8

Recently I see some debates about bypassing paywalls by modifying browser's HTTP request as stated on ghack.

Most paywalled websites allow users to read a certain number of free articles before blocking them outside of the paywall. They do it by saving a record in browser's cookies or by checking the request referrer to identify whether the user exceeds his / hers daily reading limit.

There's some browser extensions that clears the browser cookies and modify the request referrer before user send out a HTTP request. By this way they can gain access to unlimited articles since it's harder for websites to identify them.

Are making or spreading these kind of extensions illegal? How about the users that use the extension?

Improve this question
1
  • Even easier: spawn an Incognito (or equivalent) browser. When you reach the cap close it and open up a new one.
    – Giacomo Alzetta
    Commented Jun 13, 2019 at 15:50

3 Answers 3

Reset to default
6

This is relatively uncharted legal territory, so until multiple cases establish some sort of precedent, we can only guess.

I know of no legal requirement that a Browser or User has to submit cookies or referrer data or other meta-information accurately. In that regard, a user is unlikely to be prosecuted just for submitting HTTP headers. It is likely closely related to Free Speech issues.

The DMCA spells out that it is illegal to circumvent copyright protection measures. While this law is typically used to make it illegal to copy DVDs, video-games or streaming movies, it is possible that the "3-free articles" policy could be interpreted as a copyright protection mechanism, and defeating it by changing HTTP headers is a circumvention. A good summary is here.

A specific site's TOS (Terms of Service) probably contains language that spells out it is a violation to use the site in a manner other than as it is intended. This is a typical anti-hacking, anti-screen-scraping provision. Altering a browser session to circumvent their services is probably a violation of the license to access the site, and may open a user to a civil lawsuit for damages or even criminal hacking charges (the details of which are different state-to-state)

Improve this answer
4
  • Agreed that it may be seen as circumventing access-control. However, the link provided only emphasize on circumventing DRM systems. In the paywall case, sometimes it can also be achieved easily through browser's incognito mode. Nice summary though! Seems like more precedents are needed before making a conclusion.
    – Johnson
    Commented Jun 12, 2019 at 16:57
  • 1
    This is not DRM bc it would have to be obstructed or encrypted in some way to be something you could prosecute.
    – Putvi
    Commented Jun 12, 2019 at 16:59
  • 3
    I think this is the crux of the issue: From a technical perspective, the measure is not a suitable protection (it amounts to just asking the client, which is under no obligation to answer in a specific manner), but one could argue that it communicates the publisher's intent. As a technical person, I would interpret such a measure as "advertisement" and skip/ignore or automatically filter it (like OP's browser extensions do), but to a judge or jury who lack the technical expertise, the difference between skipping a trivial annoyance and "hacking" a web server might not be as clear.
    – Ruther Rendommeleigh
    Commented Jun 13, 2019 at 8:32
  • 1
    @Putvi Can you cite some statute or case law which defines DRM in the way which you've done here?
    – Chris Hayes
    Commented Jun 13, 2019 at 19:28
2

In the USA modifying cookies in this way would probably be considered a violation of the Computer Fraud and Abuse Act, which prohibits any "unauthorised" use of a computer. In the past the word "unauthorised" has been construed pretty widely.

The nearest parallel case I'm aware of was United States v. Andrew Auernheimer. Auernheimer had changed a numeric serial number in a URL to gain access to supposedly private data, and was convicted under the CFAA. His conviction was subsequently overturned on venue grounds, but the appeal court did not address the question of "unauthorised" use.

If the writers of the extension are promoting it as a paywall circumvention tool then they would be criminally liable too. However it would be a defence if they could show that the tool had legitimate uses and they were not promoting the illegitimate ones.

Improve this answer
5
  • I don't think that that case is relevant. In the OP case the resource is already available to them and the website is publishing it for everyone to see. So the case for the website owner would be way weaker than in Auernheimer case. Also there is a difference between an URL (which identifies a resource) and a cookie (which is just a string which the browser may or may not decide to send to the server).
    – Giacomo Alzetta
    Commented Jun 13, 2019 at 15:53
  • 1
    @GiacomoAlzetta The prosecution argument would be that the user is only authorised to access a certain number of articles before the paywall kicks in, and that therefore evading the paywall is unauthorised use. I agree that this exact theory has never been tried in court, but I don't see it as any weaker than the Auernheimer case, where the numeric ID was held to be an authentication token rather than a unique cookie.
    – Paul Johnson
    Commented Jun 13, 2019 at 16:00
  • 1
    @PaulJohnson But that case is bullshit. Because for example the website does nothing to enforce this in the case that, say, the user visits it from both their desktop pc and mobile phone. In fact even if the user uses two different browsers they will end up having "unauthorized access". So that's why the case is weak, because there are legitimate use cases where that measure does nothing so they can't really claim any damage. On the other hand manipulating an identifier to search for accidentally exposed resources is a completely different thing.
    – Bakuriu
    Commented Jun 13, 2019 at 18:57
  • Another related case is US. v. Swartz
    – abelenky
    Commented Jun 13, 2019 at 19:30
  • @Bakuriu You could argue that in court. You might win.
    – Paul Johnson
    Commented Jun 16, 2019 at 10:15
-8

It's not really illegal. I know you guys want page long answers, but I mean no one really cares in this instance.

Improve this answer
20
  • 1
    Business running paywalled sites care a great deal if consumers can download their content without paying for it. This is rather like saying that store owners don't care about shoplifters. No, I am not asserting that copyright infringement is theft -- there are significant differences. But in some cases there is a useful analogy. In any case, this answer does not give any reason why "this is not illegal".
    – David Siegel
    Commented Jun 12, 2019 at 16:49
  • It's not illegal bc there are no laws making it illegal. How do you prove the negative lol?
    – Putvi
    Commented Jun 12, 2019 at 16:50
  • 2
    It has been at least alleged to be contributory copyright infringement. There are already laws for that. It may also be circumvention under the DMCA, as another answer says.
    – David Siegel
    Commented Jun 12, 2019 at 17:01
  • 1
    @Putvi How about the anti-circumvention law in 17 U.S.C Sec. 1201(a)(3): "...or otherwise to avoid, bypass, remove, deactivate, or impair a technological measure..."? I'm not quite sure but this seems worth mentioning.
    – Johnson
    Commented Jun 12, 2019 at 17:16
  • 1
    @Johnson I probably will later.
    – Putvi
    Commented Jun 12, 2019 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .