How The DMCA And The CFAA Are Preventing People From Saving Their Soon-To-Be-Broken Pebble Watches

from the bad-laws dept

I've made no secret of the fact that I think smartwatches are really wonderful, even as lots of people scoff at the concept (and sales have been disappointing across the board). The first device that clued me in to the possible power of the smartwatch was the original Pebble smartwatch, which I (and many, many others) backed on Kickstarter. I ended up backing their second Kickstarter campaign as well -- but was disappointed in the end product and ended up moving on to another smartwatch instead (the Moto 360, though now it looks like Motorola is dumping that business as well). I didn't end up backing Pebble's latest Kickstarter campaign, which turned out to be a good thing, because as you may have heard, the company announced last week that it had sold its assets to Fitbit, and no more work would be done on Pebble watches (and people who backed the latest project would eventually get refunds, but no watches).

But, things are even worse for those who already do have (and still use) Pebble watches. In the announcement, the company admits that since Pebble watches rely on Pebble servers for certain features, the functionality of the watches may be reduced in the future:

Active Pebble watches will work normally for now. Functionality or service quality may be reduced down the road. We don’t expect to release regular software updates or new Pebble features. Our new mission will focus on bringing Pebble’s unique wearables expertise to future Fitbit products. We’re also working to reduce Pebble's reliance on cloud services, letting all Pebble models stay active long into the future.

Of course, as Cory Doctorow rightly notes, the real problem here is that thanks to stupid laws like the DMCA Section 1201 (barring circumvention of technological protection measures) and the CFAA (barring certain forms of "hacking"), users will have trouble fixing or saving their own watches. It's yet another case of not really owning what you thought you bought... thanks to DRM and bad laws.

The watches are among the many cloud-based Internet-of-Things products that are reliant on the ongoing maintenance of server infrastructure for normal functionality. This problem is exacerbated by the widespread IoT deployment of DRM to lock devices into manufacturer-controlled infrastructure -- thanks to laws like section 1201 of the Digital Millennium Copyright Act, developers who create software to replace cloud functions with alternative/self-hosted servers, or with local computing, face potential jail sentences and millions in fines. Add to that the Computer Fraud and Abuse Act, which has been used to threaten and even jail researchers who improved services but violated their terms of service to do so, and the IoT space is the land of the contingent, soon-to-be-bricked devices

As Cory notes, Pebble should allow their own users to hack their stuff, by releasing source code, schematics and more. Unfortunately, this is unlikely to happen. But it's yet another case of the law getting in the way of something you thought you owned.

Filed Under: cfaa, dmca, hacking, ownership, pebble watches, smartwatches
Companies: fitbit, pebble

DOJ Finally Releases Its Internal, Mostly-Vague CFAA Prosecution Guidelines

from the DOJ-knows-'unauthorized-access'-when-it-sees-it,-apparently dept

The government often engages in very dubious CFAA prosecutions, but it takes a lawsuit to get it to talk about how it decides what cases are worth pursuing.

[T]hanks to a legal challenge to the CFAA, the Department of Justice is for the first time releasing its 2014 guidelines on how prosecutors should charge computer crimes — when someone exceeds “authorized” access on a computer. (First Look Media, the publisher of The Intercept, is a plaintiff in the case.)

The Department of Justice acknowledges that “laws addressing the misuse of computers have not kept pace uniformly with developments in technology and criminal schemes” though it maintains that the law remains “important” in prosecuting cybercrimes.

I'd imagine the DOJ is more concerned about crafty cybercriminals beating them in the tech arms race than it is about legislators' inability to reform the CFAA (something the DOJ routinely opposes). The "Intake and Charging Policy" memo [PDF] for the DOJ's prosecution of cybercrimes lists a number of factors to be considered before pursuing federal charges.

The first key is the sensitivity of the information or system accessed "without authorization," followed by national security considerations and economic impact. Public safety is also a factor. The document points out that information obtained without authorization can be deployed to stalk and harass officials and lower level members of the general public.

But the definition of "unauthorized access" isn't explored adequately in the legal memo, leaving this to be answered on a case-by-bad case basis. The prosecutions of Aaron Swartz and Andrew "Weev" Auernheimer suggest the DOJ allows this definition to be set by the complainant rather than by policy. When MIT or AT&T complain, the government listens.

Also of note is the DOJ's willingness to turf questionable cases to the local boys if that seems more likely to result in a conviction.

Where criminal activity risks these broad harms or has a substantial effect in several parts of the country, federal prosecution may be warranted. In other circumstances, if the effect of a violation is geographically focused and limited, deference to state or local authorities may be warranted, where they have the legal tools and resources to act.

The DOJ also reserves the right to take local prosecutions federal.

Where an offense causes particularly significant harm to a single District or community, federal prosecution may be warranted.

And then there's this part, which is what worries security researchers and white hat hackers:

[F]ederal prosecution may be warranted even where the offender did not actually obtain any such information; in other words, in certain aggravated circumstances, mere access to a computer system that stores these types of sensitive information may weigh in favor of prosecution.

On the plus side, the DOJ memo does make it clear that it would rather have evidence of malicious intent than mere "unauthorized access" to work with. It also states that it should take more than violations of Terms of Service or other "contracts" with websites/service providers to trigger federal prosecution.

Unfortunately, the law is still outdated (30 years old this month!) and "unauthorized access" prosecutions are still being handled inconsistently. The DOJ is prone to letting victims steer prosecutions, resulting in completely ridiculous outcomes like the two-year prison sentence handed to Matthew Keys for a 40-minute website defacement he didn't even perform.

The memo somewhat ominously concludes with the statement that this legal memo -- pried out of its hands by litigation -- isn't intended to be "all inclusive." Given the law hasn't aged terribly well and is predicated on a slippery term like "unauthorized access," the DOJ will likely be pursuing questionable edge cases for years to come.

Filed Under: cfaa, doj, guidelines, prosecution

Congressional Rep Mike Honda Sues Challenger Ro Khanna For CFAA Violation Over Access To His Donor List

from the oh-boy dept

So, the CFAA strikes again, and this time right in the heart of a Silicon Valley political fight. If you live in or around the Silicon Valley tech industry, you probably know who Ro Khanna is. He's often been described as the "candidate for Congress that Silicon Valley prefers." It feels like he's been running for Congress against incumbent Rep. Mike Honda forever, but it's really just in the past two elections. Here's a big Bloomberg profile of him from 2013 when he first challenged Honda, losing narrowly to him in the 2014 election, despite having support from many Silicon Valley tech industry stars. This year, he's running again, and in the primary, Khanna narrowly beat Honda, suggesting good things in the general election in November (the top two candidates in the open primary move on to the general election, regardless of party).

Khanna is known for his pro-internet views, while Honda has a reputation for not really understanding or caring very much about the internet.

And now... Honda has sued Khanna under one of the most hated laws on the internet, the CFAA (Computer Fraud & Abuse Act). As we've discussed for many years, the CFAA was supposed to be an "anti-hacking law" that was created by politicians who were (literally, no joke) scared by the fictional movie War Games into writing an anti-hacking law in the 1980s. The law has many, many, many problems, but the biggest one, which comes up again and again in cases, is that it has a vague standard of "unauthorized access" or "exceeding authorized access."

Not surprisingly, that's the issue in this case as well. In short, Brian Parvizshahi was (until Thursday night) Khanna's campaign manager. Way back in 2012, Parvizshahi had briefly (as in, for just a few weeks) worked at Arum Group, an organization that helped Mike Honda with fundraising. After he left Arum Group, apparently no one at the company thought to turn off his access to the Dropbox where they stored all their info about donors. Now, to most people, you'd think that the issue here would be Arum Group's bad policies. But, under the CFAA some can argue that continuing to access that file is a form of "unauthorized access."

And that's the central claim here in the lawsuit. Honda claims that Parvizshahi continued to access that Dropbox folder that he was given access to four years ago and which Arum Group never shut down -- and thus he, and the whole Khanna campaign -- violated the CFAA. You can see the full filing here.

Now, we can say that Parvizshahi continually accessing this info -- especially after starting to work for Khanna -- was really, really dumb. Especially since his actions were clearly viewable in Dropbox -- including cases where he supposedly "edited" the files. From the lawsuit, here's just one of many, many images: It is worth noting, though, that some of the screenshots merely show Parvizshahi "adding" the document to his desktop, which might have happened automatically if he was syncing his Dropbox account to his computer, which is the way many people set things up.

One other sketchy thing here is that someone sent a copy of Honda's donor list to San Jose Inside magazine in late 2015 -- and apparently the file they got matched a file in the Dropbox folder that Parvizshahi had accessed.

So while it may have been dumb for him to do so, the real fault here would seem to lie with Arum Group for (1) giving Parvizshahi access on what appears to be his personal Dropbox account, rather than adding a professional account that it controlled and (2) failing to revoke his access after Parvizshahi left, and not even noticing it for years. That seems to be the really negligent move here.

But, with the way courts have been interpreting the CFAA, it does seem entirely possible (if ridiculous) that a California court could interpret this to be a CFAA violation for Parvizshahi at the very least. If that also applies to Khanna, that would seem doubly ridiculous. Either way, as far as I can tell, while Khanna has taken a position on a number of issues related to tech policy, I don't see anything about the CFAA. Perhaps this particular episode will change that.

Filed Under: brian parvizshahi, campaigns, cfaa, donor lists, hacking, mike honda, ro khanna

UK Court Says Lauri Love Can Be Extradited To Face Hacking Charges In The US

from the big-brothers-gotta-stick-together dept

Lauri Love, the British hacker the DOJ has been dying to get its hands on, has just been handed over to the US by his own government. The decision issued today [PDF] basically states that honoring extradition agreements is more important than any concerns issued about Love's health and well-being once handed over to US federal agents.

