dslreports logo
Search similar:


uniqs
1332

Cartel
Premium Member
join:2006-09-13
Chilliwack, BC
kudos:2
·TekSavvy DSL
·TELUS
·Shaw

Cartel

Premium Member

Court rules that IP cloaking is a crime

Disguising an IP address or using a proxy server to visit Web sites you've been banished from is a violation of the Computer Fraud and Abuse Act, a federal judge has ruled.

U.S. District Court Judge Charles R. Breyer for the Northern District of California issued the ruling Friday in a copyright infringement lawsuit between Craigslist and data harvester 3Taps. The legal dispute began in July 2012 when Craigslist sent a cease-and-desist letter to apartment listing app PadMapper, claiming it was violating the site's terms of service by scraping apartment rental information from the online classifieds site.

»ixquick-proxy.com/do/pro ··· 024ecb1d

"What'a you in for?", said Bubba.

"Using a proxy..." said lil' Timmy.

John Galt
Forward, March
Premium Member
join:2004-09-30
Happy Camp
kudos:8

John Galt

Premium Member

I'm sure they get right to that as soon as they get the robocall thing controlled...

Link Logger
MVM
join:2001-03-29
Calgary, AB
kudos:3

Link Logger to Cartel

MVM

to Cartel
Interesting question, is a web site considered public or private, if its private then this is a logical outcome as it equates to trespassing. How do you think this ruling should have gone and why?

Blake

Nanaki
aka novaflare. pull punches? Na
Premium Member
join:2002-01-24
Akron, OH

Nanaki

Premium Member

said by Link Logger:

Interesting question, is a web site considered public or private, if its private then this is a logical outcome as it equates to trespassing. How do you think this ruling should have gone and why?

Blake

Ohhh tuff question. Probably along the lines of a businesses that states we reserve the right to refuse service to any one at any time for any reason. Or in the case of a disruptive customer who refuses to leave and has the cops called on them. Such a person is trespassing at that point in time. Once asked to leave the customer (in this case web site user) must leave. It should be interesting for sure. Wont have much teeth at first and will need to be tried in court to get those teeth. I for one am dang happy.

I get sick of people in irc trying to spam flood cuss you out then try and pull the freedom of speech nonsense when you ban them and they break in with a proxy.

Snowy
Premium Member
join:2003-04-05
Kailua, HI
kudos:6
·Hawaiian Telcom
·Clearwire Wireless
·Time Warner Cable

Snowy to Link Logger

Premium Member

to Link Logger
said by Link Logger:

How do you think this ruling should have gone and why?

First, keep in mind that this is a civil ruling.
Second, I agree with the outcome - a website should have a right to prohibit scraping for re-posting elsewhere.

But, I completely disagree with the ruling itself though.
Personally, the benchmark I use to determine if a resource over ports 21, 80, 443, 8080 etc... are off limits or fair game is
"Is it password protected"
If it is, it's off limits.
That's an easy, simple enough rule to understand.

From the court:
"Craigslist blocked the Internet Protocol addresses associated with 3Taps, but the data harvester continued to scrape data off Craigslist by concealing its identity with different IP addresses and proxy servers. Craigslist argued that the 3Taps' subterfuge violated the CFAA, which prohibits the intentional access of a computer without authorization that results in the capture of information from a protected computer."

BF mine, but that's where the court missed the boat.
How is Craigslist a protected computer?
For sure there are directories that are password protected but the court ruling that the entire server is protected is misguided.
Now if Craigslist's public directories were password protected with the password being the letter "a" & that password being public knowledge, I would tend to agree with the ruling (that Craigslist is a protected computer).

It gives Craigslist the benefit of a protection that isn't in place.
Looks like Craigslist can have it's cake & eat it too.

Link Logger
MVM
join:2001-03-29
Calgary, AB
kudos:3
·TELUS

Link Logger to Nanaki

MVM

to Nanaki
Given the internet isn't really 'public' (ie its not like a public park) the concept of private services etc have validity and as such refusal of service or access is legit. In some way this case could have been executed as copyright violations as well (ie screens scraped copyrighted information), so there are lots of options available.

Blake

jeisenberg
New Year's Eve
join:2001-07-06
Windsor, ON
·Cogeco Cable

jeisenberg to Snowy

Member

to Snowy
said by Snowy:

said by Link Logger:

How do you think this ruling should have gone and why?

First, keep in mind that this is a civil ruling.
Second, I agree with the outcome - a website should have a right to prohibit scraping for re-posting elsewhere.

But, I completely disagree with the ruling itself though.
Personally, the benchmark I use to determine if a resource over ports 21, 80, 443, 8080 etc... are off limits or fair game is
"Is it password protected"
If it is, it's off limits.
That's an easy, simple enough rule to understand.

From the court:
"Craigslist blocked the Internet Protocol addresses associated with 3Taps, but the data harvester continued to scrape data off Craigslist by concealing its identity with different IP addresses and proxy servers. Craigslist argued that the 3Taps' subterfuge violated the CFAA, which prohibits the intentional access of a computer without authorization that results in the capture of information from a protected computer."

BF mine, but that's where the court missed the boat.
How is Craigslist a protected computer?
For sure there are directories that are password protected but the court ruling that the entire server is protected is misguided.
Now if Craigslist's public directories were password protected with the password being the letter "a" & that password being public knowledge, I would tend to agree with the ruling (that Craigslist is a protected computer).

It gives Craigslist the benefit of a protection that isn't in place.
Looks like Craigslist can have it's cake & eat it too.

I think the ruling was correct, including the conclusion that the computer was protected. I liken this to rulings regarding circumvention of copyright (DMCA violations). Craigslist indicated that areas were protected by virtue of blocking access by IP address ranges. 3Taps circumvented that measure (like those that circumvent DMCA) by deploying a masking strategy. 3Tap would have discovered they were blocked prior to using the proxy, therefore consciously trying to "break into" a protected area.

Blackbird
Built for Speed
Premium Member
join:2005-01-14
Fort Wayne, IN
kudos:4
·Frontier Communi..

Blackbird to Cartel

Premium Member

to Cartel
The way I see it, a business's servers, whether owned or leased, are akin to its storefronts (whether owned or leased). The information therein is its property until sold, insofar as it has cost the business time and resources in order to assemble the information and make it available as a product array for its customers. Just as the business has the right to control access to its store against tangible item rip-offs, it has the right to protect and control access to its servers against data rip-offs. How it protects its servers is simply up to the business, whether via passwords or via IP blocking or whatever else.

siljaline
I'm lovin' that double wide
Premium Member
join:2002-10-12
Montreal, QC
kudos:18
·Bell Fibe Internet

siljaline to Cartel

Premium Member

to Cartel
Changing IP address to access public website ruled violation of US law.
• »arstechnica.com/tech-pol ··· -us-law/

Court Rules Accessing a Public Website Isn't A Crime, But Hiding Your IP Address Could Be.
• »www.eff.org/deeplinks/20 ··· could-be

ashrc4
Premium Member
join:2009-02-06
australia

ashrc4 to Cartel

Premium Member

to Cartel
What's the negative off shoot from setting a precident such as this based on a Physical IP.
Is it that websites need to be able know some form of identity related to a individual IP in order suffice there handle in this?

Reboots router theoretical)

Snowy
Premium Member
join:2003-04-05
Kailua, HI
kudos:6
·Hawaiian Telcom
·Clearwire Wireless
·Time Warner Cable

Snowy to jeisenberg

Premium Member

to jeisenberg
said by jeisenberg:

Craigslist indicated that areas were protected by virtue of blocking access by IP address ranges.

You're right.
I didn't see blocking certain IP's conferring a protected status.
When I think of 'protected computer' I see challenge screens, login credentials etc...
but a small note on the door saying "Do Not Enter" should carry the same weight as a locked dead bolt in a legal setting.

ashrc4
Premium Member
join:2009-02-06
australia

ashrc4

Premium Member

Can we still use Starbucks wifi?
Not sure how they are going to maintain an even keel on this.
Wouldn't it be better to find/create law on trying to be deceitful?
Rojo31
join:2009-04-14
New York, NY
kudos:1

Rojo31 to Cartel

Member

to Cartel
Why do I get the feeling that this will eventually expand to banning proxies altogether?
dave
MVM
join:2000-05-04
not in ohio
kudos:10

dave

MVM

You'd have a hard time making proxies illegal, since quite a lot of outbound malware detection and/or URL access restrictions ('can't access smut.org from Xyx Corp's network') are implemented as proxies.

And how do you distinguish 'hiding your IP address' from 'using NAT'?

nwrickert
Mod
join:2004-09-04
Geneva, IL
kudos:7
·AT&T U-Verse

nwrickert to Cartel

Mod

to Cartel
Back when I was on standard DSL with PPPoE, powering off the modem for a few minutes would get me a different IP.

Perhaps the judge's ruling implies that a power outage is a violation of the Computer Fraud and Abuse Act

Anon1
@verizon.net

Anon1 to Link Logger

Anon

to Link Logger
said by Link Logger:

Interesting question, is a web site considered public or private, if its private then this is a logical outcome as it equates to trespassing. How do you think this ruling should have gone and why?

Blake

I don't think anyone is complaining about the outcome of the case. The defendant was being an asshole. It's no different when first amendment rights are denied at a supermarket.

I don't think there's any question that the law of torts (trespass) can apply. But why do they have to apply the CFAA, thus expanding its scope and this a criminal action. Criminal trespass usually needed additional elements (e.g. violence) to make it a crime.
TheWiseGuy
Dog And Butterfly
MVM
join:2002-07-04
East Stroudsburg, PA
kudos:3

TheWiseGuy to nwrickert

MVM

to nwrickert
Well the judge did not rule it a crime, the judge simply refused to dismiss the cause of action. Also if you read the ruling you would see it was very specific to the case and depended on the fact that there was a cease and desist letter forbidding access to the site and they deliberately changed their IPs to avoid the IP ban.

The case really is about does a company have the right to ban someone from their site, not about the use of a proxy or changing IPs.
said by decision :

3Taps asks this Court to hold that an owner of a publicly accessible website has no power to revoke the authorization of a specific user to access that website. However compelling 3Taps’ policy arguments, this Court cannot graft an exception on to the statute with no basis in the law’s language or this circuit’s interpretive precedent.

said by decision :

3Taps says that Craigslist had no power to “de-authorize” anyone, but it cannot point to any language in the statute supporting that conclusion.

said by decision :

To be sure, later cases may confront difficult questions concerning the precise contours of an effective “revocation” of authorization to access a generally public website. This Court cannot and does not wade into that thicket, except to say that under the facts here, which include the use of a technological barrier to ban all access, 3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization” under the CFAA.


Anon1
@verizon.net

Anon1

Anon

said by TheWiseGuy:

Well the judge did not rule it a crime, the judge simply refused to dismiss the cause of action. Also if you read the ruling you would see it was very specific to the case and depended on the fact that there was a cease and desist letter forbidding access to the site and they deliberately changed their IPs to avoid the IP ban.

The case really is about does a company have the right to ban someone from their site, not about the use of a proxy or changing IPs.

said by decision :

3Taps asks this Court to hold that an owner of a publicly accessible website has no power to revoke the authorization of a specific user to access that website. However compelling 3Taps’ policy arguments, this Court cannot graft an exception on to the statute with no basis in the law’s language or this circuit’s interpretive precedent.

said by decision :

3Taps says that Craigslist had no power to “de-authorize” anyone, but it cannot point to any language in the statute supporting that conclusion.

said by decision :

To be sure, later cases may confront difficult questions concerning the precise contours of an effective “revocation” of authorization to access a generally public website. This Court cannot and does not wade into that thicket, except to say that under the facts here, which include the use of a technological barrier to ban all access, 3Taps’ deliberate decision to bypass that barrier and continue accessing the website constituted access “without authorization” under the CFAA.

Just read the case. Unfortunately there's a lot of problems with it. The judge did not explain what a technological block was. He also didn't rule it a crime because this was a civil case, not that the statute wouldn't apply criminally should a prosecutor pursue the case, that's why the rule of leniency was allowed to apply in this case.

Anyways in theory the case could be seen like this. There's a man on the corner and he's giving out information. He doesn't like your face (IP block), so he says get out of here (C&D letter). So you ask someone else to get the information for you and convey it to you (proxy). Is there a crime of trespass or even civil trespass here?

Craigslist should have gotten a restraining order.

siljaline
I'm lovin' that double wide
Premium Member
join:2002-10-12
Montreal, QC
kudos:18

siljaline to Cartel

Premium Member

to Cartel
Facebook makes a Federal Case when you attempt to access your account from an IP they don't see.

jeisenberg
New Year's Eve
join:2001-07-06
Windsor, ON
·Cogeco Cable

jeisenberg to Anon1

Member

to Anon1
said by Anon1 :

Anyways in theory the case could be seen like this. There's a man on the corner and he's giving out information. He doesn't like your face (IP block), so he says get out of here (C&D letter). So you ask someone else to get the information for you and convey it to you (proxy). Is there a crime of trespass or even civil trespass here?

The way you frame the analogy, it sounds like the ruling is too broad. But I believe your analogy is flawed. A more apt analogy is that someone drives to your establishment and is banned. The security staff are supplied with the license number of the car to ensure it doesn't get through again. To avoid this, the person chooses to visit again, using a different car.
TheWiseGuy
Dog And Butterfly
MVM
join:2002-07-04
East Stroudsburg, PA
kudos:3

TheWiseGuy to Snowy

MVM

to Snowy
said by Snowy:

the court:
"Craigslist blocked the Internet Protocol addresses associated with 3Taps, but the data harvester continued to scrape data off Craigslist by concealing its identity with different IP addresses and proxy servers. Craigslist argued that the 3Taps' subterfuge violated the CFAA, which prohibits the intentional access of a computer without authorization that results in the capture of information from a protected computer."

BF mine, but that's where the court missed the boat.
How is Craigslist a protected computer?

The term protected is not referring to protected in a security sense. It refers to a computer that is protected by the CFAA statute, which at this point seems to be almost any computer.

Anon1
@verizon.net

Anon1 to jeisenberg

Anon

to jeisenberg
Well there's some theoretical legal debates as to whether this should be analogized to real property law or about speech and communication.

I am starting to think it should be about communication. There's no physical lines of property in a 3D sense on the internet, therefore the law of trespass doesn't quite make sense.

I also still think a proxy is basically hiring someone else to communicate information back to you, and it's not YOU yourself directly communicating with a server. Therefore it's not the same as you using a different car, going to another's place. The packet that you send over to the proxy isn't likely the same type of packet that comes out of the proxy to connect with the server.

Whether you can still be sued under agency law, well that all depends.

Lagz
Premium Member
join:2000-09-03
The Rock

1 edit

Lagz to Cartel

Premium Member

to Cartel
Suppose some one posts a link on facebook. You click this link thinking its something else, but inadvertently just clicked threw to a site you have been banned from. How would that play out and what are your thoughts?

edit: Scenario, say someone always browses on a free proxy, cause they want to remain and browse anonymously. They link to a site, but use the proxies link and post it on facebook. Just so we are all on the same page. My thought process can be strange to decipher some times(even for me).

jeisenberg
New Year's Eve
join:2001-07-06
Windsor, ON
·Cogeco Cable

jeisenberg to Anon1

Member

to Anon1
In business (where the word "proxy" originated), a proxy is someone who you appoint to represent your interests when you cannot be there in person. A proxy is given specific instructions and is not acting as an independent entity. It is only in the electronic age that "proxy" has taken on a new meaning - tending to be an anonymizing agent. Trying to remain anonymous to circumvent a ruling banning you from entry (physical or communicative) is still an overt act, done in response to an acknowledgement that you have been banned.
dave
MVM
join:2000-05-04
not in ohio
kudos:10

dave to Anon1

MVM

to Anon1
said by Anon1 :

Anyways in theory the case could be seen like this.

Only if you like imperfect analogy.

Rather, the guy on the corner does not like your face, so you show up the next day wearing a mask.

But arguing by analogy is rarely useful.

Anon1
@verizon.net

Anon1 to jeisenberg

Anon

to jeisenberg
said by jeisenberg:

In business (where the word "proxy" originated), a proxy is someone who you appoint to represent your interests when you cannot be there in person. A proxy is given specific instructions and is not acting as an independent entity. It is only in the electronic age that "proxy" has taken on a new meaning - tending to be an anonymizing agent. Trying to remain anonymous to circumvent a ruling banning you from entry (physical or communicative) is still an overt act, done in response to an acknowledgement that you have been banned.

Problem is that there was no ruling that was being circumvented, which non-lawyers don't seem to understand. A C&D letter is not the same as a restraining order issued by the court. A C&D letter is simply issued by the plaintiff's lawyer. If there was a ruling that was being circumvented, then the defendant would have been guilty of contempt, which is a far greater crime than what happened. That's why I said earlier that craigslist needed a restraining order issued by the court.

Whether he would be guilty under agency law, by using a proxy? Besides the fact that there was no ruling, I'm not entirely sure if we aren't using real property trespass law analogies.

I'm not saying the court had the wrong result, because I don't think what the defendant was doing was right. Only the method on how they got to the result was wrong. There are a whole bunch of other ways to get the same result without expanding the CFAA. Simply ruling by using copyright laws would have caused the defendant to cease all action.

The judge needs to define what a "technological block" is. I personally don't think a tech. block that is so easily circumventable is considered hacking under the CFAA. Is using a CDN cached page now considered hacking too? Is using google's cache searches considered circumventing?
Anon1

Anon1 to Lagz

Anon

to Lagz
said by Lagz:

Suppose some one posts a link on facebook. You click this link thinking its something else, but inadvertently just clicked threw to a site you have been banned from. How would that play out and what are your thoughts?

Hmm... this is SHOULDN'T have been a worry. The CFAA usually requires at least a mens rea of recklessness or higher. Clicking on a strange link inadvertently shouldn't be considered a reckless in the court of law.

HOWEVER. You do have a point. If we are analogizing to trespass and real property law. So long as you intended to be somewhere, that's enough to be considered trespassing. So it's not whether you intended to commit the crime of trespass, but whether you intended to be on a particular area of land. There are people who have been caught trespassing by accidentally crossing over to someone's land and hunting on it. They didn't INTEND TO TRESPASS, but they intended to go on that piece of land. So... if the judge is serious about this trespass analogy, I suppose we should now be worried of this possibility.
TheWiseGuy
Dog And Butterfly
MVM
join:2002-07-04
East Stroudsburg, PA
kudos:3

TheWiseGuy to Lagz

MVM

to Lagz
said by Lagz:

Suppose some one posts a link on facebook. You click this link thinking its something else, but inadvertently just clicked threw to a site you have been banned from. How would that play out and what are your thoughts?

edit: Scenario, say someone always browses on a free proxy, cause they want to remain and browse anonymously. They link to a site, but use the proxies link and post it on facebook. Just so we are all on the same page. My thought process can be strange to decipher some times(even for me).

The statute »www.law.cornell.edu/usco ··· /18/1030 that the judges ruling is based upon, deals with knowing or intentional access of a computer. Web sites are stored as data on a computer, they do not exist in thin air. The judge made it clear that the ruling was based on the specific facts in this case, the defendant company was notified they were not authorized and an IP block was deliberately circumvented. So this case would not be a precedent if you "accidentally" went to an unauthorized site using a proxy. Of course that might change if you continued to access the site once you realized you were accessing a site you were not authorized to access.

Lagz
Premium Member
join:2000-09-03
The Rock

Lagz

Premium Member

The problem though is this. The ruling sets a precedent. The term "comb the books" is common knowledge because that's what prosecutors do. Prosecutors will use this ruling in ways it wasn't intended. Kind of like wiretapping laws and video recording police.