Wednesday, June 27, 2012

Use a Computer, Go to Jail

Use a Computer, Go to Jail:
If you are reading this column online at work,
you may be committing a federal crime. Or so says the Justice
Department, which reads the Computer Fraud and Abuse Act (CFAA)
broadly enough to encompass personal use of company computers as
well as violations of website rules that people routinely
ignore.
In April the U.S. Court of Appeals for the 9th Circuit rightly
rejected this view of the CFAA, which Chief Judge Alex Kozinski
noted could conceivably make a criminal out of “everyone who uses a
computer.” Unfortunately, other appeals courts have been more
receptive to the Justice Department’s interpretation, which gives
U.S. attorneys the power to prosecute just about anyone who offends
or annoys them.
Congress passed the original version of the CFAA in 1984, when
the Internet was in its infancy and the World Wide Web did not
exist, to protect government computer systems and financial
databases from hackers. As a result of amendments and technological
developments, George Washington University law professor Orin Kerr
explains in a 2010 Minnesota Law Review article, “the law
that began as narrow and specific has become breathtakingly
broad.”
The 9th Circuit case involved David Nosal, who left the
executive search firm Korn/Ferry International in 2004 and
allegedly enlisted two former colleagues to feed him proprietary
client information with an eye toward starting a competing
business. Nosal was charged with conspiracy, mail fraud, trade
secret theft, and violating the CFAA, which criminalizes
unauthorized computer access in various circumstances.
Although Nosal’s confederates were authorized to use
Korn/Ferry’s database, prosecutors argued that improperly sharing
information with him rendered their access unauthorized. As Judge
Kozinski noted, “the government’s construction of the statute would
expand its scope far beyond computer hacking to criminalize any
unauthorized use of information obtained from a computer.”
The felony Nosal was accused of committing involves unauthorized
access “with intent to defraud.” But the CFAA also makes someone
guilty of a misdemeanor, punishable by up to a year in jail, if he
“intentionally accesses a computer without authorization or exceeds
authorized access” and “thereby obtains…information.”
Based on the government’s definition of unauthorized access,
Kozinski observed, that provision would apply to “large groups of
people who would have little reason to suspect they are committing
a federal crime,” such as employees who violate company policy by
using workplace computers to play games, read blogs, watch YouTube
videos, or check sports scores. Even people using their own
computers on their own time could be prosecuted for violating
“terms of service” they have never read by fibbing about their age
or weight on dating sites, posting photos of other people without
permission, or sharing content Facebook deems offensive.
Kerr notes that terms of service “are written extremely broadly
to give providers a right to cancel accounts and not face any
liability.” Hence “violating the TOS is the norm,” and
criminalizing it “would give the government the ability to arrest
anyone who regularly uses the Internet.”
That danger is not merely theoretical. Remember Lori Drew, the
Missouri woman who was widely vilified in 2007 after she played a
MySpace prank on a 13-year-old girl who later committed suicide?
Although Missouri prosecutors concluded that Drew had broken no
laws, Thomas O’Brien, then the U.S. attorney in Los Angeles, took
it upon himself to prosecute her for violating the CFAA
by disregarding MySpace’s TOS.
In 2009 U.S. District Judge George Wu threw out Drew’s
conviction, ruling that O’Brien’s reading of the CFAA would make
the law unconstitutionally vague, giving grandstanding prosecutors
like him unbridled discretion while leaving their potential
targets—pretty much everyone—uncertain about how to comply with the
law. As Kozinski put it, “we shouldn’t have to live at the mercy of
our local prosecutor.”
Senior Editor Jacob Sullum is a nationally syndicated
columnist. © Copyright 2012 by Creators Syndicate Inc.