As social media becomes more engrained in our lives, we hear more and more about its use among students. Although some of these uses are perfectly legitimate, others, such as the use of social media for bullying or defamatory purposes, are not. In a recent case in Oregon, Matot v. CH et al, the court addressed the question of whether the “subject of a fake social media account” could successfully claim a violation of the Computer Fraud and Abuse Act (“CFAA”) against the creators of the fake profile. The court answered the question with a resounding “No.”
Recently, students at a Oregon high school allegedly created a fake social media account for the school’s principal and allegedly began posting obscene materials on this page. Mr. Matot filed suit against both the students and their parents, alleging defamation and negligent supervision, as well as a violation of the CFAA. According to the principal, in allegedly creating these postings, the defendant students had allegedly used school computers in a manner which “exceeded authorized access” under the CFAA.
The federal district judge in Oregon, however, found otherwise, and held that there was no violation of the CFAA. In determining this, the court first addressed LVRC Holdings L.L.C. v. Brekka,, a Ninth Circuit case, where the court found that an employee’s misuse or misappropriation of an employer’s confidential or proprietary information is not “without authorization” as long as the employer has given permission to the employee to access this information. Here, unlike in Brekka, the defendants were not employees of the social media sites, and instead, their relationship with the website was entirely based on an alleged forgery. The court next addressed the United States v. Nosal case, where the Ninth Circuit previously held that lying on social media websites was common, and declined to recognize this as a CFAA violation.
Ultimately, the court in Matot concluded that the term authorization has been narrowly interpreted under Ninth Circuit law, and any ambiguity concerning criminal statutes should “be resolved in favor of lenity.” Here, if the court were to consider lying on social media websites a violation of the CFAA, millions of people could be charged with violations of this statute, including law enforcement officials. As such, the court found dismissal of this claim was proper. Furthermore, the court denied leave to add a RICO claim, finding, “Congress did not intend to target the misguided attempts at retribution by juvenile middle school students against an assistant principal in enacting RICO.”
Interestingly, as Venkat Balasubramani points out on the Technology and Marketing blog, the court failed to address the question of whether the principal actually had standing to pursue the claim. According to Balasubramani, civil claims under the CFAA can only be pursued where a computer is accessed without authorization and the principal failed to show the students lacked such authorization. Additionally, he points out that the court did not address the impact of the students’ First Amendment Rights, if any, or whether their parents could actually be held liable.
Based on this case and some other rulings in the Ninth Circuit, creating a fake social media profile, on its own, cannot be the basis for a CFAA claim, at least for now apparently.