Are sockpuppeteers computer criminals?

by John Q on January 14, 2009

The Lori Drew case, in which a US woman set up a Myspace account under the name “Josh Evans” to torment a teenage girl who had fallen out with Drew’s daughter, and drove her victim to suicide, has some legal implications of interest to bloggers. Drew was ultimately sentenced to jail, not for her cruel prank and its fatal consequences, but for “unauthorized access to a computer system” by virtue of the false name under which the account was created. On the face of it, the same offence is committed (at least under US law) every time a commenter on a blog or noticeboard uses a sockpuppet to evade bans or blocks, or to post under multiple identities in violation of contractual terms.

UpdateFollowing up on some comments, I was startled to discover that, in some US jurisdictions, obtaining consent to sex through fraud regarding identity (a man pretending to be his brother in the case at hand) is a full defence against a charge of rape, and even more startled to read this post and comments at TalkLeft largely endorsing the court’s finding in this case. This isn’t the case in Australia and, though IANAL, I’m pretty sure it never has been either here of in the UK. (Update ends)

Drew’s lawyers, who include Volokh conspirator Orin Kerr, are appealing on the unappealing (at least to a me as a non-lawyer) grounds that “fraudulently induced consent is consent nonetheless“. They claim that, by allowing the creation of the account, “MySpace affirmatively authorized the access to its computers”.

Kerr’s argument reflects his views in a 2003 article where he distinguishes between the kind of contractual violation involved in the Drew case and “bypassing of a code-based restriction such as a password gate”. But sockpuppeters illustrate the difficulties of this distinction. A typical case would be a blog commenter, blocked under one identity, who reappears under a new one. In lots of cases, this involves bypassing a software block. Admittedly, the block is easily enough dodged, but the fact that a lock is easily broken is not a defence against a charge of burglary.

Moreover, there’s no easy distinction between sockpuppeteers and spammers. The typical sockpuppeteer infests one system at a time, as opposed to the millions attacked by spammers. On the other hand, spammers are often easier to deal with.

The real defence is that so many people do this kind of thing, usually with relatively trivial harm, that it should not be criminalised. But that’s a claim that’s applicable to all sorts of nuisance offences, and there seems to be no consistent pattern. For example, sometimes abusive language is a crime and sometimes it’s just a violation of etiquette. I’ll be looking forward to a test case.

{ 31 comments }

1

Randolph 01.14.09 at 1:27 pm

Oh, for heaven’s sake! It’s perfectly legal to walk around wearing a mask (though the police might view it very dimly.) It’s only if concealment is used to commit an actual crime (for instance, net abuse) that it becomes a problem. Unfortunately, seducing someone, breaking their heart, and encouraging their suicide is probably legal. (See 18th-century novels, passim.)

2

Pete 01.14.09 at 2:04 pm

“fraudulently induced consent is consent nonetheless“
That is certainly a bizarre argument. It would make anti-hacking law meaningless: if you could sucessfully hack into a system and impersonate its administrators by any means – code injection, buffer overrun, whatever – that would be legal, regardless of the intent of the administrators.

I remember when the UK had no Computer Misuse Act, so people were prosecuted for “theft of electricity”.

The UK also has the novel solution to the “anti-social or criminal?” conundrum: the ASBO.

3

ajay 01.14.09 at 2:26 pm

I don’t think the parallel is exact. If I get banned from CT and start posting again as “ceejay”, I am not actually misrepresenting myself. There’s no point at which I have to say “my real name is XXXXX”. All it asks for is a name and an email address. Even if I posted under my real name and was banned, and popped up again as “ceejay”, there’s still no lying involved.

But to set up a myspace account as “Barack Obama”, I will at some point have to fill in a form asserting that my real name is “Barack Obama”. (Which it isn’t.) There’s your misrepresentation right there. And if myspace takes the view that “access to this system is only permitted to people who use their real names” then I’ve just used deceit to gain unauthorised access to a system.

