Law note · New York
New York Computer Trespass, notice-based revocation and circumvention presumption
What it asks of an app
- Do not continue accessing a New York-connected system, or circumvent a technical security measure, after the operator has given you actual notice, including a cease-and-desist letter, that your access is unwanted; this statute treats notice alone as sufficient to convert continued access into unauthorized access, without needing a technical block.
- Repeated exposure to terms of use posted on every response to your automated queries can support a trespass-to-chattels claim even without a signed agreement, under Register.com v. Verio (2d Cir. 2004).
- Independently gathering the same time-sensitive facts a competitor also gathers is not hot-news misappropriation under New York law; copying a competitor's own compiled output, rather than gathering the underlying facts yourself, is the fact pattern the surviving tort still reaches.
When LexLint raises it
crawls_web
What we found
Section 156.00(8) defines without authorization to mean using or accessing a computer, computer service, or computer network without the permission of the owner or lessor, or someone licensed or privileged by the owner or lessor, where such person knew that his or her use or access was without permission or after actual notice to such person that such use or access was without permission, an express, textual revocation rule under which a communicated notice, including a cease-and-desist letter, that access is unwanted converts continued access into without authorization access, without needing a technical block at all.
The same subsection also provides that the knowing use of a set of instructions, code, or computer program that bypasses, defrauds, or otherwise circumvents a security measure installed or used with the user's authorization shall be presumptive evidence that such person used or accessed such computer without authorization, giving circumvention its own statutory evidentiary weight.
Section 156.05 (unauthorized use of a computer, a class A misdemeanor) and section 156.10 (computer trespass, a class E felony, requiring either intent to commit a felony or knowing access to computer material) build on the same authorization definition.
Register.com, Inc. v. Verio, Inc. (356 F.3d 393, 2d Cir. 2004), a New York-originated dispute, affirmed a preliminary injunction on a trespass-to-chattels theory where an automated WHOIS-query tool kept accessing a database after repeated exposure to posted terms of use prohibiting that use, even though the defendant never signed an agreement, holding repeated notice sufficient.
National Basketball Association v. Motorola, Inc. (105 F.3d 841, 2d Cir. 1997), applying New York's hot-news misappropriation tort, held the tort survives Copyright Act preemption only narrowly (the plaintiff generates time-sensitive information at a cost, the defendant free-rides on it, the parties are direct competitors, and free-riding would substantially threaten the product's existence or quality), and on the facts found no violation because Motorola independently gathered its own underlying facts rather than copying the NBA's compiled product; a scraper that copies a compiled output rather than independently gathering facts could still fall within the surviving tort.
No reported New York case squarely applies section 156.00 to a plain scraping fact pattern with no notice and no technical barrier.