Facebook claimed that by using Power’s tool, users were accessing the social networking site “without permission,” which is a criminal violation under the California Penal Code Section 502(c) and the Computer Fraud and Abuse Act (CFAA). Section 502 prohibits access to computers or information that the user has no permission to access, and the CFAA is the federal permutation of the same principle. The law makes it a crime when someone “knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer system, or computer network.”
But Facebook’s terms of service are no doubt routinely violated by a large number of users. Things like, “You will keep your contact information accurate and up-to-date,” and “You will not provide any false personal information on Facebook” are extremely difficult to abide by 100% of the time. If you move, for instance, and don’t update your address on your profile right away you have already violated both of these terms. Another term states, “You will not share your password …[or] let anyone else access your account.” What about the celebrity or politician who delegates their password to employees to maintain their page? To make these things criminal would not only result in 500 million potential arrests, but it would also stifle creativity and the free flow of information on the open web.
There is a caveat in this decision, however; the court also found that it might be a violation of California’s computer crime law to bypass technical or code-based barriers intended to restrict access to or uses of a website. Facebook has argued that Power broke the law by circumventing their effort to block the Power browser’s IP address, which was designed specifically to keep users from accessing their Facebook accounts through the Power system. While a mere violation of the Terms of Service is not criminal, the court decided, intentionally bypassing code-based barriers set up in order to enforce the Terms of Service might be considered criminal under Section 502. Think of it this way: if I ask you not to step onto my property, and you do, you are wrong but not in a criminal way. But if I build a fence, and ask you not to step onto my property and you climb the fence, now we have a problem.
As these issues continue to play themselves out in other courts it will be interesting to see what happens. The EFF tracks Terms of Service changes for lots of popular websites here for anyone who wants to make sure they are in full compliance.