If a restaurant had a 'terms of service' that said no reselling of food that they make, should you be open to federal prosecution if you stopped by to pick up food for yourself and some co-workers? Especially if someone gave you a few dollars for the trouble of running the errand? And even more, if the restaurant has their own delivery service?
Am I missing an important distinction here? Should private companies be able to make binding rules that open people up to criminal prosecution for something that doesn't violate any laws per se? A person breaking a specific law AND breaking a ToS makes sense. A person breaking a law BY breaking a ToS doesn't make sense.
I can't reply to this because no part of the example you provided constitutes a federal crime under the CFAA.
On the other hand, the criminal aspect of using a university's noncommercial JSTOR access to scrape a substantial portion of the entire database so you can put it on BitTorrent is not hard to understand.
It was unclear if what you were implying was that you shouldn't violate a ToS for your own profit (or at someone's expense) because it was a federal offense. (I can see now that that was not what you were trying to get at)
What are your thoughts on PadMapper vs CL? What is the distinction between scraping that data vs scraping this data that makes one worthy of federal prosecution, but not the other? Considering in both cases it was done for profit or detriment
Elements missing from a CFAA case for PadMapper include at least interstate commerce and intent to defraud.
Swartz's prosecution alleges --- credibly, given what Swartz allegedly posted prior to scraping JSTOR --- that Swartz intention was to liberate data from a commercial database onto file sharing networks, making intent a much easier case to prove. Moreover, the indictment is at pains to point out that MIT and JSTOR repeatedly attempted to stop Swartz from continuing his plan, and found themselves in a cat-and-mouse game with Swartz eventually trespassing to maintain access.
PadMapper found itself having exceeded Craigslist's terms, found out by having its access withdrawn and becoming the target of a civil suit, and did not (directly, at least) attempt to evade the countermeasures Craiglist applied to prevent them from obtaining further access.
Whether or not you believe Swartz did something wrong here (I do) or whether you think he should get a felony conviction for doing it (he probably shouldn't), you can see pretty clearly how JSTOR had no straightforward civil remedy to what Swartz was doing. Swartz was playing chicken with them, and he lost --- or rather, his bicycle collided with JSTOR's semi truck at high speed.
Am I missing an important distinction here? Should private companies be able to make binding rules that open people up to criminal prosecution for something that doesn't violate any laws per se? A person breaking a specific law AND breaking a ToS makes sense. A person breaking a law BY breaking a ToS doesn't make sense.