United States v. Drew

United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009),^[1] was an American federal criminal case in which the U.S. government charged Lori Drew with violations of the Computer Fraud and Abuse Act (CFAA) over her alleged cyberbullying of her 13-year-old neighbor, Megan Meier, who had died of suicide.^[1][2] The jury deadlocked on a felony conspiracy count and acquitted Drew of three felony CFAA violations, but found her guilty of lesser included misdemeanor violations; the judge overturned these convictions in response to a subsequent motion for acquittal by Drew.

In 2006, Lori Drew (née Shreeves)^[3] lived in St. Charles County, Missouri, with her husband Curt and their teenaged daughter, Sarah. Megan Meier, who at one time had been friends with Sarah Drew, lived down the street from Drew.^[4]

During the summer of 2006, Drew reportedly became concerned that Meier was spreading false statements about her daughter. Lori Drew, Sarah Drew, and Drew's employee, Ashley Grills, allegedly decided to create a fake Myspace account of a 16-year-old boy under the alias "Josh Evans".^[5] They allegedly used that account to discover whether Meier was spreading false statements about Sarah Drew.^[6]

Drew allegedly used the Myspace account to contact Meier, who apparently believed that "Josh Evans" was a 16-year-old boy. "Josh Evans" communicated with Meier through October 16, 2006, via the Myspace account in a manner described by the prosecution as flirtatious.^[6]

On October 16, 2006, "Josh Evans" allegedly sent Meier a message to the effect that the world would be a better place without her. Additional Myspace members whose profiles reflected links with the "Josh Evans" profile also began to send Meier negative messages. Subsequently, Meier's mother discovered that her daughter had hanged herself in her bedroom closet.^[4]

After Meier's death, according to the indictment, Lori Drew removed the fake "Josh Evans" account and commanded a juvenile who knew about the fake account "keep her mouth shut".^[7]

In early December 2007, Missouri prosecutors announced they would not file charges against Lori Drew in connection with Megan Meier's death. At a press conference, St. Charles County Prosecutor Jack Banas stated there was not enough evidence to bring the charges.^[8] As a result, the federal government decided to pursue the case in Los Angeles, where Myspace is based.^[9]

The Meiers did not file a civil lawsuit.^[10]

Thomas O'Brien, U.S. Attorney for the Central District of California, undertook prosecution of federal charges in connection with the case.^[11][9] On May 15, 2008, Drew was indicted by the Grand Jury of the United States District Court for the Central District of California on four counts.^[6] The first count alleged a conspiracy arising out of a charged violation of 18 U.S.C. § 371, namely that Drew and her co-conspirators agreed to violate the CFAA by intentionally accessing a computer used in interstate commerce "without authorization" and in "excess of authorized use", and by using interstate communication to obtain information from the computer in order to inflict emotional distress in violation of 18 U.S.C. § 1030(a)(2)(C). Counts Two through Four allege that Drew violated the CFAA by accessing MySpace servers to obtain information regarding Meier in breach of the Myspace Terms of Service, on September 20, 2006, and October 16, 2006.

On September 4, 2008, the Electronic Frontier Foundation filed an amicus brief in support of Drew's motion to dismiss the indictment.^[12] The brief argued that Drew's indictment was wrongful because Drew's alleged violation of the Myspace terms and conditions was not an "unauthorized access" or a use that "exceeds authorized access" under the CFAA statute; that applying the CFAA to Drew's conduct would constitute a serious encroachment of civil liberties; and that interpreting the CFAA to apply to a breach of a website's Terms of Service would violate the Due Process protections of the Constitution and thereby render the statute void on the grounds of vagueness and lack of fair notice.

This jury announced on November 26, 2008^[1] that it was deadlocked on Count One for Conspiracy. It unanimously found Drew not guilty of Counts Two through Four, but convicted her of lesser included misdemeanor offenses on those three counts.^[6][11][13]

On November 23, 2008, Drew filed a motion for acquittal.^[14] On August 28, 2009, U.S. District Judge George H. Wu formally granted Drew's motion for acquittal, overturning the jury's guilty verdict on the three misdemeanor CFAA violations.^[1]

In his opinion, Wu examined each element of the misdemeanor offense, noting that a misdemeanor conviction under 18 U.S.C. § 1030(a)(2)(C) requires that:

1. The defendant intentionally have accessed a computer without authorization, or have exceeded authorized access of a computer
2. The access of the computer involved an interstate or foreign communication
3. By engaging in this conduct, the defendant obtained information from a computer used in interstate or foreign commerce or communication

Wu found that many courts have held that any computer that provides a web-based application accessible through the internet would satisfy the interstate communication requirement of the second element, and that the third element is met whenever a person using a computer contacts an internet website and reads any part of that website.

The only issue arose with respect to the first element, and the meaning of the undefined term "unauthorized access". Wu noted the government's concession that its only basis for claiming that Drew had intentionally accessed Myspace's computers without authorization was the creation of the false "Josh Evans" alias in violation of the MySpace Terms of Service. Wu reasoned that, if a conscious violation of the Terms of Service was not sufficient to satisfy the first element, Drew's motion for acquittal would have to be granted for that reason alone. Wu found that an intentional breach of the Myspace Terms of Service could possibly satisfy the definition of an unauthorized access or access exceeding authorization, but that rooting a CFAA misdemeanor violation in an individual's conscious violation of a website's Terms of Service would render the statute void for vagueness because there were insufficient guidelines to govern law enforcement as well as a lack of actual notice to the public.

Wu cited several reasons an individual would be lacking in actual notice:

• The statute does not explicitly state that it is criminalizing breaches of contract, and most individuals are aware that a contract breach is not typically subject to criminal prosecution
• If a website's Terms of Service control what is an "authorized" use or a use that "exceeds authorization", the statute would be unconstitutionally vague because it would be unclear whether any or all violations of the Terms of Service would constitute "unauthorized" access
• Allowing a conscious violation of website's Terms of Service to be a misdemeanor violation of the CFAA would essentially give a website owner the power to define criminal conduct

Wu summed up his opinion by stating that allowing a violation of a website's Terms of Service to constitute an intentional access of a computer without authorization or exceeding authorization would "result in transforming section 1030(a)(2)(C) into an overwhelmingly overbroad enactment that would convert a multitude of otherwise innocent Internet users into misdemeanant criminals."^[1] For these reasons, Wu granted Drew's motion for acquittal. The Government did not appeal.^[15]

Missouri legislators amended the state's harassment law to include penalties for bullying via computers, other electronic devices, or text messages. The bill was approved on May 16, 2008.^[16][17] More than twenty states have enacted legislation to address bullying that occurs through electronic media.^[17] These laws include statutes that mandate that school boards must adopt policies to address cyberbullying, statutes that criminalize harassing minors online, and statutes providing for cyberbullying education.^[18] California enacted Cal. Educ. Code §32261 that encourages schools and other agencies to develop strategies, programs and activities that will reduce bullying via electronic and other means.^[19]

A bill was introduced in Congress in 2009 (H.R. 1966)^[20] to set a federal standard definition for the term cyberbullying,^[21] but the proposal was criticized as overbroad and did not advance.

Legal experts expressed concern that the prosecution sought effectively to criminalize any violation of web site terms of service.^[22] Andrew M. Grossman, senior legal analyst for The Heritage Foundation, said, "If this verdict stands ... it means that every site on the Internet gets to define the criminal law. That's a radical change. What used to be small-stakes contracts become high-stakes criminal prohibitions."^[1]

Law professor Orin Kerr, one of Drew's pro bono attorneys, commented that he was "very pleased" with the vacated guilty verdict as the case was "an extremely important test case for the scope of the computer crime statutes, with tremendously high stakes for the civil liberties of every Internet user".^[23]

• Cyberbullying
• LVRC Holdings v. Brekka
• Social media and suicide
• United States v. Nosal
• Virtual crime