California judge: trolling with someone else’s Facebook is identity theft

From time to time, we will be running posts from Eric Goldman’s Technology Marketing Law Blog. Sometimes they will look similar to other articles appearing on Ars; other posts will be more “bloggy” in nature. This is one of the latter.

Venkat Balasubramani’s take

Rolando was a juvenile who received an unsolicited text message with the victim’s e-mail password. According to the court, he used the password to gain access to the victim’s Facebook account and posted several sexually inappropriate messages from the victim’s account. The Facebook posts included posts on the walls of the victim’s friends and the following change to the victim’s profile:

Hey, Face Bookers, [sic] I’m [S.], a junior in high school . . . I want to be a pediatrician but I’m not sure where I want to go to college. I have high standards for myself and plan to meet them all. I love to suck dick.

The victim testified that she suffered stigma as a result of these and other posts. “I used to love going to school,” she said. “Now, I dread dealing with this every day.”

The juvenile was prosecuted under a California statute (section 530.55) which applies to anyone who:

wilfully obtains personal identifying information [of the victim and] uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medication information.

Did the defendant willfully obtain the victim’s “personal identifying information”? The court holds that, despite his argument that he “passively receiv[ed] the text message” which contained the victim’s password information, he “willfully” obtained it because he remembered it or otherwise recorded it so he could use it later. Moreover, the court concludes that the defendant willfully obtained the victim’s Facebook account password. The record was devoid of evidence as to how exactly the defendant accessed the victim’s Facebook account, and in the absence of any such evidence, the court says it’s “reasonable to infer” that the defendant reset the victim’s Facebook password using her e-mail password and then gained access to the victim’s Facebook account.

Did the defendant use the victim’s information for an unlawful purpose? In addition to obtaining the information willfully, the perpetrator has to use the information for an “unlawful purpose.” The first possibility was that the defendant violated section 647.6, which applies when someone “annoys or molests any child under 18.” However, under California Supreme Court precedent, this statute requires a motivation by “an unnatural or abnormal sexual interest in the victim.” [emphasis added] The court concluded that the facts did not fit into this statute because the defendant had no real contact with the victim other than the Facebook posts and he also testified that he “intended his comments to be taken as a joke.”

The second possibility was that the defendant used the victim’s personal information to commit a tortious act. The defendant argued that “unlawful purpose” as used in the statute should be restricted to criminal conduct, but the court disagreed, noting legislative intent to expand the scope of the statute in amending it.

The court also pointed to the fact that the definitions section of the statute included the term “crime,” and the legislature chose instead to use “any unlawful purpose.” The defendant practically conceded that his conduct satisfied the requirements of a civil defamation claim. The court therefore finds that the defendant’s act constituted libel and constituted an “unlawful purpose” under the statute. Alternatively, the court held that the defendant’s conduct satisfied the statute because it also constituted a criminal offense. The defendant’s actions violated section 653m, which makes illegal any contact with another person using “obscene language… by means of an electronic communication device… with [the] intent to annoy.”

---

It’s tough to muster much sympathy for the defendant, who was previously in trouble for reckless driving when he drove his car “at three girls in the school parking lot, but stopped abruptly several feet away from them in an attempt to scare them.”

The definition of “personal identifying information” in the statute is broad. (We ran into an analogous problem in the Pineda case). It looks like the court focused on the Facebook password as being the information in question that supported the violation of the statute, but the opinion is not totally clear on this. A broad definition of personal identifying information coupled with the court’s decision to allow tortious conduct to satisfy the “unlawful purpose” could lead to a statute that is expansive in scope and which should raise everyone’s First Amendment hackles. Given that the defendant used the e-mail password to access Facebook, this does not feel to me like a case that pushed the statute to the limit.

Interestingly, the defendant argued that his conduct would violate California’s newly enacted e-personation statute (section 528.5) which was effective January 1, 2011, and the fact that this statute was passed demonstrates that the legislature did not view his conduct as violating the previously existing statute. The court disagrees with this argument, noting that the newly enacted e-personation statute has different elements from section 530.5:

Section 528.5 does not include a requirement that a perpetrator obtain personal identifying information. As a result, a person could violate section 528.5 by merely posting comments on a blog impersonating another person. There is no requirement, under these circumstances, that the person obtain a password—a key distinction.

Yikes. This is precisely what is wrong with California’s e-personation statute.

Eric Goldman’s take

This case plays out as a Greek-style tragedy in three parts.

Part one: Someone sent the victim’s e-mail password to the defendant. The court is vague about who did this or how that person got the victim’s password.

This brings up one of my modern rules for clean living: never tell anyone else your passwords. Ever. (Another rule for clean living is to constantly change your passwords, but this is harder to obey). I am such a stickler about my passwords that I don’t tell them to anyone. Certainly not to campus IT when they want to muck with my computer, but I don’t even tell my passwords to my wife. (FWIW, my wife has told me many of her passwords, but I would never use them without her express instructions). I know there’s a debate about the spouse-and-passwords dilemma. It’s not that I don’t trust my wife. I do, completely. But my rule is clean and simple. If someone other than me types in my password, then they ripped it off. (We’ll revisit the problem of accessing a logged-in computer in a bit).

In this case, we don’t know why the password-obtainer had the victim’s password. Perhaps it was hacked. More likely, the victim made an error in judgment. Either way, the defendant apparently used the e-mail password to help reset the Facebook password and access the Facebook account.

Part two: The defendant misused the victim’s password. It goes without saying that the defendant had no business logging into the victim’s e-mail or Facebook account. Doing so was inappropriate even if the defendant merely just looks around, given the amount of private information stored in email and Facebook accounts. It was even worse to publish content under that person’s name, and worse still to post fake come-ons for sex.

Having said this, once a juvenile finds out he/she can access to a peer’s Facebook account, it seems like it would be almost irresistible not to muck around with it. I don’t want to dismiss this entirely as “kids will be kids,” but I’m sure a nontrivial percentage of kids would take advantage of a peer’s password if the circumstance presented itself. Perhaps it’s like the joyriding of days of old. If people left keys in their cars, some kids would take the cars for a spin. We can enact draconian laws to discourage joyriding, but if keys are left in cars, joyrides are inevitable. Here, the defendant basically took the victim’s Facebook account for a joyride. It was unquestionably wrong behavior, but given its inevitability, it probably shouldn’t be felonious.

The defendant’s behavior here is analogous to the fake online profiles that teens set up for school officials. I blogged in more detail about that phenomenon last year. In connection with the DC v. RR case, I also blogged on the problems of kids saying hyperbolically outrageous things online that aren’t amenable to punishment under traditional defamation or bullying laws. All of these examples remind us that kids are going to push limits with electronic tools just like they do offline. We need to find safer ways to let kids be kids online without ruining their lives.

Part three: The court stretched the identity theft statute too far. As Venkat recaps, the court confronted several statutory ambiguities without any good common law precedent. The court also didn’t acknowledge or consider any constitutional concerns with its ruling. Instead, the court reaches the counterintuitive and potentially troubling result that publishing fake content through someone else’s account steals their identity. Obviously that takes us a pretty far distance from a paradigmatic case of pretending to be someone for commercial benefit (i.e., what I typically think of as “theft”).

As Venkat indicates, the ruling reinforces why we should be nervous about California’s recent “e-personation” law, which is even more broadly written and applies even when there’s no password misuse. It also shows why expansive identity theft laws should be feared, not encouraged. For more on that point, see my post about Illinois’ identity theft law.

This ruling leaves open two obvious questions:

1. Will it always be identity theft to use a third party password to publish fake content via someone else’s account?
2. Will it be identity theft to access a third party or shared computer and publish fake content via someone else’s account? In that case, the password isn’t obtained at all. Given how many people always leave their computers logged in to various services, I imagine this happens with some frequency.

Venkat Balasubramani
is a lawyer and the cofounder of a boutique law firm focused on media, technology, and Internet clients. You can read more from him at Eric Goldman’s Technology Marketing Law blog and at Spam Notes. Eric Goldman is an associate professor of Law at Santa Clara University School of Law and directs that school’s High Tech Law Institute. You can read more of his work at his website.

Share and Enjoy

Facebook: “Anonymity on the Internet has to go away”

Facebook’s marketing director Randi Zuckerberg, who also happens to be Facebook co-founder and CEO Mark Zuckerberg’s sister, wants to put an end to online anonymity. She believes that Internet users would act much more responsibly on the Internet if they were forced to use their real names at all times.

During a Marie Claire round table discussion on cyberbullying and social media, Randi explained how using real names online could help curb bullying and harassment on the web, according to Huffington Post:

I think anonymity on the Internet has to go away… People behave a lot better when they have their real names down. … I think people hide behind anonymity and they feel like they can say whatever they want behind closed doors.

Zuckerberg was asked several times to name what new features Facebook will offer to better safeguard security on the social networking site. Unsurprisingly, she refused to give specific examples of forthcoming initiatives:

There’s so much more we can do. We’re actively trying to work with partners like Common Sense Media and our safety advisory committee.

Five months ago, Facebook announced new safety resources and tools for reporting issues, in conjunction with a White House summit for preventing bullying. Four months ago, the company rolled them out.

Facebook requires all members to use their real names on the social network, but clearly the company knows that bullying continues to be a problem. It’s thus unlikely that cyberbullying and harassment would stop if real names had to be used everywhere online. Would the number of issues really decrease if real names were a requirement?

Also five months ago, 4chan founder Christopher Poole (also known as “moot”) tried to explain how important anonymity is on the Internet and that Mark Zuckerberg doesn’t get this. When there is anonymity, users can employ what Poole calls “fluid identity,” where there’s no risk of failure, so experimentation flourishes. Elsewhere on the Web, however, such as websites that require you to login via Facebook, the cost of failure is really high because you’re contributing as yourself. As a result, mistakes are attributed to who you are, Poole argues.

In short, there are cases where you want your actions to be attributed to you, and others where you don’t. I believe real names should only be required in scenarios where your actions can hurt others; in other cases, anonymity is just fine.

Share and Enjoy