Blog

You’ve really got to commend Michael Snow for his creative thinking. A few years ago, DirecTV sued Snow in Florida federal court, alleging that he had illegally intercepted DirecTV’s satellite signal. The case was dismissed, but Snow apparently held a grudge.

Not being satisfied with merely setting up a gripe site to air his grievances against DirecTV and so-called “corporate extortion,” Snow went a step further. He set up a “private support group” website for “individuals who have been, are being, or will be sued by any Corporate entity.” The language on the home page expressly forbade access “by DIRECTV and its agents.” To actually visit the site, you had to establish a username and password, and enter into a click-wrap agreement wherein you promised you had nothing to do with DirecTV.

Some employees of DirecTV as well as some attorneys from a couple of the firms that had represented DirecTV found Snow’s site and, notwithstanding the prohibition against their entry, signed up and went on in. After Snow discovered this “unauthorized” access, he filed suit against DirecTV and its law firms, alleging that the defendants had unlawfully accessed the stored web pages in violation of the Stored Communications Act, 18 U.S.C. §2701 et seq.

The U.S. District Court for the Middle District of Florida tossed out Snow’s suit on a motion to dismiss for failure to state a claim upon which relief could be granted. It held that the pages of the website were not “in electronic storage,” and thus could not be protected from unauthorized access under the Stored Communications Act. On appeal, the Eleventh Circuit affirmed the dismissal, but on different grounds.

The Electronic Communications Privacy Act provides that “[i]t shall not be unlawful . . . for any person – (1) to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.”

The court held that the way Snow had set up the entry page of his site was not sufficient to take it out of the class of electronic communications that are “readily accessible to the general public.” Apparently, the mechanism Snow had established to exclude certain people was too passive.

Unlike the case of Konop v. Hawaiian Airlines, Inc., 302 F.3d 868 (9th Cir. 2002), which was a case involving a site where users had to demonstrate knowledge not publicly available in order to gain access, Snow’s site employed a mere “self-screening methodology” by which “unintended users would voluntarily excuse themselves.” The court indicated that Snow needed a stronger safeguard than the honor-system method he used. “A short simple statement that the plaintiff screens the registrants before granting access may have been sufficient to infer that the website was not configured to be readily accessible to the general public.”

So the key seems to lie in the screening process. The case doesn’t provide a whole lot of guidance on what level of screening is necessary to make a site off-limits to the general public. Nonetheless, the holding of the case, along with the holding of Konop, seems to indicate that it’s easier from a legal standpoint to partition off a portion of the Internet for a specific crowd, rather than open it up to everyone while excluding just a few individuals.

Snow v. DirecTV, Inc., — F.3d —, 2006 WL 1493817 (11th Cir., June 1, 2006).

Joe Gratz has a great post on the case, and his blog (which is very interesting, by the way) is where I first learned of the decision.

You can almost literally hear the buzz from today’s California Court of Appeal ruling in the Apple v. Does case. The champagne is probably flowing at the EFF after the court’s holding that (for the time being) in California, web publishers (this probably includes bloggers) do not have to reveal their confidential sources when they get a news scoop.

Think back. When was the last time you got a secret e-mail from a company insider and posted it to your blog? It’s been awhile, right? So what does the case mean for the run-of-the-mill blogger or web publisher?

I say that the part of the case everyone’s all excited about really doesn’t mean that much.

There is a part of the case, however, that is quite relevant to everyday Internet users. The court gave a detailed analysis of how the federal Stored Communications Act (18 U.S.C. §§2701 – 2712) (“SCA”) requires e-mail messages saved on an ISP’s server to remain undisclosed in the face of a third party civil subpoena.

Here are the basics of the SCA analysis:

In 2004, someone at Apple Computer apparently sent a few e-mails containing confidential details of an unreleased Apple product to the publishers of some Mac enthusiast websites. The publishers of the sites posted the information about the anticipated product, thereby disclosing some of Apple’s trade secrets.

Apple filed suit, and naturally wanted to know who had leaked the information. It issued subpoenas to the e-mail service provider on whose server the surreptitious e-mails were stored, demanding to know the contents of the e-mail messages.

