Violating Terms of Use Isn’t a Crime, EFF Tells Court—Again

The recent ruling by the 9Th CAP states that a user is not legally (criminally(civil maybe?)) bound by the ToS of a website operator. Does that make a public endpoint that doesn't require authorization (or maybe even one that does) open for use as a user sees fit?

This ruling seems especially potent given the fact that Rimini Street was using the public endpoint to get data that allowed them to offer a product that competed directly with Oracle.


It may be useful to consult the opinion in this civil suit. The relevant portion is the state computer law claims, starting p. 22, which in the Nevada and California versions involves a law making unauthorized access a crime. These laws also provide a cause of action in case of damage caused by illegal access (that is, you can sue the person who broke into your system). On that basis (as well as copyright infringement, where the plaintiff prevailed), Oracle sued the defendant.

As the court noted, the core question is whether Rimini violated those laws by downloading the content (using automated tools in violation of the TOS). Crucially, the TOS allows downloading, it just forbids downloading via a particular method. The court said

We hold that taking data using a method prohibited by the applicable terms of use, when the taking itself generally is permitted, does not violate the CDAFA. Because the same reasoning applies to the NCCL claim, we reverse the judgment as to both claims.

Relying on prior case law (US v. Christensen),

A plain reading of the [CDAFA] demonstrates that its focus is on unauthorized taking or use of information

Rimini did have authorization initially, because Oracle only later imposed the method restriction, and the court ruled that

Because it indisputably had such authorization, at least at the time it took the data in the first instance, Rimini did not violate the state statutes.

EFF overstates what the court found: they found that the downloading was done with permission, and the question of criminal prosecution was not an issue.

| improve this answer | |

No, what it says is that violation of ToS is not criminal and therefore not a matter for the state to prosecute. It is illegal breach of contract which the aggrieved party can litigate privately.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.