Traverse Internet Law: Internet Lawyers

Lori Drew MySpace Suicide Conviction Thrown Out

On August 28, Judge George Wu of the United States District Court for the Central District of California overturned the conviction of Lori Drew and dismissed the case against Lori Drew relating to the suicide of Megan Meier. The Judge found that for purposes of this criminal prosecution the Computer Fraud and Abuse Act, the federal law upon which the Jury returned a guilty verdict, was unconstitutionally void for vagueness. You’d have to be a master marksman to draft a User Agreement that would meet constitutional muster in the face of criminal indictment.

The Judge found that Congress had not established adequately and clearly the minimal guidelines to govern law enforcement, but the decision did not affect civil causes of action and the ability of websites to protect their properties using this law. 

Internet Lawyer: Dismissal of MySpace Criminal Case

Last week, the Judge in the MySpace criminal case indicated he found the statute, as applied in the case, to be unconstitional and is preparing a detailed opinion on the matter. It's a case that every Internet lawyer should be following, and that seems likely with all the commentary from Internet lawyer types weighing in on the case. The primary objection, again, according to the trial judge, is that if the statute is applied as it was in this case, vast numbers of MySpace members would be at risk of criminal prosecution. The debate will rage on, and at Traverse Internet Law our Internet lawyers are monitoring this decision and case.

Our Internet lawyers see this as another example of the need to draft specific laws addressing malicious actions. Congress and state legislatures need to pass a law that will make this type of conduct a criminal offense. We suspect there are civil lawsuits to come against the perpetrators. While every Internet lawyer waits to see how this will play out, and whether this Judge's interpretation will be adopted by other courts, none of whom it is binding upon, the legislative branches need to act. 

Even the most jaded free speech fanatic cannot help but wonder how we find ourselves, 15 years after the Internet took off commercially and moved into the public conscience, without adequate criminal laws to cover this type of misconduct.   

Internet Law: MySpace Suicide Case Dismissal

First, if you click on the "MySpace Suicide" category link to the right you can see what has been said about this case. You can see where Dozier Internet Law has been speaking out for almost two years about the problems with the Computer Fraud and Abuse Act. And as far as I can tell, Dozier Internet Law was the only legal voice online to not come out and attack this prosecution. Given the law as it exists today, though, the conviction makes sense. 

At sentencing yesterday for the conviction, the Judge delayed it until July 2 and is considering dismissing the charges and overturning the convictions. Here is what Dozier said last year when the case was being tried:

"I will say, however, that the facts of the MySpace Suicide case are ambiguous and complex, and I won't be surprised if the case is dismissed by the Judge post verdict or the jury returns a 'not guilty' verdict. Don't take that as a statement that the law does not apply to those violating a terms of use on a website. In my opinion it clearly does apply. Now, let's get the new Congress to fix it like I suggested a year and a half ago." 

The Judge has now expressed concern over the impact of this conviction on the masses and the possibility of criminalizing the conduct of the masses who violate website terms and contracts.  This is another example of legislating from the bench. The Judge is correct to be concerned. But the change to the law must come from Congress, not the Judiciary. Judicial activism may be popular among the liberal left wingers, but it is not the right thing to do, particularly in this case.

And the reason is clear. If Judges can decide whether laws are good or bad and change them at will, then we have a real problem with the balancing of powers. What power really remains with Congress, or the state legislatures or even city councils? Not much in the end. And from a practical standpoint, if Congress elects to change the hacking statute (which I have been calling for them to do for years) then you can bet that Congress will come up with some legislation to address this type of misconduct visited upon the young girl in this tragic case. Perhaps establishing liability by requiring a digital signature be placed on user agreements, or another law that is focused on these types of abusive uses, will be forthcoming. But that is up to Congress. 

Not a California Judge.

An intellectually honest Judge with a conscience is a great thing. But everyone must know their bounds of authority and responsibility. Judges interpret the law. Congress and the executive branch make it.   

The fix will certainly require modifying the existing law or adding new law. That's something Judges cannot do. And that is why judicial activism is fundamentally wrong. I'm not criticizing the Judge. I'm criticizing a fundamental philosophy. The present law was last amended in the Patriot Act passed just after 9/11. It's time for Congress to revisit the issue and make sure that the issue the Judge faces today will not be an impediment to future convictions of online scofflaws and miscreants intent upon visiting harm to netizens through gross misconduct or, in a broader sense, online terrorism.

Dozier's book on online attacks, "Google Bomb", is coming in September. You'll appreciate the need for strong legislative action once you learn about the underworld of the web, the attacks of the mobosphere, the virtual Hydra, the Streisand Effect, and the Google Bomb. 

Dozier Internet Law: MySpace Suicide Case Media Coverage Revealing

At Dozier Internet Law  we try to maintain a balanced, objective perspective on things. It's particularly important that we have this mindset when advising clients. Not so for the media, though. When the news reports started filtering in about the MySpace conviction, I thought the defense had won.

Wired.com screamed "Lori Drew Not Guilty of Felonies in Landmark Cyberbullying Trial" and went on to characterize the jury decision as a "slap-on-the-wrist verdict". Similar headlines streamed from the online media. Needless to say, I was a bit surprised to then find that the jury had convicted Ms. Drew of three misdemeanors for unauthorized access, which appear to be computer hacking statute convictions, which carry up to three years in jail and a $300,000 fine. Here is what the headline might have said:

"Jury Verdict Guilty: Suicide Mom Faces Three Years Behind Bars and Almost a Half Million Dollar Fine"

Then the article could have gone into the reality of the situation and the implications of such a court decision. Drew will likely have to sell her assets to cover fines and costs and lawyer fees. Her reputation is ruined. She will be forever considered in the minds of the public as a heinous figure. Her name will be associated with cyberbullying, she'll get her own Wikipedia page, she'll have laws named after her, and this entire process will be available online in perpetuity for her children, her grandchildren, and her grandchildren's granchildren to see. This is a scarlet letter on her name forever. And what employer would ever hire someone convicted of a computer crime relating to personal data and information theft? Job prospects are dim, to say the least. All of this, topped with a serious threat of incarceration in jail. Hardly the victory Wired.com paints.

No, this is no victory for anyone. At Dozier Internet Law we have to ask how much influence the liberal "information yearns to be free" online media contributed to Drew's misunderstanding as to what is, and what is not, acceptable online conduct? When the "authoritative" citizen journalists and recognized online news sites constantly place a biased perspective on permissible online conduct right in the faces of the moms and dads and brothers and sisters living all across our country, are we surprised that Drew misunderstood the rules? 

So, for all of the purported "legal experts" wary of these charges, there is a place to get laws changed. It's the legislative branch! It's not the courts. And it certainly is not the court of public opinion. In your shaping of public opinion on this issue, do you provide guidance, support and encouragement for naive netizens to place their livelihood and reputations at risk for generations to come? Yes, you do. 

The online world is a long way from self policing and self regulation. Industries that don't embrace those concepts get regulated by laws. Online commentators, journalists and so-called experts need to stop fostering and encouraging lawlessness. Try to establish and promote good, honest, moral, ethical and legal conduct. You'll find that this self regulation and self restraint will preserve many of the rights and liberties today enjoyed by your constituencies. But keep up your misinformation, and you'll find that this case is just the beginning volley of a battle that is brewing over personal misconduct online.  

Dozier Internet Law: MySpace Hacking Case

Dozier Internet Law has been involved in many, many civil and criminal hacking cases and legal matters arising under the Computer Fraud and Abuse Act, the statute under which the prosecution of the MySpace Suicide case is proceeding. First, the reaction from the legal blogosphere was to criticize the application of the statute in this case. Now, lawyers purportedly involved in cyberlaw have been commenting about how nobody, in their view, ever anticipated it would be used like this! It is a statute for hackers...those stealing passwords or using other means to act maliciously, they cry! 

So, here is my post on this blog from a year and a half ago: Federal Hacking Laws. I point out, of course, exactly what those complaining now see. It is a statute (and states have similar laws) that is much broader than most think. But, I must disagree that no one saw this coming. Dozier Internet Law not only saw it coming, but we have been dealing with the same sort of claims made by private litigants in civil cases and US prosecutors and the FBI in criminal cases for years. And there are Circuit level civil court decisions that have been around for years (I argued one of the more prominent in the 9th Circuit). There is even a criminal prosecution appeal confirmed dealing with the statute in the 9th Circuit. While the Middleton case is distinguishable on its face factually...the principal of applying the statute to prosecute criminally is nothing new. I've tried two criminal cases myself dealing with the issue of unauthorized access under state laws.  

So, for all of the late comers to the show, don't sit there and criticize the Judge, the prosecutor, or anyone else. The statute stinks to high heaven. That's reality. Surprised? These "cyberlaw experts" shouldn't be. It makes you wonder what area of law these so called "legal authorities" have been practicing. 

Here is what I said a year and a half ago: "There is unauthorized access (similar to trespass) and then there is hacking (similar to assault and battery!). We need to get the legislators to understand the difference between the two, and pass some laws that are reflective of reality. Those that access a competing website by borrowing a roommate's password (like just about all college kids do) to see information thousands of others can see is likely trespassing, but he (sic) is not a hacker. Not by a long shot."

So, it is what it is. The law is on the books, strengthened even more in the post 9/11 Patriot Act, and even if Congress addresses the problem, similar laws now exist in many states subjecting those who violate a terms of use to criminal prosecution and civil liability. Indeed, at least four lawsuits were filed in the last 90 days in Federal Court asserting civil claims under the law. You can read about them at the Dozier Internet Law on Hacking blog. 

I will say, however, that the facts of the MySpace Suicide case are ambiguous and complex, and I won't be surprised if the case is dismissed by the Judge post verdict or the jury returns a "not guilty" verdict. Don't take that as a statement that the law does not apply to those violating a terms of use on a website. In my opinion it clearly does apply. Now, let's get the new Congress to fix it like I suggested a year and a half ago. 

Dozier Internet Law: MySpace Suicide Case Dismissal Coming?

We've been involved in quite a few "hacking" and unauthorized computer access cases on both sides of the issue. Several years ago Dozier Internet Law convinced a Judge, after the prosecution had rested, to dismiss a criminal case much like the MySpace suicide case going on in LA right now. We've also used Terms of Use provisions to convince the FBI in a couple of serious cases to abandon its plans for prosecution. In this case, reports indicate the defendant did not set up the account and never read the terms of use. Defense counsel are therefore arguing that the US Attorney cannot prove she accessed the MySpace site without authorization.

This does raise a number of issues...how could she know that she was violating the terms of use if she never read them? Well, there is caselaw to support holding a user of an account responsible for abiding by the Terms of Use of a site even if they were not read. Otherwise, all one would have to do is have a friend open an account and give you the password and you could never be liable for violating the rules. So that argument isn't very convincing. MySpace has its Terms of Use linked on the bottom of pages, so it was available whether you sign up or not. Many sites don't require an independent, conscious acknowledgement by a user of the terms of use and simply link to them on the pages, but most believe they are legally binding. An analogy in the offline world would be the printed language on an unsigned invoice. I've tried that case dozens of times, and the Courts regularly recognize those terms as binding.  

Dozier Internet Law was lead counsel in a two week civil trial in which the US District Court (in the 9th Circuit which covers California) found that accessing a site, even when there were no terms of use on the site at all, was unauthorized access. But in that case the party accessing the site had been told not to do so. Now if we look to the equivalent state statutes, they are most often referred to as "computer trespass" laws. And if we think about trespass in the traditional sense, land that is "posted" with "no trespassing" signs is all that is necessary to establish a lack of permission to enter upon the land. Even when the typical defense arises that "I didn't see the sign", and "I entered in between two signs and did not see them", those aren't defenses. 

On the other hand, a requirement of proving the elements of "intentional access without authorization" isn't necessarily as clear. The best interpretation, it seems to me, is that the "intentional" requirement relates to the volition involved in the act of accessing a computer, and the "authorization" means affirmative permission to do an act. So, this may be more of an issue of whether the party accessing a computer obtained permission, as opposed to whether that party actually new it did not have permission (didn't read the terms of use). This is clearly new ground being explored.  

But here is reality...the prosecutors have reportedly given the party who opened the account and actively participated in some of the mischief complete immunity. My instincts tell me that this will impact the Judge's perception of the legal issues, and given the high burden of proving a criminal offense, this could lead to the conclusion that a jury could not find "beyond a reasonable doubt" a lack of authorization. Case Dismissed! If the Judge really considers the issues, I think the case will go forward, he will allow the defense to put on their case, and let it go to the jury. If the Jury convicts, then the Judge is going to have to make a really hard call on this. 

And if there is a dismissal, the decision won't really address the key issue being followed, which is whether you can sign up for a website and then get charged criminally when you violate the terms of use and cause the requisite damages. Also overlooked is the fact that while this prosecution is being brought for an alleged violation of Federal law, there are many states with similar laws on the books (and frankly much easier to prove up).

