DOJ Says Lying on the Internet is a Federal Crime

Written by Brian Koenig --  New American
Wednesday, 16 November 2011


The U.S. Department of Justice (DOJ) is backing a controversial component of an existing computer fraud law that makes it a crime to use a fake name on Facebook or embellish your weight on an online dating profile such as eHarmony. The Computer Fraud and Abuse Act (CFAA), a 25-year-old law that mainly addresses hacking, password trafficking, and computer viruses, should enforce criminal penalties for users who violate websites’ terms of service agreements, alleges the Justice Department.

In a hearing before the House Judiciary Committee’s subcommittee on crime, terrorism and homeland security, federal officials deliberated over cyber threats to the country’s infrastructure and a perplexing interpretation of the law that makes lying on the Internet a crime. During the hearing, titled "Cyber Security: Protecting America’s New Frontier," the DOJ’s deputy computer crime chief Richard Downing addressed Congress, asserting that the CFAA law must allow "prosecutions based upon a violation of terms of service or similar contractual agreement with an employer or provide[r]."

"Businesses should have confidence that they can allow customers to access certain information on the business's servers, such as information about their own orders and customer information, but that customers who intentionally exceed those limitations and obtain access to the business's proprietary information and the information of other customers can be prosecuted," said Downing’s prepared remarks.

This interpretation of the law was applied by the DOJ in 2008 to prosecute Lori Drew, a woman who created a fake MySpace account and cyber attacked a 13-year-old girl who then committed suicide. The department contended that MySpace’s terms of service restricts users from creating fraudulent profiles, so Drew was convicted of violating the CFAA (although her conviction was dismissed in 2009). "It basically leaves it up to a website owner to determine what is a crime," U.S. District Judge George Wu indicated in his 2009 verdict, which acquitted Drew of the charges. "And therefore it criminalizes what would be a breach of contract."

The DOJ justified the move by enforcing a dubious section of the CFAA that was supposedly never intended to be used in that manner, which is a general-purpose prohibition on any computer-related action that "exceeds authorized access" — meaning, a website’s terms of service determines what is "authorized" or not. This is how Downing put it in his testimony:

These are just a few cases, but this tool is used routinely. The plain meaning of the term 'exceeds authorized access,' as used in the CFAA, prohibits insiders from using their otherwise legitimate access to a computer system to engage in improper and often malicious activities. We believe that Congress intended to criminalize such conduct, and we believe that deterring it continues to be important. Because of this, we are highly concerned about the effects of restricting the definition of 'exceeds authorized access' in the CFAA to disallow prosecutions based upon a violation of terms of service or similar contractual agreement with an employer or provider. 

In an August letter to the Senate, the ACLU, FreedomWorks, the Electronic Frontier Foundation, and Americans for Tax reform, warned that this convoluted interpretation of the law could make ignoring such "terms" a felony. "If a person assumes a fictitious identity at a party, there is no federal crime," the letter read. "Yet if they assume that same identity on a social network that prohibits pseudonyms, there may again be a CFAA violation. This is a gross misuse of the law." Orin Kerr, a former DOJ computer crime prosecutor and now law professor at George Washington University, says the government’s contentions are anemic, as he told CNET prior to the hearing:

The Justice Department claims to have an interest in enforcing Terms of Use and computer use policies under the CFAA, but its examples mostly consist of cases in which the conduct described has already been criminalized by statutes other than the CFAA. Further, my proposed statutory fix… would preserve the government's ability to prosecute the remaining cases DOJ mentions while not raising the civil liberties problems of the current statute.

In combating the statute, Kerr is requesting that Congress follow the Senate Judiciary Committee’s lead, which recently approved an amendment to a pending bill that would narrow the "exceeding authorized access" interpretation of the CFAA. The amendment says the law would "not include access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or non-government employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized." Downing and the DOJ requested that the House not approve the amendment.

