United States v. Drew, 2:08-cr-00582-GW (C.D. Cal. Aug. 28, 2009)

Almost 2 months ago, the judge presiding over the Lori Drew trial orally announced that he intended to rule in favor of Drew, but it was a little hard to decipher his statements without a written ruling. On Friday, the judge issued his written ruling, which indicates that he granted Drew's FRCP 29(c) motion for a post-verdict acquittal. I haven't seen any announcement of the prosecution's response and whether they plan to appeal. This ruling also has no direct bearing on any civil claims against Drew. Nevertheless, for now, Lori Drew has been fully acquitted of the criminal charges brought against her.

The Holding

While the written opinion clears up the judge's exact disposition of Drew's status, it is hardly a clear prcis on the legal issues. The judge ultimately grants the acquittal because a Computer Fraud & Abuse Act (CFAA) prosecution based on negative behavioral restrictions in an online user agreement is void-for-vagueness. I think this makes a lot of sense because the negative behavioral restrictions are effectively incorporated into the criminal statute but lack the degree of drafting precision we require from criminal prohibitions. The judge gives a good example of such an imprecise restriction by citing a MySpace user agreement prohibition against posting in band and filmmaker profiles...sexually suggestive imagery or any other unfair...[c]ontent intended to draw traffic to the profile. The judge rightly asks what the terms "sexually suggestive imagery" and "unfair content" mean when incorporated into a criminal CFAA prosecution. If we aren't sure, that sounds like a valid basis for a void-for-vagueness dismissal.

Having said that, given this ruling, I still can't understand why the judge let this case go to the jury in the first place. I believe the judge's ruling was independent of the jury verdict and does not rely on any of the jury findings, so why did he wait until after the jury verdict to make a ruling that he could have made pre-trial? His delay was not costless. The jury verdict against Drew remains a public rebuke of Drew even though it's been wiped away, and the judge could have saved everyone a lot of time and money by cutting to the chase earlier.

The Dicta

The judge's actual void-for-vagueness discussion of Drew's situation starts on page 25 of a 32 page opinion. What's going on in the previous 25 pages? The remainder of the opinion apparently explains how the government may have successfully proven the elements of its case, but I found the discussion gratuitous, meandering and confusing. Some of it could also be pernicious. For example, consider this oh-no quote from FN 22:

As a visitor to the MySpace website and being initially limited to the public areas of the site, one is bound by MySpace's browsewrap agreement. If one wishes further access into the site for purposes of creating a profile and contacting MySpace members (as Drew and the co-conspirators did), one would have to affirmatively acknowledge and assent to the terms of service by checking the designated box, thereby triggering the clickwrap agreement.

Read that first sentence again. WHAT??? Did the court just say that every visitor is bound to MySpace's browsewrap just by visiting the website? Uh, I don't think so, or at least I hope not. Whoa.

Another oddity: on page 9, the opinion says "According to Sung, MySpace owns the data contained in the profiles and the other content on the website." (Sung is MySpace's VP of Customer Care). The court slyly quotes the applicable provision in the user agreement which clearly points out that MySpace only takes a non-exclusive license to user data, not ownership. So what could this reference to ownership possibly mean?

Implications of the Ruling

Although I wish the judge had been more careful and laconic in his drafting, this opinion is still a good jurisprudential development. This opinion erects a significant hurdle for future CFAA criminal prosecutions for breaches of user agreements because they will face the same void-for-vagueness challenge that was dispositive here.

I'm less clear how this opinion might affect civil CFAA lawsuits for using third party servers in excess of a user agreement. As the case recounts, a number of cases already accept those claims, and I think this judge's dicta simply adds to those cases. So, for example, if MySpace wanted to sue Drew civilly under a CFAA theory for the behavior at issue with her criminal prosecution, I don't think this opinion would stand in the way. In fact, I think MySpace would cite it favorably. Then again, I doubt MySpace will be suing Drew; MySpace has been conspicuously low-profile about a crime purportedly committed against it.

I do not expect this ruling will defuse any debates over cyberbullying and how to deter it using legal means. If anything, the fact that Lori Drew walks is more likely to pour gasoline on the fire of state legislators who think they can solve the problem through their brilliant statutory drafting. They are wrong, of course, and they can do plenty of harm by trying (see, e.g., the broad and dangerous law that Texas just passed). Unfortunately, I expect more anti-cyberbullying legislative efforts, for better or (mostly) for worse.

Even though the judge corrected a judicial system error, I continue to believe that we as cyberlawyers need to mitigate the problems we create by putting extensive and ambiguous negative behavioral restrictions into our online user agreements. As I've explained before, I think best practices now move most negative behavioral restrictions into a non-binding statement of community norms and expectations.

Chris Soghoian observed in CNET that

Google's terms of service, thick with legalese, state that:

You may not use Google's products, software, services and web sites and may not accept the Terms if you are not of legal age to form a binding contract with Google.

Of course if you're in the US that means that anyone under 18 is accessing Google's computer system in violation of its terms of service. And this applies to all Google services, YouTube, Gmail, and Image Search.

Ignoring Legal Risks Leads to Selective Prosecution
Federal prosecutors recently used the Computer Fraud and Abuse Act to selectively prosecute Lori Drew as a hacker for violating MySpace's terms of service. She lied about her identity, and harassed a troubled minor who was also using the system under a false identity. After the child committed suicide, a media and political frenzy resulted in federal prosecutors turning a breach of the site's terms, which might not have even been civilly enforcable, in to a federal criminal case.

Ignoring the Disconnect Between Terms and Practice May Partly Void the Agreement
Obviously, online services retain the right to modify their own terms of use. You may begin a user experience with a minimal grant of rights and a maximum of restrictions when reflexively accepting terms. However, when site staff clearly operate to the contrary to those terms, and in some instances assure users that terms in the TOS won't be enforced, isn't the contract being modified within the user experience?

Smoking Gun: Google for Kids
Google in fact provides safe-search resources just for kids. There's no easily accessible link to terms of service, so arriving new users aren't even exposed to them.

Question 1: By creating this site and its other practices, doesn't Google by their own practice modify their terms?

Question 2: Could any reasonable person believe that a new visitor to the Google Directory for Kids and Teens should be bound by these unseen terms, which even Google seems to disregard?

Question 3: What risk is created by the gap between the lawyers who wrote the TOU, site management who follows their own drummer, and visitors who ignore the terms are entirely disconnected.

Are such TOU's unenforcable sharades posing as contracts?

LOS ANGELES A federal judge on Thursday overturned guilty verdicts against Lori Drew, and issued a directed acquittal on the three misdemeanor charges.

U.S. District Judge George Wu granted a defense motion to overturn the jury verdict in the case after reviewing transcripts from last year's trial, in which 50-year-old Drew was convicted of three misdemeanor charges of unauthorized computer access.

Drew had faced a maximum sentence of three years and a $300,000 fine. Although prosecutors sought the maximum, probation authorities, in a pre-sentencing report sent to the court, had recommended probation and a $5,000 fine.

Drew was accused of participating in a cyberbullying scheme against a 13-year-old girl who later committed suicide. The case against Drew hinged on the government's novel argument that violating MySpace's terms of service for the purpose of harming another was the legal equivalent of computer hacking.

In September 2006, prosecutors said, Drew conspired to create a fake MySpace account for Josh Evans with her then 13-year-old daughter, Sarah, and a then-18-year-old employee and family friend named Ashley Grills.

Prosecutors alleged that Drew and the two others used the profile to lure Megan Meier, a 13-year-old neighbor, into an online relationship with Josh to find out what Megan was saying about Drew's daughter online. But in October, one of the group, writing as Josh, turned against Megan, and told her that the world would be a better place without her. Shortly afterward, Megan hanged herself in her bedroom.

MySpace's user agreement requires registrants, among other things, to provide factual information about themselves and to refrain from soliciting personal information from minors or using information obtained from MySpace services to harass or harm other people. By allegedly violating that click-to-agree contract, Drew committed the same crime as any hacker, prosecutors claimed.

But testimony in the case offered by prosecution witness Ashley Grills under a grant of immunity showed that nobody involved in the hoax actually read the terms of service. Grills also said that the hoax was her idea, not Drew's, and that it was Grills who created the Josh Evans profile, and later sent the cruel message that tipped the emotionally vulnerable 13-year-old girl into her final, tragic act.

Drew was cleared of the felony computer-hacking charges by a jury, but convicted of three misdemeanors for unauthorized computer access. The jury deadlocked on the felony charge of conspiracy.

More details to come.

Photo: AP

See also:

• Judge Postpones Lori Drew Sentencing; Weighs Dismissal
• Can Lori Drew Verdict Survive the 9th Circuit Court?
• Prosecutors Seek 3 Years in Prison for Lori Drew
• Lori Drew Not Guilty of Felonies in Landmark Cyberbullying Trial
• Prosecution: Lori Drew Schemed to Humiliate Teen Girl
• Government's Star Witness Stumbles: MySpace Hoax Was Her Idea, Not Drew's
• Experts Say MySpace Suicide Indictment Sets Scary' Legal Precedent
• Blog Readers Out Anonymous Adults that Newspaper Refused to Identify

Finkel v. Facebook, Inc., 102578-09 (N.Y. Supreme Ct. complaint filed Feb. 24, 2009).

A New York teenager has sued Facebook and four Facebook users (plus their parents) for allegedly defamatory content posted in a private Facebook group called "90 Cents Short of a Dollar."

This case fits neatly with other legal battles over "cyber-bullying" (whatever that means), such as the AutoAdmit lawsuits, the Sandler case and the Lori Drew case. (For another recent and troubling example of cyber-bullying that I read just this morning, see Wolfe v. Fayetteville, Arkansas School Dist., 2009 WL 485400 (W.D. Ark. Feb. 26, 2009)).

In this case, the plaintiff's school peers said some not-nice things about her in a private Facebook page. The Newsday article has some more color about the sour relationships between Finkel and the defendants. The plaintiff claims that the posts meant that "the plaintiff was a woman of dubious morals, dubious sexual character, having engaged in bestiality, an 'I V drug user' as well as having contracted the H.I.V. virus and AIDS."

With respect to the claim against Facebook, this lawsuit is unquestionably DOA. Frankly, I'm not sure why the plaintiff bothered to sue Facebook. Facebook is completely immunized per 47 USC 230, and this should be an easy dismissal. The complaint didn't even try to do anything fancy to get around 230; in fact, the complaint alleges that Facebook "published" the content, the absolutely wrong allegation to make if you're trying to bypass 230. I think it significantly detracts from the sympathy we might otherwise feel for plaintiff for her to have futilely dragged Facebook into the lawsuit. And, it ensures there will be at least one aggressive defendant in the lawsuit.

With respect to the school peers' liability, this case raises some interesting and complex questions. First, and most obviously, how did the plaintiff get a copy of the private group's postings? This reminds me a little of the Washingtonienne case, although access to Cutler's blog wasn't technologically restricted like it was in Facebook.

Side note: the republication of the private group's posts in this complaint reminds us once again that we always have to be prepared for our digital words to show up on the front page of a national newspaper. In particular, including the transcript to the complaint without a protective order was an aggressive move; I suspect other people reading the transcript for the first time will not be happy.

Second, there were only 6 group members listed on the exhibit, which means the total universe of listeners for any defamatory statement was 5 other folks (the person posting the statement doesn't count). This may severely circumscribe any damages. Third, given that this group of 6 presumably represented a social clique with its own norms and mores, it's entirely possible that the small universe of readers completely understood that superficially factual statement weren't really factual and were never intended to be. In this respect, I'm reminded a little of the DiMeo v. Max case, where the judge adjusted the evaluative standards to reflect the fact that message boards fostered a laxer conversation, and readers understood that. A quick perusal of the posts suggests that all of them clearly were utter nonsense and, I suspect, fully understood by all readers to be inane and meaningless chatter. Finally, the posts apparently never referred to the plaintiff by name, although this may be irrelevant if everyone knew who was being discussed.

The lawsuit also goes after the students' parents. Among other things, to try to establish liability, the complaint alleges that the parents negligently supervised their children. I'd gladly write a $100 check today if the plaintiff or her lawyers could articulate a foolproof way that parents can use to prevent high schoolers from doing stupid things on Facebook (without denying them access to Facebook altogether).

From my perspective, going to court over this matter was not a good decision. Nevertheless, I remain troubled by the examples of mean behavior among students that I'm seeing in the alerts I'm getting. For example, the Wolfe and Sandler cases I mention above are absolutely horrifying. Even though I graduated high school nearly 25 years ago, reading about meanness among high schoolers still gives me the shakes, reminding me how bad high school can be! And it weighs heavily on my mind as a parent. However, I can't imagine any legal solution that will make people be less mean to each other.

I'm having trouble seeing how Power.com violates any of these things. Power.com, like plenty of other aggregator services, lets you bring together all your different social networking profiles in one spot. That seems like it could be valuable if you use a lot of those services. It doesn't do anything fraudulently, and it does not appear to misrepresent that it is a separate service. Users have to decide whether it's worth providing their username and password to Power.com, but it's not as if Power.com tricks anyone into doing so or does so in a misleading way. There's no confusion, so it's difficult to see what the trademark problem is about. It seems like a pretty big stretch for Facebook to also claim that showing the content from a user's profile is copyright infringement as well. Computer fraud? Please. Unlawful competition? Again, it may be (slightly) competitive, but it appears to actually improve the value of Facebook, rather than diminish it.

This is a pretty weak response from Facebook. Basically, it looks like Facebook trying to exert undue control over what other websites and services can do, and it's not clear that it has any real legal basis for doing so. It's a shame that a company like Facebook is becoming a legal bully at such a young age. I would have expected better. In the end, though, if Facebook keeps up actions like this, it will only hasten the shift to other social networks that don't try to limit what their users can do. Facebook might want to take a lesson from the eventual flop of Friendster after that social network was accused of being too controlling.

According to news reports (WSJ Law Blog, LA Times, AP), the jury has declared Lori Drew guilty of "three misdemeanor counts of accessing a computer without authorization." I would like to parse the actual jury verdict form to make sure we understand what the jury actually said. For now, some preliminary observations.

First, the jury verdict is not the last step in the process. For example, the judge could still dismiss the case notwithstanding the jury verdict. Personally, I think it was a mistake for the judge to let this case go to the jury; overturning a jury ruling is always a dangerous move for a trial judge, and it would be especially awkward here for the judge to kick the case out now given the high emotions and heavy press coverage for this case. There could be a retrial (especially on the fourth charge, which resulted in a hung jury). It is also possible the jury verdict could be reversed on appeal. Finally, if none of those occur, a sentence that didn't include jail time would still be a travesty but would still have let the people have their vengeance while reducing the injustice to Drew. So it's hard to assess the meaning of the jury verdict because it's only 1 chapter in a longer story.

Second, I am even more convinced that it was a travesty of justice for the government to bring this case at all. The facts elicited at trial demonstrated the illogic of the government's argument that Lori Drew made unauthorized uses of MySpace's servers, including the facts that:

* Lori Drew did not create the MySpace account at issue (Grills, the babysitter, did--but she got government immunity for testifying against Drew)
* Lori Drew did not click OK to the MySpace user agreement (Grills did)
* Lori Drew did not send the final fateful message (Grills did)
* some of the messages at issue were not even sent through the MySpace network (they were sent through AOL)

These facts severely undercut the government's theories about the Computer Fraud & Abuse Act. They should also frighten each of us who may have broken an online user agreement, intentionally or not, at some point in our lives, by showing how easy it could be to violate the CFAA. The tenuousness of the law's application to the facts reinforced that the real trial was over Lori Drew's moral culpability for Meier's death...though that wasn't supposed to be on trial.

Third, regardless of how this case turns out, I remain frustrated by how pro-regulatory forces are using Meier's death--a tragic but highly anomalous situation--as grist for their pro-regulatory agendas. In particular, the push to legally prohibit "cyberbullying" baffles me. I don't even understand the term, but I do know that we cannot legislate people being nice to each other, online or off, and we don't even try in most offline circumstances. Further, as the expansive interpretation of the CFAA highlights, restrictions against "cyberbullying" could chill many socially beneficial and protected activities. So, I hope we can resist the pro-regulatory temptations. Ironically, a guilty verdict for Lori Drew might have that salutary effect by showing that existing laws can punish "bad" actors, even if legal justice is being denied to Lori Drew in the process.

UPDATES: More coverage: NYT; NYT #2 (news analysis), Christopher Soghoian (pointing out examples of egregious user agreements that convert many site users into criminals).

Private investigators are stressing about this ruling.

U.S. District Judge George H. Wu said on Monday that he believed the suicide of 13-year-old Megan Meier was irrelevant to charges that 49-year-old Lori Drew of O'Fallon, Missouri, violated MySpace's terms of service in allegedly conspiring with two accomplices to set up an account that was used to bully Meier. Wu said he thought a discussion of Meier's suicide would unfairly prejudice the jury, according to an Associated Press report.

Drew is charged with one count of conspiracy and three counts of unauthorized access to computers after allegedly creating a MySpace account for a nonexistent 16-year-old boy named "Josh Evans."

Drew and two co-conspirators allegedly provided fake information to MySpace to set up and maintain the account in 2006. The Evans account was used to flirt with and befriend Meier, who'd had a falling-out with Drew's daughter.

The fake "Josh" ultimately turned on Meier and told the girl that the world would be a better place without her. Meier already suffered from clinical depression, and shortly after that final message she hanged herself in her bedroom.

Drew has pleaded not guilty to all of the charges and has maintained that she didn't write the messages that were sent to Meier. A 19-year-old employee of Drew has admitted that she sent the final message that Meier receivedbefore killing herself.

Lori Drew is charged with violating the Computer Fraud and Abuse Act

MySpace's user agreement requires registrants, among other things, to provide factual information about themselves and to refrain from soliciting personal information from minors or using information obtained from MySpace services to harass or harm other people. By allegedly violating that click-to-agree contract, Drew committed the same crime as any hacker, prosecutors maintain.

The use of the anti-hacking law to charge Drew was criticized by experts who said it set a dangerous precedentthat could potentially make a felon out of anyone who violated the terms of service of any website -- a prospect that is particularly troubling, they said, because terms-of-service agreements sometimes contain onerous provisions, are often arbitrarily and unilaterally changed by companies, and are rarely read by users.

Judge Hu told prosecutors on Monday that he was leaning toward excluding evidence of Meier's suicide but would rule on Friday.

Drew's defense attorney attempted last week to have the case decided by a judge rather than have his client face a jury, but prosecutors blocked that move. Jury selection will begin next week.

(Top image: Tina Meier holds two pictures of her daughter Megan. AP Photo/Tom Gannam)

See Also:

• Former Justice Dept. Prosecutor Joins Defense in MySpace Suicide Case
• Lori Drew Files Motions to Dismiss in MySpace Cyberbullying Case
• Experts Say MySpace Suicide Indictment Sets 'Scary' Legal Precedent
• Teen Involved in MySpace Suicide Hoax Says Adult Also Participated
• No Charges Will Be Filed In Cyberbullying Case
• Federal Grand Jury Issues Subpoenas in Teen Cyberbullying Case
• Megan Meier Suicide Stokes the Internet Fury Machine
• Prosecutor Will Review Megan Meier Cyberbullying Case

Copyrights

* In the Harry Potter fair use case, the court declared that the Lexicon encyclopedia isn't fair use.

* The judge declared a mistrial in the Jammie Thomas case.

* Designer Skin v. S&L Vitamins has reached its denouement. Previous blog coverage of the case (1, 2). In the prior ruling, the judge denied the plaintiff damages for the copyright infringement. In the final ruling, the court enjoins cutting and pasting product shots but allows the defendant to recreate the product shots. Ronald Coleman has more here and here (noting that the court says that, per MercExchange, an injunction does not automatically follow from a finding of copyright infringement).

* Wired's 5 year retrospective on the RIAA's litigation campaign against file sharing.

Social Networking Sites, Blogs and Online Publishing

* J.S. ex rel. Snyder v. Blue Mountain School Dist., 2008 WL 4279517 (M.D. Pa. Sept. 11, 2008). Upholding student discipline for creating a fake MySpace page of principal. The school initially based the discipline on the student infringing copyright (by cutting and pasting the principal's photo) but this aspect of the case wasn't mentioned at all in the court's reasoning.

* O.Z. v. Board of Trustees of Long Beach Unified School Dist., 2008 WL 4396895 (C.D. Cal. Sept. 9, 2008). Two seventh graders make a video about killing their teacher, described as:

The slide show is essentially a dramatization of the murder of Mrs. Rosenlof. The first slide photo states, "Mrs. Rosenlof dies." Throughout the slide show there are photos of Plaintiff dressed up in a costume, depicting a woman meant to resemble Mrs. Rosenlof. There is red text on each slide photo that describes the scene. One slide says, "Jelly Donut's knife: haha fat bastard. here i come!" In this same photo, the viewer can see a butcher knife lunging at Mrs. Rosenlof's character from the camera's point of view. The butcher knife is then laid on the fallen victim while the text reads, "hehehe. i'm a shank yoooooooooo!" At the end of the slide show, it reads, "your [sic] dead, BITCH! :D".

I think they thought it was funny, but no one else did. One of them posted the video to YouTube. It's unclear what happens to the poster, but the co-content creator was suspended and forced to transfer to another school for her eighth grade. In this case, her TRO request is denied, even if she didn't intend the video to be publicly distributed and even if the video was not a "true threat."

* Spanierman v. Hughes, 2008 WL 4224483 (D. Conn. Sept 16, 2008). Teacher who was fired for inappropriate MySpace communications with students can't sue the school.

* An encouraging update on the Lori Drew prosecution.

* Bill McGeveran on Facebook Beacon and legal liability.

* Good NYT article on the sociology of Facebook and Twitter.

* Sam Bayard on an interesting but confusing ruling from Montana on its shield law applied to anonymous online posters.

* Verdana Partners v. Giles. Online newspaper wins anti-SLAPP claim.

* Jardin v. Datallegro, Inc., 2008 WL 4104473 (S.D. Cal. Sept. 3, 2008). A litigant's taking down a blog post and its comments is not destruction of evidence.

* Nemet Chevrolet has appealed its 230 loss. Previous blog coverage.

* Do Facebook's anti-spam policies overregulate Facebook's power users?