captcha solving

[Captchakiller]

Hi,

I would like to set up a service that solves captchas (the visual confirmation images when registering to certain websites/forums). This will allow bots to do fully automated account creation on various big social networking sites like myspace.

The bot owner sends the captcha to my api, and my api will forward it to data entriers and return the turing test answer to the bot.

I was wondering if there might be any legal issues providing such service? The big companies definitely won't like it but would I be breaking any laws?

 

[Michael Wechsler]

Hi,

I would like to set up a service that solves captchas (the visual confirmation images when registering to certain websites/forums). This will allow bots to do fully automated account creation on various big social networking sites like myspace.

The bot owner sends the captcha to my api, and my api will forward it to data entriers and return the turing test answer to the bot.

I was wondering if there might be any legal issues providing such service? The big companies definitely won't like it but would I be breaking any laws?

In the terms of use I've written I specifically put in clauses that deal with bots and the like and forbid them. If you pick the right party to aggravate they will try to stop you. Cases such as the following forbid screen scraping by calling it "trespass to chattels" - think of it as though your program is invading their borders to obtain information that you are not given permission to use in the manner you are using it. While not the perfect analogy, here are a few cases to get you started:

American Airlines v. FareChase, Inc., (Texas District Court, 67th District, Tarrant County, Texas, 2003

eBay, Inc., v. Bidder's Edge, Inc. (U.S. District Court for the Northern District of California, 2000)

Register.com, Inc. v. Verio, Inc., (U.S. District Court for the Southern District of New York, 2000)

Here are some excerpts below:

 

[Michael Wechsler]

IN THE UNITED STATES DISTRICT COURT
FOR THE NORTHERN DISTRICT OF CALIFORNIA

NO. C-99-21200 RMW

ORDER GRANTING PRELIMINARY
INJUNCTION

[Docket Nos. 6, 12]

EBAY, INC.,
Plaintiff,

vs.

BIDDER'S EDGE, INC.,
Defendant.

Plaintiff eBay, Inc.'s ("eBay") motion for preliminary injunction was heard by the court on April 14, 2000. The court has read the moving and responding papers1 and heard the argument of counsel. For the reasons set forth below, the court preliminarily enjoins defendant Bidder's Edge, Inc. ("BE") from accessing eBay's computer systems by use of any automated querying program without eBay's written authorization.

I. BACKGROUND

eBay is an Internet-based, person-to-person trading site. (Jordan Decl. ¶ 3.) eBay offers sellers the ability to list items for sale and prospective buyers the ability to search those listings and bid on items. (Id.) The seller can set the terms and conditions of the auction. (Id.) The item is sold to the highest bidder. (Id.) The transaction is consummated directly between the buyer and seller without eBay's involvement. (Id.) A potential purchaser looking for a particular item can access the eBay site and perform a key word search for relevant auctions and bidding status. (Id.) eBay has also created category listings which identify items in over 2500 categories, such as antiques, computers, and dolls. (Id.)

Users may browse these category listing pages to identify items of interest. (Id.) Users of the eBay site must register and agree to the eBay User Agreement. (Id. ¶ 4.) Users agree to the seven page User Agreement by clicking on an "I Accept" button located at the end of the User Agreement. (Id. Ex. D.) The current version of the User Agreement prohibits the use of "any robot, spider, other automatic device, or manual process to monitor or copy our web pages or the content contained herein without our prior expressed written permission." (Id.) It is not clear that the version of the User Agreement in effect at the time BE began searching the eBay site prohibited such activity, or that BE ever agreed to comply with the User Agreement.

eBay currently has over 7 million registered users. (Jordan Decl. ¶ 4.) Over 400,000 new items are added to the site every day. (Id.) Every minute, 600 bids are placed on almost 3 million items. (Id.) Users currently perform, on average, 10 million searches per day on eBay's database. Bidding for and sales of items are continuously ongoing in millions of separate auctions. (Id.) A software robot is a computer program which operates across the Internet to perform searching, copying and retrieving functions on the web sites of others.2 (Maynor Decl. ¶ 3; Johnson-Laird Decl. ¶ 15.)

A software robot is capable of executing thousands of instructions per minute, far in excess of what a human can accomplish. (Maynor Decl. ¶ 3) Robots consume the processing and storage resources of a system, making that portion of the system's capacity unavailable to the system owner or other users. (Id.) Consumption of sufficient system resources will slow the processing of the overall system and can overload the system such that it will malfunction or "crash." (Id.) A severe malfunction can cause a loss of data and an interruption in services. (Id.)

The eBay site employs "robot exclusion headers." (Id. ¶ 5.) A robot exclusion header is a message, sent to computers programmed to detect and respond to such headers, that eBay does not permit unauthorized robotic activity. (Id.) Programmers who wish to comply with the Robot Exclusion Standard design their robots to read a particular data file, "robots.txt," and to comply with the control directives it contains. (Johnson-Laird Decl. ¶ 20.)

* * *

1. Trespass

Trespass to chattels "lies where an intentional interference with the possession of personal property has proximately cause injury." Thrifty-Tel v. Beznik, 46 Cal. App. 4th 1559, 1566 (1996). Trespass to chattels "although seldom employed as a tort theory in California" was recently applied to cover the unauthorized use of long distance telephone lines. Id. Specifically, the court noted "the electronic signals generated by the [defendants'] activities were sufficiently tangible to support a trespass cause of action." Id. at n.6. Thus, it appears likely that the electronic signals sent by BE to retrieve information from eBay's computer system are also sufficiently tangible to support a trespass cause of action.

In order to prevail on a claim for trespass based on accessing a computer system, the plaintiff must establish: (1) defendant intentionally and without authorization interfered with plaintiff's possessory interest in the computer system; and (2) defendant's unauthorized use proximately resulted in damage to plaintiff. See Thrifty-Tel, 46 Cal. App. 4th at 1566; see also Itano v. Colonial Yacht Anchorage, 267 Cal. App. 2d 84, 90 (1968) ("When conduct complained of consists of intermeddling with personal property 'the owner has a cause of action for trespass or case, and may recover only the actual damages suffered by reason of the impairment of the property or the loss of its use.'") (quoting Zaslow v. Kroenert, 29 Cal. 2d 541, 550 (1946)). Here, eBay has presented evidence sufficient to establish a strong likelihood of proving both prongs and ultimately prevailing on the merits of its trespass claim.

* * *

IV. ORDER

Bidder's Edge, its officers, agents, servants, employees, attorneys and those in active concert or participation with them who receive actual notice of this order by personal service or otherwise, are hereby enjoined pending the trial of this matter, from using any automated query program, robot, web crawler or other similar device, without written authorization, to access eBay's computer systems or networks, for the purpose of copying any part of eBay's auction database. As a condition of the preliminary injunction, eBay is ordered to post a bond in the amount of $2,000,000 to secure payment of any damages sustained by defendant if it is later found to have been wrongfully enjoined. This order shall take effect 10 days from the date on which it is filed.

Nothing in this order precludes BE from utilizing information obtained from eBay's site other than by automated query program, robot, web crawler or similar device. The court denies eBay's request for a preliminary injunction barring access to its site based upon BE's alleged trademark infringement, trademark dilution and other claims. This denial is without prejudice to an application for an injunction limiting or conditioning the use of any information obtained on the theory that BE's use violates some protected right of eBay.

 

[Michael Wechsler]

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF NEW YORK

REGISTER.COM, INC.,

Plaintiff,

v.

VERIO, INC.,

Defendant.

