The ACLU has filed a lawsuit challenging the constitutionality of the Computer Fraud and Abuse Act, which makes it a federal crime to access a computer in a manner that “exceeds authorized access.” This provision of the law often prohibits and chills academics, researchers, and journalists from testing for discrimination on the internet. The lawsuit was filed in the U.S. District Court for the District of Columbia in June 2016. The plaintiffs are academic researchers, computer scientists, and journalists who wish to investigate companies’ online practices through standard academic and journalistic techniques, but are limited by the terms of service of target websites. Oral argument is scheduled for October 2017.
The CFAA’s “exceeds authorized access” provision delegates power to private websites to set terms of service that are then enforced through the criminal law. Many common website terms of service prohibit such activities as gathering or recording publicly available information, creating multiple accounts, or providing false information, even though these activities are often necessary for robust audit testing to uncover discrimination on the internet.
In the offline world, audit testing has long been recognized as a crucial way to uncover racial discrimination in housing and employment, and to vindicate civil rights laws such as the Fair Housing Act and Title VII’s prohibition on discrimination in employment. Courts and Congress have long encouraged such socially useful testing and investigations.
In the online world, however, conducting the same kind of audit testing can subject individuals to prosecution under the CFAA. This inhibits the public’s access to information about discrimination online, while also prohibiting a range of speech and expressive activity protected by the First Amendment.
For these reasons, our lawsuit seeks to remove the barriers posed by the CFAA’s overbroad criminal prohibitions, so that the public can continue to learn about new forms of discrimination and ensure that civil rights protections remain effective.
The plaintiffs in the case are researchers from the University of Michigan, the University of Illinois, and Northeastern University, as well as First Look Media, which publishes The Intercept.