On the Internet, Everyone is a Criminal

On the Internet, Everyone is a Criminal September 19, 2011

Orin Kerr, a leading con law expert with a specialty in cyber law, has an op-ed in the Wall Street Journal warning about a new bill that could potentially turn 80% of internet users into felons.

The little-known law at issue is called the Computer Fraud and Abuse Act. It was enacted in 1986 to punish computer hacking. But Congress has broadened the law every few years, and today it extends far beyond hacking. The law now criminalizes computer use that “exceeds authorized access” to any computer. Today that violation is a misdemeanor, but the Senate Judiciary Committee is set to meet this morning to vote on making it a felony.

That is so broad as to be virtually limitless, as Kerr points out:

The problem is that a lot of routine computer use can exceed “authorized access.” Courts are still struggling to interpret this language. But the Justice Department believes that it applies incredibly broadly to include “terms of use” violations and breaches of workplace computer-use policies.

Breaching an agreement or ignoring your boss might be bad. But should it be a federal crime just because it involves a computer? If interpreted this way, the law gives computer owners the power to criminalize any computer use they don’t like. Imagine the Democratic Party setting up a public website and announcing that no Republicans can visit. Every Republican who checked out the site could be a criminal for exceeding authorized access.

If that sounds far-fetched, consider a few recent cases. In 2009, the Justice Department prosecuted a woman for violating the “terms of service” of the social networking site MySpace.com. The woman had been part of a group that set up a MySpace profile using a fake picture. The feds charged her with conspiracy to violate the Computer Fraud and Abuse Act. Prosecutors say the woman exceeded authorized access because MySpace required all profile information to be truthful. But people routinely misstate the truth in online profiles, about everything from their age to their name. What happens when each instance is a felony?

Not only should they not be turning this into a felony, they should be doing away with that provision of the law and replacing it with something far more specific to what ought to be prosecuted.

Browse Our Archives

Follow Us!

What Are Your Thoughts?leave a comment
  • hunter

    If everything’s illegal, they’ve got us, man.

    I wonder how many senate staffers — or senators for that matter — we could nail under that law?

  • Mr Ed

    Can I change the terms of use for my computers:

    The information on this server is available to all persons with the following exceptions, all federal employees or their agents acting in either a professional or personal capacity, anyone elected to federal office, or persons whose legal name contains the letter W.

    Now we will have some one to put in those secret FEMA prisons.

  • Michael Heath

    Was Orin Kerr’s omission regarding the specific legislation pragmatic entree to gain access to the WSJ’s readers?

    I wanted to understand which party(s) and Congress-people supported this legislation, especially the ‘terms of service’ laws that made it a felony to lie on MySpace while our laws and the excecution thereof by the DOJ encourages elected officials to lie about: why we invaded Iraq, the administration of torture, the state of consensus amongst climate scientists regarding AGW, climate scientists understanding regarding the factors which create the net positive forcings which are causing global warming, and hell – just lying in general to the American people. Instead we only get vague references to such, not even a link if space constraints is the excuse.

  • The Lorax


    Do it. Seriously. It’s within your right to make those claims and enforce them.

    It’s about time these laws started biting back.

  • MikeMa

    The replacement for ‘Disturbing the Peace’ in the digital age. If almost everyone can be threatened for this, there will be no need to look further to nail your enemies.

  • I wonder if they’d attempt to extradite from Canada, because I’m a member on several American websites and for privacy reasons I never use my real information unless a credit card is required. That includes my several Facebook accounts.

  • Pinky

    Shrunk down to the size of electrons; thats some small government!

    IMHO Black Hat Hackers should be rewarded (or at least co-opted) as valued protectors of US security and the lazy, mentally deficient bureaucrats who are unable to provide adequate electronic security fired or possibly jailed for incompetence. It is better to have a computer security weakness found by a whiz kid having fun (“because its there”) than an entity inimical to the US.

  • D. C. Sessions

    This is a key part of making government smaller and more nimble. If we make practically everyone a Federal felon, it gives police and prosecutors the latitude they need to go after the ones that they know are guilty without having to bother with the current complexity of the laws on the subject.

    It’s also going to be a very effective way to eliminate the deficit. When any use of a computer is probably illegal and everything involves computer use, those same police and prosecutors can finance the entire Government by simply going after criminals’ possessions.

  • harold

    Michael Heath –

    I strongly agree with your desire to know precisely who is changing laws, and in exactly which way.

    The editorial is disgracefully non-specific. From it –

    Think again. Congress is now poised to grant the Obama administration’s wishes in the name of “cybersecurity.”

    1) Precisely what changes in current law or current enforcement policy has been requested? Who in the Obama administration made the request? How was the request communicated to members of congress?

    2) What action is contemplated by congress? Which members of congress specifically support the action, and in what way – have bills been introduced, for example, and if not, what has happened?

    These crucial questions are not addressed in detail in the editorial.

    Instead, a bunch of out-of-context “horror stories” are discussed.

    There is probably an explanation behind the absurd sounding criminal charges discussed here. While I do not intend this as a defense of the tactic, law enforcement sometimes use obscure or seemingly stretched charges as a bargaining chip in the investigation of more serious crimes. For example, posting a fake picture on MySpace seems like a nothing, but perhaps it was related to prostitution (*I think sex for money between consenting competent adults should be 100% legal but the public perceives this as a crime worthy of law enforcement attention*).

    Obviously, progressives and libertarians agree that Obama is terrible on civil rights, albeit largely by not reversing the abuses of the Bush administration. However, without more details, I have to view this editorial with skepticism.

  • If you make something nearly everybody does into a crime, it makes things much easier for the government to selectively prosecute the people they don’t like.

  • Die Anyway

    I use my real name, real picture, etc on both MySpace and FaceBook, so I’m not too worried about that but it seems to me that there are bigger fish to fry. If they are going to go to all this effort they should first eliminate the Nigerian phishing scams along with the viruses and other malware that infests the internet.

    But then I’m probably some sort of felonious criminal for being an atheist and posting here under the alias of “Die Anyway”.

  • rabbitscribe

    There’s a fringe “Scientology-Without-the-Church-of-Scientology” website I occasionally browse for giggles. By viewing the page, I agree to refrain from any activity, online or offline, contrary to the spirit of their mission. Looks like Lewisburg…

  • dontpanic

    I suspect the referenced MySpace case is this one where a woman setup a fake account of a teen boy and then setup and then smashed a (mentally fragile from other accounts) neighbor teen girl’s self-esteem. The girl committed suicide. I think they should have charged the woman under some statute having to do with the bullying rather than the TOS charge. I have zero sympathy for that woman but would have preferred prosecutors to use a different approach as the unintended consequences of pushing the “exceeds authorized access” envelope is very problematic.

  • slc1

    Re Michael Heath @ #3

    The fact that this was an OPED in the Wall Street Journal suggests that one should view it with a healthy dose of skepticism, given the insanity of that newspaper’s editorial page. I would want to know a lot more about it from reputable sources before getting all bent out of shape.

  • nazgul7of9

    Well they should arrest Tom the default friend on Myspace the stated age on his profile was a lie, probably to make him appear hipper and younger, only changed after they were busted on it.

  • So if someone makes a Facebook page for their cat, they can prosecuted for fraud. What if the cat likes the page?

  • unbound

    I think the 80% figure is being very kind. It would be difficult for someone not to be a criminal if Terms of Use (Terms of Service) were enforced as law.

    How many times has Facebook changed their Terms of Use fairly drastically?

    Most sites and services clearly state that they can change their Terms of Use at any time without any notice (e.g. the hosting entity of freethoughtblogs – “Bluehost.com reserves the right, in its sole discretion, to change, modify, add or remove all or any part of these Terms at any time with or without notice.”).

    Heck, many sites have very ambiguous verbiage such as “Unauthorised use of this website may give to a claim for damages and/or be a criminal offence.”…but what the heck constitutes “unauthorized use”?

    Freethoughtblogs hosting site ToU includes “It is NOT intended to support the sustained demand of large enterprises, internationally based businesses, or non-typical applications better suited to a dedicated server.” So what, exactly, is a non-typical application? Pretty much up to Bluehost…and could be a criminal penalty in the future.

    Or how about “The use of the Services to engage in any activity that is determined by Bluehost.com, in its sole and absolute discretion, to be illegal is prohibited.”? Attorney Generals will be required to prosecute these types of violations?

    Whoever is involved in supporting the Senate Judiciary committee needs to be slapped hard to wake them up from their insane dream…

  • whirligig

    So now if I a person swears on our service (thus violating the T.o.S. that nobody reads), I can have him sent to real prison? Keen. I’ll bet people would be interested in that not happening to them. Maybe I can finally start to pick up some grift from this job!

  • dcsohl

    Hm. That WSJ article is dated September 14. According to the Judiciary Committee schedule, they held a hearing on human trafficking on the morning of the 14th.

    I can’t find where hearing/session transcripts etc might go, though.

    Also, after searching Thomas, I am unable to identify a particular bill that might be the subject of this article. Can anybody clear this up?

  • dcsohl

    Found it! The hearing was on the morning of the 7th! And there is no specific bill being considered. This was more of a fact-finding expedition. The testimony given at the hearing is linked in the right column of that page.

    Of course, both witnesses called for the hearing are in the DOJ (one ADA and a Deputy Special Agent in Charge), which lends a very worrisome bias to the testimony and does make me worry about what’s down the road. But until there’s something concrete being proposed I’m not sure what we could do.

    So, yes, this is up to the WSJ editorial page’s usual high standards. In other words, mostly crap with enough truth thrown in to be worrisome.

  • Pingback: Easy Click Commissions scam()

  • Pingback: Jury Nullification « azmytheconomics()

  • cedricdomingo

    Really true! better educate first the people before Internet usage, review them with the internet law and consult law firms.