Who’s the bully?

What happened to Megan Meier, a girl in a small Missouri town west of St. Louis, was a 21st century parent’s nightmare. Befriended by a stranger online who purported to be a handsome 16-year-old boy, Megan wound up being rejected and abused in a heated exchange of messages on MySpace.com. She hanged herself in her bedroom closet, dying the following day, shortly before her 14th birthday. Many weeks later, Megan’s parents learned that the flirtatious 16-year-old was in fact an impostor created by a handful of people who lived within a few doors of their home -- including the mother of one of Megan’s former classmates.

Last week a federal grand jury in Los Angeles indicted that mother, Lori Drew, on a charge of conspiracy and three counts of unauthorized access to a computer. Yet as hard as it may be to feel sympathy for Drew, what the Justice Department has done should alarm anyone who uses the Internet. The legal theory underpinning this case could just as easily be used to attack other kinds of anonymous speech online, including whistle-blowing, or to enforce dubious contracts that websites impose unilaterally on their users.

The problems with this indictment start in Missouri, where local and state prosecutors could find no law that applied to Megan’s death in October 2006. An increasing number of states have laws against “cyber-bullying� or online harassment, but Missouri does not, at least not yet. After state authorities threw up their hands, the feds took up the case -- specifically, prosecutors in the U.S. attorney’s office in Los Angeles, which has jurisdiction over MySpace’s headquarters in Beverly Hills. They seized on a federal law that was designed to stop hackers from breaking into computers and stealing sensitive or valuable information, and persuaded the grand jury to apply those strictures to Drew’s alleged involvement in the hoax.

The indictment essentially treats MySpace as the victim and Megan as collateral damage. Drew and the unnamed co-conspirators -- reportedly, three girls who were 13 to 18 years old at the time -- are accused of violating not Megan’s rights but MySpace’s terms of service. These included prohibitions against creating fictitious profiles, sending abusive messages and soliciting personal information from minors. By that logic, criminal charges also could be brought against people who adopt fake identities online for good reason -- for example, to criticize their employers or hide themselves from abusive spouses.

Terms of service online are routinely breached, sometimes unwittingly, sometimes deliberately. Violations include checking work e-mail from home (most residential broadband services forbid business uses) and submitting fake personal information when posting comments online. If a terms-of-service violation were all it took to bring federal charges, overly zealous prosecutors would be in a position to indict just about anyone who used the Internet.

Megan’s story is tragic, and it’s easy to see why prosecutors might want to stretch federal law to fill the gap evidently left by the Missouri penal code. (In her defense, Drew has told authorities that she was simply trying to find out what rumors Megan might have been spreading about her daughter online, and that she had no direct involvement in the messages. One of the girls who participated in the alleged conspiracy has admitted to sending the last message to Megan, which said in part that “the world would be a better place without you in it.�) Nevertheless, the anti-hacking statute is a poor choice, and Los Angeles is the wrong venue.

State laws against cyber-bullying and other forms of harassment are designed to draw the line that separates death threats, stalking and other injurious behavior from deceptive but legal speech. It’s an important distinction that the federal statute ignores, and it shouldn’t be lost in the outrage over Megan’s death.