The problem is that the laws have to be almost impossibly vague. In just a few years we move from Sun RPC to DCOM/ActiveX to XML to SOAP to various SOA web standards onward to REST APIs/Ajax/etc. etc.
That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on.
Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not...
Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.
>The problem is that the laws have to be almost impossibly vague.
No they don't! Please don't say things like that in public, someone may actually believe you.
It is not possible for the laws to be perfect. They can't be like programs or catch every possible nuance or edge case (and when they try they look like the tax code). But we have specific articulable laws that are severely defective in ways that normal laws aren't, and they can certainly be improved to attain roughly the same level of imperfection found in the large body of legislation rather than their current state of total absurdity.
For ours laws that can be clarified then by all means let's get those clarified.
By what I mean by almost impossibly vague is things like even basic elements of the CFAA. There have been debates up and down HN, Reddit, and across the web about whether logging onto a website that uses laughably poor authentication schemes even counts as "unauthorized access".
If a specific-enough term like "unauthorized access" can lead to so much controversy in practice then yes, I don't see how one could argue that a legal code could simultaneously encompass all reasonable aspects of computer technology, in the present and future, and still not be at least somewhat vague.
It's the principle of indirection applied at a legal level. "What does unauthorized access mean? Well, I guess that's for the specific judge to hash out and the specific jury to decide"
Penalty: "shall be punished by a fine of not more than one hundred dollars or by imprisonment for not more than thirty days or both such fine and imprisonment."
On top of that, look at the wording: You have to have some specific notice that you're unauthorized before it's trespass. And then the penalty is a $100 fine or 30 days. So okay, you want to have the digital equivalent of trespass, let's do the same thing: You have to have been specifically told (not implied by some trumped up circumstantial nonsense about MAC and IP addresses or URLs) that you aren't allowed to access a particular computer and then have done it anyway, and then the penalty should be $100 or 30 days.
Because that's the trivial offense. That's the one that should have the really low penalties because it doesn't necessarily imply any substantial harm. The high penalties should be for high value financial fraud or misappropriating classified materials or disrupting the control systems at a power plant or a chemical processing facility, and they should each be separated out so that we know what they are and have penalties proportional to the specific offense.
And to do that we don't need to talk about XML or SOAP or AJAX, because that isn't what matters. It doesn't matter specifically how you did it, it matters what you did and what you intended to do. This is why we don't have laws against trespassing while wearing a yellow shirt. Because you don't need to specify the irrelevant details, only the relevant ones, and the specific underlying technology is almost always irrelevant to a particular class of criminal activity. Sometimes it does make a difference, and then you need to update the law, but that doesn't actually happen so often that we can't keep up with it if we're paying attention.
That's why the law leaves it couched in terms unlikely to change (like "authorized access", "intentionally" doing something, etc.) and leave the charges to be considered in light of the totality of what went on.
Would a jury convict on typing in one URL, realizing it gave access to an admin panel and just leaving the site immediately? Hopefully not...
Would a jury convict on building a screen-scraper that steals the password for users by incrementing ID's on a URL that wasn't public but wasn't properly secured? I would think so. Sometimes the circumstances of the case matter more than the law itself.