00 Civ. 5747 (BSJ)

Order

BARBARA S. JONES

UNITED STATES DISTRICT JUDGE

Introduction

Plaintiff Register.com, a registrar of Internet domain names, moves for a preliminary injunction against the defendant, Verio, Inc. ("Verio''), a provider of Internet services. Register.com relies on claims under Section 43(a) of the Lanham Act, 15 U.S.C. §1125(a); the Computer Fraud and Abuse Act of 1986, 18 U.S.C. §1030, as amended; as well as trespass to chattels and breach of contract under the common law of the State of New York. In essence Register.com seeks an injunction barring Verio from using automated software processes to access and collect the registrant contact information contained in its WOIS database and from using any of that information, however accessed, for mass marketing purposes.

I. Findings of Fact

The Parties

Plaintiff Register.com is one of over fifty domain name register are for customers who wish to register a name in the .com, .net, and .org top-level domains. As a registerar it contracts with these second-level domain ("SLD'') name holders and a registry, collecting registration data about the SLD holder and submitting zone file information for entry in the registry database. In addition to its domain name registration services, Register.com offers to its customers, both directly and through its more than 450 co-branded and private label partners, a variety of other related services, such as (i) web site creation tools; (ii) web site hosting; (iii) electronic mail; (iv) domain name hosting; (v) domain name forwarding, and (vi) real-time domain name management. Register.com has invested over $15 million dollars in equipment, software, service fees, and human resources in designing, developing, and maintaining its website and the computer systems necessary to host Register.com's Internet-based services. (See Gardos Decl. ¶6). It has also spent in excess of $25 million on advertising and brand promotion in the year 2000 alone, including through print, radio, and television media. (See Mornell Decl. ¶31).

In order to give its customers control over their receipt of commercial solicitations, Register.com provides them with the opportunity to "opt-in'' during the domain name registration process to receiving sales and marketing communications from Register.com or its co-brand or private label partners. Customers who do not opt-in to such communications are not solicited by Register.com or its co-brands. Significantly, Register.com's co-brand and private label partners have contracted with Register.com for the right to have their services featured on the www.register.com website. (See Mornell Decl. ¶18).

* * *

C. Computer Fraud And Abuse Act §§1030(a)(2)(C) and (a)(5)(C)

The issue of the scope of Verio's authorization to access the WHOIS database is also central to the Court's analysis of Register.com's claims that Verio is violating two discrete provisions of the Computer Fraud and Abuse Act ("CFAA''), 18 U.S.C. §1030 et seq.10

Register.com claims both that the use of software robots to harvest customer information from its WHOIS database in violation of its terms of use violates 18 U.S.C. §§1030(a)(2)(C) and (a)(5)(C), and that using the harvested information in violation of Register.com's policy forbidding the use of WHOIS data for marketing also violates those sections. That is, that both Verio's method of accessing the WHOIS data and Verio's and uses of the data violate the CFAA.

1. Verio's Use of Search Robots

Both §§1030(a)(2)(C) and (a)(5)(C) require that the plaintiff prove that the defendant's access to its computer system was unauthorized, or in the case of §1030(a)(2)(C) that it was unauthorized or exceeded authorized access. However, although each section requires proof of some degree of unauthorized access, each addresses a different type of harm. Section 1030(a)(2)(C) requires Register.com to prove that Verio intentionally accessed its computers without authorization and thereby obtained information. Section 1030(a)(5)(C) requires Register.com to show that Verio intentionally accessed its computer without authorization and thereby caused damage.

As discussed more fully in the context of the trespass to chattels claim, because Register.com objects to Verio's use of search robots they represent an unauthorized access to the WHOIS database.

The type of harm that Register.com alleges is caused by the search robots, including diminished server capacity and potential system shutdowns, is better analyzed under §1030(a)(5)(C), which specifically addresses damages to the computer system. Pursuant to the pertinent part 11 of §1030(e)(8), "the term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information that (A) causes loss aggregating at least $5000 in value during any 1-year period to one or more individuals.''

