## Facts

- Lori Drew, in Missouri, allegedly helped create a fictitious MySpace profile (“Josh Evans”) portraying a teenage boy.
- Using the account, Drew and others communicated with 13-year-old Megan Meier over several weeks; messages shifted from friendly to hostile.
- The account allegedly sent a message implying the world would be better off without Megan; additional negative messages followed from other users connected to the profile.
- Megan died by suicide shortly thereafter.
- Federal prosecutors proceeded under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, on the theory that creating and using the false profile violated MySpace’s Terms of Service (TOS), making access to MySpace’s computers “without authorization” or “in excess of authorization.”

## Issues

1. Whether an intentional breach of a website’s TOS, without more, can constitute misdemeanor access “without authorization” or “in excess of authorization” under 18 U.S.C. § 1030(a)(2)(C).
2. Whether interpreting the CFAA to criminalize TOS violations renders the statute void for vagueness by failing to provide fair notice and inviting arbitrary enforcement.
3. Whether tying criminal liability to privately drafted and modifiable TOS effectively delegates definition of criminal conduct to website operators.

## Decision

- Drew was indicted for conspiracy and felony CFAA violations; the jury acquitted on felonies and convicted on misdemeanor CFAA lesser-included offenses based on TOS violations.
- On a post-verdict Rule 29(c) motion, the court entered judgment of acquittal on the misdemeanor counts and vacated the convictions.
- The court held the misdemeanor convictions could not rest solely on intentional TOS violations, because that reading would make the CFAA unconstitutionally vague and permit arbitrary enforcement driven by private contractual terms.
- The conspiracy count resulted in a hung jury and was later dismissed without prejudice; the case ended with no federal criminal convictions.

## Legal Principles

- “Without authorization” and “exceeds authorized access” in the CFAA do not encompass mere violations of a website’s Terms of Service, standing alone, for purposes of criminal misdemeanor liability.
- A construction that turns commonplace contractual breaches (e.g., inaccurate profile information or other routine TOS violations) into federal crimes risks void-for-vagueness problems due to lack of fair notice.
- Criminal prohibitions cannot hinge on broad, changeable, and privately written website terms in a manner that enables arbitrary or selective prosecution.
- Interpreting the CFAA to allow private website operators to define the scope of criminal “authorization” through TOS raises serious due process and delegation concerns.

## Conclusion

The court set aside the misdemeanor CFAA convictions because treating TOS violations as “unauthorized access” would transform contract breaches into crimes and would render the statute unconstitutionally vague, leaving federal criminal liability dependent on privately drafted website rules.


United States v. Drew, 259 F.R.D. 449 (C.D. Cal. 2009)