One thing is for sure. We are a long, long way from defining the law of "computer trespass", no matter how this case comes out. 

FINAL COMMENT: It remains clear, though, that this prosecution has never been, as Public Citizen, Electronic Frontier Foundation, and the ACLU types would have you believe, outrageous and unjustified prosecutorial abuse. Trust me that this case is really just standard fare for attorneys who actually deal with these issues on a regular basis. And whatever the decision, First Amendment extremists can rest assured that the Internet will not be disrupted, the foundation of E-Commerce will not collapse, and the sky will not fall. But it doesn't really help a Judge to be offering up "Chicken Little" legal briefs. Try something new-cut him some slack and don't attack him personally in the press and online if he does not agree with your view of the law or the world. 

UPDATE (Monday 11/24/08): Prescient? (No, but a good guess!) The motion to dismiss was taken under advisement by the Judge. Judge Wu indicated Monday he might not rule on the dismissal motion until after a jury verdict.

Dozier Internet Law: MySpace Hacking Indictment Well Supported

The federal prosecutors in California obviously did their legal research before asking the grand jury to indict under the Computer Fraud and Abuse Act in the myspace.com suicide case. I don't like the statute's seemingly over-broad reach. I've criticized the statute in the past for the very same reasons some of the free speech liberal commentators object all over the airwaves today. The difference, however, is that I don't pretend to make the law mean what I would like for it to mean. It is what it is. And, as it is written, the prosecutors believe they are right, I think they are right, and the 9th Circuit does too!   

Wonder if the prosecutors read my blog entry from last June about Dozier Internet Law and our view on the law of hacking? And I wonder how many of these law professors and talking heads on TV have ever tried a hacking or unauthorized access case? Maybe the prosecutors are new to this, maybe they aren't. But at least they did their legal research. Commentators, particularly the "free speechers" expressing outrage over the indictment, should be so diligent. There's at least one law professor so outraged he is offering his legal services for free. A little research, Mr. Professor, may be in order. Here's why:

California is in the 9th Circuit. I suggest anyone interested in commenting on the case who also wants to sound somewhat knowledgeable read the Middleton v. US case decided by the 9th Circuit. I suspect the prosecutors will use this case to argue that unauthorized access causing damage or loss has already been recognized as a crime in the 9th Circuit. Lay on top of that decision another 9th Circuit case, Creative Computing v. Getloaded.com, which Dozier Internet Law argued before the 9th Circuit, and you can see that the rationale the prosecutors are using has already been established in the 9th Circuit Court of Appeals in a couple of decisions. The trial court HAS TO follow this case law from the 9th Circuit Court of Appeals! Anywhere else in the country and they would not have a trial court bound by this precedent. Smart prosecutors, I would say. 

Visit the Dozier Internet Law Hacking page on our site and you can see that our interpretation has always been that such access in violation of a user agreement or terms of use violates not only the CFAA but also many, many state computer crime laws. For those who think that the CFAA applies only to damage to a computer, read the code sections again. And for those who believe that a damage or loss could not include personal injury or death, view the expansive definition of "loss". How could this statute evolve since its passage in the late 1990s to be so inclusive today? 9/11 and the Patriot Act, frankly. You can research the changes that were made to the law, review the legislative history, and read the Computer Fraud and Abuse Act from top to bottom. You may even want to re-read the Dozier Internet Law Hacker Blog Entry from last June in which I made the same points the prosecutor will likely be relying upon, and described a criminal hacking trial for which I was lead counsel in which the Judge also found that violating a terms of use is unauthorized access (won on other grounds).

No, this is not an unprecedented case. The FBI and Department of Justice recently raided our client's offices in Florida based on an alleged website user agreement violation. Another FBI investigation targeted a client for doing the same thing in Northern California. The concepts may seem novel or unique to those feigning expertise in this area of the law. But, the indictment is likely well grounded in law, and I am not surprised at all that the prosecutors brought charges under the CFAA. Particularly in California and the 9th Circuit.

The lesson, of course, is that those contracts you agree to online are binding, and those abusing a website and joining the world of online scofflaws had better watch out. I still don't like the statutes that associate hackers with non-malicious unauthorized access. But, no matter how hard the left wing, free speech commentators try, they can't change the law. They see it as they want it to be. We see it as it is. And it is what it is! Ask the 9th Circuit.