ACLU Files Challenge To CFAA Over Blocking Research Into Discrimination Online

There's been a lot of talk lately about the possibility of discrimination being built into the algorithms that determine our lives. In the past year, multiple publications have discussed what happens when algorithms are racist in a time when algorithms decide more and more of our lives. Just recently, we talked about judges using proprietary algorithms in sentencing, and how those algorithms themselves may judge people based on things like skin color. And just a few days ago, there was a fascinating NY Times article about inherent bias in artificial intelligence systems. I even went to a conference recently, where there was a whole discussion on the question of what do you do "if your algorithm is racist." It's not an easy question to answer, honestly, but one thing that we should not be doing is holding back research into these systems. And yet... that's exactly what's happening. And the culprit, once again, is the Computer Fraud & Abuse Act (CFAA), which we've written about for years. The law, which is woefully out of date, and was passed (literally) by a Congress that was freaked out over the movie WarGames, is supposed to target evil "computer hackers." But it's written so broadly, including terms like "unauthorized access" or "exceeding authorized access," that it's been used against things like violating a terms of service (that you didn't read or even agree to) or against downloading too many files. And that's scaring the hell out of researchers. Given that, the ACLU has now filed a lawsuit on behalf a group of academic researchers, computer scientists and journalists who want to investigate these issues, but are held back by the CFAA.

Our plaintiffs want to investigate whether websites are discriminating, but they often can’t. Courts and prosecutors have interpreted a provision of the CFAA—one that prohibits individuals from “exceed[ing] authorized access” to a computer—to criminalize violations of websites’ “terms of service.” Terms of service are the rules that govern the relationship between a website and its user and often include, for example, prohibitions on providing false information, creating multiple accounts, or using automated methods of recording publicly available data (sometimes called “scraping”). The problem is that those are the very methods that are necessary to test for discrimination on the internet, and the academics and journalists who want to use those methods for socially valuable research should not have to risk prosecution for using them. The CFAA violates the First Amendment because it limits everyone, including academics and journalists, from gathering the publicly available information necessary to understand and speak about online discrimination.

In terms of the specific challenge, the ACLU is arguing that it violates both the First Amendment and the due process clause of the Fifth Amendment. The crux of the First Amendment argument in the filing:

The Challenged Provision impermissibly burdens speech about business practices and other activity on the internet because websites can determine what speech and expressive activity to prohibit, and these prohibitions become criminal violations of the Challenged Provision. In other words, a website can explicitly target speech or expressive activities. For example, if a website’s terms of service provide that access by certain types of speakers (such as researchers) is unauthorized, or that engaging in certain speech (false or misleading speech, for example, or subsequent disparaging speech about the website) renders access unauthorized, then violations of those private terms of service become crimes through the phrase “exceeds authorized access” in the Challenged Provision. Such speech or expressive activity thus becomes prohibited under pain of criminal sanctions simply because it occurred on the internet. Because the Challenged Provision incorporates websites’ terms of service into the federal criminal code, its applications are virtually infinite; any speech or expressive activity that the private operator of a website has prohibited as a condition of access to its website becomes a criminal violation, even where that prohibition covers speech subsequent to the visit and in a different forum. In a good number of cases, a website’s ToS will pro