On June 29, 2016, the American Civil Liberties Union filed a lawsuit against Loretta Lynch in her official capacity as the United States Attorney General to challenge the constitutionality of a provision of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030, et seq. in Sandvig v. Lynch, Civ. No. 1:16-cv-01368 (D.D.C. June 29, 2016).  The lawsuit is brought on behalf of several academics and a media organization, who argue that the current interpretation of CFAA by courts prohibits and chills their research efforts to identify discrimination on the Internet.   

As alleged by the ACLU in Sandvig,with the rise of big data analytics, more and more commercial websites are relying on confidential and proprietary algorithms to collect and track people’s data, cull the data, and use the results to determine access to services for their customers.  However, because the process of big data analytics is typically considered proprietary and confidential, Plaintiffs fear that the websites are secretly taking into consideration information that is leading to discrimination on the basis of race, gender, or other protected characteristics.  In order to test their theories, Plaintiffs want to conduct audit testing and investigations of online discrimination.  Audit testing is the practice of pairing individuals of different races to pose as potential users of the website to identify whether they are treated differently.  This practice has historically been used to identify potential civil rights abuses in the employment and housing context.

The Sandvig case arises because Plaintiffs’ investigatory techniques routinely violate a website’s terms of use, which some courts have found to be a violation of CFAA.  Under Section 1030(a)(2)(C) of CFAA, it is illegal to visit or access a website in a manner that “exceeds authorized access” of that website.  18 U.S.C. §1030(a)(2)(C).  The ACLU claims that courts have interpreted this to include a violation of a website’s terms of use.  (However, it appears that this interpretation varies across the federal district courts.)   Thus, the ACLU argues that this interpretation of CFAA is prohibiting and chilling Plaintiffs’ ability to research whether websites are discriminating against people on the basis of a protected characteristic. 

As a result, the ACLU on behalf of the Plaintiffs has brought claims alleging that this interpretation of the CFAA is a (1) violation of the First Amendment as an unconstitutional restriction on Plaintiffs’ protected speech activities; (2) violation of the First Amendment right to petition the government for redress or grievances regarding violations of the Fair Housing Act, Title VII, and other civil rights; (3) violation of the Fifth Amendment’s due process clause because the statute is vague; and (4) unconstitutional delegation of law-making authority to website owners.  The ACLU is seeking declaratory relief, asking the court to declare that CFAA on its face violates the United States Constitution as alleged above.  The ACLU also seeks injunctive relief to stop the Attorney General’s office from enforcing Section 1030(a)(2)(C) of CFAA. 

The concerns raised by the Plaintiffs and the ACLU in Sandvig regarding the potential discriminatory use of big data appear to be shared by the Federal Trade Commission (“FTC”).  On January 6, 2016, in advance of the FTC’s PrivacyCon conference, the FTC released a Commission Report entitled, Big Data: A Tool for Inclusion or Exclusion?  The Report was the result of an FTC public workshop and details the FTC’s concerns with what it characterizes as the “era of big data.”  The FTC’s report focused on how the commercial use of big data can impact low-income and underserved populations.  While the Report details the potentially positive impacts that these analytics can have, such as advancements in medicine, education, and health, it also outlines the many ways in which big data can be used to perpetuate existing disparities, such as making assumptions that deny individuals access to opportunities like credit based on analysis of non-traditional credit information (e.g., analysis of online shopping histories).  Accordingly, the FTC cautioned companies that collect, store, sell, and use big data to be mindful of how their activities could potentially result in discriminatory actions that could subject them to liability.