In 2006 Lori Drew, a resident of O’Fallon, Missouri, joined others in registering a MySpace profile for a fictitious sixteen-year-old boy named “Josh Evans” and posted a photograph of an actual boy without his knowledge or consent.
The conspirators used the profile to contact thirteen-year-old Megan Meier, a classmate of Drew’s daughter, and exchanged flirtatious messages for several days. On October 16, 2006, they sent a final message stating that “the world would be a better place without her in it.” Later that day, after learning of Megan’s suicide, Drew caused the Josh Evans account to be deleted.
MySpace required prospective members to check a box affirming agreement to its Terms of Service and Privacy Policy during registration. The full text of the terms appeared only after clicking a separate “Terms” hyperlink and was not mandatory reading. The 2006 Terms of Service prohibited providing false registration information, creating fake profiles, posting photographs without consent, and using the service for harassment or tortious activity. They also reserved to MySpace the unilateral right to restrict or terminate access for any reason. All member data and communications were stored on servers located in Los Angeles County, and every message sent between members was routed through those servers.
A three-count indictment charged Drew with one count of conspiracy and three counts of violating the felony provisions of the Computer Fraud and Abuse Act, 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(B)(ii), on the theory that creating and using the fake profile constituted accessing MySpace computers without authorization or in excess of authorization. At trial the jury received instructions on the lesser-included misdemeanor offense under 18 U.S.C. §§ 1030(a)(2)(C) and 1030(c)(2)(A). The jury deadlocked on the conspiracy count, acquitted Drew of the three felony CFAA counts, and convicted her of the three misdemeanor CFAA counts.
Drew thereafter moved under Federal Rule of Criminal Procedure 29(c) for judgment of acquittal, contending that the only evidence of unauthorized access was the deliberate violation of MySpace’s Terms of Service. The court heard testimony from MySpace’s Vice President of Customer Care describing the registration process, the content and enforcement of the terms, and the volume of accounts created daily, then took the motion under submission.
View case