The web publishers asked the trial court for a protective order to prevent the disclosure of the messages, because they wanted to protect their confidential sources. The trial court denied the motion, however, because the publishers had involved themselves in the unlawful misappropriation of a trade secret.

On appeal, the publishers argued, among other things, that the e-mail service provider could not comply with the subpoena without violating the SCA. The Court of Appeal agreed, and reversed the trial court.

The SCA provides, in relevant part, that “a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service . . . .” It’s a fancy way of saying that an ISP can’t turn over server copies of e-mail messages. But like any good law enacted by Congress, there are some exceptions.

An ISP can turn over stored communications to a third party, for example, when doing so is “incidental to the protection of the rights or property of the service provider.” Apple argued that this exception should apply, and that the subpoena should be enforced, because failing to comply with the subpoena would subject the service provider to contempt proceedings, thus placing the provider’s property at risk. Read that sentence again. Yep, the court thought that was a circular argument too. And it made no effort to conceal the flaw in logic: “the antecedent assumes the consequents.”

Did you notice that I linked to Wikipedia just then? The court relied on Wikipedia as well in its opinion — no less than ten times! [More on Wikipedia and the courts.]

In any event, the court rejected Apple’s various arguments that the SCA would not prohibit disclosure of the stored e-mail messages. For example, it disagreed with Apple’s argument that there must be an implied exception in the SCA for disclosure of e-mail messages pursuant to a civil subpoena.

The court went on for several pages addressing this argument, analyzing the plain meaning of the SCA, and delving into the policy reasons for its enactment. It concluded that Congress “reasonably decide[d]” that email service providers are a “kind of data bailee to whom email is trusted for delivery and secure storage. . . .”

So at the end of the day, the case is no doubt interesting. Whether the heady First Amendment issues mean anything to the average blogger is not obvious. But the SCA part of the holding is at least refreshing, especially in light of all the other threats to personal privacy looming large recently.

There is plenty of commentary on this case out there already. Try Denise Howell, Joe Gratz, and the EFF for starters.

In early 2005, H&R Block noticed a strange new pattern. It began getting an unusual amount of bulk garnishment orders from defendant J&M Securities, a debt buyer, requiring H&R Block to withhold portions of some of its clients’ tax refunds. In light of the detail supporting the garnishment orders, Block believed that J&M “could not possibly have gathered Block’s clients’ income tax information … without improperly accessing and obtaining Block’s confidential information.”

Block filed suit against J&M, alleging several claims, including violations of the Electronic Communications Privacy Act (“ECPA”), 18 U.S.C. §§ 2701 and 2707. (This portion of the Wiretap Act is also commonly referred to as the Stored Communications Act.) J&M moved to dismiss, arguing, among other things, that H&R Block had failed to properly allege its claims under the ECPA. The court denied J&M’s motion to dismiss.

J&M had argued that Block should not be permitted to plead “access by inference” to the confidential stored communications. Applying the liberal pleading standards used in Federal litigation, the court held that Block had sufficiently placed J&M on notice that Block was alleging unauthorized access. The court went on to hold that “finding the fact of ‘access’ or ‘no access’ [was] a task for discovery, summary judgment, and trial.”

The court essentially instructed J&M how to argue a summary judgment motion it could file after discovery. It observed that “[J&M’s] best argument is that [Block] is not a provider of an ‘electronic communication service,’ and thus the ECPA does not regulate access to [Block’s] facility.”

In support of that observation, the court cited to the cases of In re JetBlue Airways Corp. Privacy Litigation, 379 F.Supp.2d 299 (E.D.N.Y. 2005), In re DoubleClick Inc. Privacy Litigation, 154 F.Supp.2d 497 (S.D.N.Y. 2001), and Crowley v. Cybersource Corp., 166 F.Supp.2d 1263 (N.D.Cal. 2001). Each of those cases indicated that a provider of web services is not the same as a provider of an electronic communication service.

Nonetheless, the court fell short of holding that Block was not a provider of an electronic communication service, concluding that such a holding would be “premature,” and would require “speculation about the nature of [Block’s] role in electronic communication.” The court denied the motion to dismiss as to the ECPA claim.

H&R Block Eastern Enterprises, Inc. v. J&M Securities, LLC, (Slip Op.) 2006 WL 1128744 (W.D. Mo., April 24, 2006).