3

I originally looked at this for web scraping, but upon reading it more, it seems like it could be interpreted to include all types of common mistakes.

Does this even include something like a customer who entered his/her personal credentials issued by representatives of the service just for him into the wrong URL on the website as an attempt to "intentionally access without authorization/exceed" even though he thought that was the correct URL, like with different pages of demo and live accounts?

Can someone claim that the user intentionally tried to login regardless of good faith thinking it was the right place + right auth vs user clicks on a random button that lied and actually tried to log him in without authorization instead? Does the law anywhere says something like common day activities like this don't count? This law just seems really vague/broad in that it include a lot of reasonable mistakes.

Improve this question
4
  • "...user clicks on a random button that lied and actually tried to log him in without authorization instead." What?
    – BlueDogRanch
    Commented Dec 9, 2019 at 4:23
  • @BlueDogRanch its a hypothetical but not that realistic example lol. Like maybe some guys computer got infested with a virus that makes him try to crash another computer by authenticating over and over or something.
    – clarity_not_ambiguity
    Commented Dec 9, 2019 at 4:27
  • 2
    @BlueDogRanch Login form is bugged and instead of sending the request to correcturl.example.com/clients-login sends it to wrongurl.example.com/privileged-login. Relatively reasonable is the code is spaghetti code where the URL is decided by a condition and the condition is wrong in certain edge cases.
    – Giacomo Alzetta
    Commented Dec 9, 2019 at 12:27
  • Redirects due to malware is really a different question; and in such cases, there should be evidence of the malware to show lack of intent.
    – BlueDogRanch
    Commented Dec 9, 2019 at 17:14

1 Answer 1

Reset to default
6

A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals.

"Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no intent to commit a crime. Someone confused by "different pages of demo and live accounts" can easily defend their actions by pointing out that they were confused.

It's up to the reasonableness of the pertinent law enforcement and prosecutors to take into account the evidence that reasonable mistakes were made by little old ladies and not charge them with a crime. And for the most part, 98% of the time, law enforcement and prosecutors are reasonable.

Improve this answer
7
  • I think that would be the result in most cases too. If the law said "intentionally accessed the computer without authorization while knowing he does not have permission granted at this exact zone by the authorities to do so" then it seems complete or clearer, because it sounds like some people can interpret it as simply intentionally accessing simply without authorization so the intent could be anything but as long as u don't have the authorization, then the mistaken login could violate it right? Since the law seems to only state that much in that part, would this be a problem?
    – clarity_not_ambiguity
    Commented Dec 9, 2019 at 6:02
  • 5
    I work in the information security field and I have to say that prosecutors are usually not reasonable when it comes to CFAA enforcement. Getting in legal trouble for good-faith security research is a real risk.
    – forest
    Commented Dec 9, 2019 at 13:17
  • 1
    @forest well, one could argue that good-faith white-hat security research involves accessing systems only with explicit prior authorization by the system's owner; so either work-for-hire for the organization who's systems you're testing; or a copy of someone's software on your own systems in your own lab. Treating unwanted drive-by "security testing" of online systems as a crime isn't unreasonable, CFAA is quite explicit that it's not allowed.
    – Peteris
    Commented Dec 9, 2019 at 14:00
  • 1
    @Peteris I'm not referring to greyhat "hey let's see if I can break this" style testing.
    – forest
    Commented Dec 9, 2019 at 14:02
  • @forest pentesting is not in the OP's question and is a separate topic.
    – BlueDogRanch
    Commented Dec 9, 2019 at 17:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .