The Electronic Frontier Foundation (“EFF”) and the American Civil Liberties Union (“ACLU”) have weighed in on Facebook’s high-profile dispute with a social media aggregation company over whether it had unlawfully accessed Facebook’s computers. The EFF and ACLU warned the Ninth Circuit that the panel’s ruling for Facebook risks chilling important investigations and makes “potential criminals out of millions of ordinary Americans on the basis of innocuous online behavior.” The case is Facebook, Inc. v. Power Ventures, Inc., No. 13-17102.
We wrote about the facts of the Facebook case here. As we noted, the question presented is: when does an unauthorized—or explicitly prohibited—use of a computer become a violation of the Computer Fraud and Abuse Act of 1986 (“CFAA”)? The panel ruled that once Facebook sent the defendant, Power Ventures, Inc., a letter demanding that it cease and desist accessing Facebook servers, any access after that point became “without authorization” under CFAA. Power’s use was actionable, the panel wrote, because “Facebook explicitly revoked authorization for any access.” Additionally, the panel remarked that because Facebook and Power had “no direct relationship,” this case had nothing to do with non-compliance with terms and conditions of service.
Power’s petition for rehearing argued, among other things, that the panel’s opinion failed to identify the precise boundary between lawful and unlawful behavior, and that if the ruling stands, it could greatly expand civil and criminal liability online, since it could render unlawful such benign uses as letting a friend check one’s email account.
In its response to the petition for rehearing, Facebook argues that the court should forget hypotheticals and stick to what actually happened here—“Power’s blatant disregard of Facebook’s personalized message to ‘keep out,’ and its deliberate circumvention of the technical barriers that Facebook erected to enforce that command.” According to Facebook, the panel correctly held that violating a business’s general rules may not itself amount to trespass (whether of a storefront or a computer system), but defying a targeted instruction to stay away does. As for the arguments about research from the ACLU and EFF, Facebook responds that any restrictions on use fall outside of CFAA.
Facebook also reminds the court of some of the more troubling facts in this case. For example, Power was not only accessing its servers but was also bombarding Facebook users with annoying commercial messages and scraping data from Facebook users’ profiles.
This area of the law continues to be a source of uncertainty for businesses operating online, as well as their users. We will continue to report on this case in the weeks to come.