LulzSec Hacker Jeremy Hammond Pleads Guilty To CFAA Charge; Faces 10 Years

from the doj-pile-on dept

In yet another Computer Fraud and Abuse Act case, in which the DOJ piled on charge after charge after charge until the person they were pressuring accepted a plea bargain, Jeremy Hammond has officially accepted a plea deal for helping LulzSec/Anonymous hack Stratfor. He admits that he did it, and given that, it's perfectly reasonable to suggest that some punishment is warranted, but it still seems troubling the amount of pressure that the DOJ used to get him to take a plea bargain. We've talked about this for years: very few cases go to trial, because the DOJ pulls out everything possible to pressure you to take a plea:

There were numerous problems with the government's case, including the credibility of FBI informant Hector Monsegur. However, because prosecutors stacked the charges with inflated damages figures, I was looking at a sentencing guideline range of over 30 years if I lost at trial. I have wonderful lawyers and an amazing community of people on the outside who support me. None of that changes the fact that I was likely to lose at trial. But, even if I was found not guilty at trial, the government claimed that there were eight other outstanding indictments against me from jurisdictions scattered throughout the country. If I had won this trial I would likely have been shipped across the country to face new but similar charges in a different district. The process might have repeated indefinitely. Ultimately I decided that the most practical route was to accept this plea with a maximum of a ten year sentence and immunity from prosecution in every federal court.

It's worth noting that others involved in the same case have been sentenced to much lower sentences in the UK, so it will be interesting to see what the final sentencing yields.

Hammond insists that he still stands by what he did:

Now that I have pleaded guilty it is a relief to be able to say that I did work with Anonymous to hack Stratfor, among other websites. Those others included military and police equipment suppliers, private intelligence and information security firms, and law enforcement agencies. I did this because I believe people have a right to know what governments and corporations are doing behind closed doors. I did what I believe is right.

As I've said before, while I understand why people think this is reasonable strategy, such hacks almost always lead to more backlash than forward momentum. Yes, governments and companies are doing questionable things behind closed doors, but hacking into them to "prove" that takes away much of the value of finding out that information, and only increases the power of the government to create and use laws like the CFAA broadly to stifle perfectly legitimate uses of computers.

Filed Under: anonymous, cfaa, cracking, doj, hacking, jeremy hammond, lulzsec
Companies: stratfor

Reporters Find Exposed Personal Data Via Google, Threatened With CFAA Charges

from the sounds-familiar dept

In a story that sounds mighty similar to the Andrew "weev" Aurenheimer situation, two reporters from the Scripps News service have been told that they may be hit with Computer Fraud and Abuse Act (CFAA) charges after a Google search they did turned up personal data on 170,000 customers that two telcos left exposed. At issue are low-income customers of YourTel and TerraCom, who provide service for the FCC's Lifeline, a phone service for people who are enrolled in state or federal assistance programs. Apparently, the real issue was a company called Vcare, which the two telcos outsourced certain services to. The Scripps reporters noted that they did nothing more than a Google search:

The unprotected TerraCom and YourTel records came to light through the simplest of tools: a reporter’s Google search of TerraCom.

The records include 44,000 application or certification forms and 127,000 supporting documents or “proof” files, such as scans or photos of food-stamp cards, driver’s licenses, tax records, U.S. and foreign passports, pay stubs and parole letters. Taken together, the records expose residents of at least 26 states.

The application records, drawn from 18 of those states and generally dated from last September through November, list potential customers’ names, signatures, birth dates, home addresses and partial or full Social Security numbers. The proof files, from last September through April, include residents of at least eight remaining states.

Of course, rather than be thankful to the reporters for letting them know about a huge security lapse, or be apologetic for revealing all sorts of key data on their customers, they decided to sue.

