copyright data
Legality of Using Unofficial API
<p>I have discovered a mobile app's backend API through reverse engineering. The public can access this API and it does not require specific authorization, however, it is not documented and it is not an official API that the public is meant to access. It was made solely for the purpose of that app. The app does not have a ToS.</p>
<p>Is it legal for me to use this API to get data for my own purposes?</p>
<p>By &quot;my own purposes&quot; I mean collecting data from the API, storing it on a database, and displaying it to users on my own website which was not built to make a profit.</p>

<p>If the app (and the service accessed from the app) truly doesn't have any EULA, ToS, or license agreement, to include restrictions on reverse engineering, you can probably create an alternate front end, so long as you aren't using their logos, etc.</p>
<p>However, their data may be a different beast, depending on the nature of it. For example, extracting data from Twitter would potentially violate Twitter's license on the original text copyright held by the authors in question. Wikipedia explicitly includes redistribution in their license agreement with authors/content creators.</p>
<p>If all you are extracting and storing is the temperature at a particular weather station, you might have less of a concern. Anything beyond merely factual runs the risk of a copyright infringement as you store the data in your own database.</p>

<p><a href="/questions/tagged/england-and-wales" class="post-tag" title="show questions tagged &#39;england-and-wales&#39;" aria-label="show questions tagged &#39;england-and-wales&#39;" rel="tag" aria-labelledby="tag-england-and-wales-tooltip-container">england-and-wales</a></p>
<p>If you know you have no authorisation to access the API then on the face of it this seems to be contrary to <a href="https://www.legislation.gov.uk/ukpga/1990/18/section/1" rel="nofollow noreferrer">s1 Computer Misuse Act 1990</a> (and possibly <a href="https://www.legislation.gov.uk/ukpga/1990/18/section/3" rel="nofollow noreferrer">s3 Unauthorised acts ... with recklessness as to impairing ... etc</a>, depending).</p>
<blockquote>
<ol>
<li>Unauthorised access to computer material.</li>
</ol>
<p>(1) A person is guilty of an offence if—</p>
<p>(a) he causes a computer to perform any function with intent to secure
access to any program or data held in any computer, or to enable
any such access to be secured;</p>
<p>(b) the access he intends to secure, or to enable to be secured,
is unauthorised; and</p>
<p>(c) he knows at the time when he causes the computer to perform the
function that that is the case.</p>
</blockquote>
<p><a href="https://www.cps.gov.uk/legal-guidance/computer-misuse-act" rel="nofollow noreferrer">Crown Prosecution Service Guidance for Computer Misuse Act</a>.</p>
<p>(If the data is &quot;personal data&quot; then there is the offence of the deliberate or reckless obtaining, disclosing, procuring and retention of personal data without the consent of the data controller contrary to <a href="https://www.legislation.gov.uk/ukpga/2018/12/section/170/enacted" rel="nofollow noreferrer">s170 Data Protection Act 2018</a>.)</p>
<p>[edit]</p>
<p>There is some discussion in comments about what is authorisation or tantamount to it, implied authorisation, passwords, etc.</p>
<blockquote>
<p><a href="https://www.legislation.gov.uk/ukpga/1990/18/section/17" rel="nofollow noreferrer">s17 Computer Misuse Act - Interpretation</a></p>
<p>(5)Access of any kind by any person to any program or data held in a
computer is unauthorised if—</p>
<p>(a)he is not himself entitled to control access of the kind in
question to the program or data; and</p>
<p>(b)he does not have consent to access by him of the kind in question
to the program or data from any person who is so entitled [F2but this
subsection is subject to section 10.]</p>
</blockquote>
<p><a href="https://publications.parliament.uk/pa/ld199899/ldjudgmt/jd990805/bow.htm" rel="nofollow noreferrer">Judgments -- Regina v. Bow Street Magistrates Court and Allison (A.P.) Ex Parte Government of the United States of America (on Appeal from a Divisional Court of the Queens Bench Division)</a>:</p>
<blockquote>
<p>Section 17 is an interpretation section. Subsection (2) defines what is meant by access and securing access to any programme or data. It lists four ways in which this may occur or be achieved. Its purpose is clearly to give a specific meaning to the phrase &quot;to secure access&quot;. Subsection (5) is to be read with subsection (2). It deals with the relationship between the widened definition of securing access and the scope of the authority which the relevant person may hold. That is why the subsection refers to &quot;access of any kind&quot; and &quot;access of the kind in question&quot;. Authority to view data may not extend to authority to copy or alter that data. The refinement of the concept of access requires a refinement of the concept of authorisation. The authorisation must be authority to secure access of the kind in question. As part of this refinement, the subsection lays down two cumulative requirements of lack of authority. The first is the requirement that the relevant person be not the person entitled to control the relevant kind of access. The word &quot;control&quot; in this context clearly means authorise and forbid. If the relevant person is so entitled, then it would be unrealistic to treat his access as being unauthorised. The second is that the relevant person does not have the consent to secure the relevant kind of access from a person entitled to control, ie authorise, that access.</p>
</blockquote>
<blockquote>
<p>Subsection (5) therefore has a plain meaning subsidiary to the other provisions of the Act. It simply identifies the two ways in
which authority may be acquired--by being oneself the person entitled
to authorise and by being a person who has been authorised by a person
entitled to authorise. It also makes clear that the authority must
relate not simply to the data or programme but also to the actual kind
of access secured. Similarly, it is plain that it is not using the
word &quot;control&quot; in a physical sense of the ability to operate or
manipulate the computer and that it is not derogating from the
requirement that for access to be authorised it must be authorised to
the relevant data or relevant programme or part of a programme. It
does not introduce any concept that authority to access one piece of
data should be treated as authority to access other pieces of data &quot;of
the same kind&quot; notwithstanding that the relevant person did not in
fact have authority to access that piece of data. Section 1 refers to
the intent to secure unauthorised access to any programme or data.
These plain words leave no room for any suggestion that the relevant
person may say: &quot;Yes, I know that I was not authorised to access that
data but I was authorised to access other data of the same kind.**</p>
</blockquote>
<p>The questioner states that &quot;I have discovered a mobile app's backend API through reverse engineering. ... it is not an official API that the public is meant to access. It was made solely for the purpose of that app.&quot;</p>
<p>It seems to me the questioner knows they are not authorised to access it for their purposes.</p>

<p>In the US, the relevant law is the <a href="https://www.justice.gov/jm/jm-9-48000-computer-fraud" rel="noreferrer">Computer Fraud and Abuse Act</a>, which makes it a federal crime to access a protected computer system without proper authorization or to exceed the scope of your authorization. So the questions here are</p>
<ul>
<li>Is the API sufficiently protected to count as a &quot;protected computer&quot;</li>
<li>By building an alternate frontend, are you accessing it without authorization.</li>
</ul>
<p>From the Justice Department memo I linked,</p>
<blockquote>
<p>A CFAA prosecution may not be brought on the theory that a defendant exceeds authorized access solely by violating an access restriction contained in a contractual agreement or term of service with an Internet service provider or web service available to the general public—including public websites (such as social-media services) that allow for free or paid registration without human intervention.</p>
</blockquote>
<p>So you're probably fine under the CFAA.</p>
