A few weeks back, dismissal motions were filed on behalf of Lori Drew, an adult whose disgusting conduct resulted in the suicide of teenager Megan Meiers.  Despite the fact that no normal person can feel any sympathy toward her, the prosecution theory is so decidedly misguided that it should strike fear in the hearts of all computer users everywhere. 

In its zeal to find some way to nail Lori Drew to the wall, not a disagreeable purpose, the government has engaged in terrible over-reaching and, for this reason, must be stopped.  But I questioned whether the dismissal motions by Drew’s attorney, H. Dean Steward, were sufficient.  Of course, that’s only the first half of the equation, the second being the government’s opposition papers.  From the WSJ Law Blog, the response is now available.

Yesterday, the government, represented by AUSA Mark Krause, shot back, filing three oppositions to the failure to state a claim motion, to the vagueness motion and to the unconstitutional delegation of prosecutorial power motion.

In the government’s opposition to dismiss for vagueness, AUSA Krause writes that terms in the CFAA, such as “access” and “unauthorized” are “not so imprecise that people of common intelligence must guess at their meaning.” As for claims that the statute is susceptible to being arbitrarily enforced, Krause writes: “Cyberbullying is a relatively new phenomenon, as is social networking. It is, therefore, not surprising that there have been relatively few prosecutions in this area. . . . the statute does not threaten to criminalize widespread conduct. Because the government must show that defendant acted with the requisite criminal scienter, there is no risk of criminalizing innocent, let alone negligent behavior.”

In that special sort of response that only an AUSA can proffer, the predominant word is “unavailing”.  For the most part, Krause’s response meets Steward’s challenge and more, but for one gaping hole.  Krause relies on a 5th Circuit decision, U.S. v. Phillips, 477 F.3d 316, 219 (5th Cir. 2007), for the proposition that “unauthorized use” is determined by exceeding the scope of “the expected norms of intended use or the nature of the relationship established between the computer owner and user.” 

Krause thereupon asserts that this means that when the computer owner adopts rules, those rules establish the norms and, therefore, anything outside the rules exceeds the norms.  Man, did he blow it on this one.

Norms on the internet aren’t established by terms of service, those fuzzy legally-things that no one ever reads but just clicks through to get to the good stuff.  Norms are established by use.  Norms are established by the way real people behave.  Norms are established by the way the computer owner, in this case Myspace, deals with the fact that everybody ignores the TOS and posts about how they are taller, thinner, smarter, richer and more beautiful than they really are.   The norm is clearly established:  people lie about themselves on the internet all the time.  And Myspace is fine with it.

The defense motion on the issue of authorization nibbled on the periphery of authorization, and was one of the prongs that I found to be sadly weak.  But the government’s response, which largely ignored the defendant’s argument and set off on a path of its own, has opened the door wide to a thrashing by the defense.  Thankfully, this goes to the heart of the problem, and the basic argument why this prosecution is so ill-conceived.

Many people engage in online social-networking and are slightly less than accurate in their online persona.  Even if the accuracy is arguable, the government’s position would subject almost every online social-networker to a degree of scrutiny that few could pass, thus putting them within the confines of a criminal statute, where their intent would be the target of a trial. 

Krause’s other argument, that only those with criminal intent will fall within the purview of the law, is true, but unhelpful.   It’s the combination of these unrelated aspects, creating a less than entirely accurate online persona plus some disconnected act during the course of ones life online that the government can arguably assert demonstrates criminal intent, that presents the problem. 

This is the real evil of the government’s indictment of Lori Drew.  It’s certainly not that Lori Drew personally deserves better, but that the desire to find a way to get her, via her deceptive Myspace persona to bring her within the purview of the  Computer Fraud and Abuse Act, 18 USC §1030, provides the predicate basis to prosecute almost every normal computer user. 

The question remains whether the judge will have both the techno-savvy to appreciate that the government’s argument on authorization is substantively ridiculous, and the guts to toss the indictment.  But at least the defense is back in the game.