The middle-aged mother had allegedly created a MySpace page in the name of "Josh Evans" -– purportedly a 16-year-old boy -- and used the page to contact a friend of Drew’s daughter, a 13-year-old girl. The girl, who had a MySpace page, is referred to in the indictment only as MTM (although the girl’s name is widely reported elsewhere). While Drew’s initial motivation was purportedly to get information from MTM about her relationship with the woman's daughter, eventually the fictitious online relationship between "Josh Evans" and MTM turned ugly and abusive.  When the fictional "Josh" broke up with the pre-adolescent MTM, the distraught girl committed suicide.  Only later did MTM’s parents learn of Lori Drew’s alleged subterfuge.

Initial research by investigators could find no law that Drew had broken. However, prosecutors in Los Angeles resorted to a novel legal theory to charge Drew with crimes which could result in twenty years in jail.  Ironically, the crimes charged have almost nothing to do with MTM’s suicide or Lori Drew’s alleged "cyber bullying." Instead, the prosecutors assert that merely violating MySpace’s (or any other Web site’s) "Terms of Use" constitute a prosecutable offense.

A "crime" in search of a statute

There is no doubt that Lori Drew’s alleged actions are unconscionable and inexcusable. But is it a federal computer crime?  If so, what is it about what Lori Drew did that is deserving of criminal prosecution? 

Let's review the allegations in the case.

First, she created a MySpace page with false information, lying about her name, gender and age.  Second, she used that account to communicate with MTM.  Third, using the "Josh" identity, she flirted with MTM, and inevitably got "information" from her -– most likely information about Drew’s daughter.  Fourth, someone using the "Josh" identity -- there were several people using the account at this point -- broke up with MTM in a manner that ultimately contributed to MTM’s suicide.

Nobody has yet alleged that Drew intended that MTM commit suicide or that she encouraged it.  This appears to be a classic case of someone either intentionally or negligently causing another "severe emotional distress" –- a civil and actionable tort but not a crime under current law. Indeed, as a result of the suicide, the Board of Aldermen of Dardenne Prarie, Missouri passed a law last November making it illegal to engage in a pattern of conduct that would cause a reasonable person to suffer "substantial emotional distress" or for an adult to contact a child under 18 in a communication causing a reasonable parent to fear for the child's well-being.  It is not clear that such a statute would survive First Amendment scrutiny, and a recent study (pdf) showed that 7 percent of online teens said they have felt scared or uncomfortable as a result of contact by an online stranger and another study (pdf) showed that 32 percent of all teenagers who use the internet said that they had been targets of annoying and potentially menacing online activities, such as receiving threatening messages, having their private emails or text messages forwarded without consent, having an embarrassing picture posted without permission, or having rumors about them spread online. With the tens of millions of users on online social networking sites, the Missouri statute could conceivably make criminals of millions, including millions of other teenagers.

There is also a federal harassment statute, 47 USC 223 (a)(1)(E), which makes it a misdemeanor to "repeatedly initiate communication with a telecommunications device, during which conversation or communication ensues, solely to harass any person . . .who receives the communication."  But was Lori Drew’s sole purpose to harass MTM?  Putting aside that question, the statute may not even apply here since it requires that you use a "telecommunications device" which, under section (h)(1)(b), "does not include an interactive computer service."  Both statutes, 47 USC 230(f)(2),  and case law (pdf) make it clear that social networking sites like MySpace are "interactive computer services" so the federal harassment statute likely can’t be used.

The Missouri "harassment" statute is likewise unavailing, as it generally just prohibits communications that "use coarse language offensive to one of average sensibility" and is a misdemeanor to boot.  While several states have either passed or are considering passing cyber-bullying statutes, these generally are directed at having school officials develop policies to prohibit offensive online conduct and are not criminal statutes aimed at making such offensive conduct a felony.

Social networking sites like MySpace and Facebook have gone to great efforts to try to protect the privacy and security of the services they offer, including reaching extensive agreements with state's attorneys general regarding policing of internal policies and protecting privacy.  But in the case of MTM, the public outrage and outcry regarding the nature of Drew’s conduct sent prosecutors scrambling to find something, anything, that they could prosecute her for.

It was the paucity of relevant laws that lead the United States Attorney’s Office in Missouri, where the harassment occurred, to decline prosecution.  Based upon the fact that MySpace’s servers are located in California, prosecutors in Los Angeles picked up the baton, and forged ahead with a prosecution for computer crime and conspiracy to commit computer crime.

Computer, crimes and misdemeanors

The Federal Computer Crime Statute, 18 USC 1030(a)(2)(c), makes it a crime to, in interstate commerce,

intentionally access a computer without authorization or exceed authorized access, and thereby obtain information from any protected computer.

