Last month oral arguments were heard before the 9th Circuit Court of Appeals on the case of U.S. v. Nosal, 642 F.3d 781 (9th Cir. 2011), reh’g en banc granted (Oct. 27, 2011), members of the court were particularly interested in questioning the government lawyer about whether a Facebook user could be criminally prosecuted) under the Computer Fraud and Abuse Act (“CFAA”) for lying about their personal information in signing up for a Facebook account.
Under the CFAA, it is a crime to gain unauthorized access to a computer. The court’s questioning was premised on Facebook’s terms of service that prohibit a member of the public from providing false information in signing up for a Facebook account. The concern expressed by one Judge in the argument is that a violation of Facebook’s rules such as lying about one’s age would mean that access to Facebook is unauthorized and thus the person is subject to criminal prosecution under the CFAA.
David Nosal, a Korn/Ferry International executive, was indicted for stealing confidential data from the company computers prior to joining a competitor. The issue before the 9th Circuit is limited to whether Nosal exceeded his authorized access to his employer’s computers when he violated Korn/Ferry’s computer policies that restricted the scope of its employees’ access to the company computers to “legitimate Korn/Ferry business.”
The only government prosecution under the CFAA predicated, in part, on lying about one’s age in signing up for a social networking site, was brought against Lori Drew in the federal court in Los Angeles. Judge Kozinski referenced this prosecution in the oral argument. The Drew case, however, was not a prosecution predicated solely on Drew lying about her age. Drew was a 49-year-old woman who, according to the government’s indictment, used a MySpace account to harass and torment a 13-year-old girl, who, as a result, committed suicide. Drew committed cyberbullying by posing as a fictitious 16-year-old boy in violation of MySpace’s terms of service that required her, among other things, to provide truthful information on MySpace and not use MySpace to harass, abuse or harm other people or solicit personal information from anyone younger than 18.
The allegations in the indictment against Drew were worthy of a criminal prosecution. In that case the jury convicted Drew of a misdemeanor for unauthorized access to MySpace’s website and did not convict her of the felony for doing so with the purpose of intentionally inflicting emotional distress on the young girl. The Department of Justice chose not to appeal that decision to the 9th Circuit.
So it seems reasonable to assume that a person who does nothing more than lie about their age on Facebook and violates Facebook’s terms of service could theoretically be prosecuted under the CFAA, but it is highly unlikely that the government would pursue such a case.
Comments for this article are closed.