You May Already Be a Criminal

May 22, 2008 — -- Earlier this month, the U.S. Department of Justice brought criminal charges in Los Angeles against Lori Drew, the suburban St. Louis woman at the center of the widely reported MySpace suicide case. Not surprisingly, many people have voiced support for the indictment and relief that Drew had finally been brought to justice.

It's hard to find much sympathy for Drew, who allegedly created a false profile on MySpace, posing as a teenage boy, to engage a 13-year-old neighborhood girl, Megan Meier, in conversation.

Drew's twisted scheme was to "gather intelligence," she claims, regarding what was being said at school about her own teenage daughter. But Drew's conversations with Meier were allegedly cruel and harassing, and finally unbearable; Meier hanged herself, turning every parent's nightmare into a real-life horror.

But, beyond the heartbreak and emotion of the moment, there is a dangerous scenario developing in the margin of this tragic story, and anyone who uses the Internet should be extremely wary.

The Justice Department has blundered terribly in this case. By reaching for the same statute used to prosecute computer hackers, this indictment has turned the law into a blunt legal instrument that turns every violation of a site's terms of service into a federal crime.

Usually, a case like Drew's would be handled under state or local law, but Missouri did not, at the time, have a criminal statute that would reach Drew's conduct, unlike many other states that, for example, have criminal statutes against intentional infliction of mental distress.

So, into this murky legal gap wades the Justice Department. Finding nothing appropriate in federal statutes to charge Drew with, the Justice Department decides to file the serial numbers off a federal computer hacking law and charge her with breaching the MySpace "terms of service" agreement, on the grounds that she accessed protected computers without authorization.

The indictment cheapens a tragic circumstance with its legal sideshow. If the allegations are true, Drew could certainly face civil liability for her actions, and -- at least under many states' laws (including a newly passed Missouri law) -- she could face state criminal liability as well. But the wrongness of Drew's alleged actions, however, does not and should not make this a "federal case."

If the theory of this indictment is allowed to stand, it would represent a gross and inappropriate expansion of federal power to regulate speech and communications over the Internet. It is important to understand the underlying "crime" here. The indictment does not really have anything to do with the alleged mistreatment of the girl in this case -- the alleged crime is that Drew did not follow MySpace's "terms of service." The charges are based on an anti-hacker statute, and in this indictment, the "victim" is MySpace, not the girl.

The government's theory is that, if someone uses an Internet Service Provider or signs up for a Web site or other online service, and then does not follow the rules of that service, the use of the service is "unauthorized" and, thus (according to this indictment) a federal crime.

The underlying statute, 18 U.S.C. § 1030, is appropriately used to prosecute people who hack into a computer system to damage the system, hijack it or steal sensitive information. The federal government, in this case, is stretching this statute far beyond those scenarios by saying that it is now a federal crime to use a public Web site or other Internet service if you do not follow every rule set by the Web site or service.

This indictment should make all Internet users wary of signing up for any online service without reading each and every "term of service" -- because if you violate any term, you are committing a federal crime. This could seriously chill the robust interactivity of the Internet. And if this indictment is allowed to stand, it also threatens to turn millions of teenagers into federal criminals.

Cyberbully Factor

Cyber-bullying and harassment are real concerns; in the vast majority of cases, it is teenagers who violate terms of service and bully their peers. Their conduct ranges from posting pictures online without permission and spreading rumors, to the creation of fake profile pages and the misuse of screen names and passwords to pose as another teenager.

These activities plainly violate the terms of service of social networking sites, including those of MySpace, which specifically prohibit the posting of photographs without consent, ban the knowing promotion of information that is false or misleading, or conduct that is abusive, threatening, obscene, defamatory or libelous. MySpace would be well within its rights to ban perpetrators from its site.

Parents have a right to punish such actions, if they see fit to do so, and schools may need to step in. In egregious cases, there may be grounds for civil or criminal remedies. But it strains credulity to believe that any of these activities have made MySpace the victim of a federal crime.

It is not just teenagers on social networking sites who are at risk from this foolhardy indictment. It is safe to say that many active Internet users have also committed the exact "crime" charged in this case. Anyone who has registered for a Web site without providing fully accurate information (because, say, they do not want to receive junk e-mail from the site, or because they want to engage in speech on sensitive subjects), could face federal charges.

Similarly, since most residential broadband services prohibit any "business use" of the service, anyone who has checked their office e-mail from home has violated terms of service and, thus, crossed the criminal line drawn by the Justice Department.

The inappropriateness of this federal indictment is made plain by where it was brought, in Los Angeles, although the crime occurred in Missouri. The alleged perpetrator lives in the state, as did her young victim. But the indictment was brought in Los Angeles, because that is where MySpace is based. At the end of the day, this tragic -- but decidedly local -- situation is one that is appropriately dealt with in Missouri, under the laws of Missouri, and not in a federal courthouse 1,000 miles away.

Leslie Harris is president and CEO of the Center for Democracy and Technology.