This may be moot, as the felony-misdemeanor dichotomy is an illusion: If you exceed authorization to access a computer and thereby obtain information, it’s a misdemeanor, but if you do so with in furtherance of any tort or crime, it’s a felony.  But wait.  Trespass, including computer trespass -- that is, exceeding authorization to access a computer -- is itself a tort.  Not only that, but it’s also a violation of many state computer crime statutes. So if all you do is exceed the scope of authorization to access a computer, you immediately are committing a tortuous and criminal act, and therefore a felony. You trespass -- a misdemeanor -- with intent to trespass -- a tort or another misdemeanor -- and thereby commit a felony.  Indeed, if you gain any information, this may constitute the tort of "conversion" -– taking the property, in this case information, of another. Obtaining information could also be larceny, once again transforming the misdemeanor into a felony.

If convicted on all counts, Drew could go to jail for as much as twenty years, but the Federal Sentencing Guidelines would dictate a sentence of between four and six and a half years, depending upon such factors as whether a court finds Drew’s conduct involved a "vulnerable victim," an "abuse of a position of trust or skill," the "the conscious or reckless risk of death or serious bodily injury," or an "an intent to obtain personal information."

Intentional Trespass?

There are several other ambiguities in the statute. 

First, while it requires proof that Drew "intentionally accessed a computer without authorization" the law does not make it clear whether the word "intentionally" modifies both "access" and "without authorization."  Thus, if Drew knew she was accessing the MySpace computer server in Beverly Hills, but did not know that she was exceeding her authorization -- because, say like 99 percent of all users, she never read the Terms of Service -- would she be guilty of a crime? 

Under contract law, failing to read a contract that is "readily available" doesn’t excuse you from being bound to its terms, and it is probably for that reason that the government in its indictment alleges that the TOS are readily available.  But does an unread TOS mean that the unauthorized access is therefore intentional?  Using the physical trespass analogy, if I know I am entering the property of another, but don’t know that I am not allowed to, am I guilty?  Under the common law of "trespass to land," no intent to commit a trespass was required. All that was necessary was that the act resulting in the trespass be volitional -- that he knew he was walking onto land, not that he knew it was the land of someone else. As a general rule, the conspicuous "posting" of no trespassing signs is sufficient to provide "constructive" notice, even if the alleged trespasser did not see the sign. For example, under Missouri law, criminal trespass in the First Degree -- a misdemeanor -- requires proof that the property was fenced in, that the trespasser knew that they weren’t permitted in, or that there was a "posting in a manner reasonably likely to come to the attention of intruders" -– including apparently just putting a purple slash on a tree. Criminal trespass in the Second Degree -- a $200 fine -- is a crime of "absolute liability."

However, this analogy is imperfect for the Drew case.  Generally, "no trespassing" signs simply say that.  In the Drew case, however, it wasn’t an all or nothing proposition.  Drew was entitled to be on MySpace, access MySpace pages (including that of MTM) and use the service.  The mere violation of terms of service allows MySpace to revoke or terminate her right of access, but it does not necessarily render her access "unauthorized" or "exceeding authorization."

Another analogy can be made to those jurisdictions which, for example allow licensed gun owners to carry concealed weapons, but also permit owners of various establishments to restrict this right by posting notices to that effect by, for example, a sign that says "no guns on premises."  If you knowingly enter the establishment with the posted notice while possessing a firearm, you are liable for prosecution for trespass.  In essence, your "right of entry" is terminated by your violation of the "terms of use."   But what if the establishment had another sign that simply said, "no spitting."  Does this imply that if you expectorate, you go to jail?

Breach of TOS = Go to jail

After this, things get really hairy.

According to the indictment, what Drew did that was a crime was to provide false information to MySpace when she signed up, and then use that account to obtain information.  The MySpace Terms of Use provide that "by using the MySpace Services, you represent and warrant that all registration information you submit is truthful and accurate."  Your use of MySpace, like your use of thousands of other Web sites and interactive services, are governed by such terms of use or terms of service.  Thus, an employer may have a policy which says "business use only" of the Internet or of e-mail.  Web sites frequently have "conditions" placed on your use of the service, such as no commercial use or no deep linking or no harassment or no spam. Violation of these contractual provisions moots your "authorization" to use the service and constitutes a "trespass."

This theory has been used to civilly sue those who, for example, access the Ticketmaster Web site in violation of terms of service or other Web sites in a way that would constitute a "trespass to chattels".