However, Vcare and the two telecom companies assert that the reporters "hacked" their way into the data using "automated" methods to access the data. And what was this malicious hacking tool that penetrated the security of Vcare's servers? In a letter sent to Scripps News by Jonathan D. Lee, counsel for both of the cell carriers, Lee said that Vcare's research had shown that the reporters were "using the 'Wget' program to search for and download the Companies' confidential data." GNU Wget is a free and open source tool used for batch downloads over HTTP and FTP. Lee claimed Vcare's investigation found the files were bulk-downloaded via two Scripps IP addresses.

I'm not sure how anyone could claim that the mere use of Wget constitutes a form of hacking, even under the extremely loose interpretations of the CFAA. However, as mentioned, the story does have similarities to the weev case -- except this time we're talking about reporters for a well known news service, rather than someone with a reputation as an internet troll. Hopefully, if the telcos do decide to actually file a lawsuit, it gets laughed out of court.

Filed Under: cfaa, exposed data, hacking, security vulnerability
Companies: scripps, terracom, vcare, yourtel

Feds Realize That Exploiting A Bug In Casino Video Poker Software Is Not Hacking And Not A CFAA Violation

from the about-time dept

For years, we've talked about how casinos were able to get away with not paying people who won jackpots from electronic gambling machines, by claiming that their wins were really because of software glitches. That always seemed like a highly questionable practice, but even more questionable was filing criminal charges against winners who won because of those glitches. We talked about one such case back in 2007, and then another one in early 2011. That 2011 case involved two guys, John Kane and Andre Nestor, who had figured out a bug in some video poker software from International Game Technology, a gaming giant.

The bug was very complex. It involved a series of different steps that had to be taken: play one game on the machine until you have a high payout, then switch to a different game, play until an option popped up to "double up" (basically a double or nothing proposition on a "high card wins" bet), then add more money to the machine, exit the specific game, change the denomination amount to the game maximum, and then switch back to the original game played. At that point the high payout from the initial round shows, allowing that amount to be re-awarded. On top of that, it would recalculate the award by the new denomination level, often increasing the "payout" by 10x.

Apparently Kane discovered this bug by accident from playing a ridiculous amount of video poker. His lawyer claims that Kane was obsessed with video poker and probably played it more than anyone. He also insists that there was no research or effort that went into this. It was just a fluke from playing so often that Kane found the bug -- and then got his buddy Nestor (and a few others) involved in using this bug to win an awful lot of money. When Nestor was arrested, he was reasonably angry about the whole thing:

“I’m being arrested federally for winning on a slot machine,” he said. “It’s just like if someone taught you how to count cards, which we all know is not illegal. You know. Someone told me that there are machines that had programming that gave a player an advantage over the house. And that’s all there is to it.…

“Who would not win as much money as they could on a machine that says, ‘Jackpot’? That’s the whole idea!”

The feds, of course, hit them with CFAA (Computer Fraud and Abuse Act) charges, the same highly questionable hacking law we've been writing so much about lately. The feds argued that Kane and Nestor "exceeded authorized access" -- one of the most troubling parts of the CFAA. The DOJ argued that:

In short, the casinos authorized defendants to play video poker. What the casinos did not do was to authorize defendants ‘to obtain or alter information’ such as previously played hands of cards. To allow customers to access previously played hands of cards, at will, would remove the element of chance and obviate the whole purpose of gambling. It would certainly be contrary to the rules of poker.

However, the court was skeptical of this argument, and after the 9th Circuit's ruling in last year's case against David Nosal, where they said that merely violating an employer's computer use policy did not mean you had exceeded authorized access, the court asked the DOJ to explain how the CFAA still applied in light of the Nosal ruling.

Apparently, the DOJ realized that the CFAA charges no longer made sense and, yesterday afternoon dropped those charges. In a simple filing with no explanation, the DOJ asks the court to dismiss the two CFAA-related charges in the indictment. Kane and Nestor still face a single wire fraud charge, but that's much less of a threat than the CFAA charges. At the very least, it's good to see increasing pushback on the DOJ for its regular abuse of the CFAA to pile on charges.

