Amazon Chutzpa: Do Unto Others What You Block

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

When Amazon launched a one-day promotion this month aimed at getting its customers to go into brick-and-mortars and select items they wanted to buy at Amazon for a 5 percent discount, it was engaging in a deliciously ironic act. Why? Because although what it was doing to those physical stores was likely legal, had those stores tried doing the same to Amazon, it would have been illegal, thanks to Amazon's posted policies.

That policy phrasing is not even universal—or even common—among major E-tailers. Both Sears and Best Buy's Web sites, for example, contain no similar language that would prohibit Amazon or others from accessing their pricing information, although they do prohibit certain types of interference with the operation of the Web site through the use of bots or spider programs.

Was it indeed crowdsourcing trespass? At one level, this wasn't especially new. Retailers have gone into rivals to check out their pricing for as long as stores have existed. The difference in what Amazon did was twofold: The scale it deployed—trying to get millions of its shoppers to do it all during the same 26-hour period—and the fact that it cleverly used the store's customers. If someone who is known to store management as an Amazon employee walks into a Macy's or Target wearing an Amazon windbreaker and scanning price after price with an Amazon-labeled device, the store has every right to throw that person out. But by getting the store's own customers to do it, that makes the defense much more tricky.

(Related story: Amazon Price-Check Program’s Critics Have The Wrong Facts And The Wrong Attitude)

Besides, Amazon long ago developed an app to do something very similar—to examine a product (or the serial number, SKU or barcode of that product) observed in a brick-and-mortar store and transmit this information to Amazon for price comparison. Although Amazon's activities were, shall we say, unseemly and possibly anticompetitive, because of a quirk in cyberlaw and trespass law, had the brick-and-mortar retailers done the same thing to Amazon, their executives could have gone to jail.

Pricing information is both highly sensitive and highly public. Although anyone can go to a store and see what it is charging for a product, the mass collection and use of this pricing information can result in civil and criminal issues.

Take, for example, Ronald Kahlow, a software engineer from Reston, Va.Take, for example, Ronald Kahlow, a software engineer from Reston, Va., who in 1997 walked into a Best Buy store that advertised it had the "lowest prices." In the days before smartphones, Kahlow typed the prices into a laptop computer strapped to his waist. He was asked to leave the store, as a clerk removed the price tags so he couldn't record them. When Kahlow returned the next day with a pad and paper, he was followed through the store and then arrested for trespass. Although he was acquitted in Fairfax County Court, the case illustrates the problem with capturing public pricing information in a way or for a reason that the retailer doesn't want.

A retailer, as the owner of property, can put conditions on your use or presence at the store. Sort of: "If you want to shop here, you must agree not to capture the prices for commercial purposes." If you violate these terms, you are trespassing, and can be arrested. Just as a club or concert arena may have a "no cameras" policy, a store could have a "no recording pricing" or "no sharing pricing" policy.

But to prosecute for trespass, you would have to show that the policy was well known, well advertised and that the customer was told their actions were unauthorized and could lead to their being banished. Not very likely. Indeed, many stores (including Best Buy) routinely send out their own "spies" to capture competitor's pricing data. What Amazon did was to enlist its customers' help. So, in essence, if there was a "trespass" it wasn't by Amazon but by its customers. Pretty clever.

Now, if a brick-and-mortar store were to do the same thing to Amazon (either directly, by "bot" or by crowdsourcing), there would be an entirely different result. Access to Amazon's Web site (which contains its pricing data) is restricted by its Terms of Use, which states:

Amazon grants you a limited license to access and make personal use of this site and not to download (other than page caching) or modify it, or any portion of it, except with express written consent of Amazon. This license does not include any resale or commercial use of this site or its contents; any collection and use of any product listings, descriptions, or prices; any derivative use of this site or its contents; any downloading or copying of account information for the benefit of another merchant; or any use of data mining, robots, or similar data gathering and extraction tools. This site or any portion of this site may not be reproduced, duplicated, copied, sold, resold, visited, or otherwise exploited for any commercial purpose without express written consent of Amazon. (Emphasis added.)

Sauce for the goose?Sauce for the goose? The Amazon site makes it a violation of the Terms of Use not only for a commercial entity to scour the site for pricing but for a consumer to do so, either for commercial purposes or to use that information "for the benefit of another merchant." There have been numerous cases where competitors have violated such Terms of Use for the purpose of learning what their competitors are charging, and they have been criminally prosecuted.

For example, in a 2001 case in Boston federal court, the owner of a teen travel Web site was civilly sued under a criminal statute for accessing his competitor's public Web site (using a scraping program) to capture pricing data. Numerous other cases have held that violating a company's Terms of Use constitutes "exceeding authorized access" to that company's computer system and, therefore, constitutes both civil "trespass to chattels" and criminal trespass for which the user may be arrested.

Indeed, just last month in testimony before Congress, the Department of Justice's Richard Downing urged lawmakers to retain the provision in federal law that has been interpreted to prosecute such TOS rule breakers. Dowling noted:

"Businesses should have confidence that they can allow customers to access certain information on the business's servers, such as information about their own orders and customer information, but that customers who intentionally exceed those limitations and obtain access to the business's proprietary information and the information of other customers can be prosecuted."

So here is how the law currently stands. If a brick-and-mortar store proprietor, either directly or by bot or through its customers, violates a Web site's Terms of Use, it can be sued or prosecuted for trespass and possibly for tortuous interference with a business relationship, even though the information gained is public pricing data.

This is where crowdsourcing might help the brick-and-mortar folks. Using a "bot" to collect online data may violate the Terms of Service and, therefore, may subject the user to civil or criminal liability. Same thing may be true if, say, Sears hired legions of people to surf Amazon's Web site for competitive pricing data. But when I walked into Sears last week to buy a TV, there was no problem with me making "personal" use of Sears' computers to search for lower prices at Amazon.

It's not clear whether legions of users enlisted by a retailer to get information constitutes a "personal" or a "commercial" use of the computer. It would likely depend on the relationship between the crowd and the company. In any event, having engaged in the same conduct in the past, Amazon likely opens itself up to similar concerted activity against its own prices and services.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.