Digg this story   Add to del.icio.us   (page 1 of 5 ) next 
Anti-Social Networking
Mark Rasch, 2008-05-22

On May 15, 2008, a federal grand jury Los Angeles indicted 49-year-old Lori Drew of O’Fallon, Missouri, on charges of unauthorized access to a computer, typically used in hacking cases. Yet, Drew's alleged actions had little to do with computer intrusions.

The middle-aged mother had allegedly created a MySpace page in the name of "Josh Evans" -– purportedly a 16-year-old boy -- and used the page to contact a friend of Drew’s daughter, a 13-year-old girl. The girl, who had a MySpace page, is referred to in the indictment only as MTM (although the girl’s name is widely reported elsewhere). While Drew’s initial motivation was purportedly to get information from MTM about her relationship with the woman's daughter, eventually the fictitious online relationship between "Josh Evans" and MTM turned ugly and abusive.  When the fictional "Josh" broke up with the pre-adolescent MTM, the distraught girl committed suicide.  Only later did MTM’s parents learn of Lori Drew’s alleged subterfuge.

Initial research by investigators could find no law that Drew had broken. However, prosecutors in Los Angeles resorted to a novel legal theory to charge Drew with crimes which could result in twenty years in jail.  Ironically, the crimes charged have almost nothing to do with MTM’s suicide or Lori Drew’s alleged "cyber bullying." Instead, the prosecutors assert that merely violating MySpace’s (or any other Web site’s) "Terms of Use" constitute a prosecutable offense.

A "crime" in search of a statute

There is no doubt that Lori Drew’s alleged actions are unconscionable and inexcusable. But is it a federal computer crime?  If so, what is it about what Lori Drew did that is deserving of criminal prosecution? 

Let's review the allegations in the case.

First, she created a MySpace page with false information, lying about her name, gender and age.  Second, she used that account to communicate with MTM.  Third, using the "Josh" identity, she flirted with MTM, and inevitably got "information" from her -– most likely information about Drew’s daughter.  Fourth, someone using the "Josh" identity -- there were several people using the account at this point -- broke up with MTM in a manner that ultimately contributed to MTM’s suicide.

Nobody has yet alleged that Drew intended that MTM commit suicide or that she encouraged it.  This appears to be a classic case of someone either intentionally or negligently causing another "severe emotional distress" –- a civil and actionable tort but not a crime under current law. Indeed, as a result of the suicide, the Board of Aldermen of Dardenne Prarie, Missouri passed a law last November making it illegal to engage in a pattern of conduct that would cause a reasonable person to suffer "substantial emotional distress" or for an adult to contact a child under 18 in a communication causing a reasonable parent to fear for the child's well-being.  It is not clear that such a statute would survive First Amendment scrutiny, and a recent study (pdf) showed that 7 percent of online teens said they have felt scared or uncomfortable as a result of contact by an online stranger and another study (pdf) showed that 32 percent of all teenagers who use the internet said that they had been targets of annoying and potentially menacing online activities, such as receiving threatening messages, having their private emails or text messages forwarded without consent, having an embarrassing picture posted without permission, or having rumors about them spread online. With the tens of millions of users on online social networking sites, the Missouri statute could conceivably make criminals of millions, including millions of other teenagers.

There is also a federal harassment statute, 47 USC 223 (a)(1)(E), which makes it a misdemeanor to "repeatedly initiate communication with a telecommunications device, during which conversation or communication ensues, solely to harass any person . . .who receives the communication."  But was Lori Drew’s sole purpose to harass MTM?  Putting aside that question, the statute may not even apply here since it requires that you use a "telecommunications device" which, under section (h)(1)(b), "does not include an interactive computer service."  Both statutes, 47 USC 230(f)(2),  and case law (pdf) make it clear that social networking sites like MySpace are "interactive computer services" so the federal harassment statute likely can’t be used.

The Missouri "harassment" statute is likewise unavailing, as it generally just prohibits communications that "use coarse language offensive to one of average sensibility" and is a misdemeanor to boot.  While several states have either passed or are considering passing cyber-bullying statutes, these generally are directed at having school officials develop policies to prohibit offensive online conduct and are not criminal statutes aimed at making such offensive conduct a felony.

Story continued on Page 2 

Mark D. Rasch is an attorney and technology expert in the areas of intellectual property protection, computer security, privacy and regulatory compliance. He formerly worked at the Department of Justice, where he was responsible for the prosecution of Robert Morris, the Cornell University graduate student responsible for the so-called Morris Worm and the investigations of the Hannover hackers featured in Clifford Stoll’s book, "The Cuckoo’s Egg."
    Digg this story   Add to del.icio.us   (page 1 of 5 ) next 
Comments Mode:
Anti-Social Networking 2008-05-30
Anti-Social Networking 2008-05-31
Nym, at sea (1 replies)
Re: Anti-Social Networking 2008-06-10
Mark D. Rasch
Anti-Social Networking 2008-06-13
Anti-Social Networking 2008-06-19
Anti-Social Networking 2008-11-18


Privacy Statement
Copyright 2010, SecurityFocus