) understanding of how a Web scraper works. But is it true? If it were true, couldn't an argument be made that this is a fair use of the page? I'll leave that for better lawyers.

All of this seems a bit troubling, as it would effectively rule out scraping even non-infringing content, just because the scraper had to first read through copyrighted content to get to the non-infringing stuff. But, that seems to go against the entire purpose of copyright law. The fact that the scraper reads copyrighted content shouldn't mean that it's infringement. It's not doing anything with that content other than using it to find the content it can make use of. Anyway, this ruling probably doesn't mean all that much, since it was just to reject the dismissal request, but it does seem odd that the judge gave so much weight to Facebook's terms of service, and seems to indicate the mere act of scraping can be copyright infringement.

Filed Under: copyright, infringement, scraping, terms of service, trademark
Companies: facebook, power