Cybersecurity

Is the ACLU's Lawsuit Against Bad Anti-Hacking Law Ingenious or Terrifying?

Ending federal prosecution over violations of vague 'terms of service' rules may come at a cost.

|

Valery2007 / Dreamstime.com

The vague language of the federal Computer Fraud and Abuse Act (CFAA) has made it prone to abuse by federal prosecutors.

This law's alleged purpose is to fight cybercrimes and hackers. But the law is far more expansive, making it a federal crime to violate a web site's "terms of service" as a user or to access a computer or network in an "unauthorized" fashion. Yes, the law is used to fight hackers trying to get into people's bank accounts to steal their money. But it has also been used to put journalist Matthew Keys in prison for giving a password to a member of Anonymous, who then vandalized the website for the Los Angeles Times by changing a single headline. The law was also used against activist Aaron Swartz, who was arrested and charged for downloading huge numbers of academic studies at the Massachusetts Institute of Technology with the intent of making them freely available to everybody. The prosecutor used the law as a hammer to try to push Swartz to accept a plea deal. Instead he committed suicide. It's a terrible law that you've probably broken without even realizing.

And now the American Civil Liberties Union (ACLU) is suing to challenge the constitutionality of the law. This is very good news. How they're tackling it is both interesting, but also just a little bit troubling. Their argument is that the law has the side effect of chilling some online research and journalism investigations of some online commercial behavior. More specifically, this is research over whether online algorithms that put information and advertising in front of people's eyeballs is influenced by discriminatory attitudes or intent. Are those sponsored ads you're getting racist or sexist?

The CFAA barrier keeps academics and journalists from researching algorithmic behavior, stopping researchers from independently "auditing" what happens by keeping them from creating fake online profiles to see how advertising reacts. The terms of service of many websites prohibit the use of fake accounts or identities. Therefore using the same sort techniques used to sniff out discriminatory behavior in the "real world" in areas like job interviews and bank loans (fake applications) are legally not permissible. People, of course, create fake online profiles and identities anyway, but most people are not researchers or journalists who plan to publicly release the results of their investigations and would have to worry about legal retaliation.

But potentially bringing about an end to at least part of this broad law may be exchanging one type of legal threat with another. A look over the ACLU's arguments for striking down that part of CFAA should set off alarms about what the future could bring:

As more and more of our transactions move online, and with much of our internet behavior lacking anonymity, it becomes easier for companies to target ads and services to individuals based on their perceived race, gender, or sexual orientation. Companies employ sophisticated computer algorithms to analyze the massive amounts of data they have about internet users. This use of "big data" enables websites to steer individuals toward different homes or credit offers or jobs—and they may do so based on users' membership in a group protected by civil rights laws. In one example, a Carnegie Mellon study found that Google ads were being displayed differently based on the perceived gender of the user: Men were more likely to see ads for high-paying jobs than women. In another, preliminary research by the Federal Trade Commission showed the potential for ads for loans and credit cards to be targeted based on proxies for race, such as income and geography.

This steering may be intentional or it may happen unintentionally, for example when machine-learning algorithms evolve in response to flawed data sets reflecting existing disparities in the distribution of homes or jobs. Even the White House has acknowledged that "discrimination may 'be the inadvertent outcome of the way big data technologies are structured and used.'"

Companies should be checking their own algorithms to ensure they are not discriminating. But that alone is not enough. Private actors may not want to admit to practices that violate civil rights laws, trigger the negative press that can flow from findings of discrimination, or modify what they perceive to be profitable business tools. That's why robust outside journalism, testing, and research is necessary. For decades, courts and Congress have encouraged audit testing in the offline world—for example, where pairs of individuals of different races attempt to secure housing and jobs and compare outcomes. This kind of audit testing is the best way to determine whether members of protected classes are experiencing discrimination in transactions covered by civil rights laws, and as a result it's been distinguished from laws prohibiting theft or fraud.

The text of the complaint (read here) makes it abundantly clear that one likely outcome—even a desirable outcome—could be civil rights lawsuits under other federal laws like the Fair Housing Act and Title VII of the Civil Rights Act of 1964. This is not just about people trying to avoid being punished under one federal law. This is also potentially about getting evidence in order to use federal discrimination laws to punish private companies over the complex results of computer algorithms.

This is not to say that the ACLU itself plans to go around filing lawsuits willy nilly. But the ACLU and the people they're representing in this case (one of whom is First Look Media, publishers of The Intercept), would not be the only people who be able to mobilize as a result of a friendly court ruling. Consider the lawyers (and their clients) who use the Americans with Disabilities Act to go from business to business looking for reasons to sue over frivolous concerns and eke out settlements. When the ACLU says, "Companies should be checking their own algorithms to ensure they are not discriminating," there's now a threat there, even if it's not coming from the ACLU, isn't there? Is that something even small businesses would have to pay attention to now? Is this going to be a new type of compliance cost? Could a business get into trouble for—as an example—buying targeted advertising that only reaches people in certain zip codes that have a high proportion of one race over another? Even if there are very good reasons for doing so, will a business is still now have to worry about having to defend against a lawsuit over it? Consider how many businesses settle complaints because the cost of fighting becomes too much of a burden.

It's vexing, because the ACLU's arguments for striking down that part of the law are compelling. There's no reason that it should be a federal crime to do the same kind of auditing to determine discriminatory process that's used through mailed applications or in-person interviews. Honestly it's hard to justify making the violation of a sites "terms of service" a federal crime for any reason.

It's disappointing, though, that ending one sort of abusive federal government prosecution may also be used as a tool to pry open new avenues to use the courts to harass people. The ACLU invokes redlining—the historical system of discrimination in which banks refused to provide mortgage loans in neighborhoods with high numbers of minorities. Does that really compare to which people get shown different types of online advertising?

NEXT: Attorney General Meets Privately With Bill Clinton, Mike Tyson Not Speaking at RNC, UFO Advocate Dares Government to Indict Him: P.M. Links

Editor's Note: We invite comments and request that they be civil and on-topic. We do not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments do not represent the views of Reason.com or Reason Foundation. We reserve the right to delete any comment for any reason at any time. Report abuses.

  1. Terms of Service are what they are . To have the state change them through a suit on the basis of “vagueness” whatever that happens to mean, seems errifying to me if not vague itself..

    Particularly when the ACLU spells out only reporters and investigators, etc as those needing “help” … and not you and me.

    1. Any time todays ACLU is backing an idea, take precautions ! LOL

      1. My best friend’s ex-wife makes $95/hr on the laptop. She has been unemployed for six months but last month her income with big fat bonus was over $14000 just working on the laptop for a few hours. Just try it out on the following website…
        Go here________________ http://www.Earnmore9.com

    2. Whether the state should have any say in the content of sites’ terms of use is a separate question from whether the state should use violations of terms of use in criminal prosecutions.

      1. A contractual violation isn’t enough ? I will concede it is a civil wrong, but a wrong nonetheless.
        The ACLU should overturn the law on that basis and not because it disagrees with parts of it.

      2. A contractual violation isn’t enough ? I will concede it is a civil wrong, but a wrong nonetheless.
        The ACLU should overturn the law on that basis and not because it disagrees with parts of it.

    3. Started working at home! It is by far the best job I have ever had. I just recently purchased a Brand new BMW since getting a check for $25470 this 8-week past. I began this 6 months ago and I am now bringing home at least $95 dollar per hour.
      I work through this Website. Go here____________ http://www.earnmore9.com

    4. Start working at home with Google! It’s by-far the best job Ive had. Last Monday I got a new Alfa Romeo from bringing in $7778. I started this 6 months ago and practically straight away started making more than $95 per hour.

      I work through this website____________ http://www.earnmore9.com

  2. This smells a lot like the ACLU wanting to do the “right” thing and fortuitously discovering a nanny reason for it; O frabjous day! Callooh! Callay!

  3. This is not to say that the ACLU itself plans to go around filing lawsuits willy nilly.

    Its just a huge coincidence, I’m sure, that the ACLU is pushing a legal theory and a case which would vastly increase the number of people they can sue.

    1. And on the quote, the ACLU itself in a non-profit organization but I doubt the lawyers that are members / behind that group aren’t interested in making money.

      I have suspicions the ACLU acts to provide them a client?le given all the minority groups it continues “to support” any time one pops up.

      They may actually support individual civil rights someday when they realize they are the smallest minority.

  4. And guns could be used for bad purposes too. So?

  5. One wonders why Microsoft isn’t being prosecuted over Windows 10?

  6. Fantastic work-from-home opportunity for everyone… Work for three to eightt hrs a day and start getting paid in the range of 5000-12000 dollars a month… Weekly payments…56b
    Find out more HERE—-> http://www.successway70.

  7. my co-worker’s step-aunt makes $68 hourly on the internet . She has been without a job for seven months but last month her payment was $16869 just working on the internet for a few hours. Learn More Here ….

    http://www.Profit80.com

  8. before I looked at the draft saying $9453 , I have faith that my mother in law woz like truley erning money part time at there computar. . there mums best friend haz done this 4 less than 14 months and just repayed the dept on their apartment and purchased a brand new Honda . read here …..

    Please click the link below
    ==========
    http://www.selfcash10.com

  9. before I looked at the draft saying $9453 , I have faith that my mother in law woz like truley erning money part time at there computar. . there mums best friend haz done this 4 less than 14 months and just repayed the dept on their apartment and purchased a brand new Honda . read here …..

    Please click the link below
    ==========
    http://www.selfcash10.com

  10. before I saw the bank draft which had said $9426 , I didnt believe that…my… brother woz like actualy earning money part-time at there labtop. . there uncles cousin has done this 4 less than fifteen months and by now repaid the dept on there place and got a great new Mini Cooper . read the full info here …

    Clik This Link inYour Browser??

    ? ? ? ? http://www.SelfCash10.com

  11. “and they may do so based on users’ membership in a group protected by civil rights laws.”

    Uh, do we now have to be in specific *groups* to have civil rights.

    Here I was thinking merely being human was sufficient….

Please to post comments

Comments are closed.