Unwanted access

Weev's lawyers have filed their appeal. It's interesting, readable even for non-lawyers.

Part of the appeal is based on the obvious idea that public websites are, well, public. Just because some computer access isn't "wanted" doesn't necessarily mean that it's "unauthorized". Sure, physical trespass is a good analogy for private computers, but the analogy for public websites is that you've invited the guest into your home, but they ignore your hints they should leave, because you haven't explicitly told them so.

Take search engines as an example. They steal a website's content in order to profit by it. That's the definition of "search engine". Back when they were invented, they made people upset. They'd overload the server with their aggressiveness. They would make things available and public things that website owners didn't want to be so public. Somehow, zealous prosecutors avoided making felons out of search engineers, and they have become the social norm today -- even though these problems still persist.

The same is true of cyber-security research. I do unwanted things against websites all the time, such as my frequent testing of the Un.org website to see if it it's still vulnerable to SQL injection. Those guys hate me. Yet, my blogposts have improved the situation (they fix whatever I post a few days later, and now they've got a WAF in front. I really need to play with that WAF, but I'm lazy).

The reason I'm writing this blogpost is to solicit other examples of unwanted behavior -- things you do that you know is unwanted, but which you believe is "authorized". Or, things that you would do, but aren't sure if you'll be crossing a line. Please add them to the comments below, or send me a tweet @ErrataRob.