It does sound like a crime to me too. But was it a password or other credential that was guessed, or was it just some sequential primary key? The latter is not an authorization system, and I do not believe it a crime to do that unless you have specific knowledge that it is likely to cause damage and/or the intent to cause that damage.

As far as I am concerned, I am allowed to send any traffic I wish to public-facing hosts, and if they respond with content that the owners would not wish me to see, I have no responsibility to refrain. The only traffic I am not permitted to send are credentials I am not authorized to use (this would include password guessing, because if I manage to guess correctly, I was still not permitted to use it).

So which was it?

▲

ecb_penguin 14 hours ago | parent | next [-]

You are not allowed unauthorized access regardless of how the key works.

> I am allowed to send any traffic I wish to public-facing hosts

No you're not. Denial of service is a federal crime.

> I have no responsibility to refrain

Yes you do, and this is just beyond silly. The nuance of how you obtained it will be decided in a court. Stop making everything so reductionist and lazy.

> The only traffic I am not permitted to send are credentials I am not authorized to use

Absolutely not. Use of a vulnerability to cause a data breach is OBVIOUSLY a federal crime.

This is beyond absurd.

▲

NoMoreNicksLeft 11 hours ago | parent [-]

> You are not allowed unauthorized access regardless of how the key works.

You and I seem to both speak/write English, but there is a language barrier. For me, "authorization" means that they have given me credentials, and any content locked down under those credentials is off-limits.

For you, "authorization" is a magical term that has no real meaning. It means that they want me to have the content. But I am no telepath, and I do not know what they want me to have or do not want me to have. The only way, from my point of view, to know what they want me to have or not is to try to retrieve the content without credentials, and if it succeeds, it's legal.

Of course, there are a few corner cases. What if I discover some software defect that very clearly shows they intended to require credentials, and a test without credentials shows that it is indeed off-limits, but exploiting the defect produces that content? I wouldn't do that, that'd be illegal.

But your way of (non-)thinking is alien to me, and no reasonable judge or legislator could possibly mean what you claim that law states. Or at least what you seem to claim.

>No you're not. Denial of service is a federal crime.

Only with intent. If I send reasonable content that shouldn't be DoS, how was I to know? I intend no crime.

>Yes you do, and this is just beyond silly.

You're the one being silly. You can't even decide what you mean by "authorized".

>The nuance of how you obtained it will be decided in a court.

I'm never going to trial, I'm not even going to be noticed.

>Use of a vulnerability to cause

Use of a clear defect. The biggest and most dangerous vulnerabilities are the apathy and stupidity of their employees, their lack of a sane business model and attainable vision, and so on. Using those is just common sense. There is a popular magazine that is subscription only. But they have the pdf download links hidden with display: none CSS. These links require no authorization. Just knowledge. I retrieve those quite punctually.

▲

tptacek 11 hours ago | parent [-]

You're both veering out of CFAA jurisprudence in different ways. But you know you're in trouble when you start saying things like "I am no telepath", because in fact a big part of an ambiguous CFAA case will be determining what a reasonable person (ie: the jury) would think confronted with the computer system under discussion. There will in fact be mind reading involved; your intent would in fact be tried.

There's nothing at all CFAA-specific about this; this is really basic US criminal law and it comes up in all sorts of different criminal justice contexts. The terms you're both dancing around are mens rea and actus reus.

▲

NoMoreNicksLeft 5 hours ago | parent [-]

>But you know you're in trouble when you start saying things like "I am no telepath",

I'm not in trouble. There is virtually zero chance of this ever being noticed by law enforcement, and even less chance than that of them giving a shit.

Also note, I am not arguing what the worst possible interpretation might falsely convict someone of, but how the law should be viewed, or, if someone can demonstrate to my satisfaction that the law disagreed with, then how it should be altered.

If I have to guess what retards (read: juries) might think is reasonable, then there can be no public internet. We're just a few years after journalists were arrested for looking at html source with "view source", aren't we?

>The terms you're both dancing around are mens rea

I'm only mildly ignorant. Has CFAA ever been considered to describe strict liability crimes?

	▲	tptacek 4 hours ago \| parent [-]
		You're in trouble rhetorically, is what I mean, because your argument is completely alien to criminal law.

▲

efdee 14 hours ago | parent | prev [-]

Maybe as far as you are concerned, but not as far as the law is concerned ;-)

	▲	NoMoreNicksLeft 14 hours ago \| parent [-]
		Well, I guess it's a good thing for me that they're unable to notice or care and in general incompetent. I am still permitted to do this. None of the details of this case give me the impression that they're using CFAA in such a way as to offend my sensibilities. Sounds like he sabotaged a former employer and caused hundreds of thousands in (tort not physical) damages. I guessed the urls for some issuu.com links that aren't available in search, and downloaded the page images to make a pdf. I was never prompted for a password. Arrest me, I'm a notorious hacker.