The New American (15/11) states,
The U.S. Department of Justice (DOJ) is backing a controversial component of an existing computer fraud law that makes it a crime to use a fake name on Facebook or embellish your weight on an online dating profile such as eHarmony. The Computer Fraud and Abuse Act (CFAA), a 25-year-old law that mainly addresses hacking, password trafficking, and computer viruses, should enforce criminal penalties for users who violate websites terms of service agreements, alleges the Justice Department.
There are two ways to interpret the DOJ’s push to criminalize a breach of online terms of service.
The Civil-Libertarian Interpretation
The civil-libertarian interpretation is that the DOJ finds the use of fake names and information on the Internet to be a barrier to collecting the personal data it desires for monitoring peaceful behavior. But passing legislation to outlaw bad data would be a lengthy, problematic process, during which civil-liberties and privacy advocates would howl. Thus, the DOJ is attempting to sidestep the process by interpreting existing laws in a new way.
It wants to use the CFAA to enforce the online contracts that go into effect whenever a user registers and clicks the I Agree button. Specifically, the DOJ wants to apply a general-purpose prohibition against any computer-based act that exceeds authorized access.
Thus, in addressing Congress, the DOJ’s deputy computer-crime chief stated that this CFAA provision should be interpreted broadly enough to permit prosecutions based upon a violation of terms of service or similar contractual agreement with an employer or provider.
In the name of national security, the DOJ seeks to criminalize a tort violation that is usually viewed as trivial. Indeed, as Orin Kerr, a professor at George Washington University Law School, stated All of these sites, Facebook and Twitter included, have terms of service, which are written extraordinarily broadly. No one ever reads what those terms are. I’m a law professor. I just click yes.
If someone is found to be in violation of an online contract by, for example, using a fake name on Facebook, then the current penalty is to have his account closed and, perhaps, his ISP blocked from the site.
If the DOJ is successful, however, that offense could be prosecuted as a crime. Lying about your age or other personal characteristics on sites such as Match.com could be similarly criminalized.
Kerr continues,
If you read what those terms of service are, they’ll include things like all the information you give has to be accurate. You have to be a certain age, if you’ve given any information about things that you like, where you live. If any of that is inaccurate, you are technically in violation of the terms of service of the site. But if that is a criminally enforceable rule, then suddenly pretty much everybody who uses computers is a criminal. And it’s incredibly easy for the Justice Department to step in.
In short, the DOJ is seeking a vast, unprecedented power to regulate and criminalize the flow of information over the Internet. The DOJ is unlikely to use this new power against the lovelorn who shave 10 years off their ages, but that power would be available to be used against anyone at the DOJ’s own discretion.
The DOJ’s Interpretation
DOJ justifications range from fighting terrorism to combating the specter of inside trading. The most common justification, however, is one seemingly designed to capture public sympathy. The DOJ says it wants to be sure it can successfully prosecute the next Lori Drew.
In 2006, a thirteen-year-old named Megan Taylor Meier committed suicide in reaction to cyber-bullying by Lori Drew, the mother of one of Megan’s schoolmates. Drew faked an identity on MySpace in order to conduct her cruel campaign.
The Federal Bureau of Investigation (FBI), which functions under the DOJ, investigated for a year before allowing the case to go public to the media. The case created a national sensation. In Missouri, where Megan had lived, it turned out that Drew could not be prosecuted because she had broken no existing law. (In response, the state’s harassment law was later expanded, so that it became a crime for adults over 21 to use a phone or electronic device to cause emotional distress to children under 18.)
Propelled by cries of Justice for Megan!, prosecutors then charged Drew in California (where the headquarters of MySpace is located) with three felony counts of violating the CFAA and one felony count of conspiracy to violate. In order to make the charges better fit the CFAA, which was designed to prevent hacking, the prosecutors argued that Drew’s violation of the service contract was akin to hacking into MySpace’s computers for criminal purposes.
In 2008, a California jury convicted Drew of three lesser, misdemeanor charges. The convictions were reversed on appeal. U.S. District Judge George Wu stated that allowing the convictions to stand basically leaves it up to a website owner to determine what is a crime and therefore it criminalizes what would be a breach of contract.
He further stated that the government’s interpretation of the CFAA would give prosecutors the ability to criminally convict anyone who violated online terms of service. This, Wu argued, would convert a multitude of otherwise innocent Internet users into misdemeanant criminals.
Conclusion
The DOJ is asking Congress for sweeping new powers that have the potential to impact most people in America. On November 18, a DOJ representative provided the Internet civil-liberties guru Declan McCullagh of CNET with a transcript from a Congressional hearing. The purpose was to assure McCullagh and his readers that the DOJ is in no way interested in bringing cases against the people who lie about their age on a dating site or anything of the sort.
And yet, a Left-Right coalition that includes the ACLU, the Electronic Frontier Foundation, and FreedomWorks warns of just that. In a letter sent to the Senate, the coalition stated, If a person assumes a fictitious identity at a party, there is no federal crime. Yet if they assume that same identity on a social network that prohibits pseudonyms, there may be a CFAA violation. This is a gross misuse of the law. (PDF)
Understandably, people are reluctant to grant government widespread and vague powers over their daily lives. And the criminalization of any tort is a power best denied.
Even if the DOJ’s reassurances to Congress and the public are sincere, the agency is prone to mission creep, and muscles tend to be flexed. Indeed, the DOJ’s attempt to radically expand the interpretation of the CFAA beyond its original intent is a testament to mission creep.
Of the two interpretations, it is better for freedom to be safe than sorry.
