US court rules masking IP address to access blocked Website violates law
U. S. District Judge Charles Breyer in Northern District of California has ruled that avoiding an IP address block to connect to a Website is a breach of the Computer Fraud and Abuse Act (CFAA). Some have taken this decision to mean that the court’s broad interpretation of the law may mean accessing Websites that are accessible only to some users by proxy servers, virtual private networks (VPN)s, or Tor may be illegal.
According to the court, neither 3Taps nor Padmapper can use Craigslist’s data for their online maps of available apartments.
This decision arose from a case that all started because, unlike many other popular sites, Craigslist does not provide an application programming interface (API) for third party services to use its data. Indeed, in the summer of 2012, Craigslist briefly claimed the copyright over everything posted on Craigslist.
Craig Newmark, founder of Craigslist, who says that he’s merely a “customer support representative” for the company, told Ars Technica last year that “I can say that our culture has always been community-driven, and what they tell us, in large numbers and for years, [is] that their posts are not to be used by others for profit. ” One of Craiglist’s sources of income is charging for commercial apartment listings.
The case in question, Craigslist vs. 3Taps, revolved around a copyright infringement claim by Craigslist against data gathering company 3Taps. 3Taps had been scraping Craigslist rental apartment ads and then feeding the data via an API to the apartment listing company PadMapper. This business, in turn, used the data to create interactive maps using Google Maps for would-be renters. Craigslist claimed that this violated its terms of service (ToS).
So typical of a ToS legal disagreement, PadMapper and 3Taps came up with a workaround. Craigslist retaliated with a copyright claim against the two companies.
As is so often the case in circumstances like this, 3Taps countersued, claiming that Craigslist was trying to create a monopoly by squeezing out other would-be online classified advertising businesses.
Craigslist then blocked 3Taps Internet Protocol (IP) addresses from accessing its site. 3Taps continued, however, to pull Craigslist’s data by concealing its identity with different IP addresses and proxy servers. Craigslist then argued that the 3Taps’ subterfuge violated the CFAA which prohibits the intentional access of a computer without authorization that results in the capture of information from a protected computer.
Craiglist’s CFAA claim bothered many experts.
The Electronic Frontier Foundation (EFF) in an amicus curiae to the Court stated that the CFAA had “been stretched to cover all sorts of non-hacking behavior. (PDF Link) This case perhaps represents the zenith of this trend: plaintiff Craigslist, Inc. (“Craigslist”) alleges defendant 3Taps Inc. (“3Taps”) violated the CFAA and Penal Code § 502 by copying data on Craigslist’s publicly available website and then republishing that information on its own website. Imposing CFAA liability under these circumstances means that it can now become criminal to copy and paste data from a publicly available website intended to be seen by as many people as possible on the Internet. A person using Craigslist to look for an apartment is authorized to write notes on a pen and paper, or manually plot apartment listings on a paper map. The same behavior should not be treated as criminal simply because it was done with a computer. ”
3Taps tried to have this CFAA claim thrown out but Breyer ruled that “This Court cannot grant an exception on to the statute (the CFAA) with no basis in the law’s language or this circuit’s interpretive precedent. Accordingly, the Court DENIES 3Taps’ motion. ” (PDF Link).
Orin S. Kerr, a professor of law at the George Washington University, believes Judge Breyer’s decision is the first to directly address the issue that changing IP addresses to get around a block is an unauthorized access in violation of the CFAA. It’s not a decision, he’s happy with.
Kerr wrote, “IP addresses are very easily changed, and most people use the Internet from different IP addresses every day. As a result, attempting to block someone based on an IP address doesn’t ‘block’ them except in a very temporary sense. It pauses them for a few seconds more than actually blocks them. ”
Another legal expert, who doesn’t wish to be named, doesn’t see this decision having any broad effect. He summarized the decision as “The defendant moves to dismiss a CFAA complaint because the operator of a publicly-available Website cannot, it says, ban any particular user and use CFAA to enforce the ban. The court says it can’t dismiss the complaint on that ground, because there’s no support for the claimed immunity in the specific wording of the statute. The court says it isn’t criminalizing widespread conduct, because the question involved (whether CFAA liability can attach for accessing websites one has been specifically banned from) doesn’t involve those ordinary forms of cloaking, ” such as proxies, VPNs, or Tor.
In short, this is a decision applying only to a narrow, specific circumstance.
Hanni M. Fakhoury, staff attorney for the EFF, disagrees with the decision, “The court held that since everyone is ‘authorized’ to access a publicly accessible website under the CFAA, a party (here Craigslist) has to prove that this authorization was somehow revoked. In this case, the court said Craigslist’s act of blocking 3Taps IP address and the cease and desist letter were enough to ‘revoke’ the authorization. We disagree that IP address blocking is a sufficient type of technological circumvention to prove ‘access with authorization’ under the CFAA since (1) its common and easy to mask your IP address; and (2) there are legitimate reasons to do so. ”
But could this decision affect you and your use of such IP masking technologies? Fakhoury replied, “As to whether it would impact other technologies like Tor, etc., the decision doesn’t criminalize those steps in isolation. The opinion only says that if you use one of these techniques to work around the revocation of your access, there’s a CFAA claim. ” So, while not a correct decision, it’s still rather narrow in its potential application.
