The Law, and Lori Drew

There's a case now before Judge Wu of the US District Court for the Central District of California which you may have heard of: The United States vs Lori Drew. Lori Drew is the Missouri woman who is suspected of contributing to the suicide death of a 13 year old Missouri girl by creating an online account for a fictitious 16 year old boy (Josh Evans) and using that account to befriend and ultimately "dump" the 13 year old. I think the basic facts (she created the account, she communicated with the 13 year old, the conversations are archived and available) are not in dispute. The question being decided here is if her conduct violates the Computer Fraud and Abuse Act (CFAA), and if so, she should be punished as a federal felon.

I don't think there's any question that Lori Drew acted maliciously and irresponsibly, especially for an adult. What she did is not morally defensible in any way; if and how she should be punished for her behaviour is a valid topic for debate, and should be a matter for the law to decide. However, in this case, it seems the Government decided the existing criminal statutes were inadequate; it seems that her actions may be covered as free speech, and may have been difficult to assign as a primary factor in the girl's suicide. Therefore the prosecutor decided to bring a case under the CFAA, which describes her actions as contrary to the Terms of Service of MySpace, and therefore an act of computer fraud and abuse.

While it's tempting to applaud the use of this unrelated statute to punish Ms. Drew, the consequences of expanding the reach of the CFAA will be troublesome. In effect, this case would imply that any time you violate the Terms of Service for an online site, you run the risk of being prosecuted as a federal felon. Think about that for a minute; how many online services do you use? Think of MySpace, Facebook, LinkedIn, Google Search, Google Docs, Yahoo, Windows Live, etc. Do you read the whole contract you're "signing" which grants you access to the site? Do you keep up with changes to the Terms of Service for each of the sites?

While this amicus brief from the Electronic Frontier Foundation (EFF) is 46 pages long, it's a good (hair-raising?) read. One of the points made early on is that these Terms of Service documents include provisions both important and trivial. Claims under the CFAA would cover both, thereby giving the operators of online sites the power to create federal felony offenses on the fly, so to speak. For example, Facebook and Ning want to keep for themselves the ability to show ads on their sites; if you figure out how to make an online "widget" or application which shows your ads to their members, they will accuse you of violating their terms of service. The reasonable consequence for that should be to deny you access to their systems; however, if this decision stands, they also will have the opportunity to get a federal prosecutor to charge you under the CFAA as well. That's unreasonable.