Court: Violating T.O.S Is Not a Crime, But Bypassing Technical Barriers Might Be(eff.org)
eff.org
Court: Violating T.O.S Is Not a Crime, But Bypassing Technical Barriers Might Be
http://www.eff.org/deeplinks/2010/07/court-violating-terms-service-not-crime-bypassing
3 comments
I'm unclear on how people rationalize blowing past technical TOS enforcement measures on a web app. Where, exactly, do you propose drawing the line? Because I think I speak for everyone in the room that makes a living doing application pentesting: there are very, very few technical countermeasures you will come up with that a consulting-week or two won't blow past.
> Where, exactly, do you propose drawing the line?
From TFA: "We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime."
From TFA: "We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime."
Is violating TOS unethical? immoral? considered lying to something you agreed to?
I think it's more like breach of contract. It's not necessarily unethical, but if you violate the terms, they no longer are bound to provide the service.
EDIT: Although it's unclear whether a contract was really entered into. Real contracts have signatures to indicate both parties know and agree to what's contained. That's often not the case in web services.
EDIT: Although it's unclear whether a contract was really entered into. Real contracts have signatures to indicate both parties know and agree to what's contained. That's often not the case in web services.
I think EULA's are considered signed to some degree. I don't know how or if that reasoning extends to online TOS. I wouldn't be surprised to learn the courts are fairly liberal in what they consider a contract but don't give all contracts the same strength.
The inherent power imbalance weakens the TOS's ethical standing. Facebook has lawyers. I'm not a lawyer nor can I hire one for every agreement. Which means, most people interpret the TOS to mean "I agree to no be a dick." Also any agreement which is allowed to change without notice is inherently unethical.
Only if the TOS isn't unethical, immoral or lying.
If you knowingly agree to a TOS it does not matter whether it's unethical or not. When you sign you agree to the ethics contained. You are supposed to be reading the TOS to see whether you agree or not and once you sign you are being unethical if you break the TOS in any other way not specifically allowed in the TOS.
You got downmodded because not everyone holds that a TOS is legally binding just because it exists.
It's not the same as signing a contact. But even a contract can be invalidated if a court holds it's unconscionable.
It's not the same as signing a contact. But even a contract can be invalidated if a court holds it's unconscionable.
There are two different ideas going on here. There is the legal and the ethical. It doesn't matter whether an agreement is legal or not, in the realm of ethics if you sign willingly you agree.
Would you care to explain how you can defend breaking a TOS when you have a choice on whether to sign it or not?
Would you care to explain how you can defend breaking a TOS when you have a choice on whether to sign it or not?
I've never heard of anyone, ever, signing a TOS.
The problem with a TOS is that it's unilateral - I get no chance to negotiate it. In my mind that makes it invalid. Just because the website wants it to be valid doesn't mean it actually is.
But the bigger problem is that I did not agree to it. The website tries to impose it on me.
The problem with a TOS is that it's unilateral - I get no chance to negotiate it. In my mind that makes it invalid. Just because the website wants it to be valid doesn't mean it actually is.
But the bigger problem is that I did not agree to it. The website tries to impose it on me.
I don't think your argument holds up. Any service is offered under some terms; it's irrational and unreasonable to assume that when you use someone's website or service that there are no terms whatsoever attached to that service.
So where do those terms come from? Rationally, one might expect the website to spell out what they expect from you and under what conditions their services are provided. If you don't like those terms, don't use the service.
It seems like you're arguing that you should get to determine under what terms the services are offered, or perhaps alternatively that services offered should never have any terms attached whatsoever; both of those positions seem pretty indefensible to me.
Just because you don't get a chance to negotiate terms doesn't make them invalid. It's a take-it-or-leave it offer, and you always have the right to leave it. When a restaurant gives you a bill, do you pay less than the amount just because you didn't get to negotiate the price? Do you walk into a restaurant shirtless that explicitly asks you not to do that? Of course not: your ordering the item indicated your willingness to pay the associated charge, and likewise if you don't want to abide by their rules around appropriate dress, you just don't go in.
You don't get to make up your own rules and then apply them to someone else's services.
It's a different question if the TOS are deliberately obscured such that you don't actually know what you're agreeing to, but the argument that just because you can't negotiate the TOS they're somehow invalid and you're thus justified in still using the service in violation of them is absurd.
So where do those terms come from? Rationally, one might expect the website to spell out what they expect from you and under what conditions their services are provided. If you don't like those terms, don't use the service.
It seems like you're arguing that you should get to determine under what terms the services are offered, or perhaps alternatively that services offered should never have any terms attached whatsoever; both of those positions seem pretty indefensible to me.
Just because you don't get a chance to negotiate terms doesn't make them invalid. It's a take-it-or-leave it offer, and you always have the right to leave it. When a restaurant gives you a bill, do you pay less than the amount just because you didn't get to negotiate the price? Do you walk into a restaurant shirtless that explicitly asks you not to do that? Of course not: your ordering the item indicated your willingness to pay the associated charge, and likewise if you don't want to abide by their rules around appropriate dress, you just don't go in.
You don't get to make up your own rules and then apply them to someone else's services.
It's a different question if the TOS are deliberately obscured such that you don't actually know what you're agreeing to, but the argument that just because you can't negotiate the TOS they're somehow invalid and you're thus justified in still using the service in violation of them is absurd.
If I put up a sign on the freeway saying: "The sky is blue. By reading this message you agree to ....". Do you think that's a valid TOS?
How is a website any different?
> So where do those terms come from?
State law. That's all. The website can not dictate any terms whatsoever.
To your specific points:
A restaurant is private property - they can ask me to leave if I don't wear a shirt, but they can NOT compel me to actually wear the shirt. They can't fine me for going there without a shirt, they can't do anything at all, except ask me to leave.
If I buy food from a restaurant, that's a purchase and not a contact, and it uses the various state laws that govern that. But the restaurant can NOT add extra conditions. If a restaurant puts up a sign that said "by buying food here you agree to ...." - that sign is meaningless, and has no validity.
A purchase order requires the signature of the buyer. Merely stating a term and saying "by doing ...." is meaningless.
Those terms you find on the back of a receipt sometimes? Meaningless. They can say what the store will do, and under what conditions, but they can do nothing whatsoever to the purchaser that state law does not provide.
How is a website any different?
> So where do those terms come from?
State law. That's all. The website can not dictate any terms whatsoever.
To your specific points:
A restaurant is private property - they can ask me to leave if I don't wear a shirt, but they can NOT compel me to actually wear the shirt. They can't fine me for going there without a shirt, they can't do anything at all, except ask me to leave.
If I buy food from a restaurant, that's a purchase and not a contact, and it uses the various state laws that govern that. But the restaurant can NOT add extra conditions. If a restaurant puts up a sign that said "by buying food here you agree to ...." - that sign is meaningless, and has no validity.
A purchase order requires the signature of the buyer. Merely stating a term and saying "by doing ...." is meaningless.
Those terms you find on the back of a receipt sometimes? Meaningless. They can say what the store will do, and under what conditions, but they can do nothing whatsoever to the purchaser that state law does not provide.
A website is effectively private property. Suppose my house had a nice lawn, and I said to the neighborhood kids, "You're welcome to play on my lawn, just clean up after yourselves and don't hurt the flowers." Is that reasonable? How about if, instead of communicating that to them, I instead put up a sign to that effect? Is it cool if the kids play on my lawn and mess up my flower bed because they don't like those terms and couldn't negotiate them? Of course not: I've laid out the rules for their usage of my private property, and if they don't like the rules they can do something else with their time.
I'm not saying a website should be able to sue you or file criminal complaints if you violate a TOS; I'm just saying that they do have the right to expect you to abide by them if you choose to use the site. They should be able to behave exactly as a restaurant does: kick you out if you violate them, and file criminal complaints only if you actually do something criminal (cause damage, steal stuff, abuse staff, etc.).
Whether or not a TOS is criminally enforceable is a long ways away from your argument, which I interpreted as essentially saying that breaking/ignoring a TOS isn't any sort of ethical violation because it's not a countersigned negotiated contract.
I'm not saying a website should be able to sue you or file criminal complaints if you violate a TOS; I'm just saying that they do have the right to expect you to abide by them if you choose to use the site. They should be able to behave exactly as a restaurant does: kick you out if you violate them, and file criminal complaints only if you actually do something criminal (cause damage, steal stuff, abuse staff, etc.).
Whether or not a TOS is criminally enforceable is a long ways away from your argument, which I interpreted as essentially saying that breaking/ignoring a TOS isn't any sort of ethical violation because it's not a countersigned negotiated contract.
A website is not like private property.
And even if it was, a TOS would be invalid on private property.
You can SAY don't mess up flowers, but you can't endorse it. The only rights you have are those given by state law, your TOS is nothing.
Suppose you put up a sign that says: "If you mess up the flowers you must replant them."
Those words are meaningless. You simply do not have the power to do that. You can sue for damages, but only because state law says so. What you wrote on the sign is meaningless.
A TOS is totally invalid, and you can ignore it entirely. Both on a website, and on private property. The only rights you have are those given to you by state law.
Unless you sign a contact of course. But you can't create a contract merely because someone came to your house, or to your website.
And even if it was, a TOS would be invalid on private property.
You can SAY don't mess up flowers, but you can't endorse it. The only rights you have are those given by state law, your TOS is nothing.
Suppose you put up a sign that says: "If you mess up the flowers you must replant them."
Those words are meaningless. You simply do not have the power to do that. You can sue for damages, but only because state law says so. What you wrote on the sign is meaningless.
A TOS is totally invalid, and you can ignore it entirely. Both on a website, and on private property. The only rights you have are those given to you by state law.
Unless you sign a contact of course. But you can't create a contract merely because someone came to your house, or to your website.
What I fail to understand is how a website knows if you have "agreed" to the TOS. I mean, a contract is physically signed, sometimes with a notary. FAFSA is "signed" by a multiple step process including a SSN, DOB, receiving mail including a pin#, and entering all of it with "agree" in box to assert information is true.
Where, and how can a website claim that an "agree" button is legally enough? Or perhaps, the TOS is just nonexistent(ala 404). Or, what are these "bypassing technical barriers"? Does that count reading the URL and changing it? Greasemonkey? Filtering/data modifying router? Post injection?
This suggesting is creating more confusion than it solves.
Where, and how can a website claim that an "agree" button is legally enough? Or perhaps, the TOS is just nonexistent(ala 404). Or, what are these "bypassing technical barriers"? Does that count reading the URL and changing it? Greasemonkey? Filtering/data modifying router? Post injection?
This suggesting is creating more confusion than it solves.
That's not a problem, since almost all sites say that mere usage of the site implies agreement with the TOS. I suppose this is akin to a "no shirt, no shoes, no service" sign; it doesn't matter whether you have read or agreed it — the sign is posted.
Suppose you say that's true. Ok.
Under what "law" can you even load the site to begin with? That's right, they accepted a connection. It's akin to knocking on someones door, and they let you in. The website could always pop back "connection denied", 403, or just not answering at all.
At most it's a gentlemens agreement, or in the class of "windshields not our responsibility for our uncovered load".
Aside that, we know certain public AP's modify content to add theirs instead (panera bread advert munges). Aside ssl'ing everything, how can they even be sure we agreed to the same TOS, let alone agree at all?
Under what "law" can you even load the site to begin with? That's right, they accepted a connection. It's akin to knocking on someones door, and they let you in. The website could always pop back "connection denied", 403, or just not answering at all.
At most it's a gentlemens agreement, or in the class of "windshields not our responsibility for our uncovered load".
Aside that, we know certain public AP's modify content to add theirs instead (panera bread advert munges). Aside ssl'ing everything, how can they even be sure we agreed to the same TOS, let alone agree at all?