Related Stories:
CNET: Court rules that IP cloaking to access blocked sites violates law
CNET: 3Taps countersues Craigslist, alleges unfair ‘monopoly’
CNET: Craigslist sues PadMapper for ‘mass harvesting’ listings
No more adult services on Craigslist: 1st Amendment issue or business decision?
How did Craigslist manage to become the king of classifieds?
How do I remove an IP ban? | Media Temple Community
Overview
Our network includes a number of security measures to ensure a clean, trouble-free environment for your hosting services. One of these features is an automatic mechanism that is intended to stop brute-force login attacks. This system monitors login attempts from FTP, SSH, and SMTP services. These automatic systems are intelligent enough to know not to block an IP address if you fail authenticating once or twice.
This is designed to combat automated attacks that keep trying to authenticate multiple times over a very short period of time. In other words, this component of our system is designed to identify the typical behavior of automated brute-force attacks and stop those requests from reaching our network. If these requests go un-checked, this results in wasted resources and affects the overall performance of your hosting services.
Here are some important points to consider:
If you are getting a timeout message in FTP or SSH, it is very likely that your IP was blocked. You will not get messages such as connection refused or invalid login.
A common cause for the bans we have seen is using incorrect usernames. Using just serveradmin as a username has been a common culprit from our observations. The proper format for a login on the Grid is: SSH: FTP:
Once a ban is removed, it may take a few minutes to be able to access the blocked services again. Typically, it will take about 5-10 minutes for this change to be reflected across our systems.
NOTES:
This IP ban also affects your ability to reach your website. If you are receiving a timeout error over HTTP, be sure to follow the instructions below to un-ban your IP address.
Instructions
How to remove an IP ban/block
First, log into your Account Center. You will automatically be prompted with a notification if there are any active IP bans:
Clicking on the UNBLOCK button will tell our systems to remove the block on the respective IP and you will be able to access services from that IP once more. This usually takes 5-10 minutes to take effect.
IMPORTANT:
IP bans are often the result of mail clients (Outlook, Mac Mail, Thunderbird, etc. ) with bad information that repeatedly attempt to log into a mail server. If you have recently changed an email address password, you will need to update it on all clients using that address (home pc, phone, work stations, etc. ) Also, we ask that you verify that your mail clients are using the proper email access domain. For help locating this, please navigate here. Once you have verified your access domain, verify your email credentials by logging into webmail.
Additional information
If you see a Contact Support link under the “Resolution” column, this means an administrator manually blocked traffic from that IP. This can be for a number of reasons including abuse of our servers. For this case, you will need to open a support request to have the block removed.
If you see an IP address on this list that is not one that belongs to you, it may be possible that someone is attempting to access your account. Fortunately, in these cases, the system will do its job and stop unwanted login attempts.
If you do not request an IP to be unblocked, it will still eventually expire. The “Block End Date” column specifies the date at which the IP ban will be automatically removed. No action is required on your part for this system to work as intended.
When an IP is banned, it only blocks traffic going to/from that specific IP. This features does NOT suspend or impede your hosting services in any way for others. As far as everyone else can see, your website and all its services are operating normally.
You can determine which IP address you are currently using by going to.
Ban/IP ban (7 days) | Roblox Wiki
Type of Ban
Description
Image
IP Ban (7 Days)
This type of ban is reserved for very severe violations of the Terms of Service or federal law. All players on this IP Address are blocked for 7 days (1 week) and will see a 403 error when trying to access the Roblox website. Using a VPN or changing your dynamic or static IP address in order to access one’s terminated account or create a new account can result if caught, the IP address is added to the list of banned IPs linked with the original banned IP. This can cause mistakes because anyone who logs in with that IP gets banned. Meaning, it’s an easy way to get a user banned, and if you got banned on a VPN, other unlucky people that had the same IP will get banned.
Old IP Ban notice (2012/13 to 2015)An IP Ban as shown on Google IP Ban Notice (light theme)New IP Ban Notice (dark theme)
Frequently Asked Questions about what is an ip ban
Is IP banning illegal?
Some have taken this decision to mean that the court’s broad interpretation of the law may mean accessing Websites that are accessible only to some users by proxy servers , virtual private networks (VPN)s, or Tor may be illegal. …Aug 21, 2013
What happens when you are IP banned?
When an IP is banned, it only blocks traffic going to/from that specific IP. This features does NOT suspend or impede your hosting services in any way for others. As far as everyone else can see, your website and all its services are operating normally.
How long do IP bans last?
Wiki Targeted (Games)Type of BanImageIP Ban (7 Days)Old IP Ban notice (2012/13 to 2015) New IP Ban Notice (light theme) An IP Ban as shown on Google Chrome. New IP Ban Notice (dark theme)