Laws often have the idea of intent. If the intent is to maliciously circumnavigate access control mechanisms, then that should be illegal. Requesting data that has no access controls should not be illegal.
What about the class of vulnerabilities that is due to missing or faulty access controls? For instance, is it your position that while SQL injection should be illegal, rotating the account number in a URL and using it to harvest the social security numbers of hundreds of thousands of bank customers should not be?
I feel like that should be negligence on the HOSTs part. If you have sensitive data, you often have a legal obligation (HIPPA, or whatever domain applicable law) to protect that information. Having it trivially harvested through a URL parameter is negligence in that light.
This is the second most popular argument in a unauthorized access threads. But what it suggests is a form of special pleading for the Internet. It's not an unusual situation in criminal law for the negligence of a victim (or a victim's agent) to interact with the malice of a criminal. What is unusual --- I think unprecedented, in fact --- is for the victim's negligence to negate criminal culpability.
Put simply: sure, create civil liability for companies who deploy insecure software (watch how fun it becomes to be an indie software developer!). That shouldn't change any part of criminal law.
Agreed. If you leave your house unlocked and someone walks in and steals your stuff, they can still be tried and convicted for burglary, though maybe not for breaking and entering.
Now, if you are running a self-storage warehouse and you leave the master key lying around, your customers will almost certainly be able to sue you for negligence. The thief is still committing burglary, though.
We live in a polite society, we are supposed to be able to make rules and have people respect them regardless of whether they are technically capable of circumventing them.
> burglary, though maybe not for breaking and entering.
Off-topic, but in a number of states, these are the same thing. e.g. California has no "breaking and entering" law. Burglary is just entering with the intent to commit larceny or a felony.
We have, up until this point, lived in a polite society. It's unreasonable to expect that this can continue in a world globally connected through the internet.
> What is unusual --- I think unprecedented, in fact --- is for the victim's negligence to negate criminal culpability.
You know more about these issues than me, but I expect that people who are thinking this way might be thinking in terms of an analogy of a conversation with a bank teller (the analogy being that network communication is just like a conversation between your system and theirs).
So if an attacker talks to a bank teller working at a bank and tricks them into revealing lots of private information about other customers that they shouldn't reveal, and it later comes out that the bank had not provided training to the bank teller about customer privacy, and had given them access to all kinds of data that they didn't need access to (which they shared in the 'attack'), I would expect there to be some liability on the Bank.
I agree though - even though they've 'just' spoken to the teller (and perhaps not told any direct lies), this doesn't negate the culpability of the attacker - if they've deliberately set out to trick the teller then they've committed fraud. If the 'attacker' didn't set out to trick the teller, and the teller just confused themselves, then yes, I'd expect there to be no culpability on the attacker but culpability on the bank.
In cases where it's less clear (maybe the attacker tricked the teller into giving them information in a way different to that desired by the bank, even though the attacker is normally allowed to access that information), I would very much want to err on the side of caution.
A world where using an unsupported browser or a scraper or unknowingly clicking a link or writing software that accesses data that you are otherwise allowed to read can make you liable for committing a serious crime would be a very worrying world.
Sure, but it isn't special pleading. This case is like Facebook leaving out a piece of paper on a table and telling someone not to read it. Is it then illegal to read the piece of paper if it is in plain sight in a place they are allowed to be? I sure hope not.
I explicitly reject that I want to negate criminal liability because of the hosts liability. If there are poorly designed access controls in place which are illegally eluded, both should be liable. If there are none, then only the host should be liable.
Clearly that analogy fails, since this thread is rooted in a comment suggesting (wrongly, I think) that authorization was mooted by the request and response nature of the Internet.
