Legal Reference

Source

Violating Terms Of Service equals hacking

Posted May 27th 2008 7:00PM by Juan Aguilar

A new legal precedent may be set with the case of [Lori Drew], the St. Louis woman who posed as a teenage boy on MySpace and harassed 13-year-old [Megan Meier] until she committed suicide. Drew is being charged under the computer fraud and abuse act, on the grounds that she violated the terms of service agreement of MySpace. If she is convicted of these charges (she is also being charged with conspiracy), it may allow for the criminal prosecution of anyone who violates the terms of service agreement of a site under the same law.

The computer fraud and abuse act was written primarily to target hackers who break into private networks to steal or destroy information, but prosecutors will argue that by willfully violating the MySpace user agreement, Drew's access to the site was not authorized and thus an illegal intrusion.

The ramifications for a typical user may reach further than website TOS violations though; if for example, you have an unprotected wireless network at home or in your office, it could be a violation of the agreement with your ISP. Right now an ISP could cut your service, but if a new precedent is set, you could be charged with fraud.

If you're a user of a social network, though, you may already be a guilty of what would be felony offenses. The major social networks all include a clause in their TOS agreements against using libelous, slanderous, or defamatory content. What's more, if convicted of even one offense, the maximum penalty under the expanded law is 10 years of incarceration. Since Drew is being tried on two counts, she is facing a maximum of 20 years for these charges alone.

The decision to invoke the law has been criticized by many legal experts, suggesting that it creates a slippery slope where even people running a home eBay business or checking sports scores at work can be prosecuted.

Source: Source

Legal experts wary of MySpace hacking charges

Robert Lemos, SecurityFocus 2008-05-16

On October 16, 2006, 13-year-old Megan Meier fled from her family's computer, distraught over the cutting comments of her supposed "friends" on MySpace. Twenty minutes later, the troubled teen was dead; she had hung herself in her closet.

The story, widely reported, garnered the girl's family widespread sympathy on the Internet. The twist that Lori Drew, a 47-year-old neighbor and mother of a former friend of Megan's, had allegedly created the fake persona of a 16-year-old boy to befriend and later torment the girl brought outrage. Yet, state investigators could not find a law under which Drew could be charged.

?More than a year and a half later, federal prosecutors finally have their case. On Thursday, the U.S. Attorney for the Central District of California announced that Lori Drew, now 49 years old, was indicted on conspiracy and hacking charges. The indictment charges Drew, a resident of O'Fallon, Missouri, with three counts of unauthorized access by violation of MySpace's terms of service and one count of conspiracy.

"This adult woman allegedly used the Internet to target a young teenage girl, with horrendous ramifications," U.S. Attorney Thomas P. O'Brien said in a statement announcing the indictment. "After a thorough investigation, we have charged Ms. Drew with criminally accessing MySpace and violating rules established to protect young, vulnerable people. Any adult who uses the Internet or a social gathering website to bully or harass another person, particularly a young teenage girl, needs to realize that their actions can have serious consequences."

Yet, legal experts argue that charging a person for violating computer-crime statutes because they broke the terms-of-service agreement of an online site could lead to the ability to charge nearly anyone with computer crime. Using residential broadband for business purposes? A violation of the terms of service and, thus, potentially a crime. Checking sports sites while at work? A violation of corporate policy and, thus, potentially a crime.

"'Hard cases make bad law' is an axiom in the legal world," said Mark Rasch, managing director of enterprise-services firm FTI Consulting and a former U.S. prosecutor. "This is a case where people have seen bad conduct and have said there must be something we can do, but if prosecution of this case is successful, every pseudonym and every minor violation of the terms of service becomes a computer crime."

According to the indictment, Drew and others allegedly conspired to violate MySpace's terms of service and intentionally inflict emotional distress on Megan, identified only as MTM in the court documents. (Editor's note: SecurityFocus has a policy of not identifying the underage victims of crimes. However, Megan Meier's name is so widely reported that omitting it serves no purpose and could cause confusion.) The indictment alleges that Drew obtained a MySpace account under a fictitious name, used the account to garner information from a juvenile, and used that information to torment, humiliate and harass that member -- all violations of the social-networking site's terms of service.

While the U.S. Attorney's office refused interview requests, a spokesperson said that the harm done to Megan is key to the case. Known as a "tortious act," the legal argument is generally the basis for civil lawsuits, but can be used as the basis of criminal prosecution. In this case, the tortious act elevates the unauthorized access charges from misdemeanors to felonies, FTI's Rasch said.

Yet, legal experts argue that, by trying to do right by Megan, U.S. prosecutors are doing the wrong thing.

At the center of the debate is the meaning of what is "unauthorized access," Orin Kerr, professor of law at George Washington University, said in an analysis of the indictment.

"The federal statute ... generally prohibits accessing a computer 'without authorization' or 'exceeding authorized access.' But what makes an access 'without authorization'?" Kerr stated. "If the computer owner says that you can only access the computer if you are left-handed, or if you agree to be nice, are you committing a crime if you use the computer and are nasty or you are right-handed?"

The indictment offers no guidance as to what type of violation might prod prosecutors to action, added John Morris, general counsel for the Center for Democracy and Technology, a Washington D.C.-based policy group.

"There is nothing in the indictment that differentiates between what is a serious violation of the terms of service and a trivial violation of the terms of service," Morris told SecurityFocus. "I would bet that the majority of U.S. Internet users have committed a federal crime, if the charges in this indictment are upheld."

While courts have upheld the enforceability of some terms-of-service and click-wrap agreements, many online click-to-agree contracts -- especially those that accompany spyware -- have not been found valid. Consumer studies have also found that people rarely read end-user license agreements (EULAs), privacy agreements and terms of service. For example, one study by the Helsinki University of Technology (pdf) found that less than 2 percent of users actually read through a software agreement while two-thirds of users rarely read such agreements.

Making a violation of such agreements a crime would allow prosecutors the ability to investigate nearly any Internet user, Scott Greenfield, a criminal defense attorney, stated in an online analysis.

"Violating a website's 'TOS' is carte blanche to an imaginative prosecutor," Greenfield said. "We are all felons if this flies."

Attorneys interviewed for this article believed that the charges in the indictment will be dismissed. GWU's Kerr described at least two major hurdles for the government's case: a great many people regularly violate terms-of-service agreements and the defendant Drew likely did not set out to violate the TOS.

In his own brief analysis, Daniel Solove, an associate law professor, also at GWU, agreed that the government's case will be difficult to argue.

"While Drew's (alleged) conduct is immoral, it is a very big stretch to call it illegal," Solove said.

A call to Drew's attorney, H. Dean Stewart, requesting an interview was not returned.