What are the limits of website scraping under the Computer Fraud and Abuse Act?
<p>I have read several news in the EFF's website about court appeals and fights related to web scraping.</p>
<p>I am a programmer and have always been worried about what are the limits of scraping.</p>
<p>Normally, I think any public site can be scraped, as 'viewing' a website is not different from that.</p>
<p>That seems to be the <a href="https://www.eff.org/deeplinks/2022/04/scraping-public-websites-still-isnt-crime-court-appeals-declares" rel="nofollow noreferrer">EFF interpretation too</a>. And the <strong>terms of service seem not to count,</strong> as far as I understand.</p>
<p>I would like insight in the following situations:</p>
<ul>
<li>What if we scrape using a username/pwd?</li>
<li>What rule applies when the 2 parties are in different countries?</li>
</ul>

<p>The U.S. 9th Circuit Court of Appeals ruled on September 9 that the U.S.'s Computer Fraud and Abuse Act (CFAA) is not violated when a company scrapes public websites.</p>
<p>Though, I suspect that scraping identity or access codes when access was not granted to you could be considered theft.</p>
<p>Also, see: <a href="https://law.stackexchange.com/a/706/44887">Is it legal to share a script that scrapes a website and presents in a different format?</a></p>
<p>I've always enjoyed programming scrapes...gratifying and relaxing, like sudoku or Tetris. :-D</p>
<p>-shelDev</p>

<p><strong>The CFAA is filled with words and phrases like &quot;intentionally&quot;, &quot;knowingly&quot;, &quot;with intent&quot;, which allows web scrapers that play by the rules</strong></p>
<p>Search engine crawlers are also web-scrapers, with some extra steps.  In general, search engines respect what's in the <a href="https://developers.google.com/search/docs/advanced/robots/intro" rel="nofollow noreferrer">robots.txt</a>.  That generally means they <strong>do not</strong> use username/passwords to scrap.</p>
<p>Most websites want you to scrap them - that's how Google works.  What they don't want is you making too many requests per minute, which takes computing power away from humans, or accessing personal user information, which is why scrapers don't use username/passwords regularly.</p>
<p>The CFAA explicitly mentions unauthorized access</p>
<blockquote>
<p>(1) <strong>having knowingly accessed a computer without authorization or
exceeding authorized access,</strong> and by means of such conduct having
obtained information that has been determined by the United States
Government pursuant to an Executive order or statute to require
protection against unauthorized disclosure for reasons of national
defense or foreign relations, or any restricted data, as defined in
paragraph y. of section 11 of the Atomic Energy Act of 1954, with
reason to believe that such information so obtained could be used to
the injury of the United States, or to the advantage of any foreign
nation willfully communicates, delivers, transmits, or causes to be
communicated, delivered, or transmitted, or attempts to communicate,
deliver, transmit or cause to be communicated, delivered, or
transmitted the same to any person not entitled to receive it, or
willfully retains the same and fails to deliver it to the officer or
employee of the United States entitled to receive it;</p>
</blockquote>
<p>So stealing a password is illegal, but the CFAA goes further.  Even using a legit password for unauthorized purposes is illegal.</p>
<p>The case of most interest is probably <a href="https://en.wikipedia.org/wiki/United_States_v._Swartz" rel="nofollow noreferrer">U.S v Aaron Swartz</a>.  A Harvard faculty member a with valid JSTOR login created a scraper to download all the JSTOR content.  In order to get around scraper protections on JSTOR, he plugged into a data closet directly and did some other technical wizardry.  He was charge by the government with felonies and committed suicide.</p>
<p>In this case, he had a legal username/password but wasn't allowed to scrap the site.  The government felt he exceeded his access authority and charged him, even though he had authorization to access the site.</p>
<p>Your other question about people in 2 different countries is very easy and completely unrelated.  The law that applies is the country where the computer running the scraper is located.  That's why it's next to impossible to prosecute the hackers that hijack facebook accounts and push forex scams - they're not in America.</p>

internet fraud