United States v. Drew

United States v. Drew^[1] is the final decision in a criminal case that charged Lori Drew of violations of the Computer Fraud and Abuse Act (CFAA) over the alleged cyberbullying of a 13-year-old, Megan Meier, who committed suicide.^[1][2] The federal district court vacated the jury's verdict convicting Drew of a misdemeanor violation of the CFAA.

Allegations leading to indictment and trial

In 2006, Lori Drew (née Shreeves)^[3] lived in St. Charles County, Missouri, with her husband Curt and their teenaged daughter, Sarah. Megan Meier, who at one time had been friends with Sarah Drew, lived down the street from Drew.^[4]

During the summer of 2006, Drew reportedly became concerned that Meier was spreading false statements about her daughter. Drew, her daughter, and Drew's employee, Ashley Grills, allegedly decided to create a Myspace account for a non-existent 16-year-old boy under the alias "Josh Evans" and to use that account to discover whether Meier was spreading false statements about Drew's daughter.^[5]

A Myspace account in the name of "Josh Evans" was created in September 2006.^[6] Drew allegedly used the Myspace account to contact Meier, who apparently believed that "Josh Evans" was a 16-year-old boy. "Josh Evans" communicated with Meier through October 16, 2006, via the Myspace account in a manner described by the prosecution as flirtatious.^[5]

On October 16, 2006, "Josh Evans" reportedly sent Meier a message to the effect that the world would be a better place without her.^[5] Additional Myspace members whose profiles reflected links with the "Josh Evans" profile also began to send Meier negative messages. Subsequently, Meier's mother discovered that her daughter had hanged herself in her bedroom closet.^[4]

After Meier's death, the "Josh Evans" account was deleted, and Drew reportedly directed another minor who knew about Drew's activities to "keep her mouth shut".^[5]

State decision regarding prosecution

In December 2007, Missouri prosecutors announced that they would not charge Drew in connection with Meier's death. St. Charles County Prosecutor Jack Banas stated there was not enough evidence to bring charges.^[7]

Indictment

Thomas O'Brien, U.S. Attorney for the Central District of California, undertook prosecution of federal charges in connection with the case.^[8][9] On May 15, 2008, Drew was indicted by the Grand Jury of the United States District Court for the Central District of California on four counts.^[5] The first count alleged a conspiracy arising out of a charged violation of 18 U.S.C. § 371, namely that Drew and her co-conspirators agreed to violate the CFAA by intentionally accessing a computer used in interstate commerce "without authorization" and in "excess of authorized use", and by using interstate communication to obtain information from the computer in order to inflict emotional distress in violation of 18 U.S.C. § 1030(a)(2)(C). Counts Two through Four allege that Drew violated the CFAA by accessing MySpace servers to obtain information regarding Meier in breach of the Myspace Terms of Service, on September 20, 2006 and October 16, 2006.

Amicus brief in support of defendant

On September 4, 2008, the Electronic Frontier Foundation filed an amicus brief in support of Drew's motion to dismiss the indictment.^[10] The brief argued that Drew's indictment was wrongful because Drew's alleged violation of the Myspace terms and conditions was not an "unauthorized access" or a use that "exceeds authorized access" under the CFAA statute; that applying the CFAA to Drew's conduct would constitute a serious encroachment of civil liberties; and that interpreting the CFAA to apply to a breach of a website's Terms of Service would violate the Due Process protections of the Constitution and thereby render the statute void on the grounds of vagueness and lack of fair notice.

Jury trial and split verdict

This case was heard by a jury, and the jury's verdict was announced on November 26, 2008.^[1] The jury was deadlocked on Count One for Conspiracy, but unanimously found Drew not guilty of Counts Two through Four. The jury did, however, find Drew guilty of a misdemeanor violation of the CFAA.^[5]

Motion for Acquittal Granted

On November 23, 2008, Drew filed a motion for acquittal.^[11] On August 28, 2009, U.S. District Judge George H. Wu formally granted Drew's motion for acquittal, overturning the jury's guilty verdict.^[11]

In his opinion, Wu examined each element of the misdemeanor offense, noting that a misdemeanor conviction under 18 U.S.C. § 1030(a)(2)(C) requires that:

1. The defendant intentionally have accessed a computer without authorization, or have exceeded authorized access of a computer
2. The access of the computer involved an interstate or foreign communication
3. By engaging in this conduct, the defendant obtained information from a computer used in interstate or foreign commerce or communication

Wu found that many courts have held that any computer that provides a web-based application accessible through the internet would satisfy the interstate communication requirement of the second element, and that the third element is met whenever a person using a computer contacts an internet website and reads any part of that website.

The only issue arose with respect to the first element, and the meaning of the undefined term "unauthorized access". Wu noted the government's concession that its only basis for claiming that Drew had intentionally accessed Myspace's computers without authorization was the creation of the false "Josh Evans" alias in violation of the MySpace Terms of Service. Wu reasoned that, if a conscious violation of the Terms of Service was not sufficient to satisfy the first element, Drew's motion for acquittal would have to be granted for that reason alone. Wu found that an intentional breach of the Myspace Terms of Service could possibly satisfy the definition of an unauthorized access or access exceeding authorization, but that rooting a CFAA misdemeanor violation in an individual's conscious violation of a website's Terms of Service would render the statute void for vagueness because there were insufficient guidelines to govern law enforcement as well as a lack of actual notice to the public.

Wu cited several reasons an individual would be lacking in actual notice:

• The statute does not explicitly state that it is criminalizing breaches of contract, and most individuals are aware that a contract breach is not typically subject to criminal prosecution
• If a website's Terms of Service control what is an "authorized" use or a use that "exceeds authorization", the statute would be unconstitutionally vague because it would be unclear whether any or all violations of the Terms of Service would constitute "unauthorized" access
• Allowing a conscious violation of website's Terms of Service to be a misdemeanor violation of the CFAA would essentially give a website owner the power to define criminal conduct

Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals". For these reasons, Wu granted Drew's motion for acquittal. The Government did not appeal.^[12]

Related proceedings

In early December 2007, Missouri prosecutors announced they would not file charges against Lori Drew in connection with Megan Meier's death. At a press conference, St. Charles County Prosecutor Jack Banas stated there was not enough evidence to bring the charges.^[7] As a result, the federal government decided to pursue the case in Los Angeles, where Myspace is based.^[9] The Meiers did not file a civil lawsuit.^[13]

Legislative responses

Missouri legislators amended the state's harassment law to include penalties for bullying via computers, other electronic devices, or text messages. The bill was approved on May 16, 2008.^[14][15] More than twenty states have enacted legislation to address bullying that occurs through electronic media.^[15] These laws include statutes that mandate that school boards must adopt policies to address cyberbullying, statutes that criminalize harassing minors online, and statutes providing for cyberbullying education.^[16] California enacted Cal. Educ. Code §32261 that encourages schools and other agencies to develop strategies, programs and activities that will reduce bullying via electronic and other means.^[17]

A bill was introduced in Congress in 2009 (H.R. 1966)^[18] to set a federal standard definition for the term cyberbullying,^[19] but the proposal was criticized as overbroad and did not advance.

Reactions

Legal experts expressed concern that the prosecution sought effectively to criminalize any violation of web site terms of service.^[20] Andrew M. Grossman, senior legal analyst for the Heritage Foundation, said "If this verdict stands ... it means that every site on the Internet gets to define the criminal law. That's a radical change. What used to be small-stakes contracts become high-stakes criminal prohibitions."^[1]

Law Professor Orin Kerr, one of Drew's pro bono attorneys, commented that he was "very pleased" with the vacated guilty verdict as the case was "an extremely important test case for the scope of the computer crime statutes, with tremendously high stakes for the civil liberties of every Internet user".^[21]

See also

• LVRC Holdings v. Brekka
• United States v. Nosal

References