Mr Love’s Article 8 rights are clearly engaged. In balancing the factors for and against extradition I am satisfied that the very strong counter-balancing factors required to find extradition would be disproportionate are not found in this case. Mr Love faces extremely serious charges for offences of computer hacking over a period of one year from October 2012 to October 2013. I accept Mr Love suffers from both physical and mental health issues but I have found the medical facilities in the United States prison estate on arrival and during any sentence if he is convicted available to him, are such that I can be satisfied his needs will be comprehensively met by the US authorities.

I am satisfied Mr Love’s extradition would be compatible with his Convention rights and I send this case to the Secretary of State for her decision as to whether or not Mr Love should be extradited.

Once in the US, authorities have promised to address Love's mental and physical health concerns by placing him in "segregated housing" while determining if he's capable of being housed in the general population. As anyone who's followed prosecutions of whistleblowers and hackers knows, "segregated housing" is just a colorful term for "solitary confinement" -- not generally known to improve the mental well-being of people who've already expressed suicidal thoughts.

On top of a trip to solitary, Love will be facing charges from three jurisdictions related to the alleged hacking of multiple government/government contractor websites and databases.

Mr Love is accused in three indictments in three districts as follows:

(i) Southern District of New York – Mr Love faces two counts on Indictment, one of computer hacking (maximum sentence of 10 years imprisonment) and one of aggravated identity theft (maximum sentence of 2 years imprisonment to be imposed consecutively to the sentence for count 1).

(ii) The New Jersey request details two counts on one indictment. One count is conspiracy to access a computer without authorisation and obtain information from a department or agency of the United States (maximum sentence of 5 years imprisonment) and one of accessing a computer without authorisation and obtaining information from a department or agency of the United States (maximum sentence of 5 years imprisonment).

(iii) The Eastern District of Virginia request contains nine counts on an Indictment, count 1 – conspiracy to cause damage to a protected computer and to commit access device fraud (maximum sentence of 5 years imprisonment); counts 2 -7 – causing damage to a protected computer and aiding and abetting (maximum sentence of 5 years imprisonment); count 8 – access device fraud and aiding and abetting (maximum sentence of 10 years imprisonment) and count 9 – aggravated identity theft and aiding and abetting (maximum sentence of 2 years imprisonment).

There's little to be gained by adding up the maximum possible jail sentence facing Love. Rest assured, if convicted, it will likely be over a decade. Consolidation of the cases and charges is likely, but more than one of the charges carry possible 10-year sentences.

Meanwhile, back in the UK, Love has managed to escape being jailed for refusing to turn over passwords and encryption keys to law enforcement. UK investigators fought hard to force Love -- who they've never formally charged -- to crack open multiple seized devices for them. This attempt was shot down in May by a judge who viewed this as an end run around protections built into RIPA, the laws governing law enforcement's investigatory powers.

The final decision on Love's extradition is in the hands of Elizabeth Truss, the recently-appointed Secretary of State for Justice. Truss' previous government work doesn't really provide much guidance on which side she'll come down on this, but her voting record tends to indicate she's more sympathetic to national security/law enforcement interests than those of her constituents. Considering the UK and US have a very cozy surveillance relationship, it stands to reason Truss will likely decide to appease the DOJ, rather than overturn the court's decision.

Filed Under: cfaa, extradition, hacking, lauri love, uk, us

DOJ To Researchers: First Amendment Does Not Protect Violating Websites' Terms Of Services

from the SRO-only-in-the-court-and-not-much-here-to-grab-floor-space dept

The woefully out-of-date CFAA -- the product of panicked early-80s legislating in response to underdeveloped hacker fears -- continues to hold back research (both of the security and non-security kind) when not being wielded like the prehistoric weapon it is by the DOJ and multiple entities who prefer bludgeoning the messenger to fixing their broken systems.

Because of the ongoing misuse and abuse of a badly-written law (aided and abetted by some terrible court decisions), a group of academic researchers has decided to proactively sue the government over its terrible legislation, rather than wait around to get sued/indicted for attempting to determine if individual websites exhibit bias against certain users.

They've enlisted the help of the ACLU, which filed its suit against Attorney General Loretta Lynch back in June. The DOJ has responded with a motion to dismiss [PDF] that claims everything is wrong with the lawsuit, from the issue of standing to multiple failures to state a claim under the First and Fifth Amendments.

Plaintiffs fail to allege an injury in fact sufficient to meet the constitutional minimum of standing. Standing to assert pre-enforcement statutory challenges under the First and Fifth Amendments may exist where the statute in question regulates constitutionally protected conduct and a credible fear of prosecution exists. The challenged provision of the CFAA, however, does not facially regulate protected conduct, and the conduct in which plaintiffs intend to engage—deploying information-gathering software on the websites of non-consenting private entities—is not activity that the First Amendment protects. Moreover, plaintiffs fail to provide any facts indicating a credible threat that the challenged provision will be enforced against them: plaintiffs do not allege to have been investigated by law enforcement or threatened with an enforcement action; plaintiffs do not identify any cases in which the government has sought to enforce the CFAA for harmless terms of use violations that were not in furtherance another crime or tort; and the government has affirmatively stated that it has no intention to enforce the CFAA under the circumstances alleged here. Accordingly, plaintiffs are unable to assert an objectively credible threat of prosecution and, as a result, their complaint must be dismissed on standing grounds.

It is indeed difficult to sue to prevent things from happening, rather than suing to seek recourse after damage has been done. Speculating about future Constitutional violations is even less likely to succeed, as many courts tend to avoid tangling with any civil liberties questions not directly implicated by the case at hand. These two issues alone may find the court agreeing with the DOJ's assertions.

However, other assertions made by the government aren't as solid. While it is true the DOJ tends not to prosecute simple CFAA violations without a connection to other criminal activity, when it does choose to do so, it tends to respond with zealous, fear-based prosecution and incredibly severe sentence recommendations.

That the DOJ has magnanimously offered to not enforce the CFAA against the researchers at this point is heartening, as far as that promise goes. The DOJ may have no intention of doing so now, but if the researchers roll up on the wrong website and set some influential wheels to squeaking, that could change.

The DOJ is on less solid ground when it argues the CFAA does not create a chilling effect. It may be that the research effort (deploying bots to simulate job seekers, home buyers, etc.) is not a form of protected speech, but that doesn't mean speech -- and research efforts -- aren't being deterred by the badly-written and vaguely-interpreted law.

The government doesn't contend, however, that the results of the research won't be protected under the First Amendment -- just that the method of gathering the data isn't.

Here, plaintiffs allege that the challenged provision of the CFAA has chilled their desire to deploy software technology designed to gather information from the websites of private corporations without the permission of those corporations and in a manner that the relevant website terms of use expressly prohibit. The systemic collection of information from the websites of non-consenting private entities is not conduct the First Amendment protects, and thus plaintiffs are unable to assert a reasonable First Amendment chill with respect to that conduct.

[...]

Thus, just as there is no First Amendment right to gather information by personally travelling to a sanctioned country, and no First Amendment right to gather information by visiting a jail without the permission of the warden, and no First Amendment right to access information in electronic form rather than paper form, there is likewise no First Amendment right to gather information controlled by private entities by deploying a data-scraping computer program on the websites of those entities without their permission and in a manner that the entities explicitly prohibit.

And there's the chicken-egg problem with the First Amendment, which follows after the other chicken-egg dilemma of having to wait to be prosecuted (or threatened with prosecution) before being granted standing to challenge the government's enforcement efforts. To use the DOJ's cited equivalents, delivering the news is protected under the First Amendment. Gathering it, however, may not be.

What the DOJ doesn't spend any time explaining is why researchers might get the idea the government would come after them for performing this research. The DOJ has explicitly stated in the past that violating a website's terms of use violates the CFAA, making criminals of millions of pre-teens with Facebook or Twitter accounts. And the DOJ's own suggested rewriting of the CFAA looks to turn previous misdemeanors into felonies, including the sort of activity the researchers are proposing.

...knowingly and willfully traffics... in any password or similar information, or any other means of access, knowing or having reason to know that a protected computer would be accessed or damaged without authorization in a manner prohibited by this section…

The rewrite removes a key phrase: "with intent to defraud." This excision turns the researchers' plan to search for bias in websites into an admission of felonious intent.

That being said, there's a good chance this lawsuit will be tossed quickly. The route to CFAA reform still flows (slowly and sometimes, stupidly) through Congress. Unfortunately, the stakeholders with the loudest voices are those who prosecute under the law, rather than those punished by it. Because of that barrier to true reform, efforts to attack the law from oblique angles are likely to appear periodically until the law is overhauled… or replaced with something worse.

Filed Under: cfaa, chilling effects, doj, first amendment, hacking, research
Companies: aclu

EFF, ACLU Asks Ninth Circuit Court To Rehear Two Recent CFAA Cases

from the let's-not-criminalize-even-MORE-common-activity dept

The EFF and ACLU are pushing the Ninth Circuit Court of Appeals to hold full en banc rehearings (with all 11 judges, rather than just three) of two recent CFAA-related cases. The first case, US v. Nosal, is the more (in)famous of the two. In this decision, the court read the language of the CFAA broadly enough to criminalize a mostly-harmless everyday activity participated in by thousands of Americans: password sharing.

The court tried to couple this with some "authorization" wording to make it appear as though the court wouldn't entertain frivolous prosecutions using interpretation of the CFAA, but that gives the court (and the DOJ) far more credit than they have earned.

The other case -- Facebook v. Power Ventures -- is dangerous in its own way, even if it involves two private companies, rather than the US government's prosecutorial arm. The same appeals court didn't go quite as far as it did in the Nosal decision in terms of criminalizing password sharing, but instead made the district's stance even more confusing by arriving at a seemingly-contradictory conclusion.

The Ninth Circuit found that Power Ventures violated the CFAA when it accessed Facebook’s data after receiving the cease and desist letter, on the ground that the letter gave the company notice that Facebook had revoked its authorization to access users’ Facebook accounts. The court acknowledged that Facebook users could give Power Ventures valid authorization to access their accounts without running into a CFAA violation—the step back from Nosal II’s blanket criminalization of password sharing. That was true even though Facebook’s terms of service expressly prohibit password sharing or letting anyone else use your account.

"Seemingly" is the key word. The conclusion reached by the three-judge panel finds no bright line for determining authorized access, instead opting for a reading that leaves it all up to the party moving forward with a lawsuit/prosecution. Here's Mike attempting to make some sense of the ruling:

At what point is access revoked? Does it require a full cease and desist letter? Or what if I add a drop-down telling visitors from certain IP addresses they're not welcome? What if I just type here that visitors from the state of New York are no longer allowed to visit Techdirt? If they continue to do so, is that a potential CFAA violation in the making? The same court has already ruled that a mere terms of service violation is not a CFAA violation but where's the line between a terms of service violation and a cease-and-desist letter? Or me just telling you to stop visiting my website? It seems wide open to abuse.

At best, the decisions -- when taken together -- are an incoherent mess. At worst, they're vehicles for bogus lawsuits and prosecutions, taking the CFAA even further away from its original intent: to punish malicious hackers/criminals who break into accounts, servers, etc. So, rather than activity simply being a violation of corporate policies and Terms of Service, it's now also a potential violation of federal law. The Ninth Circuit Appeals Court has, in two decisions, created a hefty, new CFAA book to be thrown at violators, who now might see themselves facing federal prosecution, rather than a writeup in their personnel file or a suspended account.

If nothing else, a full en banc hearing would at least hopefully generate a coherent, more-unified stance from the Appeals Court. The two decisions are not polar opposites, but there is some friction. The downside, of course, is that the full panel will create an even worse interpretation of the CFAA. But, even if so, at least those residing in the Ninth Circuit will know where they stand when it comes to "authorized" access, password sharing, etc.

[Nosal petition PDF] [Power Ventures petition PDF]

Filed Under: 9th circuit, authorized access, cfaa, hacking
Companies: aclu, eff

Disappointing: LinkedIn Abusing CFAA & DMCA To Sue Scraping Bots

from the please-don't-do-this dept

It's been really unfortunate to see various internet companies that absolutely should know better, look to abuse the CFAA to attack people using tools to scrape public information off of their websites. In the past few years, we've seen Facebook and Craigslist do this (with Facebook recently winning in court).

Now LinkedIn is doing the same thing, suing a bunch of anonymous users for scraping public information from LinkedIn. This is not the first time the company has done this. A few years ago, the company (using the exact same lawyers) filed a very similar lawsuit, eventually figuring out that the scraping was done by a wannabe competitor, HiringSolved, which pretty quickly settled the lawsuit, agreeing to pay $40,000 and erase all the data it collected.

The latest lawsuit appears to be more of the same, claiming that the scraping violates both the CFAA and the DMCA:

During periods of time since December 2015, and to this day, unknown persons and/or entities employing various automated software programs (often referred to as “bots”) have extracted and copied data from many LinkedIn pages. To access this information on LinkedIn’s site, the Doe Defendants circumvented several technical barriers employed by LinkedIn that prevent mass automated scraping, and have knowingly and intentionally violated various access and use restrictions in LinkedIn’s User Agreement, which they agreed to abide by in registering LinkedIn member accounts. In so doing, they have violated an array of federal and state laws, including the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030, et seq. (the “CFAA”), California Penal Code §§ 502 et seq., and the Digital Millennium Copyright Act, 17 U.S.C. §§ 1201 et seq. (the “DMCA”), and have engaged in unlawful acts of breach of contract, misappropriation, and trespass.

This is bullshit. Courts have directly held that violating a terms of service does not equate to a CFAA violation for "unauthorized access" or "exceeding authorized access." Here, it appears that LinkedIn is hoping that the combination of claiming a terms of service violation with attempts to get around technological protection measures makes it a CFAA violation.

I completely understand that LinkedIn may not like the fact that people are scraping its data, and that they've found ways around LinkedIn's attempts to block such scraping via technological means, but it's a dangerous slippery slope when a company is claiming that a terms of service violation violated the CFAA -- and that getting around simple blocks becomes a DMCA 1201 anti-circumvention violation. Both of these are problematic: saying that violating the terms of service violates the CFAA is a stretch and saying that violating the DMCA by getting around protection technology -- even if not for the purpose of infringing on copyrights -- is a problem.

Of course, this lawsuit, like the last one, is probably really designed to just sniff out who's running the bots, and to push them into a settlement where they'll stop doing so.

Still, this lawsuit seems particularly ridiculous coming just weeks after LinkedIn's founder and chairman, Reid Hoffman, funded a $250,000 disobedience award at MIT's Media Lab. The point of that award is to encourage people to engage in disobedience to change society in a positive way -- which is something that people often use scraping for. And yet, here his company is engaging in a legal battle that will make that kind of scraping much more risky. I know and like Hoffman, who is quite a smart, thoughtful and principled guy. And I have no idea if he even knew this lawsuit was going to be filed. But I think it sends the wrong message when he's encouraging useful hacking on the one hand, while his company (which, yes, was just sold to Microsoft) is suing people for doing the very same thing of hacking on the other hand.

Filed Under: bots, cfaa, dmca, scraping
Companies: linkedin

State Supreme Court Rolls Back Decision That Would Have Made Violating Company Computer Policies A Crime

from the penalties-range-from-'written-reprimand'-to-'years-in-prison' dept

The Oregon Supreme Court has handed down a ruling that should help prevent the state's computer crime laws from turning into a local level CFAA -- something that can be easily abused by prosecutors to, say, toss someone in jail for two years for 40 minutes of headline altering at a news website.

Caryn Nascimento was arrested for theft after using a convenience store's lottery machine to print off thousands of dollars of tickets she never paid for. But rather than settle for the theft charges, the state chose to charge her with unauthorized use under Oregon's broadly-interpreted computer crimes statute.

The state appeals court upheld the conviction, prompting the EFF to intervene in her case when it headed to the state supreme court. The EFF pointed out that the appeals court decision would criminalize a lot of behavior normally only subject to companies' internal disciplinary processes.

[T]he Court of Appeals’ decision transforms millions of unsuspecting individuals into criminals on the basis of innocuous, everyday behavior—such as checking personal email or playing solitaire on a work computer. Such restrictions, frequently included in employers’ computer policies, are no different than the restriction imposed on Nascimento. They're ultimately all computer use, not access, restrictions. Upholding Nascimento’s conviction on the basis of a violation of a computer use restriction expands Oregon’s computer crime statute to criminalize violations of any computer use restriction.

The Supreme Court has found that, contrary to the lower court's decision, Nascimento did not exceed her authorization when she printed out lottery tickets she never paid for. She did steal, but she was fully authorized to perform every step up to the point of not paying for the tickets.

It is difficult to square the state’s position with the text of ORS 164.377(4). The text establishes a binary division between those who are "authorized" to access or use a computer and those who are not. The text does not distinguish between use that is authorized for certain purposes (such as those permitted by employer policies) and use that otherwise would be authorized but that is inconsistent with those policies. Indeed, subsection (4) of the statute does not focus on the purpose or manner of use at all, but only on whether the access or use is "authorized."

[...]

Viewed in that light, the text supports defendant’s assertion that her use of the lottery terminal to print Keno tickets—as she was trained and permitted by her employer to do—was "authorized" use. The fact that she printed the tickets for her own use and did not pay for them may have violated company policies and other parts of the computer crime statute (in addition to the theft statute), but her use was not "without authorization" as that term is used in ORS 164.377(4).

Nascimento was not allowed to print out tickets for herself or do so without paying, but those were violations of company policy, not state law. The theft of funds -- via the unpaid-for lottery tickets -- was a criminal act, but the acquisition of the tickets via a machine she was authorized to use was not.

The court points out [PDF] that reading the state statute in the way prosecutors (and the lower court) interpreted it means adding words that aren't there to the existing law.

As noted, “access” is defined in the computer crime statute as “retriev[ing] data” or “mak[ing] use of any resource on a computer.” ORS 164.377(1)(a). If a person is “empowered” or “permitted”—the dictionary synonyms of “authorized”—by the appropriate authority to “retrieve data” or “make use” of the computer, then that use is “authorized.” Applying those words in their ordinary senses, it is a stretch to suggest that an employee who uses her work computer to send a private email during the work day— or check Facebook or buy a movie ticket—contrary to her employer’s policy against personal use, has “accessed” or “used” the computer “without authorization,” although she may have violated her employer’s policy. Nothing in the text of the statute suggests that the legislature intended such a result. As defendant argues, the state’s interpretation would criminalize not only “unauthorized” use of a computer, but also “authorized use for an impermissible purpose.” Such an interpretation would require adding words to the text of the statute that the legislature did not use. See ORS 174.010 (court may not add words to statute).

It's a good decision that rolls back the lower court's unfortunate expansion of a law already prone to abusive interpretation. This should keep people from being saddled with extra charges just because their criminal activities were committed on a computer.

Filed Under: caryn nascimento, cfaa, hacking, lottery tickets, oregon

Pokemon Company Threatens Pokemon Go API Creator With CFAA Lawsuit

from the because-of-course dept

Is there no goodwill that the Pokemon Company's lawyers won't step in and kill off? With the popularity of Pokemon Go, some third parties had started trying to develop some services to go with it, and as part of that, a few have tried to create Pokemon Go APIs. A user going by the name Mila432 had created an unofficial Pokemon Go API in Python, and posted it to GitHub. If you go now, you may notice that the Readme now reads:

see you in court nianticlabs, with love from russia xoxo

That's because the Pokemon Company (not the game developer Niantic, but rather the Nintendo subsidiary that owns a piece of Niantic along with all the Pokemon rights) sent Mila432 a legal nastygram claiming that the creation of the API could violate the Computer Fraud and Abuse Act (CFAA). Mila432 posted screenshots to Reddit. We have all the screenshots posted at the end of this post. The letter first claims that creating this API is a violation of Pokemon's Terms of Use as well as Pokemon Go's Terms of Service. But, more importantly (and ridiculously) it claims a violation of the CFAA -- a law we've discussed many times before, mainly for it being the one law "that sticks" when no law was actually broken, but you've done something people dislike "with a computer." Here's what Pokemon's lawyers have to say:

Additionally, your actions with respect to the Mila 432/Pokemon_Go_API potentially violate the federal Computer Fraud and Abuse Act ("CFAA"), a statute that prohibits the unauthorized access of servers and access which exceeds authorization, as well as similar state statutes. And your inducement of others to violate numerous terms of service provisions violates the CFAA. While notice is not a prerequisite to liability, Pokemon hereby puts you on notice that you are barred from accessing Pokemon servers or infrastructure, and barred from facilitating access by others. Any continued access, whether directly or at your direction or on your behalf, will be unauthorized.

See that language right there, about putting Mila432 "on notice" and saying that s/he is barred? That's straight out of the very recent Facebook v. Power.com decision in California, where the court ruled that once a company (in that case, Facebook) had sent a cease-and-desist notice, any further access was a CFAA violation. We were troubled by that ruling, and the use of it here further illustrates how problematic it was.

Now, yes, you can argue that unauthorized APIs can cause problems for games -- and that's true. Of course, it can also help make them more compelling by allowing others to build on the game and add more value. But, wherever you come down on that debate, going legal seems pretty silly. Niantic, for its part, had simply gone the technology route of limiting access to third-party servers, to deal with some quality of service problems created by such third parties accessing its system. That is, rather than totally freak out about such APIs, it noted the actual problem (overloaded machines) and sought to fix it through technology.

It's just the Pokemon company that took it up a few unnecessary notches to pull out a big gun like the CFAA. But, I guess, how can I be surprised? This is the same company that legally fucked over a party by Pokemon fans at PAX last year, suing the people who organized it.

Filed Under: api, cfaa, pokemon, pokemon go, terms of service, threats
Companies: niantic, nintendo, pokemon company

Colorado Republican Committee Tries To Use CFAA To Get Even With A Bogus Tweeter, Fails Completely

from the the-law-even-little-people-can-(attempt-to)-abuse dept

How do we know the CFAA is a terrible law? Because even "civilians" abuse it. Or at least try to.

Back in April, the Colorado Republican Committee's (CRC) Twitter account tweeted out something a bit concerning after Ted Cruz nailed down all 34 delegates at a committee assembly in Colorado Springs.

If you can't see the tweet, it says:

We did it. #NeverTrump

The tweet was taken down minutes later and the official Twitter account explained that someone with "unauthorized access" had posted the tweet and it was not a reflection of the Colorado GOP's official stance.

This led to a brief internet wildfire, where CRC reps were interviewed by reporters about the tweet and enraged Trump supporters [also: 4chan] -- believing the fix was in -- began posting threatening messages to and about Colorado GOP leaders. So far, so internet.

The CRC took this a step further though, attempting to sue the "Doe" with allegedly "unauthorized access" for breaching the "threat to public health or safety" clause of the CFAA. The original complaint [PDF] shows the CRC is perhaps far better at electioneering than investigating.

Over the next three weeks, the CRC conducted an investigation into the origin of the tweet. CRC was able to confirm that the fraudulent tweet was sent using the Twitter for iPhone app, but was not able to determine the identity of the responsible individual.

Um. (Source.)

Armed with info that anyone else could have obtained in seconds rather than weeks, the CRC decided it could mass email the perp into turning themselves in:

On April 19, 2016, the CRC sent an e-mail to all individuals who had at one point been authorized to access to the @cologop account asking that they identify themselves by 5:00pm on Wednesday, April 20, 2016 if they were responsible for the fraudulent tweet.

Unsurprisingly, this failed to uncover the perpetrator. It also made it clear that, until this point, the keepers of the official Twitter account never considered that telling formerly authorized users not to use the account is way less effective than actually revoking their access by changing the password.

The court was unimpressed with the original complaint and ordered the plaintiffs to show cause or GTFO. The amended complaint [PDF] contains much more detail, including the supposed expenses incurred as a result of the short-lived tweet. Apparently, everyone involved in the "investigation" spent "hours" determining that someone used an iPhone to send the tweet.

CRC’s internal staff spent hours communicating with its past and present thirdparty vendors to ascertain if any of their personnel accessed CRC’s Twitter account.

CRC’s internal staff also spent hours communicating to Twitter over the phone and through emails.

CRC’s officers and staff spent time responding to the press over the tweet.

Some of those hours were billable, so to speak.

At least 70 percent of Kohli’s time for the week following the assembly and convention and at least 25 percent of the following week was spent responding to the aftermath of the tweet, including making numerous phone calls and emails about CRC’s progress in identifying the anonymous tweeter, determining who had access to the @cologop Twitter account, and answering media requests. This resulted in a loss to CRC of at least 70 percent of his time for one week and 25 percent of him time for another week. Since his annual salary is $65,000, this loss totals at least $1,187.50.

Internet molehill having been sufficiently mountained, the amended complaint goes on to detail the threats received by CRC officials before trying to claim these threats were somehow induced by a tweet that, itself, was not threatening in any form.

Defendant’s conduct in sending the fraudulent tweet caused damage to CRC in the form of death threats to its officers and employees, closure of its offices, and harm to its reputation.

The threats received by the CRC, its officials, and personnel constituted a threat to public health or safety within the meaning of 18 U.S.C. § 1030(c)(4)(a)(i)(IV).

And there's the CFAA tie-in.

Even with certain deficiencies addressed, the CRC still can't assemble a claim that the court can move forward with. The judge has dismissed the complaint in its entirety, pointing out that just because certain things happened after another thing happened doesn't mean the first thing that happened (the bogus tweet/"unauthorized access") is directly responsible for statements made by a bunch of other internet denizens. (h/t Raul)

CRC argues that its Amended Complaint cures the defects addressed in the Court's Order to Show Cause, specifically: (i) it identifies time spent by its staff investigating the unauthorized access as the "loss" that it suffered under 18 U.S.C. § 1030(e)(11), (g); and (ii) that the "threat to public health or safety" required by 18 U.S.C. § 1030(c)(4)(A)(i) and (g) is satisfied by allegations that it was reasonably foreseeable that the publication of the unauthorized message would induce third parties to respond with threats of harm to CRC officers. Although the Court accepts the first proposition, it finds the second to be deficient as a matter of law.

In the Order to Show Cause, the Court previously addressed why 18 U.S.C. § 1030(g)'s "involves" language requires a plaintiff to allege that the unauthorized computer access itself poses a risk to public health or safety, and that the requirement is not satisfied by an allegation that the unauthorized access indirectly caused such a risk to emerge from another source. CRC's response cites to various cases that have used the term "caused" in discussing other provisions of the Act.

The Court finds these cases to be off-point and unpersuasive.

Fortunately, the court takes the CFAA's public health and safety clause and presents a narrow reading of it -- somewhat of a rarity in CFAA-related cases.

As discussed previously, the threat requirement might be met if the unauthorized access disables computers or deletes data essential to providing medical treatment, public utilities, or emergency response services, but not where the unauthorized access has a benign primary effect but induces others to harmful acts. For example, a user who hacks into the social media account of a classmate and encourages him or her to commit suicide might be liable for engaging in conduct posing a risk to health and safety, but a user who hacks into the same classmate's account and merely taunts the classmate for being unattractive cannot be said to have engaged in conduct threatening public health and safety even if the now-despondent classmate reacts to the taunting by committing suicide. Such example entails the user specifically employing the unauthorized access to bring about the risk to public health, and in such circumstances, the use of a predominantly criminal statute to afford civil relief might be proper. The latter example draws upon the complex, wide-ranging, and sometimes attenuated principles of tort causation, importing that sprawling and imprecise inquiry into a statute that was clearly intended to have a narrow, focused reach.

While the fallout of the bogus tweet may have been inconvenient and surrounded by threats from irate GOP members (oh, and 4chan...), the tweet itself was not threatening nor did it call for threats to be made. That one led to the other is undeniable, but it was in no way definitely foreseeable that the tweet would have this effect.

The CRC's complaint is, at best, an expensive windmill tilt, tossed into court solely for the purpose of exposing the "unauthorized" tweeter to angry CRC officials. It has nothing to do with CFAA violations -- which were apparently added to make a federal case out of the CRC's failure to address its own operational security issues until it was too late.

Filed Under: cfaa, cfaa abuse, colorado, gop, tweets
Companies: twitter