The American Civil Liberties Union (ACLU) is suing the US Department of Justice over a law that it argues bars researchers from investigating whether software is being used to discriminate against people by race, gender and age.
The Computer Fraud and Abuse Act includes a clause that makes software and hardware makers’ terms of service legally enforceable, which the ACLU says can be used to hide illegal activity.
The act makes any “unauthorized access” to a computer illegal and prevents academics and researchers from testing a system by using aliases or fake IDs.
By allowing tech companies to essentially write legislation, the ACLU wrote in a complaint filed in Washington DC district court on Wednesday, the government allows those companies to chill research that has exposed systemic financial discrimination by using dummy accounts to test variables such as race, gender and age. Those accounts generally violate terms of service restrictions.
The complaint says that tests for fairness often involve a measure of dishonesty, especially when auditors want a truthful answer to questions of bias. In the offline world, pretending to want a job or a home to learn about discrimination is specifically legal. “This testing involves pairing individuals of different races to pose as home- or job-seekers to determine whether they are treated differently. The law has long protected such socially useful misrepresentation in the offline world,” according to the suit.
But online, say the plaintiffs, terms of service prohibit misrepresenting your identity. Moreover, terms of service change often enough and are obscure enough that ticking the little “I agree” box can let defendants in for a world of hurt if the Department of Justice deems them bad actors and decides to prosecute them.
And the issue has become more pressing as data brokers – organizations that compile huge troves of information about private citizens through their credit card statements, online activity and loyalty card purchases, among other means – have few qualms about making race-based inferences. According to a 2014 report from the Federal Trade Commission, data brokers often focus on “minority communities with lower incomes”, giving those communities names like “Urban Scramble” or “Mobile Mixers” which, the report says, “include a high concentration of Latino and African American consumers with low incomes”.
Provided to retailers, real estate brokers, employers and financial institutions, this kind of demographic breakdown enables discrimination, the ACLU argues.
“The problematic nature of this has been it raises problems for a whole host of parties not before the court,” said Esha Bhandari, staff attorney for the ACLU’s speech, privacy and technology project. “The government is given the discretion to use the CFAA to add on charges where they believe they’re prosecuting bad actors. But if the act of violating services is criminal under the CFAA, people we don’t consider bad actors are criminals.”
As the ACLU has begun to focus on data-mining practices, Bhandari said the organization has heard researchers express concern that by testing for discrimination, they are breaking the law.
Bhandari pointed to US v Drew, the 2013 case in which criminal charges were brought against an adult woman named Lori Drew, who messaged Megan Meier, a classmate of her daughter’s, using a false name on MySpace. Meier killed herself after receiving bullying messages from Drew; Drew was convicted of violating MySpace’s terms of service.
The Department of Justice’s prosecution of Drew, Bhandari said, had nothing to do with MySpace and everything to do with its low opinion of Meier, and the pursuit of the case endangered anyone trying to maintain their privacy on social media.
(Published by The Guardian - June 29, 2016)