Continuously opining, intermittently publishing.

Archive for November, 2011


What a relief!
CBX Pass

Just when you think it couldn’t get worse…

The Department of Justice is asking Congress to amend the Computer Fraud and Abuse Act to criminalize violations of websites’ terms of service. Note that website owners and online service providers intentionally write their TOS with maximum breadth to ensure that they have the power to contractually limit or end your license to use their services so that they have a contractual defense against potential civil suits by users who are upset that their access was cut off. Terms of Service are not just about preventing nefarious behavior. In fact, terms of service routinely make it a breach of the license agreement to do a host of innocent things, just because those things are annoying to the website provider.

Ostensibly, DOJ wants Congress to curb one mechanism of identity theft—giving fake names to website accounts. But think about what sorts of behavior this would criminalize. Several articles have noted that Prof. Orin Kerr, who wrote an op-ed about this issue two months ago, testified to Congress that simple misstatements in light of a TOS requirement to state accurate information would make him a criminal, since his Facebook page lists “Washington, D.C.” as his residence when he actually lives in Arlington, Virginia.

Other articles have noted that listed a weight that is lighter than your true weight on violates its TOS, and thus would be criminal. When I go to video game websites requesting my birth date in order to show me a rated-M game, is my common practice of putting in my correct birth year but leaving the date as January 1 (because clicking on three drop down boxes instead of one is annoying) criminal? Do I violate the TOS and subject myself to prosecution for suing the website company instead of going to arbitration, or for filing suit in a forum other than the one the TOS requires? What if someone posts an image in violation of copyright, which a TOS prohibits? He would be guilty of a federal crime. What if I give my password away to a friend or loved one so he or she can access my account for some perfectly innocent reason—but the sharing of passwords is a violation of a TOS? I would be subjected to criminal prosecution.

Essentially, in the name of “fighting crime,” the Obama Administration is looking to make any simple contractual violation that occurs online a matter of national prosecution. And of course, the DOJ is claiming that it won’t overreach because it will use its power and resources for the cases that matter. But this is no comfort. It is basically admitting that many more people and their actions will fall under the reach of the CFAA’s criminal provisions, but that we should trust prosecutors not to prosecute.

This is an Orwellian melange of criminal law a civil problem between private parties. It would give the DOJ a virtually unlimited power to prosecute almost anyone using the internet—because it’s highly unlikely that any of us have never violated the terms of service of a website, even if just once by accident.