Sandvig v. Sessions

• Decision Date: 30 March 2018
• Docket Number: Civil Action No. 16–1368 (JDB)
• Parties: Christian W. SANDVIG, et al., Plaintiffs, v. Jefferson B. SESSIONS III, in his official capacity as Attorney General of the United States, Defendant.
• Court: U.S. District Court — District of Columbia

315 F.Supp.3d 1

Christian W. SANDVIG, et al., Plaintiffs,

v.Jefferson B. SESSIONS III, in his official capacity as Attorney General of the United States, Defendant.

Civil Action No. 16–1368 (JDB)

United States District Court, District of Columbia.

Signed March 30, 2018

Arthur B. Spitzer, Scott Michelman, American Civil Liberties Union of the District of Columbia, Washington, DC, Esha Bhandari, pro hac vice, Rachel Goodman, pro hac vice, New York, NY, for Plaintiffs.

John Russell Tyler, Serena Maya Schulz Orloff, Stephen J. Buckingham, U.S. Department of Justice, Washington, DC, for Defendant.

MEMORANDUM OPINION

JOHN D. BATES, United States District Judge

It's a dangerous business, reading the fine print. Nearly every website we visit features Terms of Service ("ToS"), those endless lists of dos and don'ts conjured up by lawyers to govern our conduct in cyberspace. They normally remain a perpetual click away at the bottom of every web page, or quickly scrolled past as we check the box stating that we agree to them. But to knowingly violate some of those terms, the Department of Justice tells us, could get one thrown in jail. This reading of federal law is a boon to prosecutors hoping to deter cybercrime. Yet it also creates a dilemma for those with more benign intentions. Plaintiffs in this case, for instance, are researchers who wish to find out whether websites engage in discrimination, but who have to violate certain ToS to do so. They have challenged the statute that they allege criminalizes their conduct, saying that it violates their free speech, petition, and due process rights. First, however, they must show that they have a sufficient injury to make it through the courthouse door, and that their suit is plausible enough to continue. For the following reasons, the Court finds that plaintiffs have standing, and that they can bring one (but not the rest) of their claims.

I. BACKGROUND

This case centers on a few sections of the Computer Fraud and Abuse Act (CFAA), a law dedicated to "deterring the criminal element from abusing computer technology." H.R. Rep. No. 98–894, at 4 (1984). Plaintiffs directly challenge one section, referred to here as the Access Provision, which sweeps in the greatest amount of conduct. The Access Provision states that "[w]hoever ... intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer ... shall be punished as provided in subsection (c) of this section." 18 U.S.C. § 1030(a)(2)(C). The CFAA defines "protected computer" to mean, among other things, "a computer ...which is used in or affecting interstate or foreign commerce or communication." Id. § 1030(e)(2)(B). This definition encompasses just about all computers hooked up to the Internet—including computers that house website servers. See, e.g., United States v. Nosal, 676 F.3d 854, 859 (9th Cir. 2012). The statute also defines "exceeds authorized access" as "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter." 18 U.S.C. § 1030(e)(6). Thus, the Access Provision applies to anyone who purposely accesses an Internet-connected computer without authorization, or uses a legitimate authorization to receive or change information that they are not supposed to, and thereby obtains information from the computer.

The CFAA provides for a fine and/or imprisonment for up to one year upon a first violation of the Access Provision, or up to ten years for any further offenses. Id. § 1030(c)(2)(A), (C). However, the punishment for an initial violation rises to a sentence of up to five years' imprisonment if the offense (1) "was committed for purposes of commercial advantage or private financial gain," (2) was "in furtherance of any criminal or tortious act in violation of the Constitution" or state or federal law, or (3) involved obtaining information valued at more than $5,000. Id. § 1030(c)(2)(B). Thus, meeting one of these three conditions makes a first violation a felony; if none are met, the first violation is a misdemeanor.

