The CFAA is a clusterfuck that has generated splits among the federal appellate courts on what it means.
The Second Circuit, adopting a narrow interpretation of what "exceeds authorized access" means, put it well: https://scholar.google.com/scholar_case?case=117839932121315... ("Where, as here, ordinary tools of legislative construction fail to establish that the Government's position is unambiguously correct, we are required by the rule of lenity to adopt the interpretation that favors the defendant. Santos, 553 U.S. at 514, 128 S.Ct. 2020; United States v. Granderson, 511 U.S. 39, 54, 114 S.Ct. 1259, 127 L.Ed.2d 611 (1994). We do not think it too much to ask that Congress define criminal conduct with precision and clarity.").
Can't give the DOJ a pass here either. Prosecutors should not be pushing the boundaries of creative legal theories; that's for defense lawyers.
If violating a web sites terms of service is a felony, then the government has delegated authority in defining felonies to every web site operator. That is not appropriate.
This goes back to the old problem of identity. If people were identifiable on the internet then web sites could easily blacklist or whitelist users and no rely on ToS for things like this.
I was once called "snobbish" because I used the term " transitive" while discussing a similar issue with non-technical people in the legal field.
If only the legislator understood technology instead of simply using the "everything is a contract" and the "website is like a house people can break into" (failed) analogies.
"And it’s no excuse to say that the vast majority of these cases will never be prosecuted. As the Ninth Circuit explained, “Ubiquitous, seldom-prosecuted crimes invite arbitrary and discriminatory enforcement.” Instead of pursuing only suspects of actual crimes, it opens the door for prosecutors to go after people because the government doesn’t like them."
This should be branded onto anyone that ever defended an overbroad law with 'It'll only be used to go after bad guys!'
This is a huge problem with the U.S. legal system. A lot of common behavior has been criminalized, to the point where most people could probably be pursued for something. There's a general shrug about this, followed by a "I doubt they'd actually go after you for that." But that ends up meaning that authorities can target an individual when they want to, and since this is often followed by throwing a lot of shade about the targeted individual people think it's justified.
Is this a fact about the U.S. legal system, or about legal systems in general? (This isn't a rhetorical question - I'd actually be interested to hear an answer from someone who has knowledge of multiple legal systems.)
> Is this a fact about the U.S. legal system, or about legal systems in general?
I can't speak to other legal systems, but the fact that here in the USA we have a large "private prison industry", coupled with the fact that these prisons often sell their "prisoner work services" (or whatever they call them) to other companies, and they lobby Congress for these new laws, and for more prisons to be built, etc...
Yeah - they kinda have an incentive to make more people break laws - so they continue to get more "employees" (and more "campuses") to be able to sell these services to more companies (who like the access to these cheap services - much cheaper than hiring their own employees, sometimes even cheaper than overseas workers - prisoners are pretty cheap to employee as a group!).
I'm sure that this is a trend, though, that might expand worldwide, if it hasn't already...
A lot of small businesses get caught up in structuring charges. The IRS requires banks to report deposits of greater than $10,000. But it's illegal to break up a large deposit into multiple deposits that are less than $10,000. (IANAL, so I'm not sure if you have to do this with the intent of actually avoiding the reporting requirement.)
For lots of small businesses in cash-heavy markets (e.g., gas stations or convenience stores), it's pretty easy to end up making a series of $8000 deposits and end up being charged with structuring. Regardless of whether you can beat the charge, the cost of having to defend yourself is punishment enough.
Of course, you can argue that this isn't really common --- most people aren't small business owners who happen to be making just under $10,000 every week. But the point is that even though each of these laws ends up targeting a small fraction of people, there are enough of them that everyone ends up violating a few of them at some point.
Off the top of my head... Distracted driving is a crime in many states now (where distracted has been interpreted more or less broadly to include electronic devices or even eating while driving). Having a phone playing Spotify/Pandora/$X into your car stereo can be a punishable offense in MA, OR, WA, NY, etc.
Just because there have not been actual convictions for said offenses does not mean they are not prosecutable. Depending on the state, simply interacting with an electronic device while driving (to change the station for example), can be a punishable offense.
Distracted driving is now the leading cause of traffic accidents, above even speeding and drunk driving. That to me is a strong sign that it ought to be illegal.
Also, traffic infractions usually aren't crimes or misdemeanor in most jurisdictions.
To be fair it probably always has been the leading cause. Especially if you include things like yelling at your kids to stop messing with each other, day dreaming, etc. The issue isn't that it is dangerous, the issue is that it is selectively enforced.
Also, regardless of the level of criminality, driving infractions can be/are selectively enforced. Being pulled over for being distracted can quickly lead to being arrested for some other offense, or for the police to search your car, or even for them to claim you were aggressive and shoot you dead.
License plates aren't exactly common on wood splitters, irrigation trenches, concrete mixers and other towable equipment that's small enough to be a two man lift but they're required. In some states it's a higher end misdemeanor to not have your papers in order when traveling on public roads.
I know that's not something the typical urban/suburban HN visitor deals with on a daily basis but it happens.
It doesn't have to be common or recent as long as a sufficient number of people are caught in the dragnet.
These laws exist to only be used sparingly as needed. They're to be used as a surprise "gotcha" for someone that couldn't otherwise be "gotten" If prosecution under these sort of laws was overused they the laws would be changed.
This happens at the university I go to: wearing shorts is against the rules (being written up enough times for it can get you expelled) but no one cares because it's the students (RAs) that enforce it.
So when people are mad at each other (or someone just likes wielding their power) other people end up hurt. "It's not enforced" is a terrible excuse for bad laws.
> This should be branded into anyone that ever defended an overbroad law with 'It'll only be used to go after bad guys!'
Is it shocking to anyone else that there are so many comments like that on HN recently?
"It'll only be used to go after bad guys!" or "If you don't have nothing to hide then you have nothing to worry about" or "I support free speech BUT ...".
There is a surprising amount of pro-government and anti-free speech sentiment/comments lately.
The point is that one law means that the age restriction is a standard clause in most website's TOS, while another law makes it a felony for minors to access website because of that standard term of service.
The combination of the two laws is what makes it different from violating the TOS due to a clause being inserted at the site owner's own volition.
This comes out of the Lori Drew case. For those unaware, Lori Drew, a grown-ass woman, recruited accomplices into a weaponized catfishing campaign that drove a 13-year-old to suicide.
That's apparently not a crime, or so I gather a federal district court has ruled. I'm not sure I would want one to rule differently - there are subtle and trepidatious ramifications here, and the social norms of online behavior are as yet very ill defined. But this isn't the hill I'd choose to die on.
>In the DOJ’s world, this means anyone under 18 who reads a Hearst newspaper online could hypothetically face jail time
Jail time? What is it with this American propensity for locking up more or less everybody? As seen from the other site of the pond, it does at times sort of beggar belief.
Many prisons in the US are privately operated (Corrections Corporation of America is one of the large companies that run private prisons).
These companies then sell certain services to the public - such as telemarketing (seriously). In other words, that person you're talking to in a telemarketing context may very well be a prisoner in a CCA owned facility!
Now - prisoners aren't forced (?) to participate in these activities, but they are highly encouraged; it gives them a bit of money for the commissary (very small bit) and other things, plus gives them "job skills" for the outside, and probably also a mark on their records for later parole review purposes ("hey, she participated in this, and became a model "employee" as a telemarketer - let's factor that into her record for an early release").
So - there is a strong incentive to participate in these programs. They aren't limited to telemarketing either: If you can think of something which can be done by low-skilled workers who are a "captive audience" so to speak, it is probably sold as a service by these private prison companies to other businesses.
For instance, another big one is "product assembly" (putting furniture together, or electronics, or other similar work).
So - these companies - the private prisons - need more employees, right? You know, to sell their services. These employees are very cheap (and easy to coerce to work - after all, they are also prisoners!): Just pay lowest-bidder for food and housing, then get 'em inside. Best way to do that is to lobby for more restrictive laws, make more things felonies, etc...
Right? Understand? Kinda sounds like a form of indentured servitude, or corporate prison slavery, right? Maybe because it is...?
Because that's how it really is here in the "Land of the Free! (tm)(c)(r)".
Private prisons have 7% state and 18% federal of the total population. Blaming private prisons for the problems of US corrections as a whole is disingenuous.
To the point we had state judges taking bribes from these for profit institutions, handing over our children for nothing [0]. Sick people, perverse incentives, and a systemic problem.
The Second Circuit, adopting a narrow interpretation of what "exceeds authorized access" means, put it well: https://scholar.google.com/scholar_case?case=117839932121315... ("Where, as here, ordinary tools of legislative construction fail to establish that the Government's position is unambiguously correct, we are required by the rule of lenity to adopt the interpretation that favors the defendant. Santos, 553 U.S. at 514, 128 S.Ct. 2020; United States v. Granderson, 511 U.S. 39, 54, 114 S.Ct. 1259, 127 L.Ed.2d 611 (1994). We do not think it too much to ask that Congress define criminal conduct with precision and clarity.").
Can't give the DOJ a pass here either. Prosecutors should not be pushing the boundaries of creative legal theories; that's for defense lawyers.