Filed Under: andre nestor, casinos, cfaa, doj, exceed authorized access, hacking, john kane, las vegas, video poker
Companies: international game technology

Awesome Stuff: Films About Things Techdirt Talks About

from the check-it-out dept

For this week's awesome stuff post, we've got links to movies about things that we regularly talk about here on Techdirt: the prosecution of Aaron Swartz, the CFAA, patents and piracy.

• First up, is a documentary about Aaron Swartz called The Internet's Own Boy by Brian Knappenberger, who previously did a documentary about Anonymous. Knappenberger's film isn't a "memorial" about Swartz, but rather an "investigative" documentary about his story and the lawsuit against him, as well as the legal structure that led to his arrest and trial. The video that Knappenberger has put together is really compelling and touching: This project has received a lot of attention, so there's no surprise that it's quite close to its $75,000 target with a few weeks to go. It looks like it should be a great project to support.
• From once CFAA case to another. Krystof Andres & George Russell are doing a documentary called The Hedgehog & The Hare, all about the CFAA, but mainly focused on the case against Andrew "Weev" Auernheimer. The documentary will also explore how the CFAA goes way too far in trying to criminalize perfectly reasonable computer activities. The target for this project had much more modest goals than the Swartz one, though the production values definitely look a bit more amateurish. Plus, frankly, the rewards on the Swartz movie are a lot more reasonable. That said, with just a few days left, it looks like this movie is likely to squeak by the target even if it's just slightly under as I write this.
• This next one, I'm a bit less sure about, but the topic could be interesting. It's supposedly a short film, made in South Africa about the big pharmaceutical makers going after generic drug makers, called The Cure. What makes me a bit unsure about is that the filmmakers, Katey Carson and Errol Schwartz, seem a hell of a lot more excited about the fact that (a) they signed up some "Oscar-winning talent" to be in the film and (b) that they're filming the whole thing with an iPhone, than they are about the story, which they barely mention at all. The topic sounds interesting. I just wish they'd actually have said something about that, rather than the other stuff which really isn't that interesting. The project has barely raised any money, and they're pretty ambitious to seek $35,000 for this. But since it's an Indiegogo "flex funding" campaign, they'll get the money even if they don't raise the full amount. Also, the "rewards" you get back seem ridiculously high priced. You have to pay $100 just to get a download of the short film and $50 for the script? Hmmm. Love the idea of a film that highlights problems with drug patents, but not sure this is the best way to do it.
• And, finally, a documentary about piracy. I mean that's what critics insist this site is all about, right? So I figured, why not. Here's a documentary film about a Somali pirate -- you know, one who actually hijacked a ship, called The Smiling Pirate, which aims to tell the story of the one remaining living member of the pirates who hijacked the Maersk Alabama. As the story suggests, despite a forthcoming Tom Hanks movie about this whole thing, there appear to be a lot more questions than answers about what really happened both aboard the ship and then with the captured pirate after the whole thing happened. Sounds like an interesting story, but it hasn't picked up very many backers yet. It's also an Indiegogo flexible funding project, so will receive any money it raises, but it's not clear if it'll get enough to really support the making of the documentary any time soon.

That's it for this week. Next week we'll be back with more awesome stuff.

Filed Under: aaron swartz, awesome stuff, cfaa, patents, piracy

Mainstream Press Waking Up To DOJ's Massive Overreaction To Minor Computer Hacks

from the omg-it's-a-computer! dept

We've talked plenty about the government abusing the CFAA to pretend that some minor hacks were some giant criminal conspiracy, but now even the mainstream press is starting to recognize that an overactive Justice Department seems so freaked out by computers that it feels the need to use the CFAA over and over again against minor hacks. We've covered the various cases mentioned in the article in the past, but it's good to see a paper such as the Washington Post call the administration out for its silly overreactions. It's as if they see a computer and assume that something bad must be happening. At no point, when it comes to these cases, does the DOJ seem to step back and look at the actual seriousness of any of these cases.

