Rogue professor's case has potentially significant implications for the First Amendment and online privacy

A professor violates the terms of service to go onto a platform or a website. Once there, he unleashes bots that crawl all over and scrape the data viewable there.

You might think this is a nightmare privacy scenario akin to the one in which the researcher Aleksandr Kogan scraped Facebook Inc. data that he later sold to Cambridge Analytica. And you might think the professor's actions should be prosecuted.

But a federal district court in Washington has just held that it's a professor's First Amendment right to break a site's rules to collect data available there -- and that the Computer Fraud and Abuse Act can't criminalize the conduct.

The consequences are potentially vast. In an important test case brought and won by the American Civil Liberties Union, the court made some fascinating and highly controversial new law.

Depending on how broadly it is interpreted, and what the U.S. Court of Appeals for the D.C. Circuit does with it on appeal, the court's decision could make it difficult or even impossible to prosecute conduct like Kogan's under existing federal law.

The plaintiffs in the case, Sandvig v. Sessions, aren't nefarious. They're scholars plus a media organization, the Intercept, who say they are trying to identify and understand how prejudice works in the age of algorithms and data gathering. Their aim is to "audit" entities that use online data to create profiles of people they target for real estate advertising or employment offers. Their preferred technique is to create false user accounts that cruise the web, attracting the attention of advertisers, in the hopes of determining whether characteristics associated with race change the ways the advertisers act.

To make the technique work, the professors have to go beyond creating false users. They also need to gather data. That's where crawling and scraping come in. "Crawling" online means sending bots all over a website or platform to record its contours. "Scraping" means gathering and reporting any accessible data, which is to say any data that the website or platform allows its users to access.

The trouble is that websites and platforms don't want false-name users, and they don't want bots crawling over them and scraping data. So the sites require users to agree to their terms of service, promising to use their real names and not to crawl and scrape. To do the research, the professors have to break the rules set by the terms of service.

Legally speaking, terms of service are a civil contract. Breaching a contract isn't a crime. If you violate the terms of service, ordinarily the most a platform or website can do is boot you off and bar you in the future.

The possibility of criminal prosecution arises from the CFAA. That law criminalizes anyone who "intentionally accesses a computer without authorization" or "exceeds authorized access" once using it. The federal courts are not entirely in agreement about what this means. But at a minimum, it would seem to cover using a false username in violation of terms of service to access a site or platform. Conceivably it might extend to other terms of service violations, such as unleashing bots, crawling and scraping.

The professors haven't been charged. They proactively went to the federal court to ask that it find their conduct to be protected by the First Amendment.

The court's holding is extremely complicated. To simplify, it has two major components, both highly significant -- and both possibly incorrect.

First, the court said that the First Amendment category of "public forum," where the government essentially cannot restrict speech absent a compelling interest, applies to platforms that allow access to anyone who creates an account, like most social media sites. "Placing contractual conditions on accounts that anyone can create," the court said, "does not remove the website from the First Amendment protections of the public Internet."

Taken literally, this holding is a very big deal. Although the court's opinion only technically applies to situations where the government criminalizes breaking the terms of service, the idea that you have First Amendment protection of any kind on a social media site is almost unprecedented. It's worrisome news for social media platforms that want to be able to enforce their decisions about who can use their sites and what they can say there. (Disclosure: I have advised Facebook on free expression and governance.)

Relying on this idea, the court said that the CFAA would not prohibit scraping data from a platform or website -- because anyone scraping would only be gathering and recording information that was publicly available.

Of course, from the standpoint of the platform, the opposite is true: The data is ordinarily only supposed to be viewable to users who have agreed to the terms of service, which prohibit scraping. That's not public, at least not the ordinary sense of the term.

Second, the court held that the professors could go forward with their claim that the First Amendment protects them from criminal prosecution for accessing sites using false usernames, in violation of the terms of service. The court expressed its openness to the conclusion that the First Amendment right to lie when you aren't doing any concrete harm would apply to the professors' research.

This part of the opinion matters for the Cambridge Analytica situation. To be sure, it could be argued that Kogan intended to do harm when he accessed Facebook users' data, because he intended to sell the data. (Kogan says he gathered the data originally as an academic project before being approached by an affiliate of Cambridge Analytica.) But the sale of the data to a for-profit company wasn't a violation of any criminal law. It was just a violation of the contract Kogan made with Facebook. And the professors in the test case also violated a contract with the platform, namely the terms of service.

The only crime Kogan could easily be charged with in the U.S. would be a CFAA violation. But if that were to happen, his lawyers could now point to the new precedent to say that there is a First Amendment right to be free of prosecution for violating the terms of service and scraping data.

What's more, the decision will make it harder to pass new laws to protect user privacy by prohibiting conduct like Kogan's. If data visible to users under terms of service are in fact part of a public forum, the government restrictions on who can gather that data would be subject to the highest level of First Amendment scrutiny.

In this case, a putative victory for free speech may have come at the expense of privacy. And in the era of Cambridge Analytica, that balance needs much more attention before we conclude that it is enshrined in the Constitution.

Comment by clicking here.

Noah Feldman, a Bloomberg View columnist, is a professor of constitutional and international law at Harvard University and the author of six books, most recently "Cool War: The Future of Global Competition."