The federal Computer Fraud and Abuse Act (CFAA) could be considered a harsh law by any standards. For the offense of “accessing a computer and obtaining information,” you could be sentenced to up to 5 years in federal prison on a first offense.
Could you be sentenced to that for activity that merely violates a website’s terms of service? Does merely violating a website’s terms of service violate the CFAA?
The ACLU, representing a group of academics and journalists, decided they needed to know the answer to that question. They were investigating allegations of race discrimination in the online job marketplace. To do so, they needed to create accounts for fake employers and job seekers, but that violated the terms of service of the websites they were investigating.
Since the CFAA makes it a crime to “access a computer without authorization or exceed authorized access,” the ALCU wondered if the group would be violating the CFAA by creating false accounts.
Indeed, it seems that the ACLU assumed that this would indeed violate the CFAA. In 2016, they filed a lawsuit against the federal government. They asked a judge to declare that any such violation of the terms of service would be protected by the First Amendment.
Judge rules there would be no violation of the CFAA
Instead of issuing the requested declaration, a Washington, D.C.-based judge has just ruled that the proposed research project would not violate the CFAA in the first place.
Creating false accounts in violation of terms of service is not hacking, the court reasoned. A person violates the CFAA by bypassing access restrictions like the need for a password. A person with a valid password does not become a criminal just because they do something that violates a site’s terms of service.
“Criminalizing terms-of-service violations risks turning each website into its own criminal jurisdiction and each webmaster into his own legislature,” he wrote.
He went on to note that terms of service are often long, complex and frequently changing, meaning that many people use websites without realizing what the terms of service may be. Under such circumstances, it simply isn’t reasonable to criminalize violative behavior.
Other courts have ruled the opposite
Before you go out and violate your terms of service, be aware that this ruling doesn’t apply in Iowa and that the law remains in a state of flux. Some courts have ruled, like this one, that violating a site’s terms of service is not violation of the CFAA. Others, however, have ruled that violating certain terms of service could put you on the wrong side of the CFAA. The question will ultimately need to be resolved by the U.S. Supreme Court.
