The MySpace Suicide: A Case Study in Overcriminalization

It is a legal cliché that "Hard cases make bad law"-- that is, that courts are too often tempted by emotional facts and sympathetic parties to render decisions without thinking about the law they are making and its effect on future cases.[1] The same could be said of the recent development of the criminal law: Legislators, prosecutors, and the public seem to believe that every bad act done is a legal wrong, punishable just as traditional crimes like murder and theft and rape are punished.

But too often they overlook the far greater differences between traditional crimes and these new offenses. Pushing the criminal law beyond its historical bounds carries consequences that may not be apparent when the public mood is hot and vengeful, and only later is the result apparent: bad law. This pattern is repeated nearly every time that Congress passes a narrow law to target some unlikely, newsworthy wrong or slight deviation from productive behavior.

The case of housewife Lori Drew fits the pattern perfectly. Drew was indicted under a federal anti- computer hacking statute for impersonating a young man on MySpace to gain the trust of an emotionally troubled teen, Megan Meier, who killed herself after the cruel joke spun out of control. The case contains all the hallmarks of overcriminalization and illustrates all of its common consequences:

• The decline of mens rea (guilty mind) requirements as a protection against unfair criminal liability;
  
• The arbitrary nature of modern criminal offenses that provide citizens with no notice that their conduct may be illegal;
  
• Extremely broad liability that threatens to make millions of honest citizens criminals;
  
• Politics and public opinion trumping ordinary prosecutorial discretion and traditional notions of justice; and
  
• The threat to liberty, the rule of law, and our civil society.

Drew's conduct was irresponsible, but it was not criminal. It may deserve social sanction, already dispensed in great quantity, and perhaps civil liability to Megan Meier's parents. But if Drew is convicted under criminal law, virtually every Internet user will face the consequences.

The Death of Megan Meier

Prosecutors allege that Lori Drew violated a federal anti-hacking statute when she created a fake MySpace account in violation of the Web site's terms of service.[2] According to the indictment, Drew created a MySpace account under the name "Josh Evans," whom she styled to be a 16-year-old boy recently moved to the area in eastern Missouri.

Drew's apparent aim was to find out why Megan Meier, a neighbor's 13-year-old child, had dumped her own daughter as a friend.[3] She may also have intended it as a joke: to "mess with Megan" as she believed Megan had done with her daughter. Drew's motives, the record indicates, were not clear-cut and seem to have shifted during the deception. This is not, after all, a bank robbery or a mugging for which motive, and thereby criminal intent, may be inferred simply from the facts.

At first engaging and flirtatious, "Josh Evans" suddenly turned mean one rainy October weekend. He shared some of Megan's private messages with her friends (for example, "aww sexi Josh ur so sweet if u moved back u could see me up close and personal lol") and posted public bulletins calling Megan "fat" and a "slut." Most and perhaps all of these messages, say investigators, were posted by persons with access to the account other than Drew.

The barrage continued that Monday when Megan logged in after school to see whether Josh had relented. Typing through tears, Megan fired back strongly worded replies, laced with strong language, at Josh and others who had taken his side in the dispute. Megan's mother was shocked by her "vulgar" responses and angrily demanded that she log off of MySpace. In a huff, Megan ran to her room and shut the door.

Megan's father checked his daughter's MySpace account the next day and recalls what he believes is the final message from Evans that his daughter read that evening: "The world would be a better place without you." (Federal investigators, however, were unable to confirm that text, as the message was lost in the ether.[4]) Twenty minutes after receiving that message, Megan hanged herself in her bedroom closet.

