data-protection security
Is any attempt to access restricted information on the web considered an attack?
<p><a href="https://arktimes.com/arkansas-blog/2020/05/18/governor-shooting-the-messenger-wrong-tact-in-arkansas-pua-data-breach-experts-say" rel="nofollow noreferrer">This article</a> reports that a person who "gained access to the admin portal by simply altering the website’s URL" is now under investigation by FBI for "exploiting personal information".</p>

<p>I want to understand where exactly an interaction with the site stops being <em>usage</em> and becomes <em>exploiting</em>. I understand that simply entering a reasonable URL I expect to have access to (such as <code>example.com/auth?name=user</code>) is legal, while intentionally trying to get access to someone else's account (such as <code>example.com/auth?name=admin&amp;id={stolen auth token}</code> is not. I also assume that making a honest mistake (such as making a typo in my username or using a name I have on a different site) cannot be held against me, even if that results in accessing someone else's account unintentionally.</p>

<p>Is having the intention to access restricted information all that matters? E.g. is simply typing someone else's username in a login page together with an empty password enough to be considered an attack? If not, then there is the line?</p>

<h2>“Attack” is not a legal term</h2>
<p>Neither is “use” or “exploit”. When someone is charged with a crime, the state makes very specific which crime(s) the accused has committed and, from that flow the elements that the state must prove beyond reasonable doubt.</p>
<p>Arkansas no doubt has laws about this but since it’s being “investigated by the FBI” the suspicion is that a Federal crime was committed. Of course, “under investigation” just means that someone told the FBI about it, whether the FBI does anything is up to them. As the TV show <a href="https://en.wikipedia.org/wiki/Yes_Minister" rel="nofollow noreferrer">Yes, Minister</a> put it “under consideration” means we’ve lost the file, “under active consideration” means we’re looking for it.</p>
<p>The most relevant Federal law is the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">Computer Fraud and Abuse Act</a> (CFAA) under which there are a number of crimes but the most applicable is:</p>
<blockquote>
<p>(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—</p>
<p>(C) information from any protected computer;</p>
</blockquote>
<p>The person in the article:</p>
<ul>
<li>intentionally - check</li>
<li>accessed a computer - check</li>
<li>without or exceeding authorisation - we’ll get back to this</li>
<li>obtained information - check</li>
<li>from a protected computer - check. Any computer with internet access is a “protected computer” under the Act and this includes mobile phones.</li>
</ul>
<p>So the only question is did the person not have authorisation or exceed the authorisation they had?</p>
<p>It’s clear that they were not explicitly authorised.</p>
<p>Publishing something with a URL and *without any security *on the web is <em>possibly</em> implicit authorisation. For example, you are authorised to access this web page whether you are a signed up member of Stack Exchange (SE) or not.</p>
<p><strong>However</strong>, down at the bottom of this page is a Legal link which <em>may</em> create a binding contract between you and SE (see <a href="https://law.stackexchange.com/a/13571/344">https://law.stackexchange.com/a/13571/344</a>). The CFAA is drafted so broadly that breach of a contract may trigger criminal sanctions (see the sad case of <a href="https://en.wikipedia.org/wiki/Aaron_Swartz#United_States_v._Aaron_Swartz_case" rel="nofollow noreferrer">Aaron Schwartz</a>. Criminal sanction for a civil wrong is ... odd ... but not prohibited by the legal system - government has the power to decide what is and isn’t a crime.</p>
<p>As it currently stands the CFAA is a wide-reaching and draconian piece of legislation. There is a line but if you start to think you might be crossing it, you are probably already well over it.</p>
