Is any attempt to access restricted information on the web considered an attack?

Question

This article reports that a person who "gained access to the admin portal by simply altering the website’s URL" is now under investigation by FBI for "exploiting personal information".

I want to understand where exactly an interaction with the site stops being usage and becomes exploiting. I understand that simply entering a reasonable URL I expect to have access to (such as example.com/auth?name=user) is legal, while intentionally trying to get access to someone else's account (such as example.com/auth?name=admin&id={stolen auth token} is not. I also assume that making a honest mistake (such as making a typo in my username or using a name I have on a different site) cannot be held against me, even if that results in accessing someone else's account unintentionally.

Is having the intention to access restricted information all that matters? E.g. is simply typing someone else's username in a login page together with an empty password enough to be considered an attack? If not, then there is the line?

Answer 1

“Attack” is not a legal term

Neither is “use” or “exploit”. When someone is charged with a crime, the state makes very specific which crime(s) the accused has committed and, from that flow the elements that the state must prove beyond reasonable doubt.

Arkansas no doubt has laws about this but since it’s being “investigated by the FBI” the suspicion is that a Federal crime was committed. Of course, “under investigation” just means that someone told the FBI about it, whether the FBI does anything is up to them. As the TV show Yes, Minister put it “under consideration” means we’ve lost the file, “under active consideration” means we’re looking for it.

The most relevant Federal law is the Computer Fraud and Abuse Act (CFAA) under which there are a number of crimes but the most applicable is:

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—

(C) information from any protected computer;

The person in the article:

• intentionally - check
• accessed a computer - check
• without or exceeding authorisation - we’ll get back to this
• obtained information - check
• from a protected computer - check. Any computer with internet access is a “protected computer” under the Act and this includes mobile phones.

So the only question is did the person not have authorisation or exceed the authorisation they had?

It’s clear that they were not explicitly authorised.

Publishing something with a URL and *without any security *on the web is possibly implicit authorisation. For example, you are authorised to access this web page whether you are a signed up member of Stack Exchange (SE) or not.

However, down at the bottom of this page is a Legal link which may create a binding contract between you and SE (see https://law.stackexchange.com/a/13571/344). The CFAA is drafted so broadly that breach of a contract may trigger criminal sanctions (see the sad case of Aaron Schwartz. Criminal sanction for a civil wrong is ... odd ... but not prohibited by the legal system - government has the power to decide what is and isn’t a crime.

As it currently stands the CFAA is a wide-reaching and draconian piece of legislation. There is a line but if you start to think you might be crossing it, you are probably already well over it.