This is a really good response. Even if it's a violation of CFAA, most companies or websites would rather implement cheaper options like better systems or even, better rules, then waste such legal fees in pursuing an individual. I have yet to see a single news article about someone being sued for ban evading, even to break a site's ToS repeatedly.

@nolsen however, note that many people have been convicted and received harsh sentences under the CFAA for reasons that many computer professionals think are silly nonsense. It covers almost everything you can do on a computer that someone doesn't like. (IANAL)

There is precedent that using a computer that you are allowed to use to defraud your employer is not covered by CFAA. For example, entering wrong numbers into your expenses report. Or in one case, a shop worker whose job it was to sell lottery tickets and print them using a computer, who printed 1000 tickets a week for herself without paying.

@gnasher729 As far as I can tell that's not the case though, since the person has already been told they aren't allowed to use the site.

I’m not a lawyer either, but I would not be surprised were some imaginative prosecutor to try to apply trespassing laws to the situation.

@IllusiveBrian a site operator cannot commit itself to never changing their mind.... at least not in any legal regime I can think of. A future commitment can only be made to another party. One cannot enter into a contract with oneself (to never do something in the future). So acquiring access, under false pretenses, after a ban has been issued would be no different than acquiring access, under false pretenses, after no ban has been issued. As long as an access is given, through a regular process established by the site's operator, the access would not be unauthorized.

@IllusiveBrian Actually, maybe a site's operator can make a future commitment, but only if the legal establishment becomes involved. A restraining order against a user would be such a commitment. It would still be potentially revocable, but not at will. It would require another action by the legal establishment.

@grovkin I'm not sure I understand your reasoning. If e.g. a patron at a bar breaks some bar rule and is told they are permanently banned from the property, they are still trespassing even if they come back the next day with a fake mustache.

@IllusiveBrian not if the bar's proprietor invites them in. If they get a restraining order against them though, then it would be a violation of the restraining order regardless of whether the proprietor invited them in or not.

@grovkin Sure, but that would be analogous to the ban being lifted by the site operator, wouldn't it? Just hitting the "new account" link and following it is more like opening the door, there's no human you're interacting with to do it, and you've already been told you aren't allowed to do it by the site. I guess it depends on what level of access is considered "unauthorized" given that you have been told by a site owner not to use the site and that ban has not been lifted.

@IllusiveBrian no, it would not be an equivalent to the ban being lifted. If it were, you wouldn't use it as an example. If the example it to be meaningful, then it would have to be a situation in which the proprietor doesn't recognize that it is the banned person (because of the fake mustache). If a proprietor invites them in because they don't realize that it's the person they asked to never come back, then they would still be invited in, while a "ban" would still be in place. But the invitation would make it into not trespassing. Again, you can't make a legal commitment to your future self.

@grovkin OK, I see your logic now. However, I think that if I deceive you into thinking I'm someone else because you aren't willing to deal with me, I'm committing some kind of crime, even if it's fraud rather than trespassing. On the other hand, in the OP's example, if I gave you valid but different information to sign up to the site, I agree there is an argument that that access isn't unauthorized for the purpose of the CFAA. Perhaps we'd need to see an actual adjudication of a case like this to have a firm answer.

@IllusiveBrian re: "However, I think that if I deceive you into thinking I'm someone else because you aren't willing to deal with me, I'm committing some kind of crime..." This is why I said "acquiring access, under false pretenses, after a ban has been issued would be no different than acquiring access, under false pretenses, after no ban has been issued" The problem is that the question needs multiple considerations: (1) can a proprietor change their mind and (2) is acquiring access under false pretenses a criminal act. And these considerations are independent of each other.

@IllusiveBrian I should say "these considerations are independent of each other unless there is a specific law tying them together." In other words, unless there is a law which prohibits seeking access (a personal, commercial, or professional association) through a subterfuge specifically after a similar access has been revoked.

@gnasher729 there is definitely also opposite precedent that using a computer that you are allowed to use to defraud your employer is covered by CFAA; law.justia.com/cases/federal/appellate-courts/ca11/18-12024/‌​… rejects this argument and affirms the conviction of Van Buren by quoting an earlier precedent United States v Rodriguez 628 F.3d 1258 (11th Cir. 2010) that a person with authority to access a computer can be guilty of computer fraud if he misuses the computer and does things that exceed what he was actually authorized to do.

The only thing I would add to the answer is: Until we have case law (aka, binding legal precedent) on the specific issue of ban evasion, the legality is uncertain and any criminal charges would be at the discretion of the federal prosecutor.

@user253751 Where can I read more about such cases?

@nolsen: recall that this a criminal matter, so it might not be up to the company if they make an initial complaint.

@Peteris: In the case that you quote, I checked the court papers and there is no mention that the defendent claims the access was authorized. For example, the person running payroll at my company is authorized to put money into employees' bank accounts every month. If that person puts twice the correct amount into her own bank account, that is of course a crime, but not covered by CFAA because she is authorized to use the computer for this. If I steal their password and add more money into my account, then I'm not authorized.

"intentionally accesses a computer without authorization" - However if the computer is publicly accessible and hands out authorized login credentials to anyone who asks for them (i.e. open registrations), are you really "without authorization" because someone said "don't register accounts anymore" and then took no other measures to remove/prevent your access? You have a legitimate account the same as anyone else, and the system you're accessing with it considers your account fully authorized.

@gnasher729 both Van Buren and Rodriguez were using these systems in the course of their daily work and were accessing them with valid credentials issued by their employer. Rodriguez had technical access to look up personal details of people when neccessary in his work, but he (ab)used it to look up details of other people without such necessity because of personal interest, and was for this he was convicted to 12 months of jail for breaching CFAA. If the payroll event you describe happened in the same district as Rodriguez case, then that would be valid precedent for treating it under CFAA.

@gnasher729 the legal argument from the Rodriguez case (with which I personally disagree, but my opinion doesn't matter and the disctrict court's precedent opinion does matter) is that the person running payroll was authorized by their employer to use the computer system to put $X into his account but not authorized to put 2*$X into his account (no matter if there were some technical means for validating and enforcing this), so this use exceeds authorization. This is currently being challenged in Supreme Court; perhaps it will be overturned, or perhaps it will be affirmed and apply everywhere.

What Peteris just wrote make me wonder if "being-authorized-to" rules are Turing-complete.. I'm pretty sure it is. It's just awful.