Can public websites decide who is and is not a criminal through their terms of service? A brief EFF filed yesterday argues no.

The amicus brief is a follow-up to one we filed last month in Facebook v. Power Ventures. Facebook claims that Power breaks California
criminal law by offering users a tool that aggregates their own
information across several social networking sites. For some, it may be a
useful way to access various social network information through one
interface. The tool also makes it easier for users to export their data
out of Facebook. In its suit against Power Ventures, Facebook claims
that the tool violates criminal law because Facebook's terms of service
ban users from accessing their information through "automated means."

This is not an esoteric business issue, because the legal theories Facebook is pushing forward would make it a crime not to comply with terms of service. People have already faced criminal charges for
violating a site's terms of use policy. For example, in United States v.
Lori Drew, a woman was charged with violating the federal
computer crime law for creating a false profile that was used to
communicate inappropriately with a teenager who eventually committed
suicide. EFF filed an amicus
brief in that case arguing that terms of service do not define
criminal behavior, and the charges were eventually dismissed. We also
defended Boston College computer science student Riccardo
Calixte, whose computers, cellphone and iPod were seized by local
police who claimed that he violated criminal law by giving a fake name
on his Yahoo account profile. A justice of the Massachusetts Supreme
Judicial Court ordered
police to return the property after finding there was no probable cause
to search the room in the first place.

Using criminal law to enforce private website operators' terms of use puts immense coercive power behind measures that may be contrary to the interests of consumers and the public. EFF believes that users have the
right to choose how they access their own data, and that services like
Power's give users more options. So long as the add-on service does not
access off-limits information and is not harmful to server
functionality, authorized users who choose add-on technologies like
Power’s commit no crime. Frighteningly, under Facebook's theory,
millions of Californians who disregard or don't read terms of service on
the websites they visit would risk criminal liability.

Another wrinkle in the case is Facebook's attempt to interfere with uses of the Power service through IP address blocking. In response to the block, Power simply changed its IP address so it could continue to
provide its service. The IP address blocking used by Facebook was a
crude attempt to control the means by which authorized users could
access the website; it was not aimed at distinguishing between
authorized and unauthorized users. Yet, remarkably, Facebook claims that
Power's IP address change is also a violation of the law. Indeed,
Facebook's claimed prohibition against "automated means" of access is so
broad that it could be read to prevent any automatic process for
presenting your credentials -- even the "remember my password" functions
in web browsers.

As social networking increases in popularity, it's important that users are able to preserve their rights when using these services, including the right to choose competitive services and to take their
information and leave. That's why we've developed a Bill
of Rights for Social Nework users. Users deserve to maintain
control of their information without facing criminal threats.

Related Issues: Coders' Rights Project, Innovation, Social Networks

Related Cases: US v. Drew

[Permalink]