Does the 9th Court Ruling Imply That a Public Endpoint Is Truly Public?
<p><a href="https://www.eff.org/deeplinks/2017/02/violating-terms-use-isnt-crime-eff-tells-court-again" rel="nofollow noreferrer">Violating Terms of Use Isn’t a Crime, EFF Tells Court—Again</a></p>

<p>The recent ruling by the 9Th CAP states that a user is not legally (criminally(civil maybe?)) bound by the ToS of a website operator. Does that make a public endpoint that doesn't require authorization (or maybe even one that does) open for use as a user sees fit?</p>

<p>This ruling seems especially potent given the fact that Rimini Street was using the public endpoint to get data that allowed them to offer a product that competed directly with Oracle.</p>

<p>It may be useful to consult the <a href="http://cdn.ca9.uscourts.gov/datastore/opinions/2018/01/08/16-16832.pdf" rel="nofollow noreferrer">opinion</a> in this civil suit. The relevant portion is the state computer law claims, starting p. 22, which in the Nevada and California versions involves a law making unauthorized access a crime. These laws also provide a cause of action in case of damage caused by illegal access (that is, you can sue the person who broke into your system). On that basis (as well as copyright infringement, where the plaintiff prevailed), Oracle sued the defendant.</p>

<p>As the court noted, the core question is whether Rimini violated those laws by downloading the content (using automated tools in violation of the TOS). Crucially, the TOS allows downloading, it just forbids downloading via a particular method. The court said</p>

<blockquote>
  <p>We  hold  that  taking  data  using  a  method  prohibited  by  the
  applicable terms of use, when the taking itself generally  is
  permitted, does not violate the CDAFA. Because the same  reasoning 
  applies  to  the  NCCL  claim,  we  reverse  the   judgment as to both
  claims.</p>
</blockquote>

<p>Relying on prior case law (<a href="https://cdn.ca9.uscourts.gov/datastore/opinions/2015/08/25/08-50531.pdf" rel="nofollow noreferrer">US v. Christensen</a>), </p>

<blockquote>
  <p>A   plain   reading   of   the   [CDAFA]    demonstrates that  its
  focus is on unauthorized taking or use  of information</p>
</blockquote>

<p>Rimini did have authorization initially, because Oracle only later imposed the method restriction, and the court ruled that</p>

<blockquote>
  <p>Because  it  indisputably  had  such  authorization,  at  least   at
  the time it took the data in the first instance, Rimini did  not 
  violate  the  state  statutes.</p>
</blockquote>

<p>EFF overstates what the court found: they found that the downloading was done with permission, and the question of criminal prosecution was not an issue.</p>

<p>No, what it says is that violation of ToS is not <strong>criminal</strong> and therefore not a matter for the state to prosecute. It is <strong>illegal</strong> breach of contract which the aggrieved party can litigate <em>privately.</em></p>

terms-of-service computer-misuse-act