However, beyond the devious doings of Facebook users and online dating prowlers are countless other terms of service stipulations that are littered throughout the World Wide Web. For instance, many Internet media outlets disclose various restrictions for users posting comments under articles, blogs, and forums. But how many people read the terms of service under the comments section of a website? What happens if a website’s terms of service contains a clause that prohibits users from posting opposing viewpoints? According to the DOJ, such actions are subject to prosecution.

"Terms of Use can be arbitrary and even nonsensical," said Kerr, relaying the above note.

"Anyone can set up a website and announce whatever Terms of Use they like. Perhaps the Terms of Use will declare that only registered Democrats can visit the website; or only people who have been to Alaska; or only people named "Frank." Under the Justice Department’s interpretation of the statute, all of these Terms of Use can be criminally enforced… I do not see any serious argument why such conduct should be criminal."

Lying on the Internet may be immoral, but should it really be criminalized by law? Moreover, is this the same DOJ headed by Attorney General Eric Holder who's admitted lying about the "Fast and Furious" gunrunning scandal? 

Indeed, the Big Brother police state, which continues to assail Americans’ civil liberties, strikes yet again.

Google+, the pseudonym banstick, and the netizen cultural schism.

Google+, the pseudonym banstick, and the netizen cultural schism.

by Emlyn - point7

As we all know by now, Google+ has a policy of only using real names (real world identities) in profiles. And they’re enforcing that policy with a big lumpy banstick.

This is causing much angst, a lot of gnashing of teeth. However it seems that the technorati, as well as the Googlers (and Facebook before them) are unmoved by the arguments, and sincerely puzzled by the outcry. What’s the big deal? Just create another profile, for crying out loud.

The big deal is that we are having an identity related clash of values, I think, between two very different kinds of heavily engaged online people:

• Integrated Identity: These are people who live online and offline with the same personality (including the Technorati because in fact their unified identity is their bread and butter), and
• Separate Identities: people who keep their online and offline worlds quite separate, not for duplicitous reasons but because they are in many ways two people; the online person and the offline person.

The integrated identities tend to work in the web 2.0 universe. Silicon valley seems to be the cultural center of this. They meet the same people online and offline; people who have startups, tech bloggers, money guys, opinion leaders of all kind. Their identity is their primary asset, it’s got their reputation attached to it. To them, it’d be mad to have a separate online and offline identity, and seems kind of sinister; what reason could you have to split your reputation, really, other than that you are trying to hide something?

But the separate identity people are actually part of a older tradition (and yes this environment is old enough to have an older tradition). It’s the tradition of the Handle, and it comes from back when computer networks were esoteric, back when using them was a marker of class. Back before Eternal September. I think that culture began because the people you’d meet online (be that bbs, or compuserve, or whatever) were exactly people that you’d rarely meet in real life; that was the beauty of the networks, that you could meet interesting, intelligent people who you would never otherwise have access to, but with some other, better kind of proximity; shared interests, shared tastes, shared culture at some level.

I feel like the people lucky enough to live and work in the exciting geographic centers of the web 2.0 world, who do mix with the same people online and off, who all “get it”, are missing that the great majority of us live in a very different world. The types of people with a pseudonymous online life tend to live, I think, in geographical environments very unlike their online worlds. These are conservative, sleepy parts of the world, where the normal people they meet in everyday life, the family members that they love, the work colleagues they go drinking with, are largely clueless about and uninterested in the online world.

Separate Identity netizens aren’t participating in online life as an economic activity, or for networking per se; it’s really purely social. They are doing it for fun, for connection to other people who get it, for self expression. To that end, a Handle is a badge, a marker to say “I belong”. It also communicates something about the online personality (probably often as distinct from the offline personality).

There is no doubt that Separate Identity is also about keeping the identities separate, hiding one from the other to some extent. And there’s a continuum here, between people who use a pseudonym for self expression, and those who use it for far more serious reasons (like hiding from abusive stalkers, or so they can speak candidly about people in their lives, or to protect themselves from discrimination in their communities or workplaces).

