Our Best Weapon Against Revenge Porn: Copyright Law?

“Revenge is a kind of wild justice, which the more a man’s nature runs to, the more ought law to weed it out.” - Sir Francis Bacon

* * *

When federal agents arrested Hunter Moore last month, the Internet breathed a collective sigh of relief.

Dubbed the “Most Hated Man on the Internet,” Moore ran the notorious revenge porn website IsAnyoneUp. His site racked up millions of pageviews and thousands of dollars in advertising revenue by posting sexually explicit photographs and detailed personal information about the people he featured on the site.

According to the indictment, Moore relied on a co-defendant, Charles “Gary Jones” Evens, to hack into victims’ email accounts and obtain nude photographs to feature on IsAnyoneUp. The pair is charged with one count of conspiracy, seven counts of aggravated identity theft, and seven counts of “unauthorized access of a protected computer to obtain information.”

Moore allegedly obtained some of the photos through hacking, but bitter exes submitted many more.

The photos hosted by websites like IsAnyoneUp are often referred to as “revenge porn.” The phenomenon is surprisingly common: One in 10 former partners threaten to post sexually explicit images of their exes online, and an estimated 60 percent follow through. (It’s also worth mentioning that upwards of 80 percent of revenge porn victims are women.)

The harms caused by revenge porn websites are very real—people featured on these sites receive solicitations over social media, lose their jobs, or live in fear that their family and future employers will discover the photos.

The Origins of Revenge Porn

Moore may have been the “King of Revenge Porn,” but he wasn’t the first contender for the throne.

In 1980, someone at Hustler Magazine had the idea to start Beaver Hunt, a contest that published reader-submitted images of naked women. Beaver Hunt photos were often accompanied by details about the woman: her hobbies, her sexual fantasies, and sometimes her name. Some of the photos were stolen. Exes submitted many more.

Throughout the ’80s, women sued Hustler for publishing their photos in Beaver Hunt without their permission. Several courts determined that publishing intimate photos without verifying whether the pictured women actually gave the go-ahead gave the false impression that all of the featured women felt comfortable with their pictures appearing in a “coarse and sex-centered magazine.”

Revenge porn websites have adopted many of the features that made Beaver Hunt notable: showing off user-generated content, submitted without the pictured person’s consent or knowledge, flanked by personal information.

There is one important difference between a nude photo appearing on a website or in the pages of a print magazine. The impact of the photo, even one featured in a popular magazine like Hustler, was still constrained by the fact that it was bound in print. Pages of the magazine could be torn out or photocopied, but the likelihood of a prospective employer coming across a Beaver Hunt photo through happenstance was slim to none.

The likelihood of an employer Googling an applicant and following up on a hit from a porn website? Significantly more likely. Throw links, cross-postings, and email into the mix, and it becomes all the more certain that revenge porn will be discovered.

Problems with Preventing Revenge Porn

In many ways, the lawsuits pending against revenge porn websites echo the privacy suits brought against Beaver Hunt. So far, though, victims have had limited success going after revenge porn uploaders and websites.

It isn’t because existing laws aren’t applicable. Victims who are photographed without their knowledge can use state voyeurism or Peeping Tom laws. Victims whose photos were Photoshopped or whose names were linked to naked images of other people may be able to use defamation law. Because an estimated 40 percent of non-consensual pornography was obtained through hacking, those victims can rely on the civil provisions of the federal hacking law—the same one used to prosecute Moore.

So why haven’t all these sites been shut down?

Many of the lawsuits against revenge porn websites are for tort claims like stalking, harassment or invasion of privacy. The problem is that most stalking and harassment laws are not applicable to revenge porn submitters because there is no repeated course of conduct or direct communication with the victim. False light claims for invasion of privacy—like those alleged by women who were featured in Beaver Hunt without their knowledge—may be successful against submitters. However, these laws don’t provide victims with a way to take down cross-posted, cached or linked versions of their photos on other websites.

That would require additional injunctions against additional parties, and Section 230 of the Communications Decency Act renders most claims against websites dead on arrival.

Section 230 protects interactive service providers, or ISPs, from liability for user-generated content. That protection does not apply if an ISP is also an information content provider, meaning that the ISP hosts both original and user-generated content. Revenge porn websites aren’t creating the sexually explicit photos they post. In fact, more than 80 percent of revenge porn photos are “selfies.”

Getting rid of something like Section 230 may seem appealing—why shouldn’t revenge porn websites be held responsible for the salacious selfies they post?

Section 230 was enacted after Stratton Oakmont, the financial firm of The Wolf of Wall Street fame, won a defamation judgment against the early ISP Prodigy. Congress was worried that allowing ISPs to be held liable for user-generated content would crush the Internet. Even in the early ’90s, enough people were plugged into services like Prodigy and AOL that policing every piece of user-generated content would have been impossible.

As broad as it seems, Section 230 doesn’t give websites carte blanche to host any and all user-generated content—immunity does not apply to violations of child pornography, obscenity, criminal or intellectual property laws. Narrowing Section 230, or getting rid of it entirely, would allow victims to hold revenge porn websites responsible for the content they host. But it would also allow public figures to sue Wikipedia over misleading content or business to sue Yelp, in addition to individual reviewers, for libel based on negative reviews.

The Claims Against Moore

Moore is being charged with violating federal criminal laws that fit into existing Section 230 carve-outs. The most interesting charge in the indictment, though, is for “unauthorized access of a protected computer to obtain information” in violation of the Computer Fraud and Abuse Act (“CFAA”).

The CFAA has a troubled history. It was enacted in 1986 to criminalize threats to government computers’ security perpetrated by outsiders in response to the “realistic representation” of hacking portrayed by Matthew Broderick in the classic 80s film WarGames.

The CFAA is not a particularly well-drafted law, and prosecutors have taken advantage of its vagueness.

The broadest subsection of the CFAA, (a)(2)(c), criminalizes intentionally accessing a computer to obtain information “without authorization” or in some way that “exceeds authorization.” These terms—the same ones used by Congress in the eighties—are not defined anywhere in the statute. Prosecutors have used these murky terms to go after people who swap legitimate login credentials or violate Terms of Use policies. It’s the law that was used to prosecute Aaron Swartz and Chelsea Manning.

The indictment may only present one side of the story, but the allegations against Moore are pretty straightforward: according to the Department of Justice, he paid Evens to hack into email accounts and obtain nude photos. It’s the kind of crime Congress had in mind back in 1986. As TechDirt noted just after Moore’s arrest, the allegations against Moore look like a legitimate application of the law.

However, any CFAA case, even against someone like Hunter Moore, raises a red flag. Giving prosecutors as poorly drafted a law is like is like putting a wounded antelope in front of a lion—they can’t resist going for the jugular. Although activists have long called for CFAA reform, Congress has dragged its feet on whittling down the scope of the CFAA. Last year, Congress even introduced proposals to expand the CFAA, out of some fear that limitations make it harder for prosecutors to do their jobs.

Recently some states and activists have been pushing for new criminal laws to deal with revenge porn. (Only New Jersey, Alaska, and California have specific “revenge porn laws.”) But the problem isn’t that we don’t have enough criminal laws. We have plenty of laws. They just aren’t being used effectively. And given the history, new laws may create more problems than they solve.

Using Copyright to Combat Revenge Porn

When On The Media’s Bob Garfield asked Hunter Moore whether IsAnyoneUp violated copyright laws, Moore offered this ridiculous gem of a reply:

“[B]ut when you take a picture of yourself in the mirror, it was intended for somebody else so, actually, the person you sent the picture to actually owns that picture, because it was intended as a gift. So whatever the—that person does with the picture, you don’t even own the nude picture of yourself anymore … So that’s how I’m protected.”

Moore is dead wrong.

More than 80 percent of revenge porn photos are selfies, meaning that, as the “authors” of their selfies, the majority of victims own the copyright in their photos. Victims can use the takedown provisions Digital Millennium Copyright Act (“DMCA”) to de-index websites with their photos from search engines like Google and ask the websites themselves to remove the photos, all without having to hire a lawyer.

Why would a revenge porn website voluntarily comply with victims’ requests to remove the images?

The DMCA has a safe harbor provision similar to that of Section 230: If a website satisfies certain conditions, it’s protected from liability. If it doesn’t, it’s not. One of those DMCA conditions is complying with takedown requests. Revenge porn websites that ignore victims’ requests do so at their own peril—because Section 230 has a carve-out for copyright infringement, victims can hold websites liable for republishing their copyrighted photos to the tune of up to $150,000 per photo.

It certainly isn’t a perfect solution. Victims are likely to encounter the “whack-a-mole” problem that plagues traditional copyright holders. As soon as copyrighted content is removed from one place, it pops up in another. This phenomenon may be magnified by revenge porn. In an interview with Rolling Stone, Moore admitted that IsAnyoneUp was in the business of “ruining people’s lives with naked pictures”—takedown requests may have a Streisand effect on the photos by incentivizing websites to call out the victim or encouraging users to submit the photos to other websites.

But copyright avoids many of the problems with alternative. It doesn’t affect Section 230 protections, upset existing doctrine about stalking, harassment or privacy laws or rely on new criminal legislation that could affect free speech. An imprecisely drafted revenge porn law could be CFAA 2.0: well-meaning, but dangerously overbroad.

A successful prosecution of Moore could have incredible value for victims and activists. Victims will be able to point to Moore’s case as an example of how “revenge porn adjacent” crimes can be used to prosecute revenge porn traffickers under existing law. Activists will be able demonstrate to Congress that the behavior of truly reprehensible actors is already covered by the CFAA and would still be covered if the CFAA was reformed.

Not every angry ex who submits a photo to sites like IsAnyoneUp is violating federal law. And not every victim has the resources of a federal prosecutor. Copyright law doesn’t require either one—all a victim needs is a selfie.