The death of teenager Megan Meier at the prodding of adult Lori Drew is a sad allegory for our time.  There can be no one who isn’t deeply saddened by what happened, though it’s questionable whether anyone has yet learned a lesson from Lori Drew’s conduct.

But once Missouri mom Lori Drew was indicted in California for violating the  Computer Fraud and Abuse Act, 18 USC §1030, we left the realm of techno-morality and entered a twisted world of criminalizing  behaviors so common as to make almost all computer users criminals.  No one. of course, plans to arrest people as they type happily away on their keyboards, but should the indictment against Lori Drew stand, the government will have the ability to do so should someone be disturbed by the product of people’s computer.

Lori Drew’s lawyer, Dean Steward, has moved to dismiss the indictment, per the Wall Street Journal Law Blog and the Washington Post.  Orin Kerr had a pro bono finger in the motion as well.  The WSJ includes pdf links to the moving papers:

Here are the three motions to dismiss for: failure to state an offense, vagueness and unconstitutional delegation of prosecutorial power.

Rather than a single motion, the attack consists of three independent sets of papers attacking the indictment.  According to Steward, the most significant motion is the attack for vagueness:

In its 22-year history, the Computer Fraud and Abuse Act has never before been used to criminally punish the violation of a website Terms of Service. The government’s novel theory is that the statute prohibits the violation of essentially all Terms of Service [hereinafter TOS] that apply to essentially all computers connected to the Internet.

As a matter of statutory construction, the government’s farreaching argument is either right or wrong. In either case, however, the indictment must be dismissed. If the government’s statutory construction is wrong, the statute did not reach Lori Drew’s conduct and the indictment must be dismissed because the crime has not been committed. If the government’s statutory construction is correct and the statute criminalizes violating a website TOS, then the statute is void for vagueness because it fails to provide warning of what is prohibited and ensures discriminatory enforcement under City of Chicago v. Morales 527 U.S. 41, 56 (1999).

The gist of the government’s theory is that Drew, by creating and using a false persona on MySpace, violated the MySpace terms of service.  The elements of the violation are:

♦ intentionally accessing a computer
♦ without authorization or exceeds authorization
♦ and obtains information
♦ from a protected computer
♦ involving interstate or foreign commerce

Because her use of MySpace violated the TOS, she is alleged to have intentionally accessed the MySpace server without authorization.

Nowhere in the statute is the term “unauthorized” defined. The government claims that a violation of the TOS makes access unauthorized, and therefore criminal. Surely the government will concede that, standing alone, a violation of a TOS is not a criminal act. The government’s theory in the indictment fails to set out how the next step, from TOS violation to §1030 criminal law violation, occurs.

Basing a lack of authorization on a violation of TOS presents multiple problems. Are all TOS violations enough to render the accessing unauthorized, or only material breaches? Must the terms of the TOS be reasonable? What if these terms are racist, illegal themselves or call for violence? Does the violation of such TOS’s still render access unauthorized? These questions render the term “unauthorized” hopelessly vague.

The government’s employment of a website’s TOS as the basis for a federal crime implicates some very big picture issues.  The motion to dismiss, unfortunately, addresses them more as minor technicalities than fundamental flaws, rather nit-picky than conceptually vapid.  Given the novel nature of this prosecution, combined with the vast implications of making a substantial chunk of the population susceptible to criminal prosecution, I would have hoped for a far broader approach.

The questions posed to suggest that the term “unauthorized” is “hopelessly vague” are a reach.  The first two questions need not be answered in this case, and show why facial challenges usually fail.  The next two questions are purely hypothetical and unripe for adjudication.  By posing their attack in this fashion, I fear that they have given the judge an easy out to leave these questions for another day and another case, where these issues actually arise.  Judges are appropriately reluctant to rule on theoretical issues.

But what troubles me is that the argument, that the intentional violation of the TOS renders access unauthorized, and unauthorized access falls within the ambit of §1030, is barely addressed in the motion.  Steward’s argument is that “[s]urely the government will concede that, standing alone, a violation of a TOS is not a criminal act.”  But of course, this didn’t stand alone, but was used to intentionally cause harm to another, resulting in death.  The defense has opened the door to being slam-dunked on the point.

The fundamental flaw in the government’s theory is indeed what constitutes lack of authorization, and the flaw is that user terms of service cannot constitute the basis for lack of authorization under the statute.  By analogy, the distinction is between someone being invited to a party and behaving poorly, as opposed to someone crashing the party.  The terms of service are precatory; sufficient to ask someone to leave the party but insufficient to deem their presence criminal.  To reach the level of criminal, there must be an independent wrong committed, regardless of that fact that they were invited into the party, that would be wrong whether there were terms of service or not. 

The motion to dismiss for failure to state an offense includes one prong that is very significant: That there is no allegation of fact that Drew (or her co-conspirators) read or knew of the terms of service.  While ignorance of the law is not excuse, ignorance of the TOS may well be.  The government has addressed this by alleging that the TOS were readily available for Drew to read.  So is the Library of Britain, but that doesn’t mean we are all responsible for knowing its contents.  This element has far-reaching implications for all computer users as well, since few (if any) of us actually read any website’s TOS, and the potential that we be held criminally liable for our failure to write “please” before any request is absurd.

While many will quietly hope that Lori Drew gets nailed for what happened to Megan Meier, the idea that almost every computer user is turned into a criminal in the process is at stake in this indictment.  As horrible as Lori Drew may be, this indictment is not the cure. 

It’s simply unclear from my reading of the motions to dismiss whether Steward has mounted an argument that will prevail.  For the sake of all of us, I hope he does.  But I fear that his motion falls short.