If not, why? If so, please provide US Federal code, or case law confirming this is the case.

  • Keep in mind that not all servers are in the USA, and the server's jurisdiction might apply. Therefore, you might get sued in North Korea, Germany, Canada, Mexico, or Russia - the laws might be slightly different there, and you may get a surprise when visiting. For an example, see en.wikipedia.org/wiki/US_v._ElcomSoft_Sklyarov – Piskvor left the building Oct 11 '10 at 10:33
  • @Piskvor - Interesting case, but yes, my focus is on US Federal code, or cases. Also, that case was in the US, and a federal jury found the charged parties not guilty of all four charges under the DMCA. – blunders Oct 11 '10 at 13:11
  • Good points. I was trying to find an illustration of "you can be accused of breaking a law in a country you never messed with", and this was the highest-profile case I could think of. IMO he was acquitted mainly because of the media storm that followed exposed the absurdity of the situation. It's possible that a less publicized case could have ended differently (but that's deep in "what-if" territory). – Piskvor left the building Oct 11 '10 at 13:20

US federal law pertaining to Fraud and related activity in connection with computers suggests that it is unlawful to:

intentionally access a computer without authorization or exceeds authorized access, and thereby obtain

information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602 (n) of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);

information from any department or agency of the United States; or

information from any protected computer;

Whether publicly-served log files are covered is really going to depend upon the information contained in the logs (i.e. if there are requests which include sensitive data) and the definition of "protected computer".

It's generally bad practice to expose log data, however, even if the logs do not clearly contain sensitive information, I'd say it is equally bad practice to go around reading other peoples' logs (even if it's not a criminal offense, you could still run afoul of a civil court if you're somehow using someone else's "semi-private" logs to your advantage).


Comments seem to be primarily focused on the definitions of legal terms and that's far beyond the scope of the answer - the judicial system hasn't figured it out yet, either.

| improve this answer | |
  • 1
    @danlefree - By logs, I mean HTTP access logs, or web stats. And in regards to "intentionally access a computer without authorization or exceeds authorized access" -- clearly the action would be intentional access to a computer, but access to directory/file that requires no authorization is NOT exceeding authorized access; IMHO. Make sense, or no? – blunders Oct 11 '10 at 4:47
  • 1
    I don't know that it's clearly exceeding authorized access. There are a lot of sites that broadcast their site statistics or have public logs. Google also regularly indexes unsecured logs. I think it's the webmaster's job to secure sensitive data or anything they don't want the public to have access to. If they don't and someone stumbles on it, that's the webmaster's fault. That said, the courts pretty much favor the site owners in cases like these. So even if the webmaster makes their log data publicly accessible, they can still sue others for "unauthorized access". – Lèse majesté Oct 11 '10 at 5:43
  • Although technically, the server needs to be (mis)configured to allow access and serve log files, IANAL. That said, clever lawyers have in the past convinced various courts that the technical details aren't important, and even though the site owners have been broadcasting their sensitive data, it's the other side's fault for reading them. So, definitely consult a lawyer before you do that. – Piskvor left the building Oct 11 '10 at 10:28
  • @Lèse_majesté, @Piskvor - "Courts" does not equal case law, please reference real cases if you're going to reference cases. Thanks! (FYI - My understanding is that courts misapply trespassing laws in cases like this, but I'm unable to find in cases to reference.) – blunders Oct 11 '10 at 13:07
  • @blunders: I don't recall any specific cases ATM, sorry. If I think of some, I'll update. – Piskvor left the building Oct 11 '10 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.