It took a year for the case to gel. Word of Drew's involvement emerged gradually, as did the scope of what federal prosecutors now call a conspiracy. Drew apparently did not act alone, but shared access to the account with her daughter, a family employee, and perhaps others. The facts are confused, and no one has been able to work out who exactly was responsible for which messages to Megan.[5]

That wrinkle, among others, was lost when word of the case became public in late 2007. The cable networks leapt on the story, dubbing it the "MySpace Suicide Case," following a report in the local paper. With the perils of the online world and "cyberbullying" on many parents' minds, the story found a ready audience. The strange fact of Drew's involvement-- this wasn't just children taunting children--gave the story a villain. "Good Morning America" and "Today" sought out the families and the witnesses for exclusive interviews. Hundreds of articles, opinion pieces, and television spots followed.

An indictment, however, did not--at least not immediately. A spokesman for the local sheriff's department said that what Drew did "might've been rude, it might've been immature, but it wasn't illegal."[6] Tina, Megan's mother, contested that conclusion in an interview with ABC News: "You cannot as an adult sit there and do that and hide behind a computer. It is a criminal act. We want to see her go to jail."[7]

The county prosecutor, Jack Banas, also reviewed the case and declined to press charges. The evidence, he said, showed that Drew was probably not the one who had sent the messages that final day; more crucially, she lacked the requisite criminal intent to harass or stalk Megan. Drew's behavior simply did not violate any law.[8] The local federal prosecutor announced that he had reached the same conclusion.

The result was outrage, both online and off. The hundreds of comments posted at that time to an online forum provided by ABC News seethe with anger at Lori Drew. This one is representative for its content, if not its relatively temperate tone:

Put her [Drew] in jail!!!!!! What kind of example are we setting if an adult/parent can get away with such an atrocity! We as adults all know how hard being a teenager is especially for the girls. She should have known better and acted as a parent and not as some rebellious teen. She obviously has some growing up to do! I think jail would be a great place for her to reflect on the fact that her stupidity has taken the life of a young, sensitive teenager, and ruined the lives of her family members who have to go on without her.[9]

Vigilantism also took root in online communities and spilled over into the physical world. Critics posted the Drews' home address and phone numbers on message boards, as well as a satellite photograph of their home.[10] Some discussed planning attacks on the Drews. Their home was repeatedly vandalized, and they received hundreds of angry, sometimes threatening phone calls. Drew was forced to close her coupon book business after clients were inundated with e-mails and calls from across the country. Due to the publicity and bullying, Drew's daughter dropped out of school.[11]

As interest in the case and outrage that Drew would not face jail time reached a fever pitch in early 2008, federal prosecutors in Los Angeles, where MySpace is located, decided to conduct their own investigation. The grand jury's initial subpoenas, quite unusually, made the cable and network news reports, as well as The New York Times and the Los Angeles Times.[12] Following a run-up in the press, an indictment of Lori Drew was issued in February.

The Charges

That indictment lays out a total of four charges: three for violation of a federal criminal statute and one for conspiracy to violate that statute. The statute is 18 U.S.C. § 1030, commonly known as the Computer Fraud and Abuse Act, which criminalizes unauthorized access to computer systems. Similar statutes have been enacted in all of the states.

Though intended to criminalize hacking, the statute is loosely drafted--a problem that regrettably has received little attention until now. The provision that Drew is alleged to have violated (and allegedly conspired to violate) authorizes the prosecution of any person who "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains...information from any protected computer if the conduct involved an interstate or foreign communication."[13]

As Professor Orin Kerr of George Washington University School of Law explained in a thoughtful 2003 article, "unauthorized access" statutes, and in particular § 1030, cover a very uncertain scope of conduct due to the vagueness of the words "access" and "unauthorized."[14] The key question, writes Kerr, and one that has not been asked of the federal statute until now is whether these laws criminalize the terms of contracts governing the use of computer services or something more akin to criminal trespass or theft.

The charges against Lori Drew are of the former variety. MySpace, the indictment explains, is a social networking Web site where registered individuals can post profiles of themselves and meet and interact with other users of the service. To join and register an account, an individual must visit the Web site, fill out a form, and agree to abide by its "terms of service," an agreement governing use of the site. Many Web sites, and probably all social networking services, have terms of service and require users to agree to them by checking a box on a sign-up form. Few users, however, actually review these complex and often lengthy legal documents--indeed, the trend in contract law is that they are unenforceable.[15]

Under the MySpace terms-of-service agreement, a user represents that "all registration information you submit is truthful and accurate" and promises to "maintain the accuracy of such information."[16] In addition, the agreement states that certain content is prohibited, including conduct that "harasses or advocates harassment of another person"; "promotes information that you know is false or misleading or promotes illegal activities or conduct that is abusive, threatening, obscene, defamatory or libelous"; or "solicits personal information from anyone under 18." Other prohibitions are even broader; for example, content that "provides any telephone numbers, street addresses, last names, URLs or email addresses" is also prohibited. So using MySpace to send a friend a message containing a link to a newspaper article would be a violation of the site's terms-of-service agreement.

The agreement itself appears to contemplate enforcement by MySpace. It states, for example, that "prohibited content," a label applied at "the sole discretion of MySpace.com," may be investigated by MySpace, which will "take appropriate legal action...including...removing the offending communication...and terminating the Membership of such violators." Similarly, the agreement explicitly reserves MySpace's right "to reject, refuse to post or remove any posting (including private messages) by you, or to restrict, suspend, or terminate your access to all or any part of the MySpace Services at any time." Though the agreement states that MySpace may report members to law enforcement authorities for "using the MySpace Services in a manner inconsistent with any and all applicable laws and regulations," it does not purport to make its own terms criminal law.

Yet it is for violation of those terms that Drew has been charged. The indictment alleges that she accessed MySpace "without authorization and in excess of authorized access" on three occasions when she, "in violation of MySpace TOS [terms of service], accessed MySpace servers to obtain information regarding [Meier]." The conspiracy count elaborates on these charges, alleging specific instances when Drew and others collaborated to achieve the same end, such as when she and "the co-conspirators altered the 'Josh Evans' profile to flirt with [Meier]."

In early September, district court judge George Wu denied two motions by Drew to dismiss the charges against her but held over a third for further consideration.[17] Judge Wu rejected the arguments that the statute is unconstitutionally vague and that, as applied in this case, it unconstitutionally delegated the power to define what acts constitute a crime to a private party, MySpace. The case may yet be dismissed, however, if the judge is persuaded by Drew's contention that the indictment fails to support prosecutors' claims that Drew's access was "intentional" and "unauthorized." Ruling on this motion will require the court to decide whether the prosecution's broad reading of the statute holds water. If the case is not dismissed, it will proceed to trial in early October.

Each of the crimes with which Drew is charged is a felony. If she is convicted on all counts, Drew faces a possible 20 years behind bars and criminal fines of up to $1 million. A conviction would also serve as evidence in a civil suit, perhaps leading to additional liability, such as the payment of damages for wrongful death to Megan Meier's parents.

The Consequences

Though there is some question about Drew's involvement in the meanest messages sent to Meier, even in the kindest light, her actions were irresponsible and deserve social, and perhaps civil legal, sanction. That does not mean, however, that she did anything that is or should be a crime. In the harshest light, the accusations against her do not rise to that level. If all of the allegations against her are true, she treated a vulnerable teenage girl with cruelty and a malign heart. But kindness and compassion are not things that our society enforces by law, nor could it do so.

The tragedy of Megan Meier's suicide, and especially what has followed it, demonstrates well the means and the risks of abuse of the criminal law. The public response to the episode prompted lawmakers in Meier's hometown, the state of Missouri, and the U.S. Congress to introduce legislation to curb "cyberbullying," although whether any of these proposals would actually reach Drew's conduct and, if they did, would withstand First Amendment scrutiny is uncertain.[18] The public response also led no fewer than three teams of prosecutors to consider the case.