Filed Under: cfaa, doj, hacking
Companies: washington post

Craigslist's Abuse Of Copyright And The CFAA To Attack Websites That Make Craigslist Better Is A Disgrace

from the please-stop-this-craig dept

Craigslist and Craig Newmark, specifically, have been very involved in being good corporate citizens on the internet. Craig was one of the key players in stopping SOPA, and has been involved in a number of other key internet activism campaigns, including the fight against CISPA. That's part of the reason we were so surprised and disappointed last year to see Craigslist seek to abuse both copyright law and the CFAA to go after a couple of sites that added a layer of value on top of Craigslist. The key target seemed to be Padmapper, a site that combined data from Craigslist and other sources to make searches for real estate much more useful (adding maps and other data). Those results did not compete with Craigslist but layered more info on top, driving interested people right back to Craigslist. After Craigslist threatened Padmapper for scraping its site, Padmapper switched to using a third party, 3taps, which had figured out a way to get data from Craigslist, and Padmapper just used that instead.

In response, Craigslist sued them both (and another site that was using 3taps as well) making some highly questionable claims about how this was both copyright infringement and a CFAA violation because it violated its terms of service. The copyright claim seemed particularly bizarre, because Craigslist appeared to be claiming copyright on posts made by others, something that was obviously ridiculous. Making things even more farcical, Craigslist then tried to cover this up with a click through notice on the site telling visitors that when you post on Craigslist you're granting an exclusive license to Craigslist -- meaning you're effectively giving it control over your copyright. After that raised significant backlash, including from the NY Times, Craigslist backed down on that one point.

But the lawsuit itself has continued and the judge recently ruled on the motions to dismiss the lawsuit from 3taps and Padmapper. The ruling is a mixed bag, but mostly bad. First we'll start with the tiny "good" part, though: the court did dismiss the general copyright claims Craigslist was making over everyone's posts on its site (outside that time period discussed above where Craigslist said it wanted an exclusive license).

The meaning of the phrase “You also expressly grant and assign to [Craigslist] all rights” was the subject of some debate at the hearing on these motions, but the “all rights” language relates specifically to enforcement rights–not rights to the content of the posts. The language assigning rights to the content did not use the phrase “all rights,” and did not specify that the rights granted were “exclusive.” Craigslist provides no authority for the proposition that an ambiguous grant of rights is presumptively exclusive, and the Court declines to read that term into the terms that Craigslist itself drafted

Basically, it says that Craigslist's regular terms of service didn't grant Craigslist an exclusive license, which is necessary for a lawsuit over the copyrights.

But, in the long run, that's a small victory. The court does say that Craigslist has a copyright in the "compilation," claiming that adding geographic information is somehow creative.

Craigslist has alleged that its “classified ad service is organized first by geographic area, and then by category of product or service,” with these categories organized in “a list designed and presented by craigslist.”... Construing the relevant allegations in Craigslist’s favor at this early stage in the proceedings, the Court concludes that Craigslist, in “deciding which categories to include and under what name,” ... “display[ed] some minimal level of creativity,”

Ick. I have trouble seeing how that kind of activity raises to the level of creativity protected by copyright, so hopefully later in the process the court will reject this concept. Now, the next bad part of the ruling: the court says that Craigslist does actually have a valid copyright in the posts for those few short weeks when it had that clickthrough "reminding" people that it had the exclusive right. I still don't see how this is possible, since an exclusive license is supposed to require a written confirmation, not clicking through on an oddly worded "reminder." But, the court twisted some things around to say this is okay. I've read this over a few times and it still doesn't make any sense.

Basically, it says, as noted above, that Craigslist's "regular" terms of use don't grant the necessary exclusive license, but the combination of the terms that don't grant an exclusive license with a "reminder" from Craigslist that it does grant an exclusive license, somehow makes the terms grant an exclusive license. I don't see how that's possible, especially as there's no explicit or written agreement from the user to assign the exclusive license. Even though it was just written as a "confirmation," the court says that "it is reasonable to infer that a Craigslist user would understand that this "confirmation" effected a transfer of rights." But why? How could a statement that is written as if it reminds you of something actually be an official decision to transfer rights? Here's what the reminder specifically said:

Clicking “Continue” confirms that craigslist is the exclusive licensee of this content, with the exclusive right to enforce copyrights against anyone copying, republishing, distributing or preparing derivative works without its consent.

