Can public websites decide who is and is not a criminal through their terms of service? A brief EFF filed yesterday argues no.
The amicus brief is a follow-up to one we filed last month in Facebook v. Power Ventures. Facebook claims that Power breaks California criminal law by offering users a tool that aggregates their own information across several social networking sites. For some, it may be a useful way to access various social network information through one interface. The tool also makes it easier for users to export their data out of Facebook. In its suit against Power Ventures, Facebook claims that the tool violates criminal law because Facebook's terms of service ban users from accessing their information through "automated means."
This is not an esoteric business issue, because the legal theories Facebook is pushing forward would make it a crime not to comply with terms of service. People have already faced criminal charges for violating a site's terms of use policy. For example, in United States v. Lori Drew, a woman was charged with violating the federal computer crime law for creating a false profile that was used to communicate inappropriately with a teenager who eventually committed suicide. EFF filed an amicus brief in that case arguing that terms of service do not define criminal behavior, and the charges were eventually dismissed. We also defended Boston College computer science student Riccardo Calixte, whose computers, cellphone and iPod were seized by local police who claimed that he violated criminal law by giving a fake name on his Yahoo account profile. A justice of the Massachusetts Supreme Judicial Court ordered police to return the property after finding there was no probable cause to search the room in the first place.
Using criminal law to enforce private website operators' terms of use puts immense coercive power behind measures that may be contrary to the interests of consumers and the public. EFF believes that users have the right to choose how they access their own data, and that services like Power's give users more options. So long as the add-on service does not access off-limits information and is not harmful to server functionality, authorized users who choose add-on technologies like Power’s commit no crime. Frighteningly, under Facebook's theory, millions of Californians who disregard or don't read terms of service on the websites they visit would risk criminal liability.
Another wrinkle in the case is Facebook's attempt to interfere with uses of the Power service through IP address blocking. In response to the block, Power simply changed its IP address so it could continue to provide its service. The IP address blocking used by Facebook was a crude attempt to control the means by which authorized users could access the website; it was not aimed at distinguishing between authorized and unauthorized users. Yet, remarkably, Facebook claims that Power's IP address change is also a violation of the law. Indeed, Facebook's claimed prohibition against "automated means" of access is so broad that it could be read to prevent any automatic process for presenting your credentials -- even the "remember my password" functions in web browsers.
As social networking increases in popularity, it's important that users are able to preserve their rights when using these services, including the right to choose competitive services and to take their information and leave. That's why we've developed a Bill of Rights for Social Nework users. Users deserve to maintain control of their information without facing criminal threats.
