Adam Smith

As was recently speculated about in the cowtool reward search thread, AC has filed suit against seats.aero.

You can read the complaint for yourself here. It contains a fair amount of detail not only on the alleged scraping and why AC thinks this is wrong (being neither a coder nor a lawyer, the allegation about "forged" API credentials seems interesting to me - if you have to forge some credential to access this data, is it really publicly available in the way US courts have previously deemed acceptable?), but also on the measures AC has used to try to shut them down.

AC is also going after them for using the AC/Aeroplan name and logo.

Note: the creator of seats.aero has posted a reply in this thread.
​​​​​​

canadiancow

I think I certainly timed that right.

expert7700

an "immense strain" on Air Canada's computer infrastructure.

hmm

​​​​​​

Sean Peever

Assuming they can prove the unauthorized access/impersonation, and that the brownouts were caused by the excessive load, they will likely be successful in getting damages as well.

canadiancow

I'd like to see numbers from both sides.

I've seen a lot of evidence of private "bots" for points brokers that I would think are hitting AC much harder than anything available to the public.

I don't care to comment on the law, but I'm happy to comment on the facts.

keitherson

at least it's public record now!

Sean Peever

Well, the key is prove. You can claim whatever you want, but you have to be able to actually prove it did the harm they are claiming. However, they've engaged with some fantastic companies according to the suit, so I would assume, barring any gross negligence, they will be able to prove it.

RatherBeInYOW

I am not a lawyer so I can't comment on the trademark stuff or other claims, although from what I know of this area they seem specious.

But as a software engineer the technology part (from what I can read in the complaint) ... is some horseshit. There are technological solutions to this problem, but AC didn't implement them and basically tried to use an Akamai front end to block access (and and a robots.txt file - lol) along with some legalese on their webpage to claim that this isn't allowed. They're also not forging credentials, they're just altering the HTTP header which isn't a crime. Neither is screen scraping, which has been upheld repeatedly (https://www.eff.org/deeplinks/2022/0...peals-declares).

Whatever software engineer wrote up the technology part of the complaint for ACs lawyers should be ashamed of themselves. I hope this guy has the EFF on speed dial and I hope AC loses. If you don't want people grabbing this information put it behind an authenticated API call, not on the open internet.

Jason77W

Perhaps if AP had a search tool that actually offers a feature like 'calendar view', then maybe we wouldn't be anticipating such demand for tools like seats.aero to begin with.

...that's not to say demands for rooms.aero wouldn't exist, though.

Sean Peever

Including the details about the Discord messages, the case against the scraper gains more weight. The individual was aware his activities were causing disruptions and took deliberate actions to circumvent barriers. This puts a different spin on the "open door" analogy. It's not just walking into an open house anymore; it's more like finding the door locked, then actively picking the lock to get in.

While this doesn't let Air Canada off the hook for their lack of robust security measures, it does provide them with a stronger position in the lawsuit. Both parties seem to have lessons to learn here. Air Canada needs to up their technological game to prevent such incidents, and the scraper needs to recognize the ethical and legal boundaries of his actions.

DrunkCargo

I think the use of "rapacious" and "soiling" are interesting word choices...

Smiley90

Air Canada having insufficient IT to handle searches isn't the fault of the person searching though...

Dave510

I just don't see a whole lot of merit in seats.aero's position. Air Canada has told them, in no uncertain terms, that their access is not welcomed and has put in barriers to accessing the relevant data. Saying it's "not very secure" isn't really a strong argument, anymore than I can break into a house and claim it's public because the lock isn't very good, when there's a huge sign outside saying no trespassing and an effort made at securing the property.

DrunkCargo

The allegation is it was not a "person"

YOWgary

They might well be worse, but if Seats is the only one with a legal entity AC can identify to pursue in court, they're going to be the lightning rod.