That certainly sounds like a reminder of an existing situation and not an official agreement to transfer rights. But the court seems to think people will realize that clicking that single button is giving up entirely the rights to their own copyrights to Craigslist. That seems ripe for revisiting...

The impact of this -- even if it only applies to posts from July 16, 2012 through August 8, 2012 -- could be huge. As the EFF notes this could create serious problems:

So, if you posted a craigslist ad while this provision was live, you're out of luck. craigslist's ownership claims over user posts could potentially mean that the affected users can’t republish their ads on multiple services without risking a claim of infringement. And while not every craigslist post is going to go viral and have real value outside the original context (like the “Jesus Tap-Dancing Christ” car ad), users still need the right to post and repost their material in a variety of venues. Moreover, the exclusive license provision calls into question craigslist’s compatibility with common licensing schemes, like the Creative Commons ShareAlike license or the GNU Free Documentation License for the time that provision was valid. And, worse still: craigslist’s actions, and the court's ruling, only increases the chance that other websites will start demanding ownership of the content you post there.

So, a tiny bit of good, but a lot bad on the copyright front.

On the CFAA front... it's the same basic story. The court rejects the idea that merely accessing the website is a CFAA violation (thanks to the Nosal ruling). It rejects Craigslist's claims that it was blocking access, rather than uses (which is the core of the Nosal ruling), noting correctly that within Craigslist's terms, all of the restrictions are about uses.

The Court need not decide whether violating “restrictions on access to information” contained in a website’s terms of use can ever support liability under the CFAA, because Craigslist’s TOU contain only “use” restrictions, not true “access” restrictions as the term is used in Nosal. Although the TOU include a section titled “Unauthorized Access and Activities,” parts of which are framed in terms of “access,” these restrictions depend entirely on the accessor’s purpose. TOU at 6-7 (prohibiting, e.g., “access to or use of craigslist to design, develop, test, . . . or otherwise make available any program” that interacts with Craigslist).

That part is good. But... unfortunately, the CFAA claims stay alive on two counts. First, because Craigslist sent a cease and desist letter, the court says that violating that letter is unauthorized access. That seems extreme and ridiculous in the same way the argument that violating a terms of service violates the CFAA. The second issue is that Craigslist blocked the IP of 3taps... and 3taps (shocker) changed their IP. The court actually argues that changing your IP address when it was blocked is a violation of the CFAA. This is unfortunately similar to one of the arguments made against Aaron Swartz.

Aside from the TOU, however, Craigslist specifically denied authorization to use the website “for any purposes” in its cease and desist letters, Kao Decl. Ex. A, and also used technological measures to block access from IP addresses associated with 3Taps, which Craigslist alleges that 3Taps bypassed by using different IP addresses and proxy servers to conceal its identity. Assuming that the CFAA encompasses information generally available to the public such as Craigslist’s website, Defendants’ continued use of Craigslist after the clear statements regarding authorization in the cease and desist letters and the technological measures to block them constitutes unauthorized access under the statute.

The EFF points out how ridiculous both of these claims are. On the cease and desist:

Cease and Desist Letters Should Not Make Access to a Website Criminal

The CFAA is both a civil and a criminal statute. This is a civil case, but has criminal ramifications. While the court looked at the earlier Facebook v. Power Ventures case, it misread a key holding. There, the court recognized that imposing criminal liability based on the “receipt of a cease and desist letter would create a constitutionally untenable situation.” This would put too much power in the hands of private parties to decide what a crime would be.

And on the IP address change, EFF points out how changing IP addresses is a common thing that happens all the time:

Changing IP Addresses Is Not Hacking

The court’s ruling on IP address blocking is dangerous because it could criminalize innocent behavior.

[....] There is nothing inherently improper, never mind unlawful, about switching IP addresses and thereby avoiding IP address blocking. Moreover, when a website is available without restriction to the public, a private party should not be able turn access into a crime to back up owner preferences or terms of service with the weight of criminal authority.

Given all that, there are very serious problems with this ruling, and the fact that Craigslist is driving such dangerous precedents is quite upsetting for a company that has been so involved and so at the forefront of helping fight back against such abuses of the law. Over at Freedom to Tinker, Steve Schultze asks Craigslist to dismiss the case with prejudice, and I second that call.

If Craig Newmark and Craigslist move forward with this lawsuit, which has the possibility of creating very dangerous precedents concerning both copyright law and the CFAA, it will do tremendous harm to Craigslist's reputation and standing in the wider internet community. As Schultze notes, moving forward at this point, given the details in the latest ruling will just make Craig look petty and vindictive. I know Craig and he's anything but vindictive and petty. Destroying his reputation and acting out just because a couple of sites tried to make Craigslist more useful? It just doesn't make any sense at all. Hopefully Craig will realize this as well, and will call off his legal attack dogs, and think twice about future lawsuits of this nature.

Filed Under: cfaa
Companies: 3taps, craigslist, padmapper

Shameful: Tech Companies Fighting Against Necessary CFAA Reform And CISPA Fixes

from the bad-news dept

We've been talking a lot about the importance of CFAA reform lately, even highlighting how, under the CFAA, the founders of some of the most successful tech and software companies of our time could have been thrown in jail under the CFAA. For that reason, it's ridiculous and shameful that many of the largest software companies, via the powerful SIIA lobbying group, are fighting hard against CFAA reform. We've been hearing for a while that companies like Oracle and Adobe were particularly strongly against it, but the SIIA represents an awful lot of tech companies, many of whom otherwise seem to be in favor of CFAA reform. Certainly, in talking to engineers at many of these companies, they think the CFAA is ridiculous, turning ordinary everyday activity into a possible felony. But some of the execs at these companies see a weapon to be used against people who make off with digital information -- especially rogue employees (or ex-employees).

This is silly. The tech companies are refusing to fix a very dangerous and broad law, because of a very specific circumstance that can be dealt with via other existing laws. Also, it's going against basic common sense and the views of many of these companies' own engineers. When companies are so focused on protecting one weapon that they're willing to allow such bad laws to stay, those are companies who are showing that they're not focused on innovation but on litigation and protectionist views.

Similarly troubling is the news that TechNet, an organization representing a bunch of tech companies has sent a letter to the House Intelligence Committee supporting the post-markup version of CISPA. This isn't a huge surprise. TechNet had already been listed as a supporter of CISPA, and the bills' sponsors in Congress had worked overtime (or, rather, had their staffs work overtime) seeking to appease the tech industry on the mistaken belief that the fight against SOPA was really lead by the tech industry, rather than an angry public. The public isn't quite as angry about CISPA, since the threats of CISPA aren't quite as immediately obvious to everyday people, but winning over the tech companies by giving them immunity should they violate their users' privacy is a bad long term strategy.

Yes, tech companies were a part of the coalition who fought against SOPA, but part of that was because those tech companies were focused on what was best for their users. Choosing to go against those same users when it comes to their own privacy is going to backfire eventually. Some people think that it was the tech companies who drove the fight against SOPA, when the reality was that it was the internet users, who pulled the tech companies into the fight. Not listening to their users would be a big mistake, as a vocal internet turning against these companies isn't a good sign for their future.

On that note, Reddit founder Alexis Ohanian has kicked off a campaign looking to shame Google, Facebook and Twitter into coming out against CISPA. Hopefully, he'll do something similar around CFAA reform as well. Having tech companies come down on the wrong side of these two laws is a bad long term strategy for the tech industry.