On this record Register.com has demonstrated that Verio's unauthorized use of search robots to harvest registrant contact information from Register.com' WHOIS database has diminished server capacity, however slightly, and could diminish response time, which could impair the availability of data to clients trying to get registrant contact information. Moreover, register.com has raised the possibility that if Verio's robotic queries of Register.com's WHOIS database were determined to be lawful, then other vendors of Internet services would engage in similar conduct. This Court finds that it is highly probable that other Internet service vendors would also use robots to obtain this potential customer information were it to be permitted. The use of the robot allows a marketer to reach a potential client within the first several days of the domain name registration, an optimal time to solicit the customer for other services. In contrast, if instead of using a search robot the service vendor obtains registrant contact information pursuant to a bulk license, the vendor must wait to receive the information on a weekly basis. As Eric Eden, the director of operation Henhouse wrote in an e-mail to a Verio employee "[c]onsistent testing has found that the faster we approach someone after they register a domain name, the more likely we are to sell them hosting.'' (Ex. 40 to Pl.'s Sept. 8, 2000 Motion).

If the strain on Register.com's resources generated by robotic searches becomes large enough, it cold cause Register.com's computer systems to malfunction or crash. Such a crash would satisfy §1030(a)(5)(C)'s threshold requirement that a plaintiff demonstrate $5000 in economic damages12 resulting from the violation, both because of costs relating to repair and lost data and also because of lost good will based on adverse customer reactions.

A potential harm which cannot be addressed by a legal or equitable remedy following a trial, such as the loss of customers that might result from a system shutdown or slowed response times complained of here, constitutes an irreparable injury. See Instant Air Freight Co. v. C.F. Air Freight, Inc., 882 F.2d 797, 799-800 (3rd Cir. 1989); Cyber Promotions, Inc. v. Apex Global Info.Servs., 1997 U.S. Dist. LEXIS 15344 at *7 (E.D. Pa. Sept. 30, 1997). A showing that a plaintiff may suffer a substantial loss of business if relief is not granted meets the standards for interim relief. See Doran v. Salem Inn, 422 U.S. 922 (1975).

Because Register.com has demonstrated that Verio's access to its WHOIS database by means of an automated search robot is unauthorized and caused or could cause $5000 in damages by impairing the availability of data or the availability of its computer systems, Register.com has established both irreparable harm and a likelihood of success on the merits of its claim that Verio's use of the search robot violated §1030(a)(5)(C) of the Computer Fraud and Abuse Act. Register.com is therefore entitled to injunctive relief based upon this claim.

* * *

V. Injunction

For the foregoing reasons and pursuant to Fed.R.Civ.P. 65, it is hereby ORDERED, that pending a final decision on the merits of plaintiff's claims, defendant Verio Inc., its officers, agents, servants, employees, successors and assigns, all persons acting in concert or participation with Verio, and/or acting on its behalf or at its direction (collectively, "Verio"), are enjoined from engaging in the following activities:

1. Using or causing to be used the "Register.com" mark or the "first step on the web" mark or any other designation similar thereto, on or in connection with the advertising, marketing, or promotion of Verio and/or any of Verio's services;

2. Representing, or committing any act which is calculated to or is likely to cause third parties to believe that Verio and/or Verio's services are sponsored by, or have the endorsement or approval of Register.com;

3. Accessing Register.com's computers and computer networks in any manner, including, but not limited to, by software programs performing multiple, automated, successive queries, provided that nothing in this Order shall prohibit Verio from accessing Register.com's WHOIS database in accordance with the terms and conditions thereof; and

4. Using any data currently in Verio's possession, custody or control, that using its best efforts, Verio can identify as having been obtained from Register. com's computers and computer networks to enable the transmission of unsolicited commercial electronic mail, reliant cable, or direct mail to the individuals listed in said data, provided that nothing in this Order shall prohibit Verio from (i) communicating with any of ice existing customers, {ii) responding to communications Register.com customer whose contact information is obtained by Verio from any source other Register.com's computers and computer networks.

VI. Bond

Pursuant to Fed.R.Civ.P. 65(c), plaintiff is ordered to provide security in the amount of $250,000.

SO ORDERED: