[Infowarrior] - LinkedIn: It’s illegal to scrape our website without permission

[Richard Forno]

LinkedIn: It’s illegal to scrape our website without permission
A legal scholar calls LinkedIn's position “hugely problematic.”
Timothy B. Lee - 7/31/2017, 8:00 AM

https://arstechnica.com/tech-policy/2017/07/linkedin-its-illegal-to-scrape-our-website-without-permission/

A small company called hiQ is locked in a high-stakes battle over Web scraping with LinkedIn. It's a fight that could determine whether an anti-hacking law can be used to curtail the use of scraping tools across the Web.

HiQ scrapes data about thousands of employees from public LinkedIn profiles, then packages the data for sale to employers worried about their employees quitting. LinkedIn, which was acquired by Microsoft last year, sent hiQ a cease-and-desist letter warning that this scraping violated the Computer Fraud and Abuse Act, the controversial 1986 law that makes computer hacking a crime. HiQ sued, asking courts to rule that its activities did not, in fact, violate the CFAA.

James Grimmelmann, a professor at Cornell Law School, told Ars that the stakes here go well beyond the fate of one little-known company.

"Lots of businesses are built on connecting data from a lot of sources," Grimmelmann said. He argued that scraping is a key way that companies bootstrap themselves into "having the scale to do something interesting with that data." If scraping without consent becomes illegal, startups like hiQ will have a harder time getting off the ground.

But the law may be on the side of LinkedIn—especially in Northern California, where the case is being heard. In a 2016 ruling, the 9th Circuit Court of Appeals, which has jurisdiction over California, found that a startup called Power Ventures had violated the CFAA when it continued accessing Facebook's servers despite a cease-and-desist letter from Facebook.

Some details of that case were different—Power Ventures was sending out private messages with the permission and cooperation of Facebook users, while hiQ is scraping data on public webpages. But experts told Ars that the Power Ventures precedent is likely to be bad news for hiQ because it suggests that continuing to access a site after being asked to stop is enough to trigger the anti-hacking law.

“Hugely problematic”

LinkedIn's position disturbs Orin Kerr, a legal scholar at George Washington University. "You can't publish to the world and then say 'no, you can't look at it,'" Kerr told Ars.

The CFAA makes it a crime to "access a computer without authorization or exceed authorized access." Courts have been struggling to figure out what this means ever since Congress passed it more than 30 years ago.

One plausible reading of the law—the one LinkedIn is advocating—is that once a website operator asks you to stop accessing its site, you commit a crime if you don't comply.

That's the interpretation suggested by the 2016 Power Ventures decision, which is a binding precedent in California. Power.com was a social network that functioned as a social network aggregator. Through the Power.com website, users could log into other social networks like Facebook, allowing them to access information from multiple social networks simultaneously.

To expand its user base, Power asked users to provide their Facebook credentials and then—with their permission—sent Power.com invitations to their Facebook friends. Facebook, naturally, didn't appreciate this marketing tactic. They sent Power a cease-and-desist letter and also blocked the IP addresses Power was using to communicate with Facebook's servers.

Facebook sued, claiming that its cease-and-desist letter made Power's access unauthorized under the terms of the CFAA. Power disagreed and argued that having permission from Facebook users was good enough—it didn't need separate approval from Facebook itself.

But the 9th Circuit Court of Appeals sided with Facebook last year.

"Power users arguably gave Power permission to use Facebook's computers to disseminate messages," the court wrote. "But Facebook expressly rescinded that permission when Facebook issued its written cease-and-desist letter." After this point, the court held, "Power knew it no longer had authorization to access Facebook's computers, but continued to do so anyway."

That result bothers Kerr.

For example, he said, imagine if CNN sent out letters to reporters at rival news organizations demanding that their reporters not access cnn.com. Under an expansive reading of the law, Kerr told Ars, it would then "become a federal crime to visit a public website."

Kerr argues sites wanting to limit access to their site should be required to use a technical mechanism like a password to signal that the website is not, in fact, available to the public.

"It's hugely problematic to let the subjective wishes of the website owner and not their objective action" determine what's legal, Kerr told Ars.

The Power Ventures case isn't over. Power Ventures asked the Supreme Court to consider the case in May, and the high court hasn't decided whether to do so yet. And for now, the Power Ventures precedent only applies within the 9th Circuit, which covers California and other Western states. Unfortunately for hiQ, the LinkedIn dispute is being heard by California federal courts.

Ultimately, Grimmelmann believes, the text of the CFAA doesn't clearly settle this question. Both Kerr's view that running a public website implicitly gives the public authorization to access it and LinkedIn's view that companies can rescind authorization on a case-by-case basis are plausible interpretations of the law.

But both scholars argue there are good reasons to favor the more permissive reading of the law. The LinkedIn interpretation of the law gives big website operators like LinkedIn plenty of power over how their sites are used. They argue the courts should preserve the rights of small companies, watchdog groups, and others to gather information from the Web using scraping tools.

Timothy B. Lee Timothy covers tech policy for Ars, with a particular focus on patent and copyright law, privacy, free speech, and open government. His writing has appeared in Slate, Reason, Wired, and the New York Times.