Filed Under: cfaa, cispa, lobbying, tech companies
Companies: siia, technet

Did Stephen Colbert And President Bill Clinton Violate The CFAA?

from the another-day,-another-example dept

Last night, former President Bill Clinton joined Stephen Colbert on his TV show, The Colbert Report. As many people have noted, at the very end of the program, Colbert told Clinton that he had taken the liberty of signing him up for a Twitter account, since Clinton does not currently use Twitter (he joked that he was afraid no one would reply to his tweets). The Twitter account is @PrezBillyJeff, and Colbert sent Clinton's first tweet live while on the air. If you're in the US or the one or two other places that Hulu actually works, you can see the exchange below (if you're elsewhere, blame Viacom for being stupid): Of course, as we've been discussing this week, the CFAA is an awful bill concerning hacking, and needs to be reformed. A big part of the problem is that it appears to criminalize what seems like every day behavior, and the DOJ has interpreted the CFAA broadly. While not all courts agree, the DOJ has argued that merely disobeying a website's terms of service means that you've violated the CFAA by accessing content either without authorization or by exceeding authorization.

Let's jump over to Twitter's terms of service. There, they clearly forbid impersonation:

Impersonation: You may not impersonate others through the Twitter service in a manner that does or is intended to mislead, confuse, or deceive others

Now, you could argue that Colbert registering an account for Clinton without his permission does not reach that level, but are you confident that someone else doing the same thing less publicly wouldn't run into problems if their tweets pissed someone off? An account that many people believe actually belongs to Bill Clinton would be highly valuable. Indeed, just overnight the account has racked up tens of thousands of followers. In the meantime, it's not even entirely clear who actually controls the account. Colbert registered it and tweeted from it. Are any future tweets coming from Colbert or Clinton or someone else? It's not difficult to make an argument that the account is intended to confuse others. Furthermore, if Colbert is transferring the account over to Clinton, it means that Clinton never actually agreed to the terms of service in the first place. Would that mean he is then abusing the use of the service?

While they appear to now have been deleted, according to the Washington Post, after the inaugural post done live on the air, there were a series of other tweets in which it was not clear if it was Clinton or Colbert tweeting. One had "Clinton" refer to "Colbert" as his new "BFF" and the tweets used the hashtag "#notColbertpretendingtobeme." At the very least, there is clear confusion, and a regular person might assume that this is Bill Clinton tweeting. If it's actually Colbert, it could be seen as a CFAA violation.

Yes, this is a stretch -- no doubt about it. But that's part of the problem with the CFAA. It is so broadly worded that simple activities like these can be twisted into a violation should someone in power wish to do so.

Filed Under: bill clinton, cfaa, cfaa reform, impersonation, stephen colbert, terms of service
Companies: twitter

Speak Up And Fix The CFAA

from the don't-make-it-worse dept

A bunch of internet activists, including Fight for the Future and Demand Progress, among others, have launched a new site: FixTheCFAA.com, asking people to contact their lawmakers and demand that they fix the CFAA law, rather than make it worse.

The Computer Fraud and Abuse Act is the law under which Aaron Swartz and other innovators and activists have been threatened with decades in prison. The CFAA is so broad that law enforcement says it criminalizes all sorts of mundane Internet use: Potentially even breaking a website's fine print terms of service agreement. Don't set up a Myspace page for your cat. Don't fudge your height on a dating site. Don't share your Facebook password with anybody: You could be committing a federal crime. (Read more here.)

It's the vagueness and over breadth of this law that allows prosecutors to go after people like Aaron Swartz, who tragically committed suicide earlier this year. The government threatened to jail him for decades for downloading academic articles from the website JSTOR.

Since Aaron's death, activists have cried out for reform of the CFAA. But members of the House Judiciary Committee are actually floating a proposal to expand and strengthen it -- that could come up for a vote as soon as April 10th! (Read more here.)