4

LizardBreath 01.14.09 at 2:31 pm

Several years ago, I did a little work on a couple of cases where an ISP attempted to sue spammers under a somewhat archaic tort theory, “trespass to chattel” — essentially, touching, albeit not stealing, someone’s stuff without their permission. (The pre-computer cases here are all from 1910 or so, and involve someone moving a wagon to an inconvenient location so the peach crop spoiled before it could be brought into town. That’s not accurate, I haven’t looked at this for years, but that sort of thing.) This is tort, not criminal liability, but it’s a similar issue — the offense as described in generic terms seems impossibly trivial, but spamming can cause a great deal of monetary damage, and there has to be some way of recovering for it.

(I did very little work on these cases, and don’t actually know how the law’s developed since the work I did, so this really shouldn’t be relied on as any sort of statement of American tort law.)

5

robertdfeinman 01.14.09 at 2:31 pm

Sites which make you sign a use agreement (like Facebook) should be covered by standard contract law. I’m not sure what the status is concerning criminal liability for such violations, usually the claims are taken up by civil actions.

However we live in a time when all concepts of privacy and civil liberties have been swept aside as the government continues to pass legislation which explicitly violates absolutely clear passages in the US Constitution. I guess we could call it Humpty Dumpty governance:

‘When I use a word,’ Humpty Dumpty said, in a rather scornful tone,’ it means just what I choose it to mean, neither more nor less.’

For example, Amendment I:

Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press;…

Is there any way to parse NO LAW as anything other than an absolute prohibition? Apparently, the Supreme Court and Congress think so. Once words no longer have meaning you no longer have democracy and the rule of law.

I have an essay on this based upon the work of legal philosopher Franz Neumann. Here are his principles:

1. All men are equal before the law.
2. Laws must be general, not specific (this rules out bills of attainder).
3. Retroactive laws are illegitimate.
4. Enforcement must be separate from the decision-making agencies.

In my essay I give examples of how each one has been violated:

Saving Democracy

6

Rich Puchalsky 01.14.09 at 2:35 pm

Any new legal theory that Orin Kerr supports must be bad, or he wouldn’t support it.

Which is not to say that this particular case should be settled one way or the other. But “fraudulently induced consent is consent nevertheless” is typical libertaria.

7

Tracy W 01.14.09 at 2:59 pm

You comment that there is no particular pattern of criminalising or not nusiance offences. But why would we expect there to be, particularly in democracies? I find it hard enough being consistent with myself, but to pass a law requires the cooperation of at least a majority in parliament, meaning that it draws on people from different backgrounds with different ways of looking at the world, and the only areas of life I know where agreement is very common is where disagreement results in death (eg genuine breatharians, who believe we don’t need food, are naturally self-limiting). Furthermore, a parliament is limited in the number of laws it can debate and pass simultaneously, and it has to spend some time debating non-criminal laws like the Budget, so parliaments can change their minds as the result of an election, or just because time has passed and an influential member has changed his or her mind. It would be very surprising to me if criminal law was consistent. Particularly in a common-law country where judges get involved and set precedents that leads the law off down all very unusual paths.

8

rea 01.14.09 at 3:00 pm

Is there any way to parse NO LAW as anything other than an absolute prohibition?

No, but “abridging the freedom of speech” leaves plenty of room for parsing.

If you go into a bank, and say to the teller, “I’ve got a gun–you money or your life,” you will be convicted of bank robbery, despite the fact that you’ve done nothing other than speak, just to give you an example that even the most dedicated defender of free speach would be unlikely to defend.

9

lemuel pitkin 01.14.09 at 3:52 pm

It’s perfectly legal to walk around wearing a mask

Not so.

It is, in fact, illegal to walk around wearing a mask, in many jurisdictions including Washington DC.

(I learned this first-hand many years ago as a Greenpeace campaigner…)

10

Stuart 01.14.09 at 4:30 pm

Lemuel, reading your link suggests you weren’t breaking that law, as you have to fit into one of the categories of part b, which a normal protest or whatever you were doing shouldn’t be in breach of.

11

rea 01.14.09 at 4:49 pm

In the unlikely evetn that anyone wasn’t able to figure this out, note that the local ordinance mentioned by Lemuel at No. 9 above was aimed at the Ku Klux Klan.

12

robertdfeinman 01.14.09 at 4:56 pm

Just to be clear because this is a subtle point. The first amendment guarantees (or did) freedom of speech. It does not guarantee that you won’t be prosecuted for events that happen as a result of that speech.

Right now we have a number of thought crimes on the books. These take the form of conspiracy and assisting “terrorism”. So when a bunch of guys get together and say they would like to blow up the Sears Tower even though they have no intention to do this, nor the means, nor the opportunity they get charged with conspiracy.

It wasn’t even a threat which would require some sort of overt action like waving a bomb around.

Similarly the press has allowed itself to be cowed by the government and now self censors itself even when it has evidence of official misconduct. NY Times reporter Erich Lichtblau uncovered the warrantless wiretapping story and the paper suppressed it for a year until he was on the verge of releasing it in his book. Who was served by this censorship? Then after the story came out Congress violated one of the precepts above by passing retroactive legislation to shield those who participated.

When asked, something like 50% of the population don’t think free speech is a good idea. So much for the way our civics courses are taught.

13

Alex Gregory 01.14.09 at 5:03 pm

“fraudulently induced consent is consent nonetheless”

I’m totally ignorant of legal matters, but surely this must have been settled in a rape case at some point in time?

14

Steve LaBonne 01.14.09 at 5:46 pm

Prosecutors are always tempted to invent new legal theories when they realize they can’t get a straightforward conviction. But supposedly we pay judges to put the kibosh on such creativity. Unfortunately not enough of them do their jobs.

15

bianca steele 01.14.09 at 6:23 pm

Those of us who grew up watching “The Paper Chase” tend to think the law works by analogy and any good argument will win in court but I’ve learned that isn’t the case. Even under common law, there’s also the “reasonable person” issue which is almost enough to make you agree with Catherine McKinnon.

Caveat: I’m not a lawyer and you shouldn’t consider what I say as legal advice even if I were.

16

Hogan 01.14.09 at 6:53 pm

the local ordinance mentioned by Lemuel at No. 9 above was aimed at the Ku Klux Klan.

The similar ordinance in Philadelphia was aimed at protesters at the 2000 Republican National Convention.

17

Martin benot 01.15.09 at 12:54 am

Why is it not possible to simply lock Lori Drew up as a nut? Isn’t driving a young girl to suicide for amusement psychopathic? If the issue is that her mind is lucid, wasn’t that also true of the Unabomber? The manifesto was perfectly lucid and the government admitted it feared giving him a trial because he might be too persuasive of his cause if permitted to speak publicly in his own defense. Yet he is locked up indefinitely without trial. It seems to me the case against Drew is stronger than against Kaczynski, as the latter is political and therefore a situation in which the state may have an interest other than public order. Can someone explain to me why the legal rationale that imprisons Ted cannot be applied to Lori?

I also think it is important to keep the Unabomber case in mind for those who think imprisoning terrorists without trial was a Bush innovation.

18

weichi 01.15.09 at 7:24 am

Kaczynski is “locked up indefinitely without trial”? Didn’t he plead guilty?

19

ajay 01.15.09 at 11:29 am

18: yes, he did. I think benot is trying to argue that the Clinton government worried that giving him a trial might have adverse consequences, but went ahead and gave him a trial anyway, and the Bush government kidnaps, tortures, imprisons and murders people without trial – so really they’re as bad as each other. And Kaczynski was sane. Or something.

20

eudoxis 01.15.09 at 5:32 pm

There must be many bloggers out there who are hoping that the Drew case will help put federal enforcement behind the terms of their blogs. The more likely results of the Drew case will be a dilution of federal laws governing such terms. Drew has not been sentenced yet, btw, and it is unlikely that she will go to jail for violating MySpace’s terms of service.

There are so few laws covering the use of e-technology and, even before the Drew case, users could be prosecuted, as pointed out above, using clever application of broad and archaic legislation. New legislation is aimed more at ‘cyber bullying’, which may give some protection to users, even sock puppeteers who are bullied or harassed online.

21

Katherine 01.15.09 at 7:22 pm

I am a lawyer (or used to be) and this habit of sticking whatever-you-fancy on the front of “consent”, as if that doesn’t change the very nature of “consent”, is very irritating and I think illegitimate. However, the law is not on my side for the most part. Violently-obtained consent is not considered “real” consent, but according to a judge on the UK side of the pond in the context of rape, drunken consent is, and as far as I am aware, fraudulently-obtained consent is too.

22

c.l. ball 01.16.09 at 5:43 am

As usual, news reports about the case have muddled the actual arguments. If you read the circumstance of this case, the law Drew allegedly violated, and the case Kerr refers to People v. Donell( 32 Cal. App. 3d 613; 108 Cal. Rptr. 232), you will discover that the idea is this: unless a criminal law specifies that fraudulent conduct mean that consent was not granted, the fact that consent was granted via fraud does not mean that consent was not granted. Put differently, if the law says “no one can access a computer without permission” and I get permission by pretending to be someone else, I have not broken the law since I got permission, but did so fraudulently. The law Drew allegedly violated refers to a person who “intentionally accesses a computer without authorization or exceeds authorized access.” MySpace created an account, which authorized Drew to access the servers. MySpace may have a civil complaint against Drew for violating its terms of service, but there is no criminal act because the law did not specify that, if access was obtained by fraud, it was illegal.

If I went to MySpace and brute-forced my way into Quiggen’s account, I would have unauthorized access. But if I go to MySpace and register an account in Quiggen’s name, MySpace has authorized my access although I have acted fraudulently.

23

ajay 01.16.09 at 9:48 am

21: what would fraudulently-obtained consent be, in that context?

24

Martin Bento 01.16.09 at 10:20 am

Let me be more specific. Kaczynski wished to defend himself at his trial; the state did not wish this, but insisted that he must use public defenders, who wanted him to plead insanity as his, they said, only hope for evading the death penalty. Actually, there was also a professional lawyer Kaczynski wanted who was willing to make a political defense and to work pro bono: Tony Serra. Kaczynski was denied the counsel of his choice and required to use court-appointed lawyers. He wished not to plead insanity, but to defend his actions. His lawyers regarded this as itself evidence of insanity. There was the beginning of a trial, but the trial was halted, because Kaczynski would not accept the court-appointed representation, and the court did not want to give him a forum for his ideas (and public officials said so; even the judge said he did not want to make the trial a “suicide forum”). The court solution was to drop the death penalty and cancel the trial in exchange for a guilty plea, so Kaczynski’s lawyers were wrong: he got what they said he could get only by admitting insanity without admitting such.

25

Harold 01.16.09 at 1:28 pm

Going about in a mask was prohibited in England because crimes were committed during Carnival and other mumming festivals. That is why people started wearing strips of paper or blackface during mumming in Britain and the US. In Spain they had to prohibit wide-brimmed hats for the same reason. Too many people took to committing crimes while wearing them.

I think it is illegal in the US to go about masked, but an exception is made during Holloween (and parades with permits?). You would think the muslim veil would fall under this category in the West. In Muslim countries women are not encouraged to go out unescorted, so the problem of someone committing a crime while veiled (or disguised as a veiled woman) doesn’t arise so much, I imagine. It did arise during the Algerian uprising (I am just riffing).

26

salient 01.16.09 at 5:08 pm

I think it is illegal in the US to go about masked

Hardly anywhere, really. There was some fun maybe 2 years ago with these new zippered hooded sweatshirts that zip up over the head, upward between the eyes, so that the face is covered with this light fabric that you can’t very well see into but can be seen out of, more or less. Very cute idea. I thought the ones with generic smiley faces on the mask fabric were especially inspired. Anyway, the kids (adolescent) who’d normally wear dragon-design tee shirts were completely thrilled by this. About half of the wearers were this group of kids (who frankly wouldn’t know how to create trouble without a networked computer), not quite half were genuine violent-to-property troublemakers, and a few were kids who wore the mask-jackets just because they were itching to be told to not wear them. About a dozen in all, out of a population of +/- 500.

Our school district required hoods-down while in school (equivalent to “no masks in school”) and the requirement was upheld in a challenge to the policy (one of the kids just itching to feel oppressed was the challenger). However, you’d see kids in these things out in public all the time, no problem. The sheriff admitted there was nothing illegal about wearing them, even if the kids were just rummaging about town stirring up trouble, but laughed off his own irritation: “there’s no better way for them to get my attention” and scrutiny, he said, “it’s like wearing a hovering billboard that says WATCH ME floating over your head” (probably not his exact words, but my memory of the mixed metaphor is intact).

I think there might’ve been some talk of considering the masks a sign of gang participation after the group of hooligans trashed a flush toilet in the local Subway and no particular one of them took the blame. There was this idea floating around that maybe the whole group could be charged with criminal conspiracy, but given that the entire group was allegedly witnessed all crowded into the one-person stall at the time of the incident, I don’t think their wearing of masks would be necessary to prove group responsibility. Everyone knew who they were from their incessant bragging about it for weeks afterward.

Anyway, no permit required to wear a mask, etc. I’d bet local jurisdictions differ wildly, so generalizing US policy would be impossible.

27

Katherine 01.16.09 at 7:07 pm

#23 – just consent, and thus not rape.

28

praisegod barebones 01.16.09 at 8:37 pm

‘You would think the muslim veil would fall under this category in the West. ‘

No I wouldn’t. Covering your hair is not the same as covering your face.

‘In Muslim countries women are not encouraged to go out unescorted,’

Depends what you’re counting as a Muslim country. Its not true of the country where I live which is majority Muslim in terms of population but politically and administratively secular.

29

Harold 01.17.09 at 4:04 am

Well, I misspoke of course, I should have said rigidly fundamentalist countries — and I was not talking of the head scarf, but the full head-to-toe burgah (?), whose name I had forgotten and was too lazy to look up.

I am sure about masks having been banned in Elizabethan England — and I believe it is still against the law to wear them routinely, but I may be wrong. Obviously, this is something that is going to be enforced in a sporadic manner.

I believe that changing ones’ “handle” name or password periodically is not necessarily something done with malicious intent, but rather for reasons of safety. It is not the same as posting flattering comments one one’s own blog under an assumed name — or writing a book review of one’s own work while pretending to be someone else.

In fact until recently in the US, ordinary citizens have always had the right to change their names and start over, no questions asked. This is the country of fresh beginnings, after all.

30

The Raven 01.17.09 at 11:44 am

“Why is it not possible to simply lock Lori Drew up as a nut?”

Because it’s very difficult to lock up anyone as a “nut” in in the USA, due to extensive abuse of the practice in the period 1900-1970, often directed at women. In Oregon it is not possible at all. It is probably just as well the state or family cannot arbitrarily deprive anyone of their freedom, but I do wish it was possible to do so after a trial of some sort.

31

Martin Bento 01.19.09 at 5:10 am

Raven, Agreed that due process is more important than getting every nut. I just was under the impression involuntary incarceration of the insane was still possible if there was good evidence they were dangerous, and it would seem that Drew would pass that test.

Comments on this entry are closed.