Plaintiffs in this case are four professors and a media organization: Christian W. Sandvig of the University of Michigan; Kyratso "Karrie" Karahalios of the University of Illinois; Alan Mislove of Northeastern University; Christopher "Christo" Wilson of Northeastern University; and First Look Media Works, Inc. ("Media Works"), which publishes the online news platform The Intercept. Compl. [ECF No. 1] ¶¶ 13–14, 16–17, 19. Plaintiffs are conducting studies to respond to new trends in real estate, finance, and employment transactions, which increasingly have been initiated on the Internet. Id. ¶¶ 15, 18, 55. Data brokers assemble consumers' information from myriad sources and place consumers into models that include racial, ethnic, socioeconomic, gender, and religious inferences about them. Id. ¶¶ 56–57. After brokers create consumer profiles, those profiles follow consumers around online through tracking technologies such as cookies. Id. ¶¶ 58–59. Tracking allows websites and advertisers to display content targeted at particular groups, based on consumers' inferred characteristics or the sorts of websites they visit. Id. ¶¶ 59–60. But plaintiffs are concerned, "[g]iven the ... history of racial discrimination in housing and employment," that this technology may be "harnessed for discriminatory purposes." Id. ¶ 61. They are also concerned that, "when algorithms automate decisions, there is a very real risk that those decisions will unintentionally have a prohibited discriminatory effect." Id. ¶ 62.

One way to determine whether members of protected classes are being discriminated against is to engage in "outcomes-based audit testing." Id. ¶ 67. Such testing commonly involves accessing a website or other network service repeatedly, generally by creating false or artificial user profiles, to see how websites respond to users who display characteristics attributed to certain races, genders, or other classes. Id. ¶ 70. This method is similar to classical paired testing procedures, in which multiple people—identical but for one legally protected trait—apply for the same house or job. Such procedures are often used to uncover violations of housing and employment discrimination laws in the physical world. Id. ¶¶ 41, 50, 52.

Plaintiffs plan to engage, and are engaging, in such audit testing. Sandvig and Karahalios are investigating whether computer programs that decide what to display on real estate websites discriminate against users based on race or other factors. Id. ¶ 82. They are writing a computer program that will create bots—automated agents that will each browse the Internet and interact with websites as a human user might. Id. ¶ 88. Each bot will create a number of distinct user profiles, each of which is called a "sock puppet." Id. ¶ 89. Sandvig and Karahalios will program the bots to visit real estate websites and search for properties, while also engaging in behaviors correlated with members of a particular race. Id. ¶¶ 90–91. Sandvig and Karahalios will use an automatic data recording technique known as scraping to record the properties that each bot sees on the real estate sites. Id. ¶¶ 90, 92. They can then examine their data to determine whether race-associated behaviors caused the sock puppets to see different sets of properties. Id. ¶ 93.

Similarly, Mislove and Wilson plan to conduct a study to see whether hiring websites' algorithms end up discriminating against job seekers based on protected statuses like race or gender. Id. ¶ 107. They will first use bots to crawl the profiles of a random selection of job-seekers to obtain baseline demographic data, then create fake employer profiles so that they can search for candidates and record how the algorithms rank those candidates.¹ Id. ¶¶ 114–17. They will also create fictitious sock-puppet job seeker profiles, and have the fictitious seekers—who will vary along different demographic axes—apply for fictitious jobs, to examine how the algorithms rank the candidates. Id. ¶¶ 118–19, 121–22. Mislove and Wilson will prevent real people from applying for the false jobs by giving them titles that say "[t]his is not a real job, do not apply," and will delete the fictitious accounts and jobs when they finish. Id. ¶ 120.

Media Works and its journalists seek to investigate online companies, websites, and platforms, including by examining any discriminatory effects of their use of algorithms. Id. ¶ 130.

Mislove and Wilson plan to publish their findings in academic papers, and to bring the results of their research to the public. Id. ¶ 123. Media Works intends to use the results of its journalistic investigations to inform the public about online business practices. Id. ¶ 132. Sandvig and Karahalios do not explicitly claim that they will publish their work, but state that their findings "would produce important new scientific knowledge about the operation of computer systems, discrimination, and cumulative disadvantage." Id. ¶ 94.

Plaintiffs are all aware that their activities will violate certain website ToS. Id. ¶¶ 95, 124, 131. All intend to use scraping to record data, which is banned by many of the websites plaintiffs seek to study. Id.; see id. ¶¶ 70–71. Many of the housing websites that Sandvig and Karahalios will study prohibit the use of bots. Id. ¶¶ 71, 95. All of the hiring websites that Mislove and Wilson will study prohibit the use of sock puppets, and most prohibit crawling. Id. ¶¶ 71, 124. Additionally, some websites control when and how visitors may speak about any information gained through the site—even in other forums—by including non-disparagement clauses in their ToS. Id. ¶ 72. Some sites also have ToS that require advance permission before using the sites for research purposes, which, plaintiffs allege, creates the possibility of viewpoint-discriminatory...