< The New Hacker

Transcript

Friday, December 05, 2008

BROOKE GLADSTONE:
This is On the Media. I'm Brooke Gladstone.
BOB GARFIELD:
And I'm Bob Garfield. You may have heard the tragic story of Megan Meier, the victim of what has come to be called cyberbullying. Megan’s adult neighbor Lori Drew, along with her daughter and one of her employees, used a fake MySpace account to befriend and then reject Megan, 13 years old and struggling with depression. Megan then killed herself.

When the story broke last fall, public outrage erupted at Lori Drew, a grownup who had harassed a child online. The tragedy resulted in a landmark legal case which culminated last week when Drew was found guilty on three misdemeanor counts of computer fraud, for gaining unauthorized access to MySpace. Specifically she was conducted of violating the site’s “terms of service agreement,” the online contract you must agree to before you can access MySpace, and many other sites.

While the jury acquitted Drew of the most serious charge and reduced felonies to misdemeanors, the verdict has been widely criticized by legal experts who argue that the prosecutors misapplied existing anti-hacking laws in this case.

The verdict is on appeal and may be overturned, but in the meantime we asked the Berkman Center’s Christopher Soghoian to explain how this case might affect the way we use the Internet. Chris, welcome to the show.
CHRISTOPHER SOGHOIAN:
Good afternoon.
BOB GARFIELD:
Let's just make this clear from the outset: Lori Drew was not convicted of cyberbullying, was she?
CHRISTOPHER SOGHOIAN:
No, that’s correct, and the reason for that is that there is actually no cyberbullying statute on the books. What she was convicted of was essentially hacking.
BOB GARFIELD:
Can you tell me how the prosecution argued that case?

CHRISTOPHER SOGHOIAN:
To begin with, we should first mention that this incident happened in Missouri, and the U.S. attorney in Missouri declined to prosecute the case. And so, because the bullying was happening through MySpace, which is a California company, a U.S. attorney in central California decided to pick up the case and has been personally prosecuting it.

Essentially, the prosecutor’s theory is that when anyone violates the terms of service specified by a website, they are engaging in computer hacking.
BOB GARFIELD:
Including every 17-year-old and younger who makes a Google search.
CHRISTOPHER SOGHOIAN:
Right, so Google’s terms of service specifically forbid anyone under the age of 18 from engaging in a Web search, from sending an email, from uploading a photo to their Picasa website. MySpace’s terms of service specifically state that you may not, as an end use, upload a photograph of another person that you have posted, without that person’s consent.

What this means is that if you take a photo at your family reunion, you must go around the room and obtain every single person’s permission to upload that photo to your MySpace page later that day. If you don't do it, you’re a criminal.

I also want to highlight the Match.com terms of service, which state that it’s forbidden to create a profile if you’re married or not separated from your partner. This means that essentially cheating spouses are engaged in computer hacking if they look for dates online.
BOB GARFIELD:
And then there’s the MySpace and Facebook prohibitions against uploading any sort of advertising and marketing material. That would send Madison Avenue into a tizzy, because no commercially-based viral video, for example, could be posted, correct?
CHRISTOPHER SOGHOIAN:
That’s very true. So, you know, we think of things like the Subservient Chicken, Burger King’s hugely popular viral video. And technically it would a violation of the terms of service, and thus computer hacking, to upload one of those YouTube videos or even link to them from your MySpace page.
BOB GARFIELD:
So at the risk of sounding utterly absurd, I could start a website and make one of the terms of service that if you are a carbon-based organism, you are not eligible to use this service, you must leave immediately. Then anyone who logged on could be prosecuted for hacking.
CHRISTOPHER SOGHOIAN:
That’s exactly correct. And, you know, that seems silly, but that’s actually already sort of happened. Orin Kerr, who is a professor of law, a former DOJ prosecutor and who is representing Lori Drew pro bono, has updated the terms of service of his website to prohibit anyone who’s ever visited the State of Alaska or any federal employee from visiting or posting to his blog [BOB LAUGHS] - as an example of how insane this new ruling is.
BOB GARFIELD:
I'm curious, though, has anyone in all of human history ever read one of these things? I mean, like, ever?
CHRISTOPHER SOGHOIAN:
Actually, yes. One person appears to read every terms of service document that she’s presented, and that is the lead juror in the Lori Drew trial. She told Wired News this week, quote, “The thing that really bothered me was that Drew’s attorney kept claiming that nobody reads the terms of service. I always read the terms of service. If you choose to be lazy and not go through that entire agreement or contract, then absolutely you should be held liable.”
BOB GARFIELD:
Okay. Christopher, thank you very much.
CHRISTOPHER SOGHOIAN:
My pleasure. Have a good day.
BOB GARFIELD:
Christopher Soghoian is student fellow at Harvard University’s Berkman Center for Internet and Society, and blogs about privacy and security for CNET.