Last Thursday, a federal grand jury in California indicted a Missouri woman, Lori Drew, for her alleged role in a MySpace hoax directed against a 13-year-old neighbour, Megan Meier. Meier was distressed by the hoax and committed suicide in October 2006. CNN has a story about the case and the indictment [pdf].

The charges revolve around claim that Drew accessed protected computers without authorisation. The indictment cites 18 U.S.C. 1030 sections (a)(2)(C) and (c)(2)(B)(ii). Did Drew "hack into" a MySpace account to get information?

Not in the usual sense, The act of creating an account in the name of a non-existent person in violation of MySpace's terms of service (ToS) and using that account to communicate with the victim was deemed to be the unauthorised access. This is quite a stretch.

Orin Kerr's posting on The Volokh Conspiracy explains three hurdles for the prosecutors and why the indictment should be dismissed. Kerr also makes a reference to his NYU Law Review article, Cybercrime's Scope: Interpreting 'Access' and 'Authorization' in Computer Misuse Statutes.

Daniel J. Solove also has been commenting on the case & indictment. Solove has also posted on a misguided response to the case by Missouri legislators. The summary for Missouri bill SB 818 to modify laws concerning stalking & harassment says:

Currently, the crime of harassment includes communications meant to frighten or disturb another person. Under this act, communications conducted to knowingly frighten, intimidate, or cause emotional distress to another person are included. Harassment includes communications by any means.

Harassment includes knowingly using unwanted expressions that put the person in reasonable apprehension of offensive physical contact or harm or knowingly making unwanted communications with a person.

A person also commits harassment:

1) By knowingly communicating with another person who is, or who purports to be, seventeen years of age or younger and in so doing, and without good cause, recklessly frightens, intimidates, or causes emotional distress to such other person; or

2) By engaging, without good cause, in any other act with the purpose to frighten, intimidate, or cause emotional distress to another person, cause such person to be frightened, intimidated, or emotionally distressed, and such person's response to the act is one of a person of average sensibilities considering the person's age.

[...]

This act expands the crime of stalking to include any course of conduct with two or more acts over a period of time that is communicated by any means. A "credible threat" includes those made with the intent to cause the person who is the target to reasonably fear for his or her family's safety or family's pet's or livestock's safety, and not only his or her own safety.

Under this act, the definition of "harasses" is modified to include conduct directed at a specific person that serves no legitimate purpose, that would cause a reasonable person to be frightened or intimidated, as well as emotionally distressed. A person need only harass a person purposely, rather than purposely and repeatedly, to commit the crime of stalking or aggravated stalking.

Solove explains how this attempt to address a difficult problem with an awkwardly craft legislation could have a chilling effect upon speech. He gives a scenario showing also how many children could easily become criminals under this legislation:

Consider the following case: Child 1 teases Child 2 by saying that he's a "nerd." Child 2 starts to cry. Child 1 repeats the insult. Child 1 has knowingly communicated with Child 2 and without good cause, has recklessly caused that child emotional distress. Yup, let's charge Child 1 with a crime and all other children of his or her ilk. Let's have Missouri start building jails, so it can lock up all those children who insult, frighten, or cause emotional distress to each other.

Good example.

By the way, the Missouri bill states "This act shall not apply to activities of law enforcement officers conducting investigations." OK, it helps the police, but what about others whose activities might risk being interpreted as violations? For example, the modification of the verb  "harasses"  to include "conduct directed at a specific person that serves no legitimate purpose, that would cause a reasonable person to be frightened or intimidated, as well as emotionally distressed" leaves much uncertainty as to what might be a violation.

Much would hinge upon interpretation of what constitute legitimate purposes. Investigative reporters may cause emotional distress in some cases. Perhaps print, radio, and TV journalists would be generally safe. But what about online media journalists and content creators?

J.D. Abolins
NOTE: I am not an attorney and my ponderings upon the law should not be taken as expert advice.