Defendant Charged with Wire Fraud for eBay Cookie Stuffing Scheme

February 9, 2010. The Department of Justice's (DOJ) Office of the U.S. Attorney for the Northern District of California (USAO/NDCal) charged Christopher Kennedy by criminal information [PDF] with one count of conspiracy to commit wire fraud in connection with his alleged creation and sale of a computer cookie stuffing program directed at eBay that enables users of the program to obtain referral income from eBay to which they are not entitled.

The information alleges that eBay compensates web site operators who place eBay advertisements in their web sites when internet users visit those web sites, click on the eBay advertisements, and then engage in a revenue transaction at the eBay web site. It further alleges that eBay tracks this through the use of cookie technology. However, the information alleges, Kennedy created a program that places cookies on visitors' computers that enable the program users to obtain referral revenue from eBay even when there has been no click on an eBay ad.

The information states that "eBay maintains an advertising and promotion program, known as the eBay Partner Program ("EPN"), through which website that display eBay advertisements are reimbursed for referrals. Under the EPN, eBay will pay a referral fee to an affiliate when an advertisement on that affiliate's website directs a web user to the eBay website. When that user accesses the eBay website, a text string of code ("cookie") is deposited on the user's computer. This cookie contains information identifying the referring website ("EPN ID") and may be used to track whether and when the user returns to the eBay website. A subsequent visit to the eBay website may result in payment of a referral fee if the user engages in a revenue action, which occurs when the user utilizes eBay's action service. If multiple cookies are present on the user's computer, which may occur if the user has clicked on several different advertisements before engaging in a revenue action, the most recently deposited cookie (and it corresponding affiliate website) will be credited for any revenue action. Many users of eBay's website without being referred by an affiliate and the revenue actions performed by such users do not result in a commission payment." (Parentheses in original.)

The information alleges that Kennedy "created" a "cookie stuffing" program titled "saucekit".

The information defines cookie stuffing as "the act of depositing a cookie containing an affiliate website's EPN ID onto an individual's computer without that individual having to click on an advertisement or link. Cookie-stuffing occurs when an individual visits an affiliate website or webpage, such as an eBay auction page, and without clicking on an advertisement or link (and in some cases, without ever seeing an advertisement), a cookie containing the affiliate website's EPN ID is placed onto the individual's computer. The cookie remains on that individual's computer for a period of time and, if that individual engages in a revenue action, eBay will credit the affiliate. As a result, eBay will pay referral fees to an affiliate, even though the individual who visited the affiliate website or webpage had not been referred to eBay by that website or webpage."

The information further alleges that Kennedy offered for sale over the internet the saucekit program.

There is no federal cookie stuffing statute.

The crime of conspiracy, which the information charges, is codified at 18 U.S.C. 371. The wire fraud statute, which is codified at 18 U.S.C. 1343, does not reference cookies, web technology, or the internet. It provides, in relevant part, as follows:

"Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both."

The information does not allege plain fraud, which is codified at 18 U.S.C. 1341.

Nor does the information allege violation of 18 U.S.C. 1030, which bans computer hacking, and unauthorized access to a protected computer system. Were the DOJ to bring a Section 1030 charge, the theory might be that the the web site operators who run the saucekit program on their web sites engage in unauthorized access to the computers of visitors to their web sites by placing cookies thereon that are designed to fool the eBay referral compensation program.

However, there are also reasons for not proceeding under Section 1030. First, there is the matter of proving lack of authority, or exceeding authority.

Second, in the case of access to non-governmental computers, under most subsections of Section 1030, the prosecution must prove acquisition of information from, damage to, or loss to, the protected computer. But, the protected computer owners suffer no loss or damage under this cookie stuffing scheme. Instead, eBay does. And, most provisions in Section 1030 do not criminalize conduct that only harms third parties, such as eBay.

However, subsection 1030(a)(4) provides that "Whoever ... knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ... shall be punished ..."

The OUSA declined to comment on the selection of charging statutes, the history of prosecutions for cookie stuffing schemes, or other questions put to it by TLJ. eBay did not promptly return a phone call from TLJ.