Attorney Evan Brown

February 12, 2024 Copyright, DMCA, Litigation

DMCA subpoena to “mere conduit” ISP was improper

DMCA defamatory

Because ISP acted as a conduit for the transmission of material that allegedly infringed copyright, it fell under the DMCA safe harbor in 17 U.S.C. § 512(a), and therefore § 512(h) did not authorize the subpoena issued in the case.

Some copyright owners needed to find out who was anonymously infringing their works, so they issued a subpoena to the users’ internet service provider (Cox Communications) under the Digital Millennium Copyright Act’s (“DMCA”) at 17 U.S.C. § 512(h). After the ISP notified one of the anonymous users – referred to as John Doe in the case – of the subpoena, Doe filed a motion to quash. The magistrate judge recommended the subpoena be quashed, and the district judge accepted such recommendation.

Contours of the Safe Harbor

The court explained how the DMCA enables copyright owners to send subpoenas for the identification of alleged infringers, contingent upon providing a notification that meets specific criteria outlined in the DMCA. However, the DMCA also establishes safe harbors for Internet Service Providers (ISPs), notably exempting those acting as “mere conduits” of information, like in peer-to-peer (P2P) filesharing, from liability and thus from the obligations of the notice and takedown provisions found in other parts of the DMCA. This distinction has led courts, including the Eighth and D.C. Circuits, to conclude that subpoenas under § 512(h) cannot be used to compel ISPs, which do not store or directly handle the infringing material but merely transmit it, to reveal the identities of P2P infringers.

Who is in?

The copyright owners raised a number of objections to quashing the subpoena. Their primary concerns were with the court’s interpretation of the ISP’s role as merely a “conduit” in the alleged infringement, arguing that the ISP’s assignment of IP addresses constituted a form of linking to infringing material, thus meeting the DMCA’s notice requirements. They also disputed the court’s conclusion that the material in question could not be removed or access disabled by the ISP due to its nature of transmission, and they took issue with certain factual conclusions drawn without input from the parties involved. Additionally, the petitioners objected to the directive to return or destroy any information obtained through the subpoena, requesting that such measures apply only to the information related to the specific subscriber John Doe.

Conduits are.

Notwithstanding these various arguments, the court upheld the magistrate judge’s recommendation, agreeing that the subpoena issued to the ISP was invalid due to non-compliance with the notice provisions required by 17 U.S.C. § 512(c)(3)(A). The petitioners’ arguments, suggesting that the ISP’s assignment of IP addresses to users constituted a form of linking to infringing material under § 512(d), were rejected. The court clarified that in the context of P2P file sharing, IP addresses do not serve as “information location tools” as defined under § 512(d) and that the ISP’s role was limited to providing internet connectivity, aligning with the “mere conduit” provision under § 512(a). The court also dismissed the petitioners’ suggestion that the ISP could disable access to infringing material by null routing, emphasizing the distinction between disabling access to material and terminating a subscriber’s account, with the latter being a more severe action than what the DMCA authorizes. The court suggested that the petitioners could pursue the infringer’s identity through other legal avenues, such as a John Doe lawsuit, despite potential challenges highlighted by the petitioners.

In re: Subpoena of Internet Subscribers of Cox Communications, LLC and Coxcom LLC, 2024 WL 341069 (D. Hawaii, January 30, 2024)

February 7, 2024 Copyright

Not fair use after all – Fourth Circuit reverses lower court’s decision in online copyright infringement case

fair use

Plaintiff photographer sued defendant news website for copyright infringement over a photo of Ted Nugent that defendant used in an online article. The lower court granted summary judgment for defendant, finding that its use of the photo was fair use. Plaintiff sought review with the Fourth Circuit. On review, the court reversed, applying the factors set out in 17 U.S.C. § 107 in finding the use of the photo was not fair use.

For the first fair use factor, the court found that defendant’s use of the photo was not transformative and was commercial. This caused the factor to weigh against fair use. It looked to the recent Supreme Court case of Andy Warhol Found. for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508 (2023). The court noted that in a manner similar to what happened in the Warhol case, plaintiff took the photo of Ted Nugent to capture a “portrait” of him, and defendant used the photo to “depict” the musician. Accordingly, the two uses “shared substantially the same purpose.” The court actually found that defendant in this case had “less of a case” for transformative use than the Andy Warhol Foundation did, because unlike in Warhol, defendant did not alter or add new expression beyond cropping negative space. And though the article in which the photo appeared did not generate much revenue for defendant, the relevant question to determine commercial use was whether defendant stood to profit, not whether it actually did profit.

Though the district court did not address the second and third fair use factors, the appellate court looked at those factors, and found they did not support fair use. Looking at the nature of plaintiff’s photo, the court observed that plaintiff made several creative choices in capturing the photo, including angle of photography, exposure, composition, framing, location, and exact moment of creation. As for the third factor, the court found it to weigh against fair use because defendant copied a significant percentage of the photo, only cropping out negative space while keeping the photo’s expressive features.

Finally, the court also found that the fourth fair use factor weighed against fair use. The court concluded that if defendant’s unauthorized use became “uninterrupted and widespread,” it would adversely affect the potential market for the photo. It emphasized the notion of the potential market. In this case, there was at least one instance where plaintiff had allowed use of his photo for free, and he also made it available for free subject to a Creative Commons license, requiring attribution in return. But that did not change the outcome, given that he customarily licensed if for either money or attribution.

Philpot v. Independent Journal Review, — F.4th —, 2024 WL 442066 (4th Cir., February 6, 2024)

See also:

Ted Nugent photo by Republic Country Club, under this Creative Commons license. Changes made: frame expanded, image color modified and background enhanced using generative AI.

February 6, 2024 Computer Crime

Apple’s civil hacking lawsuit against software maker moves forward

apple hacking

Apple sued defendant NSO, accusing it of, among other things, the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (the “CFAA”), The case dealt with NSO’s creation and distribution of “Pegasus,” a piece of software Apple claimed was capable of covertly extracting information from virtually any mobile device.

Apple alleged NSO fabricated Apple IDs to gain access to Apple’s servers and launch attacks on consumer devices through a method known as “FORCEDENTRY.” This exploit, characterized as a “zero-click” attack, allowed NSO or its clients to infiltrate devices without the device owners’ knowledge or action. The repercussions for Apple were significant, as the company reportedly faced considerable expenses and damages in its efforts to counteract NSO’s activities. These efforts included the development and deployment of security measures and patches, as well as increased legal exposure.

Defendant moved to dismiss the claims. The court denied the motion.

In finding that Apple had properly pled the CFAA claim, the court noted that Apple’s allegations aligned with the anti-hacking intent of the CFAA. Despite NSO’s contention that the devices in question were not owned by Apple and thus not protected under the CFAA, the court observed that Apple’s claims extended to the exploitation of its own servers and services, fitting within the statute’s scope.

Apple Inc. v. NSO Group Technologies Ltd., 2024 WL 251448 (N.D. Cal. January 23, 2024)

February 5, 2024 Contracts

Online retailer’s browsewrap agreement was not enforceable

browsewrap

Plaintiff sued defendant Urban Outfitters under California law over the way that the retailer routed messages sent using the company’s website. Defendant moved to compel arbitration, arguing that the terms and conditions on defendant’s website required plaintiff to submit to arbitration instead of going to court. The court denied the motion.

The key issue in the case was whether plaintiff, by completing her purchases on defendant’s website, was sufficiently notified of and thus agreed to the arbitration agreement embedded via hyperlinks on the checkout page. Defendant maintained that the language and placement of the hyperlinks on the order page were adequate to inform plaintiff of the arbitration terms, which she implicitly agreed to by finalizing her purchases. Plaintiff argued that the hyperlinks were not conspicuous enough to alert her to the arbitration terms, thus negating her consent to them.

The court looked at the nature of the online agreement and whether plaintiff had adequate notice of the arbitration agreement, thereby consenting to its terms. The court’s discussion touched upon the differences between “clickwrap” and “browsewrap” agreements, emphasizing that the latter, which defendant’s website purportedly used, often fails to meet the threshold for constructive notice due to the lack of explicit acknowledgment required from the user.

The court examined the specifics of what constitutes sufficient notice, pointing out that for a user to be on inquiry notice, the terms must be presented in a way that a reasonable person would notice and understand that their actions (such as clicking a button) indicate agreement to those terms. The court found that defendant’s method of presenting the arbitration terms – through hyperlinks in small, grey font that were not sufficiently set apart from surrounding text – did not meet this standard.

Rocha v. Urban Outfitters, 2024 WL 393486 (N.D. Cal., February 1, 2024)

See also:

February 1, 2024 Fraud/Misrepresentation

Online marketplace not liable for causing murder committed by criminal seller

The Tenth Circuit Court of Appeals in Colorado upheld the dismissal of a tort case brought against the operator of the website Letgo. The court held that the website was not negligent and did not commit fraud in facilitating the purported transaction that resulted in the murder of a married couple.

The tragic story

At 11 PM on August 14, 2020, Mr. and Mrs. Roland met an execrable miscreant named Brown at a PETCO parking lot, intending to buy a car that Brown had placed for sale on the online marketplace Letgo. Claiming to not have the right title for the car (it turns out the car was stolen), Brown led the couple to a second location under the pretense of retrieving the correct vehicle title. But Brown ambushed the Rolands with a handgun, resulting in a struggle that led to the tragic deaths of both Mr. and Mrs. Roland, who left behind five minor children. Brown was later convicted of two counts of first-degree felony murder.

The estate sued

The Rolands’ estate sued Letgo under Colorado law, alleging a number of claims, including negligence, fraud and negligent misrepresentation. The lower court dismissed the claims. So the estate sought review with the Tenth Circuit. On appeal, the court affirmed the dismissal.

To act or not to act

The court’s negligence analysis turned on whether plaintiffs’ claim was one of misfeasance (active conduct causing injury) or nonfeasance (a failure to take positive steps to protect others from harm). The plaintiffs contended that Letgo’s claims of collaboration with law enforcement, use of technology to block stolen goods, and a user verification system created a false sense of security – that the negligence was based on misfeasance. But the court was not persuaded, emphasizing that the representations, when viewed in context, did not constitute misfeasance or active misconduct.

Instead, the court determined that the plaintiffs’ allegations were more indicative of nonfeasance, or Letgo’s failure to act, which required a special relationship between the parties for a duty of care to be established – a condition the plaintiffs could not satisfy. And in the court’s mind, even if Letgo’s actions were misfeasance, the plaintiffs failed to adequately plead that these actions were a substantial factor in the Rolands’ deaths, as the decisions made by the Rolands to pursue the transaction, and the decision of the perpetrator to commit murder, were more significant factors in the tragic outcome than the provision of the online platform.

No fraud or negligent misrepresentation either

Colorado law required plaintiffs to demonstrate a series of stringent criteria: Letgo must have made a false representation of a material fact, known to be false, with the intention that the Rolands would rely upon it, leading to damages as a result of this reliance. Negligent misrepresentation, while similar, necessitates showing that Letgo, within its professional capacity, made a careless misstatement of a crucial fact intended for the guidance of others in their business dealings, which the Rolands justifiably relied upon to their detriment.

Federal Rule of Civil Procedure 9(b) sets a higher bar for fraud claims, requiring plaintiffs to specify the circumstances of the alleged fraud with particularity, including the time, place, and content of the false representations, as well as the identity of those making them and the resultant consequences. This rule aims to provide defendants with fair notice of the claims against them and the factual basis for these claims. In certain cases, this standard may also extend to claims of negligent misrepresentation if they closely resemble allegations of fraud, highlighting the necessity for precise and detailed pleadings in such legal matters.

In this case, plaintiffs contended that Letgo’s assurances regarding safety and user verification —such as collaboration with law enforcement, technology to identify stolen goods, and “verified” user statuses — were misleading, constituting either fraud or negligent misrepresentation. However, the court found that plaintiffs failed to plausibly link the alleged misrepresentations to the tragic outcome, failing to provide sufficient factual content to demonstrate causation between Letgo’s actions and the Rolands’ deaths.

Roland v. Letgo, Inc., 2024 WL 372218 (10th Cir., February 1, 2024)

See also:

January 31, 2024 Contracts, Trade Secrets

Unauthorized press release caused drone software deal to crash

drone software

Usually back in the boilerplate section, technology contracts often contain a provision saying the parties will not issue press releases without the prior written consent of the other party. Here is a recent case where failure to strictly abide by such a requirement resulted in the breakdown of an important licensing arrangement, followed by expensive and difficult litigation.

An exciting drone software collaboration

Plaintiff entered into a software licensing agreement with defendant whereby plaintiff could use defendant’s avionics software for drones. The agreement gave plaintiff a limited exclusive license to certain functionality in the software.

The licensing agreement defined confidential information to include the terms of the agreement. The parties could not use any confidential information other than as required to exercise a right or perform an obligation under the agreement. The agreement also restricted the parties from issuing press releases without the other party’s prior written approval.

Fateful quick email exchange right before vacation

On a Sunday in August 2022, an employee of defendant wrote to defendant’s CEO, letting defendant know that plaintiff was developing a press release. The message concluded with, “Let me know if you have any objections, or if you want to send us a quote or have our PR team make a quote[.]”

Three minutes later the CEO wrote back with the following: “That sounds great. I’m on vacay all week up in the Adirondacks. You guys can make up some quote – I’m sure it will be fine or at least a great start.”

Going public with what should have stayed private

On Wednesday of that week – without further contact with defendant – plaintiff issued a press release discussing the parties’ relationship. The press release stated, in part, that under the terms of the software licensing agreement between the parties, the “software will only be made available to [plaintiff],” and that “[c]ompetitors will have to develop their own software or secure licenses from others with inferior test performance.”

On Friday (probably the last day of the CEO’s “vacay . . . up in the Adirondacks”), defendant sent a letter to plaintiff terminating the agreement. Defendant cited to a provision of the agreement enabling it to terminate immediately upon breach of the agreement’s confidentiality provision. The letter explained that plaintiff had issued the press release without defendant’s consent and that the press release included confidential information.

And then the lawsuit

Plaintiff sued, asserting breach of contract, namely, that defendant improperly declared the agreement terminated, and improperly ceased fulfilling its obligations under the agreement. Defendant moved to dismiss the claims. The court granted the motion.

Court: defendant had the right to terminate

The court found that it was “express and plain” that the definition of confidential information included the terms of the agreement. And when plaintiffs disclosed language from the agreement discussing the exclusive license, plaintiffs breached the agreement, giving defendant a right to terminate, which it exercised.

The court also rejected plaintiff’s argument that defendant’s CEO’s Sunday pre-vacation quick response email gave consent for the press release. The court found that rather than serving as approval of the press release that was issued, the consent the CEO provided was for the continued development of a press release and qualified permission to make up a quote for him as part of the development process. Moreover, the harms to defendant arising from plaintiff’s mischaracterization of the parties’ relationship were “precisely the effects that are avoided by requiring ‘prior written consent’ before publication of Confidential Information in a press release.”

Red Cat Holdings, Inc. v. Autonodyne LLC, 2024 WL 342515 (Del. Ch., January 30, 2024)

See also:

January 30, 2024 Artificial Intelligence, Litigation

ChatGPT providing fake case citations again – this time at the Second Circuit

Plaintiff sued defendant in federal court but the court eventually dismissed the case because plaintiff continued to fail to properly respond to defendant’s discovery requests. So plaintiff sought review with the Second Circuit Court of Appeals. On appeal, the court affirmed the dismissal, finding that plaintiff’s noncompliance in the lower court amounted to “sustained and willful intransigence in the face of repeated and explicit warnings from the court that the refusal to comply with court orders … would result in the dismissal of [the] action.”

But that was not the most intriguing or provocative part of the court’s opinion. The court also addressed the conduct of plaintiff’s lawyer, who admitted to using ChatGPT to help her write a brief before the appellate court. The AI assistance betrayed itself when the court noticed that the brief contained a non-existent case. Here’s the mythical citation: Matter of Bourguignon v. Coordinated Behavioral Health Servs., Inc., 114 A.D.3d 947 (3d Dep’t 2014).

When the court called her out on the legal hallucination, plaintiff’s attorney admitted to using ChatGPT, to which she was a “suscribed and paying member” but emphasized that she “did not cite any specific reasoning or decision from [the Bourguignon] case.” Unfortunately, counsel’s assertions did not blunt the court’s wrath.

“All counsel that appear before this Court are bound to exercise professional judgment and responsibility, and to comply with the Federal Rules of Civil Procedure,” read the court’s opinion as it began its rebuke. It reminded counsel that the rules of procedure impose a duty on attorneys to certify that they have conducted a reasonable inquiry and have determined that any papers filed with the court are legally tenable. “At the very least,” the court continued, attorneys must “read, and thereby confirm the existence and validity of, the legal authorities on which they rely.” Citing to a recent case involving a similar controversy, the court observed that “[a] fake opinion is not ‘existing law’ and citation to a fake opinion does not provide a non-frivolous ground for extending, modifying, or reversing existing law, or for establishing new law. An attempt to persuade a court or oppose an adversary by relying on fake opinions is an abuse of the adversary system.”

The court considered the matter so severe that it referred the attorney to the court’s Grievance Panel, for that panel to consider whether to refer the situation to the court’s Committee on Admissions and Grievances, which would have the power to revoke the attorney’s admission to practice before that court.

Park v. Kim, — F.4th —, 2024 WL 332478 (2d Cir. January 30, 2024)

See also:

January 29, 2024 Section 230

Zillow gets win in case alleging fraudulent online auction notices

section 230

Plaintiff sued Zillow and some other parties in federal court, claiming they engaged in a conspiracy to defraud her by illegally foreclosing on her home. She apparently claimed that Zillow “illegally” published information regarding the property at issue on its website, including listing it “for auction.”

Zillow moved to dismiss for failure to state a claim. The court granted the motion. It held that Section 230 (47 U.S.C. 230) immunized Zillow from liability. This statute immunizes providers of interactive computer services against liability arising from content created by third parties.

The court found that Zillow was an “interactive computer service,” demonstrated by how its website stated that it is “reimagining the traditional rules of real estate to make it easier than ever to move from one home to the next.”

It also found that plaintiff’s claims sought to hold Zillow liable for posting “auction notices”. But since the court did not believe plaintiff could demonstrate that Zillow developed or created this content, it found that plaintiff’s claims fell squarely within the purview of Section 230.

Choudhuri v. Specialised Loan Servicing, 2024 WL 308258 (N.D. Cal., January 26, 2024)

See also:

January 27, 2024 Computer Crime

Can one be liable for hacking by depositing fake checks into an ATM?

ATM fraud

If a person uses an ATM to deposit fraudulent checks, is the person liable for computer fraud? A recent criminal case answers that question, at least as far as Virginia state law would address the situation.

Depositing checks

Defendant deposited four checks at an ATM. These checks were later identified as forgeries or linked to a closed account, leading to the bank losing around $937. Security footage confirmed defendant’s involvement. During subsequent police interrogation, defendant acknowledged depositing the checks but denied knowing the man on whose account they were drawn, or the checks’ origins. At trial, she claimed her stepfather had given them to her, and that she believed he had earned them from construction work. Her mother supported this claim. The man on whose account the checks were drawn denied writing the checks, suspecting they were stolen from his truck.

Convicted for computer fraud, but…

At trial, defendant was convicted of multiple offenses, including uttering forged checks, obtaining money by false pretenses, computer fraud (under Virginia Code § 18.2-152.3), and failure to appear, resulting in a lengthy prison sentence. On appeal, a three-judge panel reversed her conviction for computer fraud, finding the evidence insufficient to show that the she acted “without authority” in using the ATM do deposit the checks.

The appellate court saw it differently

The government asked the court to reconsider the question en banc (i.e., with the full court, not just the three judge panel). The full court likewise determined the conviction for computer fraud should be reversed.

The court held that the term “without authority” in the statute specifically pertained to the use of a computer or network, not necessarily the intent or outcome of such use. It concluded that defendant, as a bank customer, had the right to use the ATM. Her actions, albeit for fraudulent purposes, did not equate to using the ATM without authority. Accordingly, the court reversed her conviction for computer fraud, differentiating between the unlawful purpose of an action and the unauthorized use of a computer or network as defined by the statute.

Wallace v. Commonwealth, — S.E.2d —, 2024 WL 236297 (Ct. App. Va., January 23, 2024) [Link to Opinion]

See also:

January 26, 2024 Contracts, Litigation

Click to Agree: Online clickwrap agreements steered bank lawsuit to arbitration

online terms and conditions

Plaintiffs sued their bank alleging various claims under state law. The bank moved to compel arbitration based on various online clickwrap agreements plaintiffs had entered into.

One of the clickwrap agreements required plaintiffs to scroll through the entire agreement and then click an “Acknowledge” button before continuing to the next step. Citing to the case of Meyer v. Uber, 868 F.3d 66 (2d Cir. 2017), the court observed that “[c]ourts routinely uphold clickwrap agreements for the principal reason that the user has affirmatively assented to the terms of agreement by clicking ‘I agree.'”

Similarly, for the other relevant agreements, plaintiffs were required to click a box acknowledging that they agreed to those agreements before they could obtain access to digital products. Again, citing to the Meyer case: “A reasonable user would know that by clicking the registration button, he was agreeing to the terms and conditions accessible via the hyperlink, whether he clicked on the hyperlink or not.” By affirmatively clicking the acknowledgement, plaintiffs manifested their assent to the terms of the these agreements.

Curtis v. JPMorgan Chase Bank, N.A., 2024 WL 283474 (S.D.N.Y., January 25, 2024)

See also: