However, this analogy is imperfect for the Drew case.  Generally, "no trespassing" signs simply say that.  In the Drew case, however, it wasn’t an all or nothing proposition.  Drew was entitled to be on MySpace, access MySpace pages (including that of MTM) and use the service.  The mere violation of terms of service allows MySpace to revoke or terminate her right of access, but it does not necessarily render her access "unauthorized" or "exceeding authorization."

Another analogy can be made to those jurisdictions which, for example allow licensed gun owners to carry concealed weapons, but also permit owners of various establishments to restrict this right by posting notices to that effect by, for example, a sign that says "no guns on premises."  If you knowingly enter the establishment with the posted notice while possessing a firearm, you are liable for prosecution for trespass.  In essence, your "right of entry" is terminated by your violation of the "terms of use."   But what if the establishment had another sign that simply said, "no spitting."  Does this imply that if you expectorate, you go to jail?

Breach of TOS = Go to jail

After this, things get really hairy.

According to the indictment, what Drew did that was a crime was to provide false information to MySpace when she signed up, and then use that account to obtain information.  The MySpace Terms of Use provide that "by using the MySpace Services, you represent and warrant that all registration information you submit is truthful and accurate."  Your use of MySpace, like your use of thousands of other Web sites and interactive services, are governed by such terms of use or terms of service.  Thus, an employer may have a policy which says "business use only" of the Internet or of e-mail.  Web sites frequently have "conditions" placed on your use of the service, such as no commercial use or no deep linking or no harassment or no spam. Violation of these contractual provisions moots your "authorization" to use the service and constitutes a "trespass."

This theory has been used to civilly sue those who, for example, access the Ticketmaster Web site in violation of terms of service or other Web sites in a way that would constitute a "trespass to chattels".

Many years ago, the government attempted to prosecute an IRS employee for browsing at files he was not authorized to see in violation of his employment agreement. The Court of Appeals rejected the government’s claim that this constituted an "unauthorized access" to the computer in order to obtain "something of value."  Partially in response, Congress broadened the scope of the computer crime law to include "exceeding the scope of authorization" to access -- or use -- a computer, and eliminated the need to show that you got "something of value."  Indeed, if you obtained "any information" in excess of your authorization, you could be prosecuted.  Presumably, this would include public information, like that on a public MySpace profile.

Despite the broadening of the statute, this appears to be the first time that the government has, in a criminal case, taken such an expansive view of what the law prohibits.  The consequence of the government’s position in the Drew case is that virtually any violation of a Terms of Use, Terms of Service, or employers’ computer use policy can land you in the federal penitentiary.

Here is how it works.  You access, or use, a computer -- including a web server, PC, or many electronic devices -- that is governed by some Terms of Use or Terms of Service. When you breach those terms of use, you have exceeded your authorization to access that computer.  Send an email to your mom in a company that has a "no personal use" policy -– that’s an "unauthorized" access to the computer.  If you use your home broadband network for commercial purposes -- say, to VPN into the office, or check corporate e-mail -- you have probably violated the terms of use of the broadband provider and committed a crime.

While we can be sympathetic to the government’s motives in this case, their manipulation of the statute goes beyond making breaches of agreements into crimes. To prove that Drew exceeded unauthorized access, the government has to prove that the defendant thereby obtained information from a protected computer.

So what information did Drew obtain and from what protected computer?   The information obtained could simply be access to MTM’s public MySpace page.  Or, it could be the contents of the "chats" or messages from MTM to the fictitious "Josh Evans."  The revised law puts no limit on the type or value of the information obtained. 

Moreover, the victim of the crime -- while identified in the indictment as MTM -- is under the government’s theory actually MySpace, the company whose computers were "accessed" in excess of authorization.  But MySpace is no more the victim of these crimes than they would be criminally liable for the suicide -- a theory rejected in a federal case called Doe v. MySpace (pdf) involving the parents of a teenager who committed suicide. They are suing MySpace for failing to prevent their child from having an online relationship with an adult.