Thursday, September 10, 2009

Can a breach of contract be a crime? Not under the Computer Fraud and Abuse Act.

Last month, the United States District Court for the Central District of California granted defendant Lori Drew's motion to dismiss the case against her and overturn a jury verdict that had convicted her of the misdemeanor offense of "intentionally access[ing] a computer without authorization or exceed[ing] authorized access" under the Computer Fraud and Abuse Act (the "CFAA"), 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(A). (The opinion and, in pdf format, is here.) The jury had convicted Drew on the grounds that in accessing MySpace with the intent to harass Megan Meier she had she had intentionally accessed a computer "without authorization" or in a manner "exceed[ing] authorized access" because in doing so she breached MySpace's terms of service agreement. As a result of the harassment, Meier committed suicide.

According to the court, making the mere breach of a terms of service agreement a crime under the CFAA violates the constitutional right to due process because every breach of a terms of service agreement "does qualify [as a criminal offense under the CFAA], then there is absolutely no limitation or criteria as to which of the breaches should merit criminal prosecution. All manner of situations will be covered from the more serious (e.g. posting child pornography) to the more trivial (e.g. posting a picture of friends without their permission). All can be prosecuted. Given the 'standardless sweep' that results, federal law enforcement entities would be improperly free 'to pursue their personal predilections.'” Slip Op. at 31-32 (footnote and citation omitted).

The court pointed out too some specific examples of how far law enforcement officials could reach if the court were to reach a contrary conclusion:
Where the website’s terms of use only authorizes utilization of its services/applications upon agreement to abide by those terms (as, for example, the [MySpace terms of service (the "MSTOS") does herein), any violation of any such provision can serve as a basis for finding access unauthorized and/or in excess of authorization. One need only look to the MSTOS to see the expansive and elaborate scope of such provisions whose breach engenders the potential for criminal prosecution. Obvious examples of such breadth would include: 1) the lonely-heart who submits intentionally inaccurate data about his or her age, height and/or physical appearance, which contravenes the MSTOS prohibition against providing “information that you know is false or misleading”; 2) the student who posts candid photographs of classmates without their permission, which breaches the MSTOS provision covering “a photograph of another person that you have posted without that person’s consent”; and/or 3) the exasperated parent who sends out a group message to neighborhood friends entreating them to purchase his or her daughter’s girl scout cookies, which transgresses the MSTOS rule against “advertising to, or solicitation of, any Member to buy or sell any products or services through the Services.”
Slip op. at 29.

It would be odd if one could be a criminal for lying on a dating site while the dating service itself might not even be in breach of contract if it lied.                                                                                                            


  1. Risa Lander9/13/09, 9:35 PM

    I understand the court's rationale, however I disagree with its holding of reversing the jury's verdict. Since this is an egregious case, which resulted in someone's death, the defendant's actions shouldn't be compared with someone tagging another person's picture without their permission. The outcome of not abiding by the CFAA are distinct (i.e a friend may become mad for being tagged to a picture without his/her permission v. someone who commits suicide). Therefore, this case should be treated differently.

  2. It's true that this is distinct because of the tragic consequences of cyber bulling. However, I am not sure but I think the victim's family might be able to file an intentional infliction of emotional distress against the woman.

    But what she did is not criminal, even though there were tragic consequences to her actions. Congress could also pass a law giving criminal sanctions to abusive use of internet, but that might have first amendment concerns.