United States V. Lori Drew - Guilty Verdict Set Aside

Guilty Verdict Set Aside

On November 23, 2008, Drew filed a motion for acquittal. On Aug. 28, 2009, U.S. District Judge George H. Wu formally granted Drew's motion for acquittal, overturning the jury's guilty verdict.

In his opinion, Wu examined each element of the misdemeanor offense, noting that a misdemeanor conviction under 18 U.S.C. § 1030(a)(2)(C) requires that (1) the defendant intentionally have accessed a computer without authorization, or have exceeded authorized access of a computer; (2) the access of the computer involved an interstate or foreign communication; and (3) by engaging in this conduct, the defendant obtained information from a computer used in interstate or foreign commerce or communication.

Wu found that many courts have held that any computer that provides a web-based application accessible through the internet would satisfy the interstate communication requirement of the second element, and that the third element is met whenever a person using a computer contacts an internet website and reads any part of that website.

The only issue arose with respect to the first element, and the meaning of the undefined term "unauthorized access." Wu noted the government's concession that its only basis for claiming that Drew had intentionally accessed MySpace's computers without authorization was the creation of the false "Josh Evans" alias in violation of the MySpace Terms of Service. Wu reasoned that, if a conscious violation of the Terms of Service was not sufficient to satisfy the first element, Drew's motion for acquittal would have to be granted for that reason alone. Wu found that an intentional breach of the MySpace Terms of Service could possibly satisfy the definition of an unauthorized access or access exceeding authorization, but that rooting a CFAA misdemeanor violation in an individual's conscious violation of a website's Terms of Service would render the statute void for vagueness because there were insufficient guidelines to govern law enforcement as well as a lack of actual notice to the public.

Wu cited several reasons an individual would be lacking in actual notice: (1) the statute does not explicitly state that it is criminalizing breaches of contract, and most individuals are aware that a contract breach is not typically subject to criminal prosecution; (2) if a website's Terms of Service control what is an "authorized" use or a use that "exceeds authorization," the statute would be unconstitutionally vague because it would be unclear whether any or all violations of the Terms of Service would constitute "unauthorized" access; and (3) allowing a conscious violation of website's Terms of Service to be a misdemeanor violation of the CFAA would essentially give a website owner the power to define criminal conduct.

Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals." For these reasons, Wu granted Drew's motion for acquittal. The Government did not appeal.