Lori Drew and the Computer Fraud and Abuse Act

Daniel Solove
Founder of TeachPrivacy

Lori Drew Megan Meier Case

The Lori Drew trial is set to begin this week, and it is a travesty that this trial is even taking place. The basic facts of this case are that Drew was the mother of a teenage daughter and she created a fake MySpace profile for a fictional teen boy to befriend a classmate of her daughter’s. It remains unclear what the motivation was for creating this fake profile, but from what I’ve read, it was to learn about rumors about her daughter. This classmate, Megan Meier, befriended the fake MySpace persona. At some point, the fake persona broke up with Meier, saying he no longer wanted to be friends, and Meier committed suicide.

Afterwards, there was considerable media attention in the case, although this didn’t happen until about a year later. There was outrage at Drew, with many people calling for blood. But local prosecutors determined, correctly in my opinion, that although Drew’s conduct may have been immature, shortsighted, and mean, it wasn’t criminal.

Enter an ambitious federal prosecutor, eager for fame and national attention. He indicted Lori Drew for creating a fake MySpace profile, which he contends is a violation of the Computer Fraud and Abuse Act (CFAA). The CFAA § 1020(a)(2)(C) makes it a criminal misdemeanor to “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer if the conduct involved an interstate or foreign communication.” The CFAA § 1030(c)(2)(B)(2) make it a felony if one “intentionally accesses a computer without authorization . . . , and thereby obtains . . . information from any protected computer” and “the offense was committed in furtherance of any . . . tortious act [in this case intentional infliction of emotional distress] in violation of the . . . laws . . . of any State.”

Basically, the theory of the prosecution’s case is that Lori Drew violated the CFAA because she violated the terms of service of Myspace which prohibited creating fake profiles, and she did so in furtherance of committing the tort of intentional infliction of emotional distress.

These CFAA provisions are, in my opinion, unconstitutionally vague. I believe they either must be struck down or saved with a narrowing interpretation. I personally would strike down these parts of the statute and have Congress start over. My argument is here, and I won’t repeat much of it, but the gist is that a vague law is one that either fails to provide the kind of notice that will enable ordinary people to understand what conduct it prohibits; or authorizes or encourages arbitrary and discriminatory enforcement. Because the CFAA would essentially criminalize many violations of website terms of service (if not nearly all), this allows the website operators to virtually write the criminal code.


So I hereby declare that on Concurring Opinions nobody may write a comment while wearing a hat. If you write a comment by wearing a hat, you’re violating our terms of service, and that’s a criminal violation under the CFAA! And if your comment is tortious (defamatory, invasive of privacy, etc.) then that’s a felony violation of the CFAA, and you could be put in prison for up to 5 years.

Of course, we all know that most of these violations wouldn’t be prosecuted. Prosecutors would use their discretion to go after only those cases that they found particularly bad. Like what happened in here with Drew. But this is precisely what the constitutional prohibition on vague laws is all about — it prevents arbitrary enforcement of laws by prosecutors because they’re dealing with an unpopular defendant or because they want to get some media attention.

If the government’s interpretation stands, it means that hundreds of thousands–perhaps millions–of Internet users are criminals. The absurdity of it all is mind-boggling.

What perplexes me about the case are the following questions:

1. Why is this case being prosecuted at all? The case is making a mockery out of the CFAA. I can think of no reason why this prosecution is going forward other than to be a way for the prosecutor to gain media attention and go after a person who is unpopular. Of course, I am only speculating as to the prosecutor’s motives, but I find this case so inappropriate that I can’t think of a legitimate motivation to bring it.

2. Why is this case going to trial? The judge, U.S. District Judge George Wu, apparently hasn’t made any rulings on dismissing the case. This is exactly the kind of prosecution that should be dismissed prior to prosecution. Why should a defendant have to stand trial, a very expensive and stressful experience, when as a matter of law, the statute either (a) shouldn’t apply to her conduct; or (b) is unconstitutionally vague?

3. In the most recent news, the judge has said he will allow evidence of Meier’s suicide, even though it isn’t relevant:

U.S. District Judge George Wu previously indicated he might bar any mention of suicide because it could be prejudicial, but he changed his mind after hearing lawyers’ arguments.

Wu said he was now convinced that many prospective jurors would be aware of the suicide from reading news reports or seeing a recent episode of the TV show “Law and Order” that involved a similar scenario.

He said he would instruct jurors, possibly at the outset of the trial, that the case was not about the suicide and that Drew is not charged with causing the suicide.

I have no idea if this AP report is correct about Judge Wu’s reasons for allowing the evidence of the suicide, but it strikes me as erroneous reasoning. The suicide has little to do with the violation of the CFAA. The alleged violation can be proven without introducing evidence of the suicide. The suicide is so prejudicial, likely to inflame the jurors’ passions and get them to hate Lori Drew for what happened rather than to focus on the alleged violation of law. It should be excluded from evidence, as this evidence is considerably more prejudicial than probative. The fact that pretrial publicity might mean that some jurors know about it is no excuse for sidestepping the rules of evidence. In many high profile cases that were much more widely publicized than this one, plenty of evidence was excluded that was more prejudicial than probative.

This case is basically a witch hunt. It is exactly what the Constitution mandates should not happen in criminal law. The law shouldn’t be vague. It shouldn’t be a tool that prosecutors can use whenever they don’t like a particular person. Judge Wu should dismiss this case immediately, either striking down these provisions of the CFAA or issuing a limiting construction. This case should not be going to trial.

Disclosure: My colleague, Orin Kerr, is one of the defense attorneys for Lori Drew. My opinions here are my own.

UPDATE: Scott Greenfield at Simple Justice has this critique of Judge Wu’s evidentiary ruling.

 

Originally Posted at Concurring Opinions

* * * *

This post was authored by Professor Daniel J. Solove, who through TeachPrivacy develops computer-based privacy training, data security training, HIPAA training, and many other forms of awareness training on privacy and security topics. Professor Solove also posts at his blog at LinkedIn. His blog has more than 1 million followers.

Professor Solove is the organizer, along with Paul Schwartz, of the Privacy + Security Forum and International Privacy + Security Forum, annual events designed for seasoned professionals.

If you are interested in privacy and data security issues, there are many great ways Professor Solove can help you stay informed:
*
LinkedIn Influencer blog
*
Twitter
*
Newsletter

TeachPrivacy Ad Privacy Training Security Training 01