Joe,
@JoePetewrote:
Two aspects of physical trespass recognized in many US states are- Some sort of intent - you know you're not supposed to be there but you go there anyway.
- The property owner has to give you some sort of warning.
One of the problems that I think we run into is that we often attempt to describe the online world through physical parallels and analogies without running them to their end. As you point out, in the physical world trespass often requires notice and then willful disobedience of the notification.
The problem with applying this physical parallel to the online world is that we often stop here. The logical translation of this parallel to the online world means that there has to be some banner announcement or click-wrap agreement telling someone they're not welcome to meet the online version of "notice."
We've failed to fully apply the custom from the physical world in that context. In the physical world we equate certain physical barriers (like a locked door) with notice. For example, a locked door doesn't mean we can crawl in through the bathroom window or smash the front windows with a brick. It generally means "go away"; or at most, come back and try [to open the front door normally] again later. A host that answers the door, telling you the business is closed for a private party for township residents doesn't mean you can then lie about your home address (or IP address) to gain admittance. Knowingly providing materially false information (an address) that is relied upon to confer a benefit (admittance) is the textbook definition of fraud.
@JoePetewrote:
For security researchers, let's say someone is just probing different networks, access points, I think we need to define at one point you in fact trespass vs. you are just looking around. If you manage to obtain an IP address on a network that could be an important distinction. But if all I am doing is intercepting, examing WiFi traffic or doing a port scan of an Internet facing server, to me that is the equivalent of standing at the edge of someone's property and looking.
I'm with you here, but you also changed the scenario. This is less on par with the arguments that were being made by security researchers, and more on par with a civil case involving Google mapping WiFi hot-spots. Google eventually won in appeals.
Let's talk about looking around. We can't throw a brick through the window; or send a destructive packet without invoking the CFAA's damage clause. So, let's assume that we sent data but it's just getting dropped. We might make an assessment that the target is using 802.1x, MAC or IP filtering. In my opinion, that's as far as looking around goes. That is the equivalent of seeing something that looks like a bathroom window on the side of the building.
If you then change your MAC or IP address to gain access, you have done the equivalent of walking up and opening the window on the precipice of going inside; or lied about your home address and age to the bouncer at the front door. In the physical world you can stop there and turn away. You can open the window (presumably without sticking your fingers inside - known as crossing the threshold) or lie to the bouncer, and then never actually go inside the building. In the online world you can't well separate the preparatory act of transmitting the spoofed-MAC/IP packet (either opening the window or lying to the bouncer) with the functional act of accessing the network (going inside the building).
EDIT: These acts online simultaneously cross the threshold and place the actor inside the network. In my opinion therefore, an actor just gained Access to the system using the common definition of access. Because they had to lie about the origin of their traffic by masking their MAC or IP Address, circumventing an Access Control List, then it was Unauthorized. Hence, Unauthorized Access.