Many years ago, the government attempted to prosecute an IRS employee for browsing at files he was not authorized to see in violation of his employment agreement. The Court of Appeals rejected the government’s claim that this constituted an "unauthorized access" to the computer in order to obtain "something of value."  Partially in response, Congress broadened the scope of the computer crime law to include "exceeding the scope of authorization" to access -- or use -- a computer, and eliminated the need to show that you got "something of value."  Indeed, if you obtained "any information" in excess of your authorization, you could be prosecuted.  Presumably, this would include public information, like that on a public MySpace profile.

Despite the broadening of the statute, this appears to be the first time that the government has, in a criminal case, taken such an expansive view of what the law prohibits.  The consequence of the government’s position in the Drew case is that virtually any violation of a Terms of Use, Terms of Service, or employers’ computer use policy can land you in the federal penitentiary.

Here is how it works.  You access, or use, a computer -- including a web server, PC, or many electronic devices -- that is governed by some Terms of Use or Terms of Service. When you breach those terms of use, you have exceeded your authorization to access that computer.  Send an email to your mom in a company that has a "no personal use" policy -– that’s an "unauthorized" access to the computer.  If you use your home broadband network for commercial purposes -- say, to VPN into the office, or check corporate e-mail -- you have probably violated the terms of use of the broadband provider and committed a crime.

While we can be sympathetic to the government’s motives in this case, their manipulation of the statute goes beyond making breaches of agreements into crimes. To prove that Drew exceeded unauthorized access, the government has to prove that the defendant thereby obtained information from a protected computer.

So what information did Drew obtain and from what protected computer?   The information obtained could simply be access to MTM’s public MySpace page.  Or, it could be the contents of the "chats" or messages from MTM to the fictitious "Josh Evans."  The revised law puts no limit on the type or value of the information obtained. 

Moreover, the victim of the crime -- while identified in the indictment as MTM -- is under the government’s theory actually MySpace, the company whose computers were "accessed" in excess of authorization.  But MySpace is no more the victim of these crimes than they would be criminally liable for the suicide -- a theory rejected in a federal case called Doe v. MySpace (pdf) involving the parents of a teenager who committed suicide. They are suing MySpace for failing to prevent their child from having an online relationship with an adult.

If this case sets a precedent, it will be a crime to essentially provide any false information online, if that violates a Terms of Use and you get any information as a result. 

What’s wrong with that?  Plenty.  First, we have a long tradition in the United States of both anonymous and the use of pseudonyms in political discussion.  Whether it is Hamilton, Jay and Madison’s "Publius," or Ben Franklin’s "Silence Dogood", America's founding fathers frequently disguised their true identity in a manner which, if communicated online would violate a provider’s terms of use and therefore constitute a federal crime, despite the fact that the U.S. Supreme Court has repeatedly held that there is a Constitutional right under the First Amendment to such "anonymous" speech.

In defense of lying

Much has been made of the fact that Drew lied about who she was when she created her MySpace account, as if this is an anomaly.  Lying, exaggeration, and misrepresentation are ubiquitous both online and off.  Indeed, in many cases there are good reasons to lie -– particularly when creating a MySpace or Facebook account.  A report (pdf) released last year by the Pew Internet and American Life Foundation found that, of those teenagers whose online profiles can be accessed by anyone online, nearly half said that they gave at least some false information in establishing the account.  For younger teens, the number was more than two-thirds.

While some people reportedly put up fake information to "be silly" or "playful," a great number of them did so to protect themselves from predators and stalkers, and to protect their own privacy. Thus, they lie about their teenage status to escape the notice of those trolling for underage children. They lie about their home town to keep predators from finding them.  They lie about their e-mail addresses to prevent spam and other unwanted solicitations and to prevent cyber-harassment.  Indeed, the United States Federal Trade Commission -- the organization principally responsible for protecting privacy in general and the privacy of children in particular -- noted that "common responses to perceived threats to privacy included avoiding sites that make information requests and providing false information."

Remember, Drew was indicted for providing false registration information to MySpace and then using the account in excess of her authorization.  Her motive for doing so is relevant only to determine whether the crime is a misdemeanor or a felony.  Thus, providing false information to MySpace -– even if just to protect yourself –- could land you into legal hot water.  Indeed, in the case that lead to the indictment, MTM herself -- apparently with her mother’s knowledge -- provided MySpace with false information about her age, as MySpace does not permit access to persons under the age of 13.  In theory, MTM would have faced jail time under the government’s theory of prosecution. 

A British study of mostly adult users of social networking sites showed in 2007 that 31 percent of them provided false information in order to protect their own privacy.   A cursory glance at the photos of MySpace users suggests that many of these pictures are fakes. The fake pictures are a violation of MySpace’s TOS and are done to obtain "information" and therefore a crime, under the prosecution's reading of the law.

