0

So I often watch my web server traffic. At least a quarter of the time, it's someone attempting to break in. Either by ssh or by attacking my directories and login panel.

My question is, if I present a EULA to the user PRIOR to them being able to access my login page, that specifically states

"If you load the login page, you agree to all me to access your machine remotely including all of the files on it"

Then I proceed to access it after they attempt to login.

Would this hold up in court or would it still violate the computer fraud and abuse act?

EDIT:

The exact flow of events would be...

  1. Person attempts to navigate to my website login page on a server that I own, control and operate.
  2. Prior to being able to access the login they're forced to accept a EULA
  3. They accept EULA and proceed to the login page
  4. I have a payload that then deploys on their machine which gives me partial control over it
  5. [I go to jail] OR [I don't go to jail]
Improve this question
3
  • Please clarify what law / jurisdiction you are talking about. You mention the Computer Fraud and Abuse Act, which is a law in the USA, but you've used the tag computer-misuse-act, which is a law in the UK.
    – Nate Eldredge
    Aug 10, 2017 at 14:07
  • @NateEldredge sorry about that I didn't read the tag. I assumed it was the law I was looking for. I do mean the Computer Fraud and Abuse Act
    – DotNetRussell
    Aug 10, 2017 at 14:08
  • 1
    Ok, I assigned some other tags. In general, on this site, you should always use a tag giving the jurisdiction, as well as other tags describing the specific area of law relating to your question.
    – Nate Eldredge
    Aug 10, 2017 at 14:10

1 Answer 1

Reset to default
2

Hacking involves accessing someones device without their permission.

So an EULA which permits hacking doesnt really make sense. Since agreeing to such an EULA means its not longer hacking, but giving consensual access to your computer.

So it may seem that the computer fraud and abuse act isnt engaged. (It applies to when there is no permission given)

However such an EULA would likely be found unenforceable in court. This is because it is offerred on a "take it or leave it" basis, and generally the more honerous a clause in an agreement is, the more clear it has to be made to the user. Meaning a court might only ever beleive that users agreed to such an EULA if it was shown clearly to them that it would give the site a right to download a payload onto their computer. And they would need to explicitly accept this. A single click on an accept button probably wouldn't be enough.

So that would mean most likely the EULA doesnt turn the hacking into a consensual act, ans so the Computer Fraud and Abuse Act would indeed be engaged. And the site would be in deep trouble

Improve this answer
1
  • Okay so I'm the only person ever ever allowed to log in. So I don't care if it's explicitly stated in giant bold letters and the button says download and accept lol. It by itself might be a deterrent. That's good to know. Thanks
    – DotNetRussell
    Aug 10, 2017 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .