EFF is fighting another attempt by a giant corporation to take advantage of our poorly drafted federal computer crime statute for commercial advantage—without any regard for the impact on the rest of us. This time the culprit is LinkedIn. The social networking giant wants violations of its corporate policy against using automated scripts to access public information on its website to count as felony “hacking” under the Computer Fraud and Abuse Act, a 1986 federal law meant to criminalize breaking into private computer systems to access non-public information.
LinkedIn’s position would undermine open access to information online, a hallmark of today’s Internet, and threaten socially valuable bots that journalists, researchers, and Internet users around the world rely on every day—all in the name of preserving LinkedIn’s advantage over a competing service. The Ninth Circuit should make sure that doesn’t happen.
The CFAA makes it illegal to engage in “unauthorized access” to a computer connected to the Internet, but the statute doesn’t tells us what “authorization” or “without authorization” means. This vague language might have seemed innocuous to some back in 1986 when the statute was passed, but in today’s networked world, where we all regularly connect to and use computers owned by others, this pre-Web law is causing serious problems.
Then in 2016, the Ninth Circuit reversed course and delivered two dangerously expansive interpretations of the CFAA in cases involving password sharing. Despite our warnings that the decisions would be easily misused, the court refused to reconsider either case, stressing that the decisions would be limited to their “stark” facts.
Within weeks after the decisions were reached, LinkedIn began using these two decisions in an attempt to get around the Ninth Circuit’s 2012 ruling—and to use the CFAA to enforce its terms of service prohibition on scraping and thereby block competing services from perfectly legal uses of publicly available data on its website.
As we told the court in our amicus brief, Linkedin’s interpretation of the CFAA is problematic for a number of reasons.
First, allowing a website to use the CFAA as a terms of service enforcement mechanism would do precisely what the Ninth Circuit in 2012 sought to avoid: it would “transform the CFAA from an anti- hacking statute into an expansive misappropriation statute” for enforcing the use of publicly available information across the Web. Accessing public information on the open Internet cannot—and should not—give rise to liability under a law meant to target breaking into private computers to access non-public information.
Second, imposing CFAA liability for accessing publicly available information via automated scripts would potentially criminalize all automated “scraping” tools—including a wide range of valuable tools and services that Internet users, journalists, and researchers around the world rely on every day. Automated scraping is the process of using Internet “bots”—software applications that runs automated tasks over the Internet—to extract content and data from a website. LinkedIn tried to paint all bots as bad, but as we explained to the Ninth Circuit, bots are an essential and socially valuable component of the Internet. The Web crawlers that power tools we all rely on every day, including Google Search and Amici DuckDuckGo and Internet Archive, are Internet bots. News aggregation tools, including Google’s Crisis Map, which aggregated critical information about the California’s October 2016 wildfires, are Internet bots. ProPublica journalists used automated scrappers to investigate Amazon’s algorithm for ranking products by price and uncovered that Amazon’s pricing algorithm was hiding the best deals from many of its customers. The researchers who studied racial discrimination on Airbnb also used bots, and found that distinctively African American names were 16 percent less likely to be accepted relative to identical guests with distinctively white names.
Third, by potentially criminalizing what are in fact everyday online tools, LinkedIn’s position violates the long held “Rule of Lenity,” which requires that criminal statutes be interpreted to give clear notice of what conduct is criminal.
LinkedIn argues that imposing criminal liability for automated access of publicly available LinkedIn data would protect the privacy interests of LinkedIn users who decide to publish their information publicly, but that’s just not true. LinkedIn still wouldn’t have any meaningful control over who accesses the data and how they use it, because the data will still be freely available on the open Internet for malicious actors and anyone not within the jurisdiction of the United States to access and use however they wish. LinkedIn’s contractual use restrictions on automated access may provide an illusion of privacy—and deter law-abiding individuals and U.S.-based companies from using automated tools to access that data—but nothing more.
The only way for LinkedIn to truly protect the privacy of its users’ is to make their profiles non-public—i.e., to put their information behind a username and password barrier. But instead its profiles are public by default. As LinkedIn itself admits, it benefits from that data remaining public and freely accessible on the Internet: open access on its platforms means more Internet traffic (and thus more data and more eyes for advertisers). As we told the court, “LinkedIn wants to ‘participate in the open Web’ but at the same time abuse the CFAA to avoid ‘accept[ing] the open trespass norms of the Web.’” We hope the court does not allow it.
Correction: An earlier version of this post stated that LinkedIn and the Electronic Privacy Information Center both argued that imposing criminal liability for automated access would protect the privacy interests of LinkedIn users. The post was updated to clarify that EPIC filed an amicus brief in the case in support of neither party, raising the privacy implications of the scope of the lower court's preliminary injunction order, which enjoined LinkedIn from blocking hiQ's access to publicly available user profiles, and not arguing in favor of criminal liability.