It’s not just teenagers lying on MySpace.  Suppose Lori Drew was concerned about her daughter’s potential drug use, promiscuity, alcohol use or other behavior.  Let’s also suppose that their relationship was dysfunctional, and she didn’t feel like she could just talk to her daughter.  In a misguided but well intentioned effort to protect her daughter, Drew creates the "Josh Evans" persona and engages in a conversation with her daughter about topics like drug use, alcohol use, and sexual conduct.  Indeed, many parents keep tabs on their children’s use of social networking sites either with or without their children’s knowledge, although it is not know how many do so through the use of ruse or subterfuge. If the government’s theory of prosecution is successful, this conduct would be a crime. Moreover, if committed with the intent of the parent to commit the tort of "invasion of privacy" of the minor, it could be a felony.

Big lies, little lies and doing time

The "exceeding authorized access" theory is not limited to false statements or false claims.  Since your "access" to any Web site is conditioned on your complying with all of the terms of use, any violation of the terms can render your "access" "unauthorized."  Thus, if on MySpace you "include a photograph or video of another person that you have posted without that person's consent" you have violated the TOS, and therefore "exceeded" your authorization to access to MySpace service. If you "provide instructional information about illegal activities" including hacker tutorials or explanations even if intended to help defend against attacks, this may violate TOS and make you subject to prosecution.

If there is a genuine need for a cyber-harassment or cyber-bullying statue, then by all means, let’s pass one.  Much has been made in the Drew case of the fact that an adult was "harassing" a child.  But would it have really mattered to MTM if the online comments and dumping were done by a real, rather than illusory, "Josh Evans?"  Would the pain have been any less and the result any different?  If we do draft such a "harassment" statute, what would –- or constitutionally could -– it say?

The fictional Josh apparently told MTM that "the world would be better off without you" hours before the fragile and depressed MTM hung herself.  While many States have criminal statutes regarding "promoting a suicidal act" Missouri does not appear to be one of them.  If Drew/Evans really intended that MTM kill herself, then this could likely be prosecuted under such a statute.  But not every imperative to "drop dead" is the solicitation of suicide.

What kinds of "cyber harassment" should we make a crime? This strikes a delicate balance between the right of free and sometimes uncomfortable speech and the right to live in a peaceful and civilized society.  Is saying "I hate you" a hate crime if said to a 13 year old by another 13 year old?  What about an adult to a child? A mother to a daughter? Vice versa? 

On May 15, 2008 the Missouri state legislature passed a new bill which would define "harassment" as communications of any kind conducted to knowingly frighten, intimidate, or cause emotional distress or knowingly using unwanted expressions that put the person in reasonable apprehension of offensive physical contact or harm or knowingly making unwanted communications with a person.  Under that statute then, texting a friend after they tell you, "I don’t think we should talk anymore," might be a prosecutable offense.

Similarly, do we really want to make providing false information in violation of TOS a "computer trespass" punishable by the federal government thousands of miles away from where the statement was made or read? Certainly, transparency breeds accountability.  A recent federal law made it both a crime and an enhancement to the federal sentencing guidelines to lie on a domain registration.  Other countries like India and Germany are considering passing statutes also making it a crime to provide false information online.  In the United States, such actions were considered criminal only when done as part of a "scheme or artifice to defraud" someone out of "money or property."  As noted above, there are many good reasons NOT to provide accurate information online, most notably protecting privacy.  The debate about false information is one we should have openly, and not attempt to shoehorn this crime in a Terms of Use debate.

The most troubling aspect of the California indictment is the fact that it might just succeed.

First, while we can argue that this is not what the statute was intended to prohibit, the language of the statute is capable of that interpretation.  Just as with any "trespass" statute, the owner of the property, in this case Fox’s MySpace, gets to make the rules about who is allowed in and who is a trespasser, and the criminal law enforces these rules.  If Drew’s lawyers file a motion to dismiss, it might be difficult for a judge to find a deficiency in the indictment itself.  The Indictment tracks the language of the statute, and may be legally sufficient.  Moreover, public and jury outrage over the egregiousness of Drew’s conduct may lead to acceptance of the "breach of contract, go to jail" theory of liability.

In the end, however, the precedent would open up the field of prosecutable offenses. Workers could be prosecuted for using their computers for personal reasons. Members of online dating sites could be prosecuted for making themselves sound more exciting. And, anti-government protesters who don’t provide accurate information to their ISP’s, IM providers, or social networking sites would also face the threat of prosecution.

While the government’s response would likely be, "Oh, don’t worry. We would never prosecute you." The reality would require that that statement end with "... yet."