The U.S. Attorney’s Office in Los Angeles has secured an indictment against Lori Drew, whose cruel hoax on MySpace drove a teenaged neighbor to suicide. Drew, you may recall, joined her daughter and another girl in creating a fake persona, “Josh”, who wooed and flattered troubled thirteen-year-old Megan Meier over MySpace. Eventually Drew and her teen cohorts turned “Josh” against Megan, telling her that the world would be a better place if she were dead. Megan killed herself. Local authorities could not find a way to charge Drew for her contemptible behavior.

But my former colleagues at the Los Angeles U.S. Attorney’s office are crafty, and announced an indictment of Drew today. There are at least two remarkable things about this. First, there’s the venue issue. All of Drew’s conduct took place in Missouri, and Megan Meier killed herself in Missouri. Drew was indicted in Los Angeles on the theory that MySpace’s servers and parent company are in Los Angeles. This illustrates how venue and personal jurisdiction will become increasingly thorny issues as more civil and criminal cases address online conduct. Drew probably never saw herself getting in trouble in an entirely different state.

Second, consider the creativity of the government’s theory. She’s charged with substantive violations of 18 U.S.C. section 1030, the federal computer fraud statute, as well as conspiracy to violate that statute. Normally the statute addresses hacking, damaging computer networks, and computer fraud. The charged section of the statute — 18 U.S.C. section 1030(a)(2)(c) — makes it illegal to “intentionally access[] a computer without authorization or exceed[] authorized access, and thereby obtain[] . . . information from any protected computer if the conduct involved an interstate or foreign communication . . . .” Here the government’s theory is that Drew “intentionally accesses a computer without authorization or exceed[ed] authorized access” when she entered false information about her identity in creating a MySpace profile in violation of MySpace’s terms of service, and that she “obtained information from a protected computer” in interstate communication because she used her resulting user-level MySpace access to gain information about Megan Meier — information available to any registered MySpace user.

The indictment also charges that she did these things in order to commit the tort of intentional infliction of emotional distress against Megan Meier. But that isn’t an element of the crime. It’s a penalty provision, triggering the five-year maximum sentence under section 1030(c)(2)(B)(ii). If they didn’t make that penalty allegation, the penalty would have defaulted to the catch-all penalty provision of (c)(2)(A).

Let me run that past you again — she’s charged with federal crimes because she created a profile on a social networking site using a fake name, and then using the same access that anyone with a profile would have, accessed information about another user of the social network site. Everything else is just about the extent of the penalty.

That’s remarkable. It demonstrates how flexible many federal statutes are. When I was an AUSA, we used to say that we could indict nearly anyone for any transaction if we looked hard enough for a theory. This indictment makes that boast something less of a joke. Let me be clear — if Drew did what she’s accused of, she’s a vile human being and deserves punishment. But I, for one, am not entirely comfortable with a scheme of federal law flexible enough to address any wrong we might want to punish. I’m also not comfortable with the notion that creating a profile on a web site with a fake name — even if the site’s terms of service prohibit it — can be bootstrapped into a federal felony. The potential for abuse and selective prosecution — and for suppression of (for instance) anonymous and pseudonymous posting — is enormous.

I’ve registered on plenty of internet forums and sites under handles and pseudonyms and fake names. I couldn’t tell you whether or not that violated their terms of service if you put a gun to my head. That registration allowed me access to information I wouldn’t otherwise have — information available to anyone who registered on those sites. I am supremely confident that there are tens or hundreds of thousands of people on MySpace who have registered with at least some false information in violation of MySpace’s TOS. Under the government’s theory, I’ve committed a federal felony each time I’ve done that. So have hundreds of thousands of other people.

The difference is that I have not driven someone to suicide. But the driving-to-suicide part isn’t the crime. Do we want the government having this sort of charging discretion and using only against people it (justly or not) doesn’t like?

Last 5 posts by Ken

• In Which I Indulge In The Very Appalling Elitist Liberal Sneering That is Destroying America - August 27th, 2010
• Was That Wrong? Should We Not Have Done That? - August 27th, 2010
• A Less Perfect Union - August 27th, 2010
• SPEECH Act A Bulwark Against Buffoonish Brits - August 27th, 2010
• Anatomy Of A Toner Scam - August 26th, 2010