fnordprefect

Seconded. Great work.

Don't worry - the conversation in the anecdote does not reflect the true position in the major common law countries at least. The public shareholder model is not doomed or flawed on this account.

If an acquirer wants to acquire shares in a public company (or any company actually) it makes the offer to the shareholders and they are the ones who decide to accept or not. The proposed transaction is between the acquirer (who wants to buy the shares) and the current owner of those shares (the shareholder). The Board manages the company but is not itself an entity (it's a group of people) and cannot therefore own shares (tho individual directors can and usually do).

The Board can make a recommendation to its shareholders about whether it thinks the offer is fair or not (based on their usually greater knowledge of the company and its worth), but it is the shareholder who decides whether to accept.

The underlying suggestion that a Board or CEO is essentially forced to do something bad for the company because of some underlying obligation to make shareholders money etc etc is false. Directors owe fiduciary duties, but they are proscriptive, not prescriptive in this way. One of the most commonly repeated falsehoods is that the Board is under some duty to maximise profits etc - that is proved wrong not least by the existence of non-profits...

The closest analogy is someone owns and investment property being managed by a real estate agent. A buyer approaches and says "I will pay you $x for the land". The agent can say "Hey I rent this out all the time, it can earn $z over t years, so I think it's worth $x + y, or $x - y" but it's up to the owner to say yes or no.

The above ignores eg competition law issues (laws that prevent an acquirer buying companies where there is likely to be a substantial lessening of competition), potential conflicts for share-owning directors, and the myriad statutory considerations etc but is the basic underlying position.

I raised exactly this possibility with them when they announced their new model. Their support would not engage with this even as a possibility. Just assertions that everything would be completely secure.

Getting access to this data is the holy grail for attackers - it is preposterous not to have a local-only or "saved on iCloud only" model. Clearly the only reason they removed this ability was the juicy, juicy subscription revenue, which requires them to hold the data.

They may have avoided a breach this time but have they previously been breached? Will they be breached in future? The possibility of each is non-zero.

Needless to say, I'm still using the older version and am planning how to transition once it stops working after an OS update.

That's fantastic, thank you!

With respect, that's not right. I've advised Australian companies of all sizes (from one-man bands to ASX-listed companies) for decades, and they are very heavily motivated by avoiding bad press from a preventable accident, avoiding company and personal reputational damage, being fired, being sued personally (noting that eg D&O insurance almost invariably excludes fraudulent acts), suffering regulatory investigation/enforcement (including eg fitness to hold licences) and because a surprising number of people believe that it is important to do the right thing, and (contrary to popular belief on the interwebs) this doesn't change just because they are employed in a business.

In cases where there is intentional wrongdoing, existing laws already make complicit people liable both to civil action by people harmed, plus criminal or civil penalty provisions by ASIC (or the ACCC, depending on the industry and conduct). As a plaintiff, you typically join them to increase your potential pool of recoverable assets for your clients.

The same is true if there are breaches of the Australian Consumer Law, and the person has a particular level of knowledge that is below intention.

In cases of pure negligence, like this, if the negligence rises to a criminal standard, then criminal laws and penalties already apply. How and when this works has been a topic for over 50 years, since Tesco v Nattrass in the UK.

In other words, there are already very significant legal mechanisms in place, and by and large they work - and not all of them involve having executives personally liable. In any event, many already do, and this has been worked out carefully over a long period.

This is a straight up case of negligence, just via a different means and with different damage from usual. The only impediment to suing is the cost of doing so vs the damage suffered, which is still too high for the average person.

The usual way around this is via a class action, and there are already at least 2 being prepared that I know of. They will run and probably settle at some point. The main thing to be policed is to avoid the funders and solicitors taking too much of the proceeds, although that process is already in hand due to recent abuses.

It seems to be an LGBTQ-focused website, so it looks to be doing nothing more than viewing things from the viewpoint of (presumably) its biggest reader base...

> A corporation exists to make a profit, period. Suggesting otherwise is just emotional manipulation, albeit very profitable manipulation.

This is wrong. A corporation is just an artificial person. Like a person, it can seek a profit or not - eg charitable not-for-profits. There is no legal obligation either way.

> Am I missing something? To me, this ruling means that if a person is granted technical access to a computer system, then that person cannot be held criminally liable for anything they do with access to that system, even if the owner explicitly prohibits it.

What you are missing is that you are assuming that the CFAA is the only means by which Van Buren should be punished. So you are assuming that either the CFAA covers this abuse, or he gets off completely free.

The CFAA isn't the only means to deal with his conduct. Although it doesn't apply, he is still liable to be punished under whatever regime he was given access to it.

In simplified form:

He was granted access to the system pursuant to his employment - ie he was able to log into it, whereas the average citizen can't. Whatever conditions are applicable to that grant are the ones to apply when he abuses that access (eg if the policy says "you can only access this for these purposes, or you will be fired" then if he accesses it for a different purpose, they can fire him).

That is quite separate from the CFAA.

The CFAA is a parallel source of obligations, and is part of the criminal law.

Just because Van Buren breached the terms on which his employer let him access the database doesn't necessarily mean he committed a crime as well.

What SCOTUS did was say that the criminal law provision essentially deals with the "technical" side of access:

* if you get into a computer that you have no access to (ie hacking into it), you breach the relevant section.

* if you are authorised by the operator to have the technical means to access to certain info in the computer (eg permissions), and you do something to access other material, you breach the section (eg escalation of privileges)

* if you have the technical means to access the computer (eg log/password) and you access material that is permitted under those means (ie the user account), but you are not authorised to have that means of access (ie stolen login credentials), you also breach the section.

The problem with the interoperation that SCOTUS rejected was that under EULAs, the provider could essentially say "you can use our systems to log in and view information. But if we decide we don't like you, or you haven't paid your bill, or if you decide you are going to vote for politician X in the upcoming election, then if you actually view any information while you are logged in, you breach the act and commit a crime"

The rejected interpretation said: "authorised does not just mean you have been provided with the technical means to access the information, but also any additional conditions put on your use of the technical means by the person who granted it, which may change at any time" (eg change of policy, what is going through the user's mind)

So the answer to your observation:

> I feel pretty strongly that what van Buren did is a massive abuse of authority and it warrants punishment.

is: it is exactly that. But it is punishment to be delivered via the process granting him the access to the information (ie whatever sanctions apply to violation of departmental policy). What he did was a breach of that policy, leaving him open to whatever sanctions are provided in it. But it is not also a crime under the CFAA.