Could Accessing Your Own Data On Facebook Make You Criminally Liable?

from the hopefully-a-court-says-otherwise dept

We've been following the rather bizarre and dangerous lawsuit filed by Facebook against Power.com, an online service that tries to let users aggregate various social networking activity into a single service. All Power.com does is let a willing user have Power.com's tools log into Facebook and reuse/reformat the data within its own framework. From a user's perspective, this could be quite useful. From Facebook's perspective this is both a violation of copyright law and a violation of computer hacking laws. Why? Because Facebook says so. That is, it says so in its terms of service, and it's arguing that in ignoring the terms of service, Power.com is criminally hacking.

The EFF has filed a new amici brief in the case pointing out the logical problems with this argument. It's saying that if a user chooses to access his or her own data that is stored in Facebook, using a tool of his or her own choice... that can open themselves up to criminal liability, just because it violates some random term in Facebook's terms of service. That clearly seems to go way beyond the purpose of anti-computer hacking laws:

This is not an esoteric business issue, because the legal theories Facebook is pushing forward would make it a crime not to comply with terms of service. People have already faced criminal charges for violating a site's terms of use policy. For example, in United States v. Lori Drew, a woman was charged with violating the federal computer crime law for creating a false profile that was used to communicate inappropriately with a teenager who eventually committed suicide. EFF filed an amicus brief in that case arguing that terms of service do not define criminal behavior, and the charges were eventually dismissed. We also defended Boston College computer science student Riccardo Calixte, whose computers, cellphone and iPod were seized by local police who claimed that he violated criminal law by giving a fake name on his Yahoo account profile. A justice of the Massachusetts Supreme Judicial Court ordered police to return the property after finding there was no probable cause to search the room in the first place.

Using criminal law to enforce private website operators' terms of use puts immense coercive power behind measures that may be contrary to the interests of consumers and the public. EFF believes that users have the right to choose how they access their own data, and that services like Power's give users more options. So long as the add-on service does not access off-limits information and is not harmful to server functionality, authorized users who choose add-on technologies like Power's commit no crime. Frighteningly, under Facebook's theory, millions of Californians who disregard or don't read terms of service on the websites they visit would risk criminal liability.

Filed Under: hacking, terms of service
Companies: facebook, power.com

If You're A Terrorist, You're Not Allowed To Use iTunes

from the that'll-show-them dept

Michael Scott points us to someone who was reading carefully through the iTunes terms of service, and noticed that it appears to say that you can't use the program if you're recognized as a terrorist by the US government. The specific clause reads:

You may not use or otherwise export or re-export the Licensed Application except as authorized by United States law and the laws of the jurisdiction in which the Licensed Application was obtained. In particular, but without limitation, the Licensed Application may not be exported or re-exported (a) into any U.S. embargoed countries or (b) to anyone on the U.S. Treasury Department's list of Specially Designated Nationals or the U.S. Department of Commerce Denied Person's List or Entity List. By using the Licensed Application, you represent and warrant that you are not located in any such country or on any such list. You also agree that you will not use these products for any purposes prohibited by United States law, including, without limitation, the development, design, manufacture or production of nuclear, missiles, or chemical or biological weapons.

And, as Nate Oman notes:

Notice, as I read this clause not only are terrorists -- or at least those on terrorist watch lists -- prohibited from using iTunes to manufacture WMD, they are also prohibited from even downloading and using iTunes. So all the Al-Qaeda operatives holed up in the Northwest Frontier Provinces of Pakistan, dodging drone attacks while listening to Britney Spears songs downloaded with iTunes are in violation of the terms and conditions, even if they paid for the music!

That'll show 'em...

Now wouldn't that be a great lawsuit? Seeing Apple take those on the US terrorist list to court for breaking their iTunes terms of service?

Filed Under: itunes, terms of service, terrorists

Yes, MySpace Is Allowed To Delete MySpace Page That Tries To Show Fake And Real MySpace Celebs

from the nice-try dept

Last year, we wrote about a case brought by a woman named Julie Riggs against MySpace. The complaint itself is somewhat of an amusing read ("At this point Plaintiff was literally seething with anger to the point that she was now consumed by it"). The main issue was that Riggs had created a website that tried to determine which celebrity profiles on MySpace were real and which were fake. She was upset (among other things) because (1) there were fake profiles on MySpace (2) MySpace later did something similar itself and (3) MySpace deleted her profile. After we wrote about the case, we received an angry email from Ms. Riggs telling us we "missed the point" and that MySpace "stole" her idea -- and that we needed to get our story straight. She never explains how coming up with the same idea is illegal, of course. Also, my favorite: "What can you expect from site such as yours though." Indeed.

Unfortunately, it appears that the district court also "missed the point" and did not get the story straight, because as Eric Goldman points out, it has dismissed the lawsuit. However, in this case, it may actually be true that the court missed the point. As Goldman notes in his discussion of the ruling, the court seems a bit confused about how Section 230 of the CDA works, and may have dismissed parts of the case for rather confused reasons. Riggs has appealed, so hopefully the Appeals Court fixes the problems (but still dismisses it). However, again as Goldman notes, this is taking place in the notoriously nutty Ninth Circuit, which often has a problem with reading Section 230 the way everyone else reads Section 230. Hopefully, they get this one right.

Filed Under: deleting, julie riggs, terms of service
Companies: myspace

Under 18? Using Google? You May Be A Criminal!

from the whoops dept

It's no secret that people ignore the terms of service on most sites, and there are pretty big questions concerning how enforceable any such terms really are. However, Petrea Mitchell, alerts us to an odd note at the very end of some notes on a conference session where Chris Soghoian points out that Google's terms of service forbid use by those under 18. I did some looking and Soghoian actually wrote out the details about this a few months ago. Basically, Google's terms of service state:

You may not use the Services and may not accept the Terms if (a) you are not of legal age to form a binding contract with Google

But, as Soghoian notes, in all 50 states in the US, that legal age is 18 -- meaning that those under 18 may be breaking Google's terms of service. And, of course, as we learned in the Lori Drew case, violating the terms of service of a website (even if you haven't read them or done anything to agree with them!) can be grounds for making you criminally liable for "accessing a computer without authorization." That seems like a problem, doesn't it?

Now, to be fair, the chances of anyone bothering to care or enforce this is slim to none. But we saw what happened in the Lori Drew case, where prosecutors with nothing else to sue against Drew twisted the law to find her guilty of something. You could certainly see that happening in some other case as well. If prosecutors can't find anything else on a teenager who did "something" people don't like, why not charge him with "hacking" for violating Google's terms of service?

Filed Under: terms of service
Companies: google

Can Scraping Non-Infringing Content Become Copyright Infringement... Because Of How Scrapers Work?

from the this-seems-troubling dept

Earlier this year, we couldn't figure out how Facebook's lawsuit against Power.com made any sense. Power.com tried to aggregate various social networking accounts in a single place, so you could manage them all at once through a single interface. Yet Facebook charged the company with all sorts of complaints, including copyright and trademark infringement, unlawful competition and violation of the computer fraud and abuse act. Power.com asked for the case to be dismissed, but last month the judge sided with Facebook, but did so in a troubling way, by basically suggesting that since Facebook's terms of service prohibited these uses, it made it copyright infringement. Michael Scott points us to lawyer Jeff Neuberger's take on the ruling, and separately Tom O'Toole has a good analysis of the ruling. Neuberger states the following:

Judge Fogel concluded that the allegations of the complaint made out a sufficient claim of copyright infringement because Power Ventures "need only access and copy one page to commit copyright infringement." The court also found that the ToU prohibited downloading, scraping or distributing content from the Facebook Web site content except that belonging to the user, and that in any event, using automated methods, i.e., "data mining, robots, scraping, or similar data gathering or extraction methods" to access any content were also prohibited by the ToU. Thus, the court found that the allegation that Power Ventures accessed Facebook via automated means constituted made out a claim of direct copyright infringement, while the allegation that Facebook users utilized the Power.com interface to access their own profile pages made out claim of secondary copyright infringement.

Thus, because the terms of service said you can't do any automated scraping of the site, it's suddenly infringing? Even worse, the court found that even though the data being used by Power.com isn't owned by Facebook (it's the users') the scraping was still copyright infringement, because in order to scrape the non-infringing content, Power.com had to first "scrape" the whole page. O'Toole explains:

OK, so far the court has found that Power.com made unauthorized copies of the Facebook Web site. What about the fact that Facebook does not own the copyright in its users' profile data? Facebook surmounted this hurdle by arguing that the content of the Facebook page that surrounded the user's data is copyrightable and is owned by Facebook. According to Facebook, the Power.com scraper operated in a manner that required it to copy the entire Web page in order to extract the user's profile data....

Note that the court is conditioning its ruling on the assertion that the Power Ventures scraper necessarily copied the entire Web page before it processed the page and extracted the profile data. That comports with my (limited) understanding of how a Web scraper works. But is it true? If it were true, couldn't an argument be made that this is a fair use of the page? I'll leave that for better lawyers.

All of this seems a bit troubling, as it would effectively rule out scraping even non-infringing content, just because the scraper had to first read through copyrighted content to get to the non-infringing stuff. But, that seems to go against the entire purpose of copyright law. The fact that the scraper reads copyrighted content shouldn't mean that it's infringement. It's not doing anything with that content other than using it to find the content it can make use of. Anyway, this ruling probably doesn't mean all that much, since it was just to reject the dismissal request, but it does seem odd that the judge gave so much weight to Facebook's terms of service, and seems to indicate the mere act of scraping can be copyright infringement.

Filed Under: copyright, infringement, scraping, terms of service, trademark
Companies: facebook, power

Sears Settles With FTC For Putting Spyware On Customers' Computers

from the customers-aren't-lawyers dept

You may recall a couple years back, a controversy over the fact that Sears appeared to be installing spyware on the computers of online customers who had agreed to join a "community." Sears insisted this wasn't true, and that it really was software to help create a community of shoppers -- but the evidence suggested otherwise. The FTC eventually got involved, and now Sears has settled the charges that it was unfairly spying on users without clearly indicating this to users. Sears insisted that because the fine print of the terms of service for joining the community said that it would track your online browsing, it was in the clear, but the FTC noted, accurately, that most users would not have gotten that impression from signing up. As Thomas O'Toole notes about this ruling:

I'm pretty sure that attorneys would understand the breadth of the consent covered by the phrase "online browsing." It means everything. The position taken by the FTC signals the agency's belief that consumers should not be treated like lawyers when it comes to privacy-related disclosures. The FTC also appeared to be concerned about the fact that the disclosure was buried in a lengthy privacy statement, which was displayed to the consumer rather late in the consent-collecting process.

This is a good thing. Customers shouldn't need to be lawyers to understand what it is they're agreeing to, and it's nice to see the FTC recognize that fact.

Filed Under: community, lawyers, spyware, terms of service
Companies: sears

EFF Tracking Changes To Major Company Terms Of Service

from the watch-what-you-change... dept

The EFF has launched a neat little project, called TOSback, where it tracks any changes to online service agreements from a bunch of different well known companies, such as Google, Yahoo, Microsoft, Facebook and eBay. Considering that some of these companies have been known to quietly change their terms without making the details all that public, it seems like this could be quite a useful service -- at least in getting these companies to recognize that they should clearly explain why they're changing their terms and what those changes really mean.

Filed Under: terms of service, tracking
Companies: eff

Disputing A Bogus Charge Is A Violation Of Terms Of Service?

from the how-does-that-work? dept

Consumerist has the story of how a guy who's account on some pay porn site got hacked, with $450 charged to his account. When he threatened to have his credit card company dispute the charge, the site warned him that doing so was a "serious violation of our terms of service." They also refused to return the money (though they said he could get credit at the site). Of course, he still had his credit card company dispute the charges and got his money back. Still, it takes quite an amazing sense of entitlement to (a) claim that you're not giving a guy whose account was hacked his money back and then (b) threaten him with a TOS violation for disputing the charge.

Filed Under: disputing a charge, terms of service

Should Police Be Arrested For Illegal Hacking For Setting Up Fake Facebook Profile?

from the we-should-be-fair,-right? dept

In the Lori Drew case, she was convicted for "computer hacking" because she violated MySpace's terms of service by setting up a profile of a fake person. And for this, she deserves years in jail? Well, if that's the case, reader Roni Evron wants to know if some police officers are going to face the same charges after they set up a fake Facebook profile in order to bust up an after-prom high school party. Apparently, they set up a fake Facebook profile and friended a bunch of the kids at school, who apparently were "cavalier about accepting people into their network of friends." That, of course, is fine... but it's basically the same thing that Drew was arrested and convicted of doing.

Filed Under: hacking, lori drew, terms of service

Court Rejects Online Terms Of Service That Reserve The Right To Change At Any Time

from the wow dept

If you look at many online terms of service, they reserve the right to change the terms at any time. Some force you to re-agree to the terms -- but others don't. In the past, courts have ruled that if someone didn't agree to the changed terms, the new terms could be found to be unenforceable, but a recent decision has gone much further, effectively saying that the entire terms of service are void if they claim they can be changed at any time. Sent in by Blake, the ruling said that Blockbuster's online terms of service were "illusory" and unenforceable because it included a clause saying it could change the terms at any time. So, even though the term it was trying to enforce was in the terms that the person agreed to, the court found the entire terms unenforceable. This is quite a ruling that could have a pretty major impact on any online service that has terms that insist they can change at any time. While it's just a district court ruling and may be reversed on appeal, it's something anyone running an online service should pay attention to.

Filed Under: changed terms, illusory, terms of service, unenforceable
Companies: blockbuster