Suspending judgment momentarily on what the law and scope should be in regard to unauthorized access to data, I would like the examine what the law can be in the Meier case. §1030 could be used to cover the case. Whether it is wise to do so – again – let me suspend for a moment.

Technically speaking, Drew was unauthorized to use the MySpace servers in the way she did. An analogy can be drawn with passwords and authorization. If someone was granted a password to use a particular system, they are authorized to use the system. However, that authorization is not boundless. For instance, in the Allison case (R v Bow Street Magistrates’ Court and Allison ex p USA [2000] 2 AC 216) a credit analyst employed by American Express used her access to steal credit card numbers which she passed on to defraud AmEx and customers of US$1million. Her password gave her access but she was unauthorized to do what she did. The House of Lords (UK) said she was authorized only for her work purposes, not illegal purposes. This case – like the Meier case – is a violation of a contract which lead to unauthorized access to data.

<< Judgment unsuspended >>

Kerr argues that authorization should be code-based not contract-based. See in his posts and his article ‘Cybercrime’s scope: Interpreting “access” and “authorization” in computer misuse statutes.’ (2003) 78 NYULR 1596.

The argument – again – is the unauthorized access to data statutes should not be used in this way. The better way to proceed on these types of cases would be, for example in the Allison case above, to proceed under some fraud statute. Similarly, as I stated before, the Meier case would proceed better under a harassment or intentional infliction of emotional distress sort of claim.

It seems too broad to use the statutes in this way. I would suspect that most of us are violating terms and conditions – many of which we never or rarely read – every day. Should that be criminalized by this type of statute? It just doesn’t sit right with me. Proceed under copyright infringement, harassment, defamation – whatever the relevant offense. Leave the unauthorized access to data statute for hacking and similar offenses.

Timothy DeHaut