Thankfully, we've heard that the public outcry over the bad CFAA reform proposal probably (though not definitely) means that it won't be scheduled for a markup this week (as originally intended). However, that doesn't mean it's not still a major risk. There remains strong support from law enforcement folks and the Justice Department in particular for this kind of CFAA reform (the kind that makes it even broader). And, tragically, many in Congress just don't think that the public cares enough to support a bill in the other direction. Hopefully enough people speak up and let them know that this is unacceptable. A law that criminalizes breaking terms of service is not a law worth having on the books.

Filed Under: aaron swartz, cfaa, fix the cfaa, hacking

In Which NY Times Reporter Jenna Wortham Accidentally Reveals How She Violated Both The CFAA & The DMCA

from the all-in-one dept

Over the past few months and weeks there's been much greater attention paid to both the CFAA and the anti-circumvention provisions of the DMCA, and how both are in need of serious reform. The attention to anti-circumvention was galvanized around the fact that unlocking your mobile phone became illegal again, after the Library of Congress allowed an exemption to expire, making many people realize that the anti-circumvention clause of the DMCA, also known as section 1201, meant that they often don't really own the products they thought they owned. The attention to CFAA reform came in response to Aaron's Swartz's untimely death, and the light it shed on the parts of the CFAA that he was charged under. Of course, many of us have been fighting back against both laws for years, but the public attention on both has been key over the past few months.

One of the key issues that critics of both laws have pointed out, repeatedly, is how they criminalize things that most people don't really think are bad or illegal. That is, they often criminalize someone (or at least make them open to huge civil awards) for the types of things plenty of people do everyday without thinking twice about it.

Given all that, it's interesting to see a NY Times reporter, Jenna Wortham, more or less admit publicly to willfully breaking both laws in an article she wrote about the rising number of people, including herself, who use other people's logins for various streaming content services. In Wortham's case, she logs in to the HBO Go internet service via a login obtained from some guy she met at a restaurant.

LAST Sunday afternoon, some friends and I were hanging out in a local bar, talking about what we’d be doing that evening. It turned out that we all had the same plan: to watch the season premiere of “Game of Thrones.” But only one person in our group had a cable television subscription to HBO, where it is shown. The rest of us had a crafty workaround.

We were each going to use HBO Go, the network’s video Web site, to stream the show online — but not our own accounts. To gain access, one friend planned to use the login of the father of a childhood friend. Another would use his mother’s account. I had the information of a guy in New Jersey that I had once met in a Mexican restaurant.

That's a violation of the anti-circumvention clause of the DMCA, as she is circumventing a technical protection measure that is designed to keep her from watching the show without paying. It's a violation of the CFAA because it means that she is knowingly accessing a protected computer without authorization (or, at least, exceeding authorized access). There may be some questions about whether or not the data she obtained exceeds $5,000 in value, but it wouldn't be that hard for a inspired US Attorney to come up with some way to count it as such. After all, they made that claim with Aaron Swartz and all he was downloading was academic papers that have little or no actual commercial value. Wortham is admitting to streaming some of the most popular (and expensive to produce) content out there.

No, no one thinks that anyone is likely to actually go after Wortham, but this story highlights why both of those laws are highly problematic and are in serious need of immediate reform. Just the fact that Wortham could find herself on the receiving end of lawsuits (both criminal and civil) over both of those laws (and considering her public admission to the key facts, she might have a difficult time pleading innocence) shows why those laws desperately need to be fixed. A quick look through Wortham's writings this year suggest that she has not written about either of these issues. While it may not directly be considered her "beat," the fact that this latest article leads to inadvertent admissions to breaking two laws -- one of which can result in $150,000 in statutory damages and the other a felony charge and potential jail time -- suggest that perhaps it should be something worth covering.

All that said, her article is actually pretty interesting, and worth reading. While it starts out talking about how people are sharing their accounts, it also notes that many of these services are really falling down on enabling easier community and sharing features among friends or the wider community of people who like the same content. I agree with all of that, though I don't think people should face penalties for breaking these two incredibly obsolete laws to explore the topic.

Filed Under: anti-circumvention, cfaa, dmca, exceeds authorized access, hbo go, jenna wortham, shared accounts, streaming