BY REBECCA STOCKEL

A law was passed in Tennessee this summer that makes the sharing of passwords to online entertainment subscription services a crime.[1] Effective July 1, 2011, “entertainment subscription services” joined Tennessee’s state Theft of Services statute, placing it on the same level of widely-recognized services, such as cable, mail, or telephone.[2]

It gives anyone standing to bring an action against an offender, as long as they are “directly or indirectly harmed” and places criminal liability on all offenders.[3] Thefts of up to $500 of subscription services are misdemeanor offenses.[4] Over the $500 threshold, violators will be indicted on felony charges, punishable by gradually increasing fines and jail time.[5]

Sponsors say that the purpose of this law is to target those who harvest passwords en masse for services such as Netflix, Rhapsody, and other online paid subscription services, and then sell those passwords for a profit.[6] They further state that this law will not be used to punish family members who casually share their passwords.[7]

So far, Tennessee is the only state in the U.S. with such a statute.  However, the Recording Industry Association of America (RIAA) is lobbying for national extension of the criminal penalties underlying this law.[8] In May of 2011, RIAA-backed legislation made it’s way into the United States Senate as S. 978, sponsored by a bipartisan U.S. Senate Judiciary Committee.9 The goal of the Senate bill makes “unauthorized web streaming of copyrighted content” a felony offense punishable by up to five years in prison.10 Ten instances of “public performances by electronic means” within six months or if the value of such performances is more than $2500 would be enough to constitute a criminal violation if this bill is signed into law.11

Certainly an argument can be made for laws like the one passed in Tennessee and the bill now in the Senate.  Our use and consumption of copyrighted materials is swiftly moving from traditional sources to digital sources.  Television and movies are streamed on paid sites like Netflix, where even after a drastic decrease in users, membership is still over 20 million.12

While preventing and punishing piracy is a reasonable goal of government, there is nothing in the new law, or any earlier versions, stating this goal, expressly limiting statutory reach, or even using the word “password.”  Many are worried that this, like statutes meant to prevent mass distribution of black boxes to steal cable, will be used to prosecute individual violators.  However, the Tennessee statute includes within its list of affirmative defenses the user’s honest belief that the owner of the password would have allowed him or her to use it.13

In the wake of the Tennessee law and the Senate bill, several questions are left unanswered.  Criminal liability for the sharing of streaming web services or the passwords to them could have serious consequences that may not address the problems these Bills were intended to address.  Many have called the Tennessee law “a solution in search of a problem.”14 Is there even a place for them?  Whose job is it to regulate these services?

Most Internet streaming services already have regulations in place to monitor account usage and prevent individual passwords from being used on more than a reasonable number of devices.  The Netflix Terms of Use state that account owners are responsible for the actions of those with whom they share their passwords.15 The Rhapsody End User License Agreement (EULA) prohibits account owners from allowing others to use the Rhapsody application.16 Therefore, a breach of contract action may be sufficient for punishing violators even in the absence of these laws.

Time will tell what impact the Tennessee law has on violators within that state, or if Congress passes a federal law.  Although unlikely that this will become a federal crime, if password sharing and unauthorized does extend to other states, it is prudent to consider the consequences now.