The resulting indictment is based on a crime of questionable legitimacy--a tortured reading of a poorly drafted statute--and the consequences of this charging cannot be overstated. Specifically, and proving that hard cases do indeed make bad law, the Lori Drew case offers five cautionary lessons.

Lesson #1: A guilty mind doesn't matter.

Historically, nearly all crimes contained mens rea requirements to protect those who did not intend to commit wrongful acts from unwarranted prosecution and conviction. Mens rea, Latin for "guilty mind," stands for the idea that for an act to be worthy of society's condemnation through the criminal law, it must have been done with the purpose of violating society's norms (some scholars use "fault" as a gloss on the term).[19] For example, driving into a pedestrian by accident is very different from running down a person deliberately, though the result may be the same. One undoubtedly deserves criminal punishment, for it is murder, but the other may not if it truly was an accident not brought about by the driver's recklessness.

In this way, mens rea requirements sort criminals from those who brought about bad results but without the intent of doing so. Their use, however, is in decline at a time when the criminal law is growing at an exceedingly brisk pace. A significant percentage of recent federal criminal statutes, for example, lack mens rea protections altogether, and others contain weak or ambiguous mental elements.[20]

This is a hallmark of overcriminalization. Lax or nonexistent mens rea requirements make the task of prosecution far easier, but they do so at the expense of wrongful conviction and the blurring of the purpose of the criminal law.

Although the statute that Lori Drew stands accused of violating contains a relatively strong mens rea requirement, the indictment all but ignores it. The law requires that a person "intentionally" accesses a computer without authorization. In the context of criminal intent, "intentionally" means either of two states of mind: that a person (1) "consciously desires the result" and acts to achieve it or (2) "knows that that result is practically certain to follow from her conduct."[21] Thus, accessing a system without authorization accidentally, or without knowledge of an authorization requirement, should not bring about criminal liability.

To meet this mens rea standard, then, Drew must have intended to access MySpace in knowing violation of the authorization that MySpace had granted to her in its terms-of-service agreement. This means that she must have (1) known of the agreement and its provisions, (2) known that her authorization to access MySpace was conditioned on her not violating those provisions, and (3) known that her conduct had caused her authorization to access the site to be revoked so that subsequent access would be without authorization.

For several reasons, this chain of reasoning is a stretch.

First, there is no evidence that Drew had ever accessed or read the terms-of-service agreement. The indictment states only that the agreement "was readily available" to all MySpace users, but that is not enough. The agreement is nine solid pages of legalistic text, at times all in capital letters, organized into paragraphs that regularly go on for half a page. One doubts that anyone save a lawyer could read and understand it or that any MySpace user, lawyer or not, would bother to try. The indictment does not even allege that Drew, who is not a lawyer, had ever seen it.

Second, the agreement itself is not really susceptible to the reading that violation of its terms would necessarily terminate authorization to access the site. MySpace states throughout the document that it "reserves the right" to remove any posting on the site and to terminate a user's access, but it does not state that access is conditioned on following the agreement's terms--in other words, that misconduct would automatically lead to a withdrawal of authorization. So even had Drew read and understood the agreement, she would still probably have lacked the requisite mental state because she would not have known that she lacked authorization to access the site.

In short, proving criminal intent will likely be an impossible hurdle for the prosecution.

This is as it should be. Whatever Drew intended to do, hacking MySpace was not it. Moreover, even if her actions did amount to hacking, she simply lacked the mental state required for conviction. This is how the criminal law, quite appropriately, protects those who lack "fault" from punishment. That protection is undermined, however, by the rigors and expense of defending one's self, as Lori Drew must now do.

Lesson #2: Citizens receive no notice of the law and what is forbidden.

It is said that ignorance of the law is no excuse, but traditionally such ignorance was rare because criminal offenses had an intuitive moral basis. Until recent decades, the bulk of crimes concerned acts that were malum in se, or wrong in themselves. This includes murder, rape, and theft, all offenses that a member of society would know, without reading statutes or case law, are crimes. Thus, an individual could easily conform his conduct to the law's requirements, and those who ran afoul of the law, it could be said with some certainty, deserved society's condemnation and punishment.

But today, new criminal laws invariably concern conduct that is malum prohibitum, or wrong only because it is prohibited. Malum prohibitum crimes include things like shipping chemicals without the proper sticker on the box, violating a recordkeeping requirement, or driving (non-recklessly) above the speed limit. Because these acts are not morally wrong, individuals often lack notice that their conduct may subject them to criminal liability. As Professor John Baker of Louisiana State University has written, this modern trend makes strong mens rea requirements even more important today than they were in the past.

The law that Lori Drew is accused of violating appears to address conduct that really is morally wrong, but its loose language has been twisted to give it a far broader coverage that extends beyond any reasonable person's expectations as to what, exactly, constitutes online criminal conduct. As Professor Kerr explains, legislatures enacting unauthorized access statutes saw them "as doing for computers what trespass and burglary laws did for real property,"[22] but translating that intent into statutory language proved difficult because the concepts of "access" and "authorization" online differ from their real-world cousins. The usual case-- until now, all those brought under the federal statute have been "usual" in this way--does not confront this problem, because it concerns conduct that is analogous to physical intrusion, such as an employee installing malicious software on his employer's computers and a Russian hacker breaking into a Connecticut business's computers to steal proprietary information.[23]

The case against Drew is different. Under the prosecutors' reading of the statute, "unauthorized access" includes not only hacking, but also any access in violation of the terms of service, in effect turning the terms of certain contracts (those concerning access to online services) into criminal law. These contracts, however, are not written with the same clarity as most criminal law and often regulate conduct that has nothing at all to do with the concerns or purposes of criminal law.

For example, the MySpace agreement prohibits covering or obscuring the site's banner advertisements and requires users to "acknowledge that MySpace.com reserves the right to charge for the MySpace Services." Would violation of these provisions also give rise to criminal liability? The agreement also prohibits offensive speech that "promotes racism, bigotry, hatred or physical harm of any kind against any group or individual," as well as the use of "sexually suggestive imagery." Enforcing these provisions by criminal prosecution may well be an unconstitutional abridgment of individuals' First Amendment rights.

Aside from those specific concerns, the MySpace terms of service, like those of most other services, provide no clear notice of what conduct, exactly, is forbidden. Throughout, MySpace states that it will make determinations, in its "sole discretion," as to whether content is in violation of its rules, and it reserves the right to modify the agreement at any time, with any modification being effective immediately. While perhaps a sensible approach for an agreement between a social networking service and its users, this is no firm basis for criminal liability because it is vague and arbitrary, giving users no ability to conform their conduct to the rules that may subject them to criminal punishment. A criminal statute containing similar commands would be void for vagueness under the Constitution.[24]

Lesson #3: Everyone is a criminal.

As the scope of criminal prohibition expands, so does the number of people who are, according to the law, criminals. The increasing criminalization of economic conduct in recent years, for example, means that many entrepreneurs engaging in socially beneficial conduct may, because they overlooked a regulatory requirement or made a simple mistake, face criminal charges and even conviction.

This concern is anything but hypothetical. The Heritage Foundation's overcriminalization project has collected dozens of cases in which ordinary individuals--honest businesspersons, hobbyists, homeowners, inventors, and retirees--have been prosecuted and in some cases imprisoned for common conduct that few Americans would recognize as criminal.[25] As state legislators and the U.S. Congress criminalize more conduct, greater numbers of individuals are unwittingly being subjected to criminal liability. Even those who prevail find that they have had to spend substantial portions of their savings on legal defense and have lost years of their lives fighting charges that they had no reason to expect.

It is not at all farfetched to say that, today, every American is a criminal--or would be if prosecutors chose to enforce all of the laws on the books. The federal mail fraud and wire fraud statutes, for example, are so broad that they ensnare an enormous amount of private conduct unrelated to traditional fraud offenses. Calling in sick to the office to take an extra vacation day, while not commendable behavior, should not be a criminal offense either; by statute, however, it is almost surely wire fraud.[26] Similarly, conspiracy offenses, as used in the Drew case, are a way for prosecutors to go after those whose actual conduct violated no criminal law.

The amount of conduct that would be criminalized if Lori Drew is convicted on the prosecution's theory of the law is enormous, as is the number of Americans who would be in violation of the law. Any person who has exaggerated his or her height on a dating Web site profile,[27] unwittingly linked to a file that happens to contain a virus on Facebook,[28] or performed research for pay using Google[29] has violated a terms-of-service agreement and could be prosecuted for it.

As pointed out in a strong amicus curiae brief by the Electronic Frontier Foundation (EFF) in the Drew case, the majority of teenage MySpace users have submitted at least some false information to the site in violation of its terms of service, and some child-protection groups actually encourage children to enter false information online in certain circumstances to protect their privacy and guard against exploitation.[30] The EFF brief, noting that Google's terms of service bars minors from using its services, reasonably supposes that the company "Surely...did not mean--or imagine--that tens of millions of minors in fact would never use its services to obtain information or do so at the risk of criminal liability."[31]

Professor Kerr puts forward a particularly pointed example:

Imagine that a website owner announces that only right-handed people can view his website, or perhaps only friendly people. Under the contract-based approach, a visit to the site by a left-handed or surly person is an unauthorized access that may trigger state and federal criminal laws. A computer owner could set up a public web page, announce that "no one is allowed to visit my web page," and then refer for prosecution anyone who clicks on the site out of curiosity. By granting the computer owner essentially unlimited authority to define authorization, the contract standard delegates the scope of criminality to every computer owner.[32]

In short, broad criminal liability means that more good people--people who are honest and who do not infringe on others' rights or run roughshod over society's basic rules--will be treated as criminals, to nobody's ultimate benefit. All that protects them from criminal sanction is prosecutorial discretion and restraint, but overcriminalization causes even that to break down.

A prosecutor's role, according to the ABA's Standards of Criminal Justice Relating to the Prosecution Function, is not to win convictions or to advance his or her own political advantage, but to do justice.[34]

Moreover, although public interest and concern should play a role in a prosecutor's exercise of discretion--after all, it is the prosecutor's duty to direct his resources to combat serious threats to the community--it is no substitute for his independent analysis of the merits of the case.[35] Only when a prosecutor is himself convinced that a charge is supported by probable cause and sufficient admissible evidence to warrant a conviction may he institute it. Any lesser standard risks subjecting the innocent to the great burden and expense of criminal prosecution.

The Lori Drew indictment arrived with the whiff of politics upon it. At least two teams of prosecutors in Missouri--one local, one federal--investigated and reviewed the evidence in the case, and both declined to bring charges for the reason that Drew's conduct had violated no law. Only at that point, when public outrage was at its height, did the U.S. Attorney's office in Los Angeles, a jurisdiction far removed from the case's natural Missouri locale, become involved in the case. The appearance, if not the reality, of improper motivation in the decision to charge is strong.

That the L.A. prosecutors were more "creative" in charging than their Missouri counterparts is no answer, for the principal purpose of the criminal law is voluntary deterrence, which is built atop certainty. That such creativity in charging is possible speaks to the great overbreadth of the criminal law in general and the vagueness of the statute in particular. A criminal charge that comes as a surprise simply demonstrates that the law is unclear, has provided insufficient notice, and has failed in its purpose.

Lesson #5: Fundamental values fall by the wayside.

It is said that overcriminalization is a bipartisan pursuit: Republicans wish to appear tough on crime, and Democrats tend to be happy to see business leaders behind bars. Meanwhile, the Department of Justice and prosecutors lobby for broader offenses to ease charging and conviction, and the public pushes for new offenses to target the evil of the day. The result is that criminal offenses multiply, with no natural constituency in opposition, and when a person whose hands are unclean is alleged to have committed a questionable offense, few public figures are eager to rise to the defense.

However, this dynamic is changing as more and more groups recognize the growing threat of overcriminalization to the rule of law, our civil liberties, and the economy. Overcriminalization may be good politics, but it is terrible policy, and that fact is slowly swaying opinion.

For conservatives, prosecutions like Drew's demean the rule of law.

First, such prosecutions decrease respect for the law across the board. As Professor John Coffee has explained, "The criminal law is obeyed not simply because there is a legal threat underlying it, but because the public perceives its norms to be legitimate and deserving of compliance. [T]he criminal law is a system for public communication of values."[36] This function is sacrificed, however, as the criminal law expands to cover offenses that are unconnected to our values. As a result, the power of the law to influence conduct is reduced, leading to more crimes, including those of the malum in se (wrong in themselves) variety. Overcriminalization, in other words, is actually counterproductive.

Second, the growth in criminal law is a part of the overall growth of government at the expense of citizens' freedoms.[37] At the federal level, the statutes at issue in cases such as Lopez (the Gun-Free School Zones Act), Morrison (the Violence Against Women Act), and Raich (the Controlled Substances Act) embody flawed notions of Congress's Commerce Clause powers that have allowed federal control to expand well beyond its constitutional limits, severely undermining the federal system and threatening individual liberty.[38]

Third, overcriminalization has become a brake on the economy. Today, corporate leaders face criminal liability for minor regulatory violations at every turn. American business is less vibrant and internationally competitive because of the liability and compliance costs imposed by ill-conceived criminal statutes and prosecutions.

Those who are on the left share these concerns and have several of their own. Unbounded prosecutorial discretion, for example, raises the risk of abuses, such as racial discrimination and politically motivated cases. These liberals, like conservatives, see overcriminalization as a threat both to fundamental liberties, such as free speech and the right to speak anonymously, and to the rights of the accused. The National Association of Criminal Defense Attorneys is a leading voice on the latter issue, while groups like the EFF and the American Civil Liberties Union focus on expressive rights.

In fact, it was the EFF, joined by the Center for Democracy and Technology and Ralph Nader's Public Citizen, that filed a strong brief on behalf of Lori Drew, making the case that a conviction on the government's "novel and unprecedented" reading of an anti-hacking statute would "convert the millions of internet-using Americans who disregard the terms of service associated with online services into federal criminals"--an end that would be "unwarranted" and unconstitutional.[39] The government's theory, the brief concludes, would violate the First Amendment because of its restrictions on free speech and anonymous speech and the Due Process Clause because of its vagueness and lack of notice.

This case is being closely watched by organizations from across the ideological spectrum. The fight against overcriminalization is based on shared constitutional principles and good public policy and for that reason has been able to transcend all partisan divides.

Conclusion

Convicting Lori Drew of the charges leveled against her is bad law, no matter what her transgressions have been, but the recent trend in criminal law--one of great expansion and few checks-- suggests that a conviction on the government's excessively creative legal theory is not unlikely. Even if she prevails, Drew has still had to suffer the rigors of prosecution, a burden that any person would rightly fear.

If the facts are as alleged, Drew does deserve punishment, but it need not, and should not, be of a criminal nature. Social sanction, which has been dispensed in great quantities, and civil justice are the appropriate remedies to address conduct such as Drew's, which was both hardhearted and unkind. Criminal law is not the proper remedy, for the simple reason that she committed no crime.

If Lori Drew is convicted, we all, as Americans, will have to suffer the greater consequences.

Andrew M. Grossman is Senior Legal Policy Analyst in the Center for Legal and Judicial Studies at The Heritage Foundation.