July 14th, 2016

PK Icon

Interestingly disturbing civil case under Computer Fraud and Abuse Act (CFAA)

Don't have time to write about this too much. But figured I'd park it here for possible future reference.

Orin Kerr (respected Cyberlaw Prof) writes a column on the recent 9th Circuit decision in Facebook v. Power Ventures, Inc. (not sure why Kerr refers to it as FB v. Vachani (the individual owner) when convention is to use the first header first for consolidated cases). Basically, Vachani, through his company Power Ventures (collectively, "Power") developed an ap that let users organize their posts and send messages in a different way than the FB default. FB did not like this and sent Power a cease and desist, warning it that in FB's view Power's ap violated federal law. FB also blocked the Power IP address so the ap wouldn't work. Power ignored the letter and switched IP addresses. FB filed a civil suit under, among other things, the CFAA.

The opinion works in the shadow of a previous en banc 9th Cir. decision, which held that violation of a public website's terms of service did not violate the CFAA. Writing for the court Judge Graber found that a cease and desist letter is different from a violation of the acceptable use policy and terms of service, in that it provides specific notice to the individual that the computer owner (meaning the company owning the servers, not the individual user downloading the ap) has revoked permission to access the computers in question.

I'll skip Kerr's analysis (I agree with some of it, but not all) and point out what to me is the systemic problem. It's clear that the author of the opinion believes that the provider of the service (FB) should be able to limit who uses the service and for what purpose. Fair enough. But the author is shoving this outcome into a frame that does not fit. What we really have here is a breach of contract case. I make something available to a customer (and you are a customer, whether or not you are paying with money or your personal information) under certain terms, and reserve the right to deny service to a customer who violates those terms.

That's all good, proper and appropriate. But unlike a physical store, where I can simply have security evict the offending customer, that doesn't work easily for online digital services. Additionally, the right to refuse service is not unconstrained. State law and federal law prohibit the exercise of this refusal for a variety of reasons, ranging from discrimination on the basis of race or sex (including sexual orientation) to various considerations of consumer protection and equity.

These various checks and balances on "meat space" commercial acticvity evolved over time via the common law and legislatures passing statutes. We are seeing a similar struggle here, but at warp speed. It's clear the opinion does not like Power offering a service through an ap that violates the way FB wants to offer its service. One may agree or disagree with this position (I have good arguments for each, seeing as how I'm a lawyer, as well as good arguments for how to distinguish among the various types of online services). But in trying to reach the "right" result, courts need to remember they are constrained by the existing law and the regular cannons of stautory interpretation. Warping the law to reach the "right" result in a particular case often has unfortunate ripple effects in the other direction.

I've been through a couple of cycles of this, which included the fantastic warping of copyright and trademark in the 1990s and 00s to accomplish the same thing, generally at the cost of free speech and innovation. Sometimes the pendulum has swung the other way (it did on domain names and cybersquatting, not so much on TM). But even after the pendulum swings some, it still creates the opportunity for litigious behavior and things like SLAPP suits (stands for "Strategic Lawsuit Against Public Participation") (a lawsuit likely to lose if taken to trial, but has the effect of taking down speech critical of a person or interest and discourages participation generally. For example, the lawsuit against the NYT for libel in the Supreme Court NYT v. Sullivan case would be an example of a SLAPP suit).

All that said, there is value in letting court's take the first stab at these things rather than trying to legislate too quickly. Getting bad legislation undone is a harder process than getting bad judicial decisions narrowed and reversing the overall bad trend that may emerge at first blush as courts struggle to adapt law to the new set of circumstances. While hard on the guinea pigs either suing or getting sued, it does create a solid record and debate in the legal literature on which Congress can build. OTOH, there is also clearly costs in doing it this way, especially to the guinea pigs.

So yeah, life is messy and complicated.