Research On Cybercrime Involving Illegal Data Scraping And Information Theft
Cybercrime: Illegal Data Scraping & Information Theft
Illegal data scraping is the automated extraction of data from websites without authorization.
Information theft involves unauthorized access, copying, or use of data, which can include trade secrets, proprietary databases, or personal information. Both can be addressed under criminal and civil law, depending on jurisdiction.
Key issues:
Unauthorized Access: Accessing data beyond permissions granted.
Breach of Terms: Violating website Terms of Service (ToS) or contracts.
Trade Secrets & Intellectual Property: Extracting proprietary datasets or algorithms.
Criminal Liability: Hacking statutes, fraud, or computer misuse acts.
Civil Liability: Misappropriation, breach of contract, trespass to chattels.
Detailed Case Studies
Case 1: Craigslist Inc. v. 3Taps Inc. (2013, USA)
Facts:
3Taps scraped Craigslist’s housing listings and republished them on other platforms.
Craigslist sent cease-and-desist letters and blocked IP addresses.
3Taps circumvented the blocks and continued scraping.
Legal Issues:
Whether scraping publicly accessible data could constitute “unauthorized access” under the Computer Fraud and Abuse Act (CFAA).
Ruling:
The court held that circumventing IP blocks and ignoring cease-and-desist letters constituted “without authorization” under CFAA.
Significance:
Even public data can be legally protected if access is explicitly revoked and technological barriers are in place.
Case 2: hiQ Labs, Inc. v. LinkedIn Corp. (2019, USA, 9th Circuit)
Facts:
hiQ scraped publicly available LinkedIn profiles for analytics.
LinkedIn sent a cease-and-desist letter demanding hiQ stop.
hiQ sued for injunction to continue scraping.
Legal Issues:
Does scraping public data after a cease-and-desist violate CFAA?
Can violation of ToS alone trigger criminal liability?
Ruling:
The 9th Circuit held that scraping publicly accessible profiles did not violate CFAA.
Contract or tort claims could still be possible.
Significance:
Publicly accessible data is generally not protected under criminal hacking laws, but civil liability is still a concern.
Case 3: United States v. Ivanov (2001, USA)
Facts:
Ivanov, a Russian national, hacked into Online Information Bureau servers in the US.
He stole confidential data and attempted extortion.
Legal Issues:
Extraterritorial application of CFAA.
Unauthorized access from a foreign country.
Ruling:
Court ruled U.S. laws applied since the effects were felt in the U.S.
Ivanov was convicted.
Significance:
Shows that cross-border unauthorized access and data theft is prosecutable under domestic laws.
Case 4: United States v. Agrawal (2013, USA)
Facts:
Samarth Agrawal, a bank analyst, copied proprietary high-frequency trading code and left to join a competitor.
Legal Issues:
Misappropriation of trade secrets.
Applicability of Economic Espionage Act and National Stolen Property Act.
Ruling:
Agrawal was convicted under trade secret and property theft statutes.
Significance:
Highlights that even internal company data and intangible information can be legally protected as property.
Case 5: Compulife Software Inc. v. Newman (2024, USA)
Facts:
Competitors scraped Compulife’s online life-insurance quote database.
Used bots to extract large volumes of data for commercial purposes.
Legal Issues:
Can scraping publicly available data constitute trade-secret misappropriation?
Ruling:
Court ruled that even public-facing data can be a trade secret if obtained by “improper means.”
Competitors were liable for damages.
Significance:
Public availability does not automatically remove trade-secret protections.
Case 6: Facebook, Inc. v. Power Ventures, Inc. (2016, USA)
Facts:
Power Ventures offered a service to consolidate social media accounts.
It scraped Facebook data, including messages and friend lists, despite users’ credentials.
Facebook blocked Power Ventures and sent cease-and-desist letters.
Legal Issues:
Does bypassing technical blocks and scraping constitute CFAA violation?
Ruling:
Court held Power Ventures violated CFAA by continuing after being blocked and warned.
Significance:
Confirms that ignoring technical and legal restrictions can trigger criminal liability for scraping.
Case 7: United States v. Morris (1989, USA)
Facts:
Robert Tappan Morris released the Morris Worm, which replicated across the internet.
Caused unauthorized access to thousands of computers.
Legal Issues:
Unauthorized access under CFAA.
Information theft and system damage.
Ruling:
Morris convicted; established precedent for prosecuting unauthorized access at scale.
Significance:
Early foundational case demonstrating criminal liability for unauthorized access to computer systems.
Case 8: LinkedIn vs. hiQ Labs Revisited (2022 Settlement)
Facts:
After prolonged litigation, LinkedIn and hiQ settled.
hiQ agreed to pay damages for violation of user agreements and certain scraping activities.
Significance:
Even when criminal liability may not apply, civil remedies for contractual violations are enforceable.
Summary Table
| Case | Type of Crime | Legal Basis | Key Takeaway |
|---|---|---|---|
| Craigslist v. 3Taps | Scraping after revocation | CFAA | Explicit revocation + tech barriers = unauthorized |
| hiQ v. LinkedIn | Public profile scraping | CFAA/Contract | Public data not criminal; ToS violations may be civil |
| US v. Ivanov | Hacking | CFAA | Extraterritorial liability for foreign hackers |
| US v. Agrawal | Trade secret theft | EEA & NSPA | Internal code/data is property under law |
| Compulife v. Newman | Database scraping | Trade-secret law | Public data may still be misappropriation |
| Facebook v. Power Ventures | Scraping blocked accounts | CFAA | Bypassing tech blocks = unauthorized |
| US v. Morris | Worm spreading | CFAA | Unauthorized system access is criminal |
| LinkedIn vs. hiQ (settlement) | Contract violation | Civil | Civil remedies enforceable even without criminal liability |
Key Observations:
Access Revocation Matters: Ignoring cease-and-desist notices + technical blocks usually triggers liability.
Public vs Private Data: Public data may not violate criminal law, but civil or trade-secret claims are possible.
Trade Secrets Apply to Data: Even databases with publicly accessible components may be protected if extracted systematically.
Cross-border Issues: Foreign actors can still be prosecuted if U.S. systems are affected.
Contract and ToS: Civil claims for violating terms are frequent in scraping disputes.
RELATED Blog
0 comments