3

Commonly, wireless printers in homes and corporate settings can be configured incorrectly, exposing them to the internet. This can be a major security vulnerability, and can allow anyone to not only print stuff remotely on it, but sometimes even get full access to the network it's connected to.

If somebody happens to find a vulnerable printer online, and no contact information associated with it, would it be legal to print a message on it to let the owners know that it's vulnerable, and possibly even how to fix it?

Edit:

Usually, these printers are configured not to have any sort of password, or anything really, preventing access from anyone on the internet. The printer also has to be manually set up to allow access from the internet, so could that technically be considered permission to access the device?

Improve this question
9
  • 2
    While it would be a lot of work for me to cite chapter and verse to support it, this is probably a crime, although the "victim" might not complain and law enforcement, prosecutors, and judges might be inclined to be lenient under the circumstances given one's good intentions.
    – ohwilleke
    Sep 8, 2022 at 23:16
  • 2
    Ethics are irrelevant to crime, and the CFAA makes it a crime to do anything on a computer that the owner of that computer doesn’t like. This is easily into the bounds of doing serious time in jail
    – jmoreno
    Sep 9, 2022 at 0:16
  • 1
    Seems to me that it would depend on whether you hacked your way in, or casually browsed to the printer on an unsecured WiFi network. (i.e. breaking and entering a locked house with no-trespassing posted, vs walking into a home a realtor is holding an open house for...)
    – Michael Hall
    Sep 9, 2022 at 15:01
  • 2
    @MichaelHall: nope, how easy it is to access is irrelevant. See apple/att and endpoint that returned email addresses, no password, right out there in the open, no restriction at all. Jail: nbcnews.com/technolog/…
    – jmoreno
    Sep 9, 2022 at 22:15
  • 2
    @MichaelHall: I would not characterize changing the number at the end of a url as “trickery”, although I’ll give you mischief in his case. Note that he did exactly what the OP asks about, and it is/was generally considered a crime although as he is out of the country no charges have been filed
    – jmoreno
    Sep 9, 2022 at 22:32

1 Answer 1

Reset to default
5

This could be a violation of 18 USC 1030 (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as

an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device

Any printer that I have encountered in the past 40 years counts as "a computer". Second,

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer;

It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your "obtains information" element. Maybe not useful information, but information nevertheless. It also has to be a protected computer,

(B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States

Well, a computer connected to the internet is a protected computer, see US v. Trotter, 478 F.3d 918. Also, the access must be "without authorization or exceeds authorized access". The law doesn't explain with "without authorization" means, but the latter is defined as

to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter

If the law were stated in terms of "prohibited access", meaning "express denial of permission", and if the computer owner had set the computer to "prohibited access" by default (password protected), there would be no issue -- accessing the computer is prohibited. "Unauthorized" can also mean "has not been explicitly authorized", i.e. lacking any indication one way or the other. Every computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law.

There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes "unauthorized access". Also, it is not clear that the defendant in this case has "obtained information", since with printing, information flows into the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result ("damage" is defined as "any impairment to the integrity or availability of data, a program, a system, or information"), and how printing would be "reckless". It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.

Improve this answer
5
  • 2
    Does the SCOTUS ruling in Van Buren v. United States (2021) impact the analysis at all? See lawfareblog.com/supreme-court-reins-cfaa-van-buren It seems not because it distinguishes "The prohibition on "access without authorization" bans entering a computer one is not authorized to access, "targeting so-called outside hackers—those who access a computer without any permission at all.", from cases where someone has the capacity to access data but violates a company policy. But, I'm hardly an expert in this area of law. I'm also fuzzy on the "access or obtain information" part.
    – ohwilleke
    Sep 9, 2022 at 0:38
  • 2
    The analysis you link nicely rephrases the court's holding about "gates" – "To violate the CFAA, a person needs to bypass a gate that is down that the person isn't supposed to bypass". Which is my "prohibited access" reading.
    – user6726
    Sep 9, 2022 at 1:11
  • 1
    @ohwilleke I think you're right that Van Buren doesn't change anything. What matters is the degree of authorization: are you going past a gate (metaphorically) that you were not permitted to go past.
    – user46677
    Sep 9, 2022 at 1:12
  • 1
    My phone lets me choose any printer nearby that announces its presence. So I could print things to this printer by mistake. I think I could check the toner level by mistake.
    – gnasher729
    Sep 9, 2022 at 7:45
  • 1
    The printer likely has to be configured to allow access to the outside. Now I don't think being incorrectly configured is exactly an invitation, but it is enough to give the impression that everyone is invited to use the printer.
    – gnasher729
    Sep 9, 2022 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .