Netflix, HBO GO, and other streaming devices have become a major part of millions of Americans’ recreation. So, too, has the practice of sharing accounts among family and friends so they can enjoy movies, shows, and music by simply plugging in a username and password.
This seemingly innocuous aspect of daily life has become a federal criminal offense with significant possible ramifications, although the CEO of Netflix and other contemporaries have stated support for sharing. Continuing a disturbing pattern, the federal court system has potentially criminalized a standard facet of everyday behavior through an overly broad interpretation of statute.
The issue of password sharing came to a head on July 5 in the federal Ninth Circuit Court’s ruling in U.S. v. Nosal. The case centered on a former employee of the executive search firm Korn Ferry International, who used a colleague’s login to download huge amounts of confidential data from the company’s computer system.
While David Nosal was rightfully convicted under the Computer Fraud and Abuse Act (CFAA), the decision Circuit Judge M. Margaret McKeown wrote was so broad it could be used to criminalize the behavior of millions of Americans. Her decision could set a precedent where any person who shares a password could be violating the CFAA.
The ruling stated that accessing a website or computer network with someone else’s password violates the CFAA. As such, even if your friend consents to you using his Netflix password, accessing his account could be a federal offense unless you obtain Netflix’s permission.
Transforming Millions into Criminals Overnight
This case vastly distorts the CFAA’s original purpose. The CFAA was created as a protection against hacking and other forms of Internet fraud. However, by broadening the scope of the statute to password sharing, hackers and lax or consenting citizens will be tried under the same law.
In a dissenting opinion, Circuit Judge Stephen Reinhardt asserts, “the Computer Fraud and Abuse Act does not make the millions of people who engage in this ubiquitous, useful, and generally harmless conduct into unwitting federal criminals…the majority repudiates important parts of Nosal I, jeopardizing most password sharing. It loses sight of the anti-hacking purpose of the CFAA, and despite our warning, threatens to criminalize all sorts of innocuous conduct engaged in daily by ordinary citizens.”
Reinhardt hits upon two critical issues: the increasingly widespread use of criminalization to deal with generally victimless transgressions as well as the subject of mens rea, or the intention or knowledge of wrongdoing that constitutes part of a crime.
U.S. laws and regulations now classify thousands of harmless activities as crimes, and this case may set the precedent for another widespread activity to become a criminal offense. Significant differences between criminal and civil or administrative law make the criminal justice system an overly blunt tool for regulating non-fraudulent business activities.
The crime and punishment model of criminal law logically applies to activities that are inherently wrong like murder, but creates problems when such benign activities such as password sharing become criminal offenses.
Beyond the questionable expansion of its reach, the CFAA carries heavy punishments with conviction. Someone who violates the CFAA can be sentenced to decades in prison and slapped with extensive fines. Does password sharing require such a draconian punishment? To say the punishment exceeds the crime is a drastic understatement.
Ignoring the Importance of Intent
With the overcriminalization of such a standard part of many Americans’ lives comes the issue of criminal intent. Every crime consists of two parts: the criminal act and criminal intent, also known as mens rea. Criminal intent is a central tenet of the American criminal justice system, as the “guilty mind” distinguishes an accident from a wrongful act that society has decided should be punished.
Do many Americans share their passwords with the intent of harming society or breaking a law? When the federal government creates thousands of criminal offenses out of minor activities (which it has), it becomes impossible for a citizen to know of them all.
The idea of someone being sentenced to decades in prison for sharing his Netflix account is terrifying. If the government can create such punishments for relatively innocent actions, it calls into question where and if they will stop creating criminal offenses.
The Nosal case created yet another potential federal criminal offense that implicates millions of Americans. This is part of a greater trend among federal lawmakers and judiciaries making overcriminalization and disregard for mens rea endemic. It is time for serious reform within the federal legal system, where the average Joe has become the average criminal.
