You are presuming the legislation was "poorly worded" rather
than
"intentionally vague". I doubt that. There are too many cases where
when
laws are applied in unjust ways they are claimed to be
"poorly
worded".
One website published a different wording with the
intent of fixing the problem,
and to me it looked just as broken.
The
current legislation distinguishes between "having no authorisation", "having
authorisation" and "exceeding authorisation". The intention is quite clearly.
Let's
say Groklaw resides on some computer. I have authorization to access the
computer because the software on the computer responds if I type in
"groklawstatic.ibiblio.org". But there are many parts on that computer that I shouldn't
access. So if I managed to delete all groklaw posts, that would be "exceeding
authorisation". And everyone will agree that action should be punished.
Now lets say Groklaw has some Terms of Service that say "no swearing". So
someone could claim that by swearing in a post I violate the TOS, which makes
my post "exceeding authorisation", which makes me a criminal. The same kind of
criminal as someone creating significant damage. That is (I hope) not intended,
but that is the case.
The change in the law should be to not say
"authorised to access a computer",
but "authorised to access or modify specific
data on one or more computers in
specific ways". There would be no "exceeds
authorisation". For example, I have
authorization to modify the database of all
groklaw posts by clicking the
"submit" button. I have no authorisation to
modify the database by hacking the
server and deleting everything. My posts
would be "authorized access" no matter
what I post - TOS violation would be a
TOS violation, but it would not be a crime. [ Reply to This | Parent | # ]
|