3

I originally looked at this for web scraping, but upon reading it more, it seems like it could be interpreted to include all types of common mistakes.

Does this even include something like a customer who entered his/her personal credentials issued by representatives of the service just for him into the wrong URL on the website as an attempt to "intentionally access without authorization/exceed" even though he thought that was the correct URL, like with different pages of demo and live accounts?

Can someone claim that the user intentionally tried to login regardless of good faith thinking it was the right place + right auth vs user clicks on a random button that lied and actually tried to log him in without authorization instead? Does the law anywhere says something like common day activities like this don't count? This law just seems really vague/broad in that it include a lot of reasonable mistakes.

  • "...user clicks on a random button that lied and actually tried to log him in without authorization instead." What? – BlueDogRanch Dec 9 '19 at 4:23
  • @BlueDogRanch its a hypothetical but not that realistic example lol. Like maybe some guys computer got infested with a virus that makes him try to crash another computer by authenticating over and over or something. – clarity_not_ambiguity Dec 9 '19 at 4:27
  • 2
    @BlueDogRanch Login form is bugged and instead of sending the request to correcturl.example.com/clients-login sends it to wrongurl.example.com/privileged-login. Relatively reasonable is the code is spaghetti code where the URL is decided by a condition and the condition is wrong in certain edge cases. – Giacomo Alzetta Dec 9 '19 at 12:27
  • Redirects due to malware is really a different question; and in such cases, there should be evidence of the malware to show lack of intent. – BlueDogRanch Dec 9 '19 at 17:14
6

A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals.

"Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no intent to commit a crime. Someone confused by "different pages of demo and live accounts" can easily defend their actions by pointing out that they were confused.

It's up to the reasonableness of the pertinent law enforcement and prosecutors to take into account the evidence that reasonable mistakes were made by little old ladies and not charge them with a crime. And for the most part, 98% of the time, law enforcement and prosecutors are reasonable.

| improve this answer | |
  • I think that would be the result in most cases too. If the law said "intentionally accessed the computer without authorization while knowing he does not have permission granted at this exact zone by the authorities to do so" then it seems complete or clearer, because it sounds like some people can interpret it as simply intentionally accessing simply without authorization so the intent could be anything but as long as u don't have the authorization, then the mistaken login could violate it right? Since the law seems to only state that much in that part, would this be a problem? – clarity_not_ambiguity Dec 9 '19 at 6:02
  • 4
    I work in the information security field and I have to say that prosecutors are usually not reasonable when it comes to CFAA enforcement. Getting in legal trouble for good-faith security research is a real risk. – forest Dec 9 '19 at 13:17
  • 1
    @forest well, one could argue that good-faith white-hat security research involves accessing systems only with explicit prior authorization by the system's owner; so either work-for-hire for the organization who's systems you're testing; or a copy of someone's software on your own systems in your own lab. Treating unwanted drive-by "security testing" of online systems as a crime isn't unreasonable, CFAA is quite explicit that it's not allowed. – Peteris Dec 9 '19 at 14:00
  • 1
    @Peteris I'm not referring to greyhat "hey let's see if I can break this" style testing. – forest Dec 9 '19 at 14:02
  • @forest pentesting is not in the OP's question and is a separate topic. – BlueDogRanch Dec 9 '19 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.