0

I have a download page with many files. If a user clicks on the download button of a file, then a window with user agreements shows, and you can only download the file by pressing the I agree button, then I send the word allowed to the server so that it knows the user accepted the agreements. Then the server initiates the download, otherwise I send notAllowed and nothing will happen (simplified).

However, It is easy for users to bypass this agreement window and just send allowed to the server without even seeing the user agreement window. (for more technical details click here)

Questions:

Is this considered as a cyber crime if they do it intentionally?

Are they automatically accepting the user agreements if they initiate the download this way?

  • 1
    No, they are explicitly not accepting any agreement at all, since they have not done so and actively avoided doing so. Yes, it is a crime; breaches of copyright and of accessing (parts of) a system without permission are the obvious. – Nij Dec 19 '16 at 8:23
  • 2
    @Nij it is not a breach of copyright. – davidgo Dec 22 '16 at 19:17
  • 2
    Taking data, media, or software without permission? Copyright breach. – Nij Dec 22 '16 at 21:20
5

Your question has two distinct aspects which have to be considered separately: criminal law and civil law. I will give an opinion on both aspects, but first I have to give you a word of warning:

This case is not clear in the sense that the law can be immediately apply. For a full answer you need the services of a practicing lawyer who does the necessary research. I have a degree in German Law and I have had some practice in IT law, so I know what I am talking about, but I am currently not practicing it and I have done no research for this case. So please, pretty please, don't base any important decision on my opinion. It is a mere guidance, not more.

Criminal Law

The German Criminal Code (StGB) specifies two cyber crimes explicitly:

  1. Computer Fraud (Computerbetrug, § 263a StGB), which you violate when you gain some illegal monetary advantage using a computer, for example a hacker using your stolen credit card data to transfer funds to his account.
  2. Computer Sabotage (Computersabotage, § 303b StGB), which applies when you cause damage with a computer, for example a hacker attacking the power grid.

The second option clearly does not apply here, but the first one could. That would depend on the answer to a couple of questions, most importantly if a user would gain some monetary advantage at your expense and if that advantage would be illegal.

The first of these questions (advantage at your expense) already does not have a clear and universal answer. As it is quite common with fraud, this criminal law question has a civil law aspect (more on that on part two of the answer). The two ways how this could create an advantage to an attacker world be...

  1. A contract would not be enacted between you and the attacker, but he would take advantage of you believing in the contract's validity. This option would though probably not apply here, judging from the (spoiler alert) civil law part of the question.
  2. A valid contract would be created, but the terms and conditions would not apply and that would cause an illegal financial advantage for the attacker at your cost. Since the base contract would still be in effect and that comes with the obligation to pay, that advantage would have to be in the terms and conditions not applying. You can construct such a case, but that would depend on the terms in question, so there can not be an answer here. There is though a good chance that the terms would still apply (see below), so there will probably be no damage.

The other aspect is if this advantage would be through illegal use of the system, which is an interesting question in your case, since the link is publicly accessible. But, then again you can also fake a POST, so you can argue that it is always possible to make the terms not appear.

An aspect to be considered though, is that merely attempting computer fraud is already an offense. An attacker who thinks he can gain a monetary advantage from such an attack could be still punished, even if it is not even possible to commit the crime due to the circumstances (this by itself is an interesting question in criminal law).

The bigger danger that I see is that your solution makes it easy for an attacker to make their own site and then use your public link to book on your site (in a man in the middle attack). That would clearly be an offense, but it would be the attacker's not your client's. But since your success depends on the trustworthiness of your site, I would recommend to look for a safer solution (such as POST with https).

To summarize that part: There is a possibility that accessing the site in the described way is a crime, but I would say it is rather not due to the lack of damage. It is though possible that an attacker still commits a crime by attempting such an attack. You should in any case make your site safer to make it harder to commit MITM attacks.

Civil Law

The civil law side is whether the terms can be accepted in the described way. This is a case for the law of general terms and conditions (Allgemeine Geschäftsbedingungen or AGB). In a few words, for AGB to apply, the have to be notified to the client and he has to accept them. If your site is used how it is supposed to be, both conditions are met.

In the (invalid) way you have described, the first condition is in question. Since the user knows that using the described URL means accepting the terms, I would consider the second condition to be satisfied. So how can the terms apply if the user has not seen them?

In case you provide no shortcut to the accepted link and you also prevent that it can be found in another way (e.g. through a search engine), the direct link would be equivalent to someone signing terms and conditions without reading them, although he has had a chance to do so. That would still make the terms apply, because the client would have been given the chance to read them, which is the only thing the seller needs to do. So chances are that your terms would still apply (thus negating the financial advantage necessary for a crime).

However, AGB law is a complex subject that is generally handled by specialists. Any opinion of someone who is not such a specialist has to be handled with care. That includes my opinion.

  • I made it harder by presuppose a token from the client. He only get this token from the server when clicking the "I accept the user agreements" Button. Then a token is generated on the server, saved in the session and sent to the client, the client can now only download if the token matches the token on the server. Attackers could still get the token though if they call the correct URL which requests the token... but I don't know how I can make it better. The only way would be to require them to login before downloading. – Black Jun 13 '17 at 10:57
2

I can download a file from your website, which means I can create a copy of that file. I can do this by clicking the download button. The way your website is designed, it seems clear that I have your permission to create that copy if I click the download button.

I also assume that the way your website is designed, it is clear that I don't have your permission to create that copy if I don't click the download button. The fact that I found a way to create the copy without clicking first doesn't mean I now have your permission. So download without click would be copyright infringement.

There is obviously no contract between us because I never agreed to one. But there is no contract needed; the plain fact is that I created a copy of your work without permission (and in a way that I cannot argue with a straight face I was made to believe I had permission). The matter is most likely not criminal at this point; it could become criminal if I duplicated the file and sold copies, for example, even if clicking on the button would have given me permission to do just that.

If you had one button "Download" and one button "Accept Terms and Conditions" and the "Download" button just works, then I would argue strongly that you intentionally allowed people to download with or without accepting the terms and conditions. But if you had a button "Accept Terms and Conditions" which goes to a download page, and as a software developer or power user I can figure out how to go to the download page without pressing the button, then I would be downloading without permission therefore copyright infringement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.