Court Rules Sending Too Many Emails Is "Hacking"

An anonymous reader writes "An appeals court has ruled that having people send a company a lot of emails (in this case, a union protesting a company's business practices) qualifies as hacking under the Computer Fraud & Abuse Act. We're not even talking about a true DDoS action here, but just a bunch of protest emails. Part of the problem is that the company apparently set up their email to only hold a small number of emails in their inbox, and the court seems to think the union should take the blame for stuffing those inboxes."

Actually, the union didn't lose.

[Animats]

Here's the actual decision. [courtlistener.com] First, the company's request for an injunction to stop the mail campaign, denied by the district court, is still denied. The claim under the Computer Fraud and Abuse act goes back to the district court, and can proceed there, but the appellate court makes no comment on the merits of that claim. The appellate court was only dealing with the issue of whether the Norris-LaGuardia act, which gives jurisdiction to the National Labor Relations Board when the behavior involved arises out of a labor dispute, preempted the Computer Fraud and Abuse Act . The appeals court decided that this isn't an NLRB matter, and goes back to the district court.

Nowhere does the ruling say "hacking"

[NiteShaed]

The law in question is called the Computer Fraud and Abuse act, and I'd say they're going with the angle of abuse. In this case, LIUNA seems to have been going for what amounts to a DDoS attack against the contractors phones and emails.

To generate a high volume of calls, LIUNA both hired an auto-dialing service and requested its members to call Pulte. It also encouraged its members, through postings on its website, to “fight back” by using LIUNA’s server to send e-mails to specific Pulte executives. Most of the calls and e-mails concerned Pulte’s purported unfair labor practices, though some communications included threats and obscene language.

Now, right or wrong, I can at least see the reasoning of the ruling, and this isn't just a clueless judge saying "Oh noes, they hax0r3d the company interwebs". LIUNA seems to have decided that they were going to use their membership and outside companies to shut down Pulte's communications. That they used individual members instead of a botnet to go after the email server seems irrelevant, the intent was clearly to beat the company into submission, not just to voice dissatisfaction. Had they not hired the guys with the autodialer it would have been much easier to believe they were just trying to make themselves heard.

Re:Got it wrong in one

[Anonymous Coward]

The union used an automated mailing system to send thousands of emails to a few email addresses... It wasn't only a bunch of people sending their own emails. Many emails were "threats and obscenities". The company told the union to stop because it was disrupting their service. The union intentionally continued knowing that it would cause the business problems. It wasn't a protest, it was revenge for firing employees.

Their intent was clear. To disrupt business by hammering the mail servers. That is very similar to a DDOS attack and how it affects a business, (i.e. making resources unavailable).

If the union had no idea that it would kill the mail server then I would agree. But the Union knew and was first asked to stop before litigation.

Re:Got it wrong in one

[todrules]

To quote from TFA: "Damage alone, however, is not enough for a transmission claim. A defendant must also cause that damage with the requisite intent."

The brief goes on to explain, in detail, how it comes to the conclusion that LIUNA had the intent to cause damage:

"The following allegations illustrate LIUNA’s objective to cause damage: (1) LIUNA instructed its members to send thousands of e-mails to three specific Pulte executives; (2) many of these e-mails came from LIUNA’s server; (3) LIUNA encouraged its members to “fight back” after Pulte terminated several employees; (4) LIUNA used an auto-dialing service to generate a high volume of calls; and (5) some of the messages included threats and obscenity. And although Pulte appears to use an idiosyncratic e-mail system, it is plausible LIUNA understood the likely effects of its actions—that sending transmissions at such an incredible volume would slow down Pulte’s computer operations. LIUNA’s rhetoric of “fighting back,” in particular, suggests that such a slow-down was at least one of its objectives. The complaint thus sufficiently alleges that LIUNA—motivated by its anger about Pulte’s labor practices—intended to hurt Pulte’s business by damaging its computer systems.

LIUNA attempts—but fails—to justify its conduct. Though it maintains that the calls and e-mails are “fully consistent with an ongoing, lawful, organizing campaign” through which it “is attempting [only] to organize Pulte employees,” LIUNA offers no explanation of how targeting Pulte’s executives and sales offices—rather than employees eligible for recruitment—advances its campaign. And an equally, if not more, plausible explanation is that LIUNA intended to disrupt Pulte’s business by bogging down its computer systems."