DOJ Says Lying on the Internet is a Federal Crime

Written by Brian Koenig --  New American
Wednesday, 16 November 2011


The U.S. Department of Justice (DOJ) is backing a controversial component of an existing computer fraud law that makes it a crime to use a fake name on Facebook or embellish your weight on an online dating profile such as eHarmony. The Computer Fraud and Abuse Act (CFAA), a 25-year-old law that mainly addresses hacking, password trafficking, and computer viruses, should enforce criminal penalties for users who violate websites’ terms of service agreements, alleges the Justice Department.

In a hearing before the House Judiciary Committee’s subcommittee on crime, terrorism and homeland security, federal officials deliberated over cyber threats to the country’s infrastructure and a perplexing interpretation of the law that makes lying on the Internet a crime. During the hearing, titled "Cyber Security: Protecting America’s New Frontier," the DOJ’s deputy computer crime chief Richard Downing addressed Congress, asserting that the CFAA law must allow "prosecutions based upon a violation of terms of service or similar contractual agreement with an employer or provide[r]."

"Businesses should have confidence that they can allow customers to access certain information on the business's servers, such as information about their own orders and customer information, but that customers who intentionally exceed those limitations and obtain access to the business's proprietary information and the information of other customers can be prosecuted," said Downing’s prepared remarks.

This interpretation of the law was applied by the DOJ in 2008 to prosecute Lori Drew, a woman who created a fake MySpace account and cyber attacked a 13-year-old girl who then committed suicide. The department contended that MySpace’s terms of service restricts users from creating fraudulent profiles, so Drew was convicted of violating the CFAA (although her conviction was dismissed in 2009). "It basically leaves it up to a website owner to determine what is a crime," U.S. District Judge George Wu indicated in his 2009 verdict, which acquitted Drew of the charges. "And therefore it criminalizes what would be a breach of contract."

The DOJ justified the move by enforcing a dubious section of the CFAA that was supposedly never intended to be used in that manner, which is a general-purpose prohibition on any computer-related action that "exceeds authorized access" — meaning, a website’s terms of service determines what is "authorized" or not. This is how Downing put it in his testimony:

These are just a few cases, but this tool is used routinely. The plain meaning of the term 'exceeds authorized access,' as used in the CFAA, prohibits insiders from using their otherwise legitimate access to a computer system to engage in improper and often malicious activities. We believe that Congress intended to criminalize such conduct, and we believe that deterring it continues to be important. Because of this, we are highly concerned about the effects of restricting the definition of 'exceeds authorized access' in the CFAA to disallow prosecutions based upon a violation of terms of service or similar contractual agreement with an employer or provider. 

In an August letter to the Senate, the ACLU, FreedomWorks, the Electronic Frontier Foundation, and Americans for Tax reform, warned that this convoluted interpretation of the law could make ignoring such "terms" a felony. "If a person assumes a fictitious identity at a party, there is no federal crime," the letter read. "Yet if they assume that same identity on a social network that prohibits pseudonyms, there may again be a CFAA violation. This is a gross misuse of the law." Orin Kerr, a former DOJ computer crime prosecutor and now law professor at George Washington University, says the government’s contentions are anemic, as he told CNET prior to the hearing:

The Justice Department claims to have an interest in enforcing Terms of Use and computer use policies under the CFAA, but its examples mostly consist of cases in which the conduct described has already been criminalized by statutes other than the CFAA. Further, my proposed statutory fix… would preserve the government's ability to prosecute the remaining cases DOJ mentions while not raising the civil liberties problems of the current statute.

In combating the statute, Kerr is requesting that Congress follow the Senate Judiciary Committee’s lead, which recently approved an amendment to a pending bill that would narrow the "exceeding authorized access" interpretation of the CFAA. The amendment says the law would "not include access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or non-government employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized." Downing and the DOJ requested that the House not approve the amendment.

However, beyond the devious doings of Facebook users and online dating prowlers are countless other terms of service stipulations that are littered throughout the World Wide Web. For instance, many Internet media outlets disclose various restrictions for users posting comments under articles, blogs, and forums. But how many people read the terms of service under the comments section of a website? What happens if a website’s terms of service contains a clause that prohibits users from posting opposing viewpoints? According to the DOJ, such actions are subject to prosecution.

"Terms of Use can be arbitrary and even nonsensical," said Kerr, relaying the above note.

"Anyone can set up a website and announce whatever Terms of Use they like. Perhaps the Terms of Use will declare that only registered Democrats can visit the website; or only people who have been to Alaska; or only people named "Frank." Under the Justice Department’s interpretation of the statute, all of these Terms of Use can be criminally enforced… I do not see any serious argument why such conduct should be criminal."

Lying on the Internet may be immoral, but should it really be criminalized by law? Moreover, is this the same DOJ headed by Attorney General Eric Holder who's admitted lying about the "Fast and Furious" gunrunning scandal? 

Indeed, the Big Brother police state, which continues to assail Americans’ civil liberties, strikes yet again.

The FBI and the Myth of Fingerprints

A "100 Per Cent Certainty"

by ALEXANDER COCKBURN and JEFFREY ST. CLAIR

Few law enforcement institutions have been so thoroughly discredited in recent years as the FBI’s forensic lab. In 1997 the Bureau’s inspector general of the time issued a devastating report, stigmatizing one instance after another of mishandled and contaminated evidence, inept technicians, and outright fabrication. The IG concluded that there were "serious and credible allegations of incompetence" and perjured courtroom testimony.

CounterPunch’s view is that taken as a whole, forensic evidence as used by prosecutors is inherently untrustworthy. For example, for years many people went to prison on the basis of the claims of a North Carolina anthropologist, Louise Robbins. She helped send people to prison or to Death Row with her self-proclaimed power to identify criminals through shoe prints. As an excellent recent Chicago Tribune series on forensic humbug recalled, on occasion she even said she could use the method to determine a person’s height, sex and race. Robbins died in 1987, her memory compromised by the conclusion of many Appeals Courts that her methodology was bosh. There have been similarly hollow claims for lip prints and ear prints, all of (added "of") them invoked by their supporters as "100 per cent reliable" and believed by juries too easily impressed by passionate invocations to 100 per cent reliable scientific data.

Of course the apex forensic hero of prosecutors, long promoted as the bottom line in reliability–at least until the arrival of DNA matching–has been the fingerprint.

Fingerprints entered the arsenal of police and prosecutors in the late nineteenth century, touted as "scientific" in the manner of other fashionable methods of that time in the identification of supposed criminals, such as phrenology. A prime salesman was Francis Galton, Charles Darwin’s cousin and a founding huckster for the bogus "science " of eugenics. Actually fingerprints, at least in modern times, found their original use in the efforts of a British colonial administrator to intimidate his Indian laborers (whose faces he could not distinguish) from turning up more than once to get paid. He’d make a great show of scrutinizing the fingerprints he insisted they daub on his ledger book. Then, as now, the use of the so-called "unique fingerprint" has been histrionic , not scientific. In 1995, so the Chicago Tribune series discovered, " one of the only independent proficiency tests of fingerprint examiners in U.S. crime labs found that nearly a quarter reported false positives, meaning they declared prints identical even though they were not–the sort of mistakes that can lead to wrongful convictions or arrests."

Decade after decade people have been sent to prison for years or dispatched to the death cell, solely on the basis of a single, even a partial print. So great is the resonance of the phrase "a perfect match" that defense lawyers throw in the towel, as judge and jury listen to the assured conclusions of the FBI’s analysts who virtually monopolize the fingerprint industry in the U.S.A. Overseas, in London’s Scotland Yard for example, the same mesmerizing "certainty" held sway, and still does. In the U.S.A., part of the mystique stems from the "one discrepancy rule" which has supposedly governed the FBI’s fingerprint analysis. The rule says that identifications are subject to a standard of "100 per cent certainty" where a single difference in appearance is supposed to preclude identification.

The 1997 lab scandals threw a shadow over the FBI’s forensic procedures as a whole and the criminal defense bar began to raise protests against prosecutorial use of latent fingerprint identification evidence, as produced by FBI procedures. In 2002 Judge Louis Pollak, in a case in Pennsylvania, initially ruled that the FBI’s fingerprint matching criteria fell below new standards of forensic reliability (the Daubert standards) stipulated by the U.S. Supreme Court. Ultimately he was persuaded that the FBI’s fingerprint lab had never made a mistake. In 2004, in U.S. v. Mitchell, the Third Circuit Court of Appeals upheld these same procedures.

Now at last, in 2006, the FBI’s current inspector general, Glenn Fine, has grudgingly administered what should properly be regarded as the deathblow to fingerprint evidence as used by the FBI and indeed by law enforcement generally.

The case reviewed by Inspector General Fine, at the request of U.S. Rep John Conyers and U.S. Senator Russell Feingold, concerns the false arrest by the FBI of Brandon Mayfield, a lawyer from Beaverton, Oregon.

On March 11, 2004, several bombs exploded in Madrid’s subway system with 191 killed and 1,460 injured. Shortly thereafter the Spanish police discovered a blue plastic bag filled with detonators in a van parked near the Acala de Heres train station in Madrid, whence all of the trains involved in the bombing had originated on the fatal day.

The Spanish police were able to lift a number of latent prints off the bag. On March 17 they transmitted digital images of these fingerprints to the FBI’s crime lab in Virginia. The lab ran the images through its prized IAFIS, otherwise known as the integrated, automated, fingerprint identification system, containing a database of some 20 million fingerprints.

The IAFIS computer spat out twenty "candidate prints", with the warning that these 20 candidates were "close non-match". Then the FBI examiners went to work with their magnifying glasses, assessing ridges and forks between the sample of 20 and the images from Spain. In a trice the doubts of the IAFIS computer were thrust aside, and senior fingerprint examiner Terry Green determined that he had found "a 100 per cent match" with one of the Spanish prints of the fourth-ranked print in the IAFIS batch of 20 close non-matches. Green said this fourth ranked print came from the left index finger of Brandon Mayfield. Mayfield’s prints were in the FBI’s master file, not because he had been arrested or charged with any crime, but because he was a former U.S. Army lieutenant.

Green submitted his conclusions to two other FBI examiners who duly confirmed his conclusions. But as the inspector general later noted, these examiners were not directed to inspect a set of prints without knowing that a match had already asserted by one of their colleagues. They were simple given the pair of supposedly matched prints and asked to confirm the finding. (These two examiners later refused to talk to the FBI’s inspector general.)

The FBI lost no time in alerting the U.S. Prosecutor’s office in Portland, which began surveillance of Mayfield with a request to the secret FISA court which issued a warrant for Mayfield’s phone to be tapped on the grounds, laid out in the Patriot Act, that he was a terrorist, and therefore by definition a foreign agent.

Surreptitious tapping and surveillance of Mayfield began. On April 2, 2004, the FBI sent a letter to the Spanish police informing them that they had a big break in the case, with a positive identification of the print on the bag of detonators.

Ten days later the forensic science division of the Spanish national police sent the FBI its own analysis. It held that the purported match of Mayfield’s print was "conclusively negative". (The inspector general refers to this as the "negativo Report".)

The next day, April 14, the U.S. Prosecutor in Portland became aware of the fact that the Spanish authorities were vigorously disputing the match with Mayfield’s left forefinger. But by now the Prosecutor and his team were scenting blood. Through covert surveillance they had learned that Mayfield was married to an Egyptian woman, had recently converted to Islam, was a regular attendee at the Bailal mosque in Portland, and had as one of his clients in a child custody dispute an American Muslim called Jeffrey Battle. Battle, a black man, had just been convicted of trying to go to Afghanistan to fight for the Taliban.

Armed, so they thought, with this arsenal of compromising detail, the U.S. Prosecutor and the FBI had no patience with the pettifogging negativism of the Spanish police. So confident were the Americans of the guilt of their prey that they never went back to take another look at the supposedly matching prints. Instead, on April 21, they flew a member of the FBI’s latent print unit to Spain for on-the-spot refutation of the impertinent Madrid constabulary.

The Inspector General’s report makes it clear that the FBI man returned from Spain with a false account of his reception, alleging that the Spanish fingerprint team had bowed to his superior analytic skills. The head of the Spanish team, Pedro Luis Melida-Weda, insists that his team remained entirely unconvinced. "At no time did we give our approval. We refused to validate the FBI’s conclusions. We kept working on the identification."

By now either the U.S. Attorney’s office or, more likely, the FBI was leaking to the press news of the pursuit of a U.S. suspect in the Madrid bombing. But they knew that the actual evidence they had on Mayfield was virtually non-existent, aside from the fingerprint. On May 6, the U.S. Prosecutor in Portland told U.S. District Court Judge Robert Jones that the Spanish police had ultimately accepted the FBI’s match, that Mayfield, alerted by the stories in the press about an unnamed suspect, might start destroying evidence, and that, therefore, they wanted to seize Mayfield, using the now favored charge du jour of the war on terror, claiming him to be a "material witness". Judge Jones okayed an arrest warrant.

Mayfield had no idea that the FBI had been tapping his phones and secretly rummaging through his office. The first time he became aware that he was a citizen under suspicion was on the afternoon of May 6. On that day eight FBI agents showed up at his law office, seized him, cuffed his hands behind his back, ridiculed his protestations. As they approached the door, Mayfield implored them to take the handcuffs off, saying he didn’t want his clients or staff to see him in this condition. The FBI agents said derisively, "Don’t worry about it. The media is right behind us."

Mayfield ended up with two federal public defenders, Steven Wax and Christopher Schatz. Like many such, these two were dedicated to their interest of their client, tireless and resourceful. Their first concern was to get Mayfield out on the Multnomah federal detention center in downtown Portland. Though jailed under an alias chosen for him by the U.S. Prosecutor, the feds had immediately leaked this alias–Randy Barker–to The Oregonian newspaper, and a guard at the jail had promptly roughed up Mayfield.

The two public defenders went before Judge Jones and asked that as a material witness he be kept under house arrest, there being scant apparent evidence against him. Judge Jones finally compelled the U.S. Prosecutor to say what evidence he had against Mayfield. A fingerprint, said the U.S. Prosecutor, withholding from the court the fact that this fingerprint was highly controversial and had been explicitly disqualified by the Spanish police.

The federal defenders questioned the imprisonment of their client, faced penalties of the utmost gravity, on the basis of a fingerprint. Judge Jones allowed as how he had sent people to prison for life on the basis of a single fingerprint. Mayfield’s attorneys asked to see a copy of the allegedly matched fingerprints and have them evaluated by their own expert witness. Knowing he was on thin ice the U.S. Prosecutor refused, claiming it was an issue of national security. Under pressure from Judge Jones, himself pressured by the assiduous federal defenders, the U.S. Prosecutor finally agreed he would give the prints to an independent evaluator selected by Judge Jones.

The prints were given to Kenneth R. Moses of San Francisco, an SFPD veteran who runs a company called Forensic Identification Services which, among other things, proclaims its skills in "computer enhancement of fingerprints". It was "quite difficult", Moses said, because of "blurring and some blotting out", but yes, the FBI had it right, and there was "100 per cent certainty" that one of the prints on the blue bag in Madrid derived from the left index finger of Brandon Mayfield.

Moses transmitted this confident opinion by phone to Judge Jones on the morning of May 19. Immediately following Moses’ assertion, the U.S. attorney stepped forward to confide to Judge Jones dismaying news from Madrid from the Spanish police that very morning. The news "cast some doubt on the identification". This information, he added, "was classified or potentially classified".

The prosecutors then huddled with the judge in his chambers. After 20 minutes, Judge Jones stormed back out and announced that the prosecutors needed to tell the defense lawyers what they had just told him. The prosecutor duly informed the courtroom that the Spanish police had identified the fingerprint as belonging to the right middle finger of Ouhnane Daoud, an Algerian national living in Spain. Daoud was under arrest as a suspect in the bombing. Judge Jones ordered Mayfield to be freed. The U.S. prosecutor said he should be placed under electronic monitoring, a request which the judge turned down.
Four days later, on May 24, the warrant for his detention was dismissed.

The FBI sent two of their senor fingerprint analysts to Spain on a mission to salvage the Bureau from humiliation. The two analysts did their best, returning with the claim that the fingerprint sent to the FBI by the Spanish police was of "no value for identification purposes", a claim which the inspector general later shot down by pointing that only a few weeks thereafter the FBI’s latent fingerprint unit concurred with the Spanish national police lab’s determination that the print on the bag matched the right middle finger of Ouhnane Daoud.

The FBI lab fought an increasingly desperate rearguard battle, eventually claiming that it had been the victim of an excessive reliance on technology. The inspector general points out that the only investigator in the FBI’s lab to emerge with any credit is in fact the IAFIS computer that had stated clearly, "close, no match".

The inspector general writes the bottom line on the "science" of fingerprint matching He gets the FBI’s top examiner to admit that if Mayfield had "been like the Maytag repair man" and not a Muslim convert married to an Egyptian, "the laboratory might have revisited the identification with more skepticism."

And Daoud’s fingerprint match? We don’t know, but if he was convicted on the basis of fingerprints alone, we would say there is grounds for an appeal.