And a California prosecutor used terms of service violations as a lynchpin of its case against "My Space Mom" Lori Drew in 2009.
The prosecutions stem from an interpretation of the Computer Fraud and Abuse Act, a federal law against hacking. The law prohibits "unauthorized access" to computers, and some prosecutors have said this provision of the law applies to anything you do on a website that violates its terms of service.
Whether or not such charges can truly stick isn't clear. Orin Kerr at George Washington University Law School says Reddit's moved is based on a "misunderstanding of the law." Kerr writes in a blog post that federal prosecutors didn't go after Swartz for violating terms of service. Their strongest charge was that Swartz broke into an MIT closet and connected directly to its network, in order to steal articles protected by a paywall.
The Lori Drew case comes closer to a true terms-of-service prosecution, according to the Los Angeles Times. A U.S. attorney charged Drew with creating a fake MySpace account that she used to harass a girl who had offended her daughter. The girl committed suicide, and Drew faced charges of violating MySpace's terms of service, which require users to provide "truthful and accurate" registration information.
U.S. District Judge George H. Wu threw out Drew's conviction precisely because he was concerned about the precedent of prosecuting people for violating terms of service, the newspaper reported.
At the May hearing, Wu grilled Assistant U.S. Atty. Mark Krause at length about whether the government had prosecuted Drew under the appropriate laws when they asserted that violating MySpace's terms of service amounted to a crime.
"Is a misdemeanor committed by the conduct which is done every single day by millions and millions of people?" Wu asked. "If these people do read [the terms of service] and still say they're 40 when they are 45, is that a misdemeanor?"
The law surfaced again last week when the U.S. Justice Department charged Matthew Keys, a former web producer for a Sacramento television station, under the Computer Fraud and Abuse Act. Keys provided hackers a login for the websites of the television station's owner, the Tribune Company, the DOJ charged. It said the hackers used the login to alter a headline in another property the company owned, the Los Angeles Times.
If convicted, Keys faces up to 10 years in prison, three years of supervised release and a fine of $250,000 for each count. Although Keys wasn't accused of violating terms of service, the severe penalties he faces for this prank have added impetus to a movement for changing the law.
Last week members of the US House of Representatives debated Aaron's Law, a proposal by San Jose Rep Zoe Lofgren to reign in anti-hacking prosecutions.
Not everyone agreed with the proposed changes. Several lawmakers at that hearing said the laws need to be tougher, given that hackers steal intellectual property and people's financial data, according to The Hill:
Rep. Jim Sensenbrenner (R-Wis.), the chairman of the Subcommittee on Crime, Terrorism, Homeland Security and Investigations, which was holding the hearing, said that it may be time for Congress to "augment and improve" the CFAA to address international criminal groups. He said he would be concerned with any proposal that would decriminalize computer abuse that is currently illegal.
"The theft of valuable intellectual property is a serious strategic threat to the American economy, and it must be treated as such by U.S. law enforcement," Sensenbrenner said.
Reddit isn't waiting for an act of Congress. It wants to make sure its users won't be guilty of a federal offense if, for example, one posts ads instead of news, or makes a mobile app to access the site from elsewhere.
Eric Goldman, a cyber law expert at Santa Clara University, calls Reddit's move "terrific." He is concerned that lawyers write "overly expansive" restrictions into online user contracts, thereby "unwittingly turning many or all of our clients’ users into criminals."
Following the Lori Drew case, Goldman advocated that cyberlawyers write contracts with more "permissive" clauses that don't trigger -- or even enable -- criminal prosecution.
While analysts disagree about the wisdom of Reddit's move, they say it'll have an impact if other companies follow suit.
