California judge: trolling with someone else’s Facebook is identity theft

By Venkat Balasubramani and Eric Goldman

Read Original Article

From time to time, we will be running posts from Eric Goldman’s Technology & Marketing Law Blog. Sometimes they will look similar to other articles appearing on Ars; other posts will be more “bloggy” in nature. This is one of the latter.

Venkat Balasubramani’s take

Rolando was a juvenile who received an unsolicited text message with the victim’s e-mail password. According to the court, he used the password to gain access to the victim’s Facebook account and posted several sexually inappropriate messages from the victim’s account. The Facebook posts included posts on the walls of the victim’s friends and the following change to the victim’s profile:
Hey, Face Bookers, [sic] I’m [S.], a junior in high school . . . I want to be a pediatrician but I’m not sure where I want to go to college. I have high standards for myself and plan to meet them all. I love to suck dick.

The victim testified that she suffered stigma as a result of these and other posts. “I used to love going to school,” she said. “Now, I dread dealing with this every day.”

The juvenile was prosecuted under a California statute (section 530.55) which applies to anyone who:
wilfully obtains personal identifying information [of the victim and] uses that information for any unlawful purpose, including to obtain, or attempt to obtain, credit, goods, services, real property, or medication information.

Did the defendant willfully obtain the victim’s “personal identifying information”? The court holds that, despite his argument that he “passively receiv[ed] the text message” which contained the victim’s password information, he “willfully” obtained it because he remembered it or otherwise recorded it so he could use it later. Moreover, the court concludes that the defendant willfully obtained the victim’s Facebook account password. The record was devoid of evidence as to how exactly the defendant accessed the victim’s Facebook account, and in the absence of any such evidence, the court says it’s “reasonable to infer” that the defendant reset the victim’s Facebook password using her e-mail password and then gained access to the victim’s Facebook account.

Did the defendant use the victim’s information for an unlawful purpose? In addition to obtaining the information willfully, the perpetrator has to use the information for an “unlawful purpose.” The first possibility was that the defendant violated section 647.6, which applies when someone “annoys or molests any child under 18.” However, under California Supreme Court precedent, this statute requires a motivation by “an unnatural or abnormal sexual interest in the victim.” [emphasis added] The court concluded that the facts did not fit into this statute because the defendant had no real contact with the victim other than the Facebook posts and he also testified that he “intended his comments to be taken as a joke.”

The second possibility was that the defendant used the victim’s personal information to commit a tortuous act. The defendant argued that “unlawful purpose” as used in the statute should be restricted to criminal conduct, but the court disagreed, noting legislative intent to expand the scope of the statute in amending it.

The court also pointed to the fact that the definitions section of the statute included the term “crime,” and the legislature chose instead to use “any unlawful purpose.” The defendant practically conceded that his conduct satisfied the requirements of a civil defamation claim. The court therefore finds that the defendant’s act constituted libel and constituted an “unlawful purpose” under the statute. Alternatively, the court held that the defendant’s conduct satisfied the statute because it also constituted a criminal offense. The defendant’s actions violated section 653m, which makes illegal any contact with another person using “obscene language… by means of an electronic communication device… with [the] intent to annoy.”

California judge: trolling with someone else’s Facebook is identity theft
It’s tough to muster much sympathy for the defendant, who was previously in trouble for reckless driving when he drove his car “at three girls in the school parking lot, but stopped abruptly several feet away from them in an attempt to scare them.”

The definition of “personal identifying information” in the statute is broad. (We ran into an analogous problem in the Pineda case). It looks like the court focused on the Facebook password as being the information in question that supported the violation of the statute, but the opinion is not totally clear on this. A broad definition of personal identifying information coupled with the court’s decision to allow tortuous conduct to satisfy the “unlawful purpose” could lead to a statute that is expansive in scope and which should raise everyone’s First Amendment hackles. Given that the defendant used the e-mail password to access Facebook, this does not feel to me like a case that pushed the statute to the limit.

Interestingly, the defendant argued that his conduct would violate California’s newly enacted e-personalization statute (section 528.5) which was effective January 1, 2011, and the fact that this statute was passed demonstrates that the legislature did not view his conduct as violating the previously existing statute. The court disagrees with this argument, noting that the newly enacted e-personalization statute has different elements from section 530.5:

Section 528.5 does not include a requirement that a perpetrator obtain personal identifying information. As a result, a person could violate section 528.5 by merely posting comments on a blog impersonating another person. There is no requirement, under these circumstances, that the person obtain a password—a key distinction.

Yikes. This is precisely what is wrong with California’s e-personalization statute.

Eric Goldman’s take

This case plays out as a Greek-style tragedy in three parts.
Part one: Someone sent the victim’s e-mail password to the defendant. The court is vague about who did this or how that person got the victim’s password.

This brings up one of my modern rules for clean living: never tell anyone else your passwords. Ever. (Another rule for clean living is to constantly change your passwords, but this is harder to obey). I am such a stickler about my passwords that I don’t tell them to anyone. Certainly not to campus IT when they want to muck with my computer, but I don’t even tell my passwords to my wife. (FWIW, my wife has told me many of her passwords, but I would never use them without her express instructions). I know there’s a debate about the spouse-and-passwords dilemma. It’s not that I don’t trust my wife. I do, completely. But my rule is clean and simple. If someone other than me types in my password, then they ripped it off. (We’ll revisit the problem of accessing a logged-in computer in a bit).

In this case, we don’t know why the password-obtain-er had the victim’s password. Perhaps it was hacked. More likely, the victim made an error in judgment. Either way, the defendant apparently used the e-mail password to help reset the Facebook password and access the Facebook account.

Part two: The defendant misused the victim’s password. It goes without saying that the defendant had no business logging into the victim’s e-mail or Facebook account. Doing so was inappropriate even if the defendant merely just looks around, given the amount of private information stored in email and Facebook accounts. It was even worse to publish content under that person’s name, and worse still to post fake come-ons for sex.

Having said this, once a juvenile finds out he/she can access to a peer’s Facebook account, it seems like it would be almost irresistible not to muck around with it. I don’t want to dismiss this entirely as “kids will be kids,” but I’m sure a nontrivial percentage of kids would take advantage of a peer’s password if the circumstance presented itself. Perhaps it’s like the joyriding of days of old. If people left keys in their cars, some kids would take the cars for a spin. We can enact draconian laws to discourage joyriding, but if keys are left in cars, joyrides are inevitable. Here, the defendant basically took the victim’s Facebook account for a joyride.

Urna magna porttitor in ac lorem magnis etiam nunc. Cras. Ac turpis integer egestas a tortor. Massa ut, egestas odio aenean mus, in. Mus! Hac arcu facilisis porta porttitor etiam, urna parturient, placerat tristique! In lundium nunc ac, amet urna sit arcu, odio, dictumst dignissim dictumst nisi tincidunt. Tempor, placerat penatibus. Adipiscing mattis nisi tristique pulvinar! Dis non est porttitor nec in mid habitasse placerat scelerisque duis cursus mattis tortor? Auctor ut elementum in. Augue non elit nisi! Ultrices mus dis, aenean scelerisque et, in dis egestas tincidunt porttitor montes phasellus a! Urna nunc nec dapibus, quis natoque, vut, ut! Ut ut, vut nascetur in cum, eros pulvinar? Porta, pulvinar parturient ultrices. Egestas ut amet integer parturient tempor placerat lorem.

Lectus dolor? Odio pid duis, porta ultricies! Ac ac? Amet mauris, aliquam dignissim amet cum! Augue augue cursus porta placerat est dis cum eros augue magnis nisi porttitor porttitor! Sit amet auctor dictumst pid pulvinar habitasse aliquet vel pid? Magna duis aliquam mauris placerat arcu dapibus ultricies, dignissim cursus? Aenean amet? Hac ac adipiscing dis, ut augue eros pid, porttitor natoque, penatibus. Mauris cum dolor eros tortor lacus ac est nec! Nec, mus dis, porttitor! Mid odio magna et, dignissim odio in elementum ridiculus duis dis in tortor augue? Vel ridiculus, urna. Aliquam integer auctor, a. Habitasse turpis magnis mid, mauris diam est est mid mid nec odio sit odio. Amet in, ac non, sit pid ut natoque habitasse.