I personally go by my real name, but I’m sympathetic to Separate Identity, and still partially am a Separate Identity person. Offline I’m Emlyn O’Regan, online I’m Emlyn, the virtual person. I tried using handles in my very early engagements with the online universe, but found I was too lazy to keep it going; I decided instead to make my own name into my online “brand”, let the worlds clash where they will, and deal with the fallout as it comes.

It turns out that’s been a really good decision. I was in a better position, when the web 2.0 social network storm hit, to just let loose and not worry about these issues, than many of my pseudonymous friends. But it’s still difficult. A google search on my name will dredge up a long google shadow, and while that might be cool in the context of my netizen status, to folks embedded heavily in RL it can be something that asks questions and engenders suspicion. What’s all this weird stuff he talks about online? Why does he spend all this time doing unpaid technical stuff? What’s with the weirdo anarchist/socialist tendencies?

Now I’ve chosen to just wear that stuff, and let it act as a real life filter. If you don’t like my prodigious output on frivolous social networking sites, and choose not to employ me for that reason, then maybe I’ve dodged a bullet (ie: maybe you make foolish decisions and would have been a shitty boss). But my choices are unusual.

More common in my experience is that people choose to hide parts of themselves from their real world contacts in order to live the life they want to live. Maybe you decide not to let your family know of your anarchist tendencies? Maybe the tell all blog about your relationship is something you really don’t want your partner to read? Maybe you need to discuss your atheist convictions, but not have that connect with your deeply conservative, christian employer?

For many netizens, Pseudonyms are just a way to separate concerns, to keep distinct namespaces. Forcing people to collapse these identities into one may seriously damage this, and probably end up diminishing their lives. This is especially true for those who treasure their online identity more than their offline one.

Also, many long time users of pseudonyms have serious reputation capital invested in their pseudonyms. Forcing them to rename themselves is flushing this down the toilet. It’s also potentially breaking their own relationship networks; if they are only known by the pseudonym, it might be very difficult to reestablish those ties. Certainly in the Buzz community, a crowd of google cheerleaders and fanbois, the move to Google+ has been a mixed blessing, as the banstick reeks havoc and maybe permanently damages the fabric of the community’s relationship graph.

Something else that Google (and other Integrated Identity techies) might want to consider is that people will continue to use pseudonyms. You might try to enforce real identities, but people gain value from their nicknames, and will find ways around your restrictions. The same thing applies to a large social network that applies to any large information system in which end users are being forced by policy to do something against their interests; they will rebel against the policy and fill the system with garbage, garbage that better aligns with their interests. In a work monitoring system, for example, you get stuff like bogus hours worked, weird job codes. In a social network, you’ll get real looking fake identities, and a culture of breaking the system for the lulz.

One last point for integrated identity people: you are the minority. Separate Identity is not the weird old past of the net, it is the present. The most switched on online people are Separate Identity. Look at the gamer communities and the persistent use of handles. Look at the Mommy Bloggers. Look at old email lists and usenet groups. The only subcultures that I can think of that are committed to real identities online are

• the late adopters (“your grandma”), the people who hate computers and wouldn’t be here if they weren’t forced.
• people who use LinkedIn (and that’s not really a subculture, just a reflection of the work world)
• the silicon valley web 2.0 people.

I know you guys want to change the world. I do too. But you need to absorb a truth, and that is that the Separate Identity culture is here for a *reason*. Its benefits far outweigh its drawbacks. On the internet, no one knows you are a dog, and that’s a really good thing.

You want to help people rebel against tyrants? Talk openly about their thoughts and beliefs and fears? Connect with new people, learn new things? Imagine and discuss and create a new and better world?

Then embrace the Separate Identity. It’s the right thing to do, it’s the good thing to do. And who knows? You guys might need it too one day.

****

(Excellent points and I expect I'll fall any day now in this cull.--jef)