Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

You Wouldn't Scrape the Internet to Make an LLM

Kurt Opsahl

PolicyTalks22 minBeginnerOpen on YouTube ↗

Where

Talks
ShmooCon 2024

Duration

22 min

Explains how US copyright, hacking and privacy law apply to scraping public web data for training AI models.

Summary

Kurt Opsahl opens by noting that large language models are commonly trained on data scraped from the internet, and that this has prompted lawsuits and a policy debate. He presents the talk as a primer on the legal side of scraping, and warns that rushed reactions to AI could bring collateral damage to the open web.

The talk then covers three main areas of law. On copyright, facts and ideas are not protected, and fair use often depends on whether a use is transformative. He reviews earlier cases on image search, book search and video search to show how courts have treated scraping. On hacking law, he discusses the Computer Fraud and Abuse Act, the Van Buren decision, and the LinkedIn and Power Ventures cases. His view is that terms of service alone should not turn scraping of public pages into unlawful hacking. US privacy law is patchy, so protection comes from FTC enforcement over deceptive statements and from state laws such as Illinois' biometric statute.

The closing section looks ahead. New AI-specific laws may be hard to write well, and automated analysis of personal data could enable mass surveillance even when it is accurate. The practical takeaway is that scraping publicly available information is generally defensible, while protecting non-public data requires technical controls such as authentication, access controls and encryption.

Related talks