Testing whether the web is discriminating against you shouldn’t be a crime

One of the great, tongue-in-cheek dreams of 1993 was that ‘on the internet, nobody knows you’re a dog.’ The increasingly overwhelming reality is that the internet knows exactly who you are and makes offers to you accordingly. If you’re a black user of Airbnb, it’s going to be harder to book a place to stay. If you’re an Apple user trying to book a vacation, Orbitz is going to steer you to pricier hotels. If you’re a woman, Google is going to show you ads for lower-paying jobs.

The best way for external researchers to figure out who’s getting the short end of the stick online is to create lots of different profiles on a site, with a range of different genders, races, and ages. But because of a law that dates back to 1986, that is technically illegal.

So, on Wednesday, the ACLU announced that it’s filing a lawsuit against the federal government claiming the 1986 anti-hacking law, which technically makes it illegal not to comply with a company’s terms of service, violates the First Amendment rights of academic researchers and journalists.

The lawsuit, Sandvig v. Lynch, filed in the U.S. District Court for the District of Columbia, takes aim at a section of the Computer Fraud and Abuse Act (CFAA) that criminalizes “exceeding authorized access” on a computer to obtain “information from any protected computer.”

The ACLU explains on its blog that courts have interpreted this as criminalizing violations of the Terms of Service that govern user relationships with the websites they visit. So if a researcher or journalist wants to perform research by, for example, setting up accounts under false names and using photos of others in order to test whether a service is discriminating on race, that could be considered illegal. Similar concerns have also been raised in the past about security research, but the ACLU’s current suit focuses on research on discrimination.

The ACLU is bringing the suit on behalf of four academic researchers, including Christian Sandvig, the University of Michigan professor who the case takes its name from, and the journalism organization First Look Media.

The lawsuit isn’t in response to any particular trouble a researcher has gotten into for doing this kind of research. But it claims that researchers are holding back from doing beneficial work because it’s technically illegal. Sandvig and another plaintiff, Kyratso Karahalios, are hoping to research discrimination on real estate websites by setting up profiles as various people of different races and seeing how that affects the listings shown to them by the website offers. The two other researcher plaintiffs, Alan Mislove and Christopher Wilson, hope to research how race is used as a factor for ranking candidates on hiring sites. First Look Media, which owns The Intercept, would like to scrape data as part of its investigations. All of those practices could be prosecuted under the CFAA.

This particular provision of CFAA is one of many that’s been harshly criticized. In 2013 law professor and author Tim Wu called it “the most outrageous criminal law you’ve never heard of.” It’s been criticized as being so broad that it could criminalize lying online . The CFAA is also the law the government used to prosecute internet activist Aaron Swartz, who committed suicide in January 2013. In April, journalist Matthew Keys was sentenced to two years in prison for violating the CFAA by helping Anonymous access a website owned by the Tribune Company (now known as tronc).

On much rarer occasions, parts of the law have been used for more worthwhile purposes, like the indictment of revenge porn purveyor Hunter Moore. Over opposition from some Democrats and tech activists, the Obama administration also suggested expanding the application of the CFAA in 2015.

The ACLU is right that the CFAA, and certainly the section of the law, has been repeatedly misread and abused. You can chalk that up to a litany of causes, including judges with a poor understanding of technology and, as the ACLU notes, corporations whose financial interests are best served by not having outside research on their practices conducted. Take Airbnb, which has had to answer questions about its racism problems, which have been documented in part through external, academic research involving the creation of fake profiles.

Whether this particular case will succeed, though, is kind of a dicey question. The suit relies on yet-to-be conducted research plans laid out by researchers, and a judge may see it as a publicity stunt and throw it away. The ACLU even says that this lawsuit is “the first step in this fight.” But the reality is it’ll likely be the first of many steps.

Ethan Chiel is a reporter for Fusion, writing mostly about the internet and technology. You can (and should) email him at [email protected]