joegratz.net

Via How Appealing comes the 11th Circuit’s opinion this morning in Snow v. DirecTV. The issue arises on a motion to dismiss for failure to state a claim; the facts alleged in the complaint are as follows. Snow ran a web forum for defendants in antipiracy suits brought by DirecTV. The front page of that site included a clickwrap agreement requiring visitors to affirm that they were not affiliated with DirecTV before allowing entry. DirecTV and its agents accessed the forum despite this prohibition.

Snow sued under the Stored Communications Act, 18 U.S.C. 2701, which generally prohibits unauthorized access to stored electronic communications. But 18 U.S.C. 2511(2)(g)(i) limits the reach of the Stored Communications Act such that it is not a violation “to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public” (emphasis added). The court found that, while Snow’s forum expressly denied authorization to DirecTV and its agents, they didn’t need authorization because the site was readily accessible to the general public. Under the court’s reasoning, any web site that is not protected by a password or other information not readily accessible to the general public is not protected by the Stored Communications Act.

It appears to me that the plaintiff in this case just chose the wrong cause of action. A garden-variety breach of contract claim would have, I think, succeeded, though the damages to Snow for such a breach would presumably be very small, while damages under the SCA were likely to be much larger.

When I saw my first “no p0lice a11ow3d, suxx0rs!” notice on a dodgy BBS in 1989 or so, I found it hard to believe that through the simple talisman of prohibiting access, an electronic forum could keep out anyone it disliked. The Eleventh Circuit evidently didn’t believe it either.

UPDATE: Orin Kerr posts a quick take on the case. He argues that instead of relying solely on the fact that the website was readily accessible to the general public and thus that no authorization was needed, the 11th Circuit should have held that the Terms of Service did not affect DirecTV’s authorization vel non. Such a broader holding would make clear that it isn’t a crime to violate a website’s terms of service, just a breach of contract. The broader holding wouldn’t make any difference in this case, but it would have a big effect on whether a user of a password-protected website whose terms of service revoke authorization in the event of breach commits a crime when he accesses the service but violates the contract. (Think Westlaw.) I agree with Professor Kerr that authorization (as the term is used in ECPA) should not be automatically revocable solely by operation of contractual terms.

UPDATE 2: I had forgotten that Cindy Cohn and Kevin Bankston of the EFF, in an amicus brief, were the ones who introduced the ultimately successful argument that the “readily accessible to the general public” language of section 2511(2)(g)(i) is fatal to Snow’s claim. Kudos, Cindy and Kevin.