Author: edfu777 [AT] hotmail [DOT] com (Nick Farrell) Fudzilla.com – Home
Even if a site says you can’t
A district court in Washington, D.C. has ruled that using automated tools to access publicly available information on the open web is not a computer crime—even when a website bans automated access in its terms of service.
The court ruled that the 1986 Computer Fraud and Abuse Act (CFAA) which was designed to stop hackers—does not make it a crime to access information in a manner that the website doesn’t like if you are otherwise entitled to access that same information.
The case, Sandvig v. Sessions, involves a First Amendment challenge to the CFAA’s overbroad and imprecise language. The plaintiffs are a group of discrimination researchers, computer scientists, and journalists who want to use automated access tools to investigate companies’ online practices and conduct audit testing.
However the automated web browsing tools they want to use (commonly called “web scrapers”) are prohibited by the targeted websites’ terms of service, and the CFAA has been interpreted by some courts as making violations of terms of service a crime.
According to the Electronic Frontier Foundation, the plaintiffs have refrained from using automated tools out of an understandable fear of prosecution. Instead, they decided to go to court. With the help of the ACLU, the plaintiffs have argued that the CFAA has chilled their constitutionally protected research and journalism.
The CFAA makes it illegal to access a computer connected to the Internet “without authorisation,” but the statute doesn’t tell us what “authorisation” or “without authorisation” means. Even though it was passed in the 1980s to punish computer intrusions, it has metastasised in some jurisdictions into a tool for companies and websites to enforce their computer use policies, like terms of service (which no one reads). Violating a computer use policy should by no stretch of the imagination count as a felony.
Judge John Bates said that a broad reading of the CFAA “threatens to burden a great deal of expressive activity, even on publicly accessible websites”.
The First Amendment protects not only the right to speak, but also the right to receive information, and the court held that the fact “[t]hat plaintiffs wish to scrape data from websites rather than manually record information does not change the analysis”. According to the court: “Scraping is merely a technological advance that makes information collection easier; it is not meaningfully different from using a tape recorder instead of taking written notes, or using the panorama function on a smartphone instead of taking a series of photos from different positions.”
Judge Bates did not strike down the law as unconstitutional, but he did rule that the statute must be interpreted narrowly to avoid running afoul of the First Amendment. Judge Bates also said that a narrow construction was the most common sense reading of the statute and its legislative history.
