Netflix, HBOGo & Facebook Password Sharing Is Now a Federal Crime
Still using your ex's Facebook or Netflix account with a password you both used to share? Now you can both be brought up on federal crimes! A Ninth Circuit Court of Appeals ruling announced this past Wednesday officially declares that sharing passwords counts as a violation of the Computer Fraud and Abuse Act. Both Netflix and HBO Go passwords fall into this category. And if you're not careful, getting caught sharing these passwords could result in jail time.
This new law was set up as a catch-all for hacking, though in the past it has been widely used to prosecute behavior that wouldn't really count as hacking in the terms that we understand it to be. In this particular ruling from earlier in the week, former Korn/Ferry International employee David Nosal was accused of using a friend's password to access the research firm's database. It was deemed an unauthorized use of the computer system under the CFAA. Some are calling the ruling a 'nightmare scenario' for civil liberties groups. They claim that such a broad interpretation of the CFAA means millions of Americans are violating the federal law every time they share account information in regards to sites such as Facebook, Spotify and the various popular streaming services, which also include Amazon Prime and Hulu. Judge Stephen Reinhardt, who presided over this latest ruling noted the following.
"[This ruling] threatens to criminalize all sorts of innocuous conduct engaged in daily by ordinary citizens."
Judge Margaret McKeown, who was in the majority vote, had this to say about the unprecedented ruling.
"Nosal and various amici spin hypotheticals about the dire consequences of criminalizing password sharing. But these warnings miss the mark in this case. This appeal is not about password sharing."
McKeown's argument is that David Nosal wasn't just using a shared password. He was no longer authorized by the company to access their database at the time. He took a password from friend, a scenario which happens millions a times a day all across America on a number of different platforms. The argument is that the friend in question had no authorization to be sharing the password with anyone, violating the company's contract. The issue being argued, which stems from the language in the CFAA is that this ruling makes it illegal to access a computer system without proper authorization to each individual. McKeown goes onto state the following.
"Without authorization [is] an unambiguous, non-technical term that, given its plain and ordinary meaning, means accessing a protected computer without permission."
The big question this raises is, 'Who gives the authorization?' While Nosal wasn't granted authorization by Korn/Ferry to use the password, he was authorized the use of the password by the friend in charge of maintaining the password for security purposes. What the ruling declares in the long run is that we are no longer authorized to give a friend or loved one our Netflix or Facebook password. Only Netflix or Facebook as a company can specifically authorize who gets to use the password beyond the person who is assigned to the account. Once you share that password without getting an ok from the source company, you are in direct violation of breaking federal law. Judge Stephen Reinhardt goes onto say this.
"In the everyday situation that should concern us all, a friend or colleague accessing an account with a shared password would most certainly believe-and with good reason-that his access had been 'authorized' by the account holder who shared his password with him. The majority does not provide, nor do I see, a workable line which separates the consensual password sharing in this case from the consensual password sharing of millions of legitimate account holders, which may also be contrary to the policies of system owners. There simply is no limiting principle in the majority's world of lawful and unlawful password sharing."
Reinhardt, who appears to be an authority on hacking, claims that the decision loses site of the Computer Fraud and Abuse Act's purpose in controlling and maintaining its anti-hacking initiative. He argues that while obtaining and using a password that has not been give with permission definitely falls under the term hacking, having a friend offer up their password so you can watch their HBO Go account does not. It was also noted that each of the 50 states have their own, more narrow rules and laws when it comes to computer trespassing. It is Reinhardt's belief that this particular case would have been better suited for civil, not criminal, proceedings.
In the long run, this ruling probably won't affect anyone currently sharing their social media or streaming passwords, unless HBO and Netflix suddenly decide they want to prosecute millions of their costumers. At this juncture, neither company has made a move to do so. But the precedent has been set, and should give anyone thinking about sharing their password with a third party pause.
Motherboard, who brings this initial report, points out that the Ninth Circuit covers most of the West Coast including Silicon Valley, and many tech cases are tried here. This particular ruling is binding in this circuit, and will help define future guidelines as the issue comes up in other cases around the country.