privacy – Page 9 – Attorney Evan Brown

September 30, 2010 Computer Crime, Privacy

Divorce attorney did not conspire to violate the Electronic Communications Privacy Act

Court declines to recognize secondary liability for civil ECPA violation, holding that defendant’s divorce lawyer could not be a conspirator in a civil action alleging email interception.

Garback v. Lossing, 2010 WL 3733971 (E.D.Mich. September 20, 2010)

Plaintiff sued his ex-wife’s attorney for violation of the Electronic Communications Privacy Act. He claimed that his ex-wife, her attorney and some other defendants (including a computer forensics firm) acted together to violate the ECPA by “hacking” into plaintiff’s email account. The ex-wife allegedly used information gathered in this process to negotiate a more favorable divorce settlement.

The defendant attorney moved to dismiss for failure to state a claim upon which relief may be granted. The court granted the motion.

The court found that in plaintiff’s “inartful” pleading, he had failed to allege that the defendant attorney had actually intercepted or knowingly used information obtained in violation of the ECPA. Plaintiff argued that this failure was not fatal, however, in that he had alleged that the defendant attorney conspired to intercept emails.

Rejecting this argument, the court observed that “normally federal courts refrain from creating secondary liability that is not specified by statute.” Finding no textual support in the ECPA for such secondary liability, the court declined to read ECPA’s scope so expansively. The court found the statute as being clear on who may be liable: those who intercept communications and those who get ahold of those communications knowing they were illegally obtained. So the ECPA claim failed and plaintiff was given leave to replead.

September 27, 2010 Computer Crime, Privacy

Doctor’s wiretapping case under ECPA heads to trial

McCann v. Iroquois Memorial Hospital, No. 08-3420 (7th Cir. September 13, 2010)

Mystery of how doctor’s dictation machine got turned on to record conversation between doctor and hospital employee is a question for the jury and should not have been decided on summary judgment.

Two hospital employees — Dr. Lindberg and the director of physician services, Ms. McCann — had a conversation behind the doctor’s closed office door that the two of them thought was private. In their conversation, the two of them criticized hospital administration. But they did not know that the doctor’s dictation machine was recording what they said.

: Image via Wikipedia

How that machine got turned on is a mystery. Dr. Lindberg had been dictating radiology reports a few minutes before Ms. McCann arrived, so he may have accidentally left the machine running. But the recording of the conversation started in mid-sentence, which discredits that theory.

A member of the hospital’s transcription staff, Ms. Freed, is alleged to have come into the room during this conversation to pick up some papers, and Dr. Lindberg and Ms. McCann believe she surreptitiously turned on the machine. That would seem a plausible explanation, given that Ms. Freed supposedly had an axe to grind with Dr. Lindberg.

The recorded conversation made its way to the transcription staff, and after it was typed out, Ms. Freed forwarded it to the hospital’s CEO. Dr. Lindberg and Ms. McCann filed suit against Ms. Freed and others under the Electronic Communications Privacy Act. They claimed that by secretly turning on the dictation machine and forwarding the transcript, Ms. Freed violated the statute.

The district court granted the defendants’ motion for summary judgment. Plaintiffs sought review with the Seventh Circuit. On appeal, the court reversed in part, finding there was a genuine issue of material fact as to whether Ms. Freed was in the room and secretly turned on the dictation machine.

The court of appeals held that whether Ms. Freed was in the office on the date the recording was made was merely the subject of a “swearing contest,” and that summary judgment is not appropriate to resolve such a contest. The lower court had based its grant of summary judgment largely on the contents of the recording. At the end of the conversation, one can hear the office door close as Ms. McCann leaves. But one cannot hear the door shut with Ms. Freed would have left, during the conversation and after she allegedly turned on the dictation machine.

Viewing the facts in the light most favorable to the plaintiffs, the court found that the absence of such a sound did not prove that Ms. Freed was not there: “[N]othing in the record tells us whether the door could have been closed silently; . . . [Ms.] Freed who was conscious that she was intruding (and, perhaps, that she was being taped) may have closed the door softly to be inconspicuous.”

So the court found that whether Ms. Freed was responsible for making the recording — and by extension whether Ms. Freed intentionally intercepted the conversation between Dr. Lindberg and Ms. McCann in violation of the ECPA — was an issue for the jury, and not one for summary judgment.

September 25, 2010 Privacy

Court: privacy on social networking sites is wishful thinking

Defendant is permitted access to plaintiff’s social networking accounts as part of discovery in personal injury case.

Romano v. Steelcase Inc., — N.Y.S.2d —, 2010 WL 3703242 (N.Y.Sup. September 21, 2010)

Plaintiff sued defendant for personal injury that allegedly caused her to lose her enjoyment of life. During discovery, plaintiff refused to voluntarily turn over the contents of her Myspace and Facebook accounts. So defendant filed a motion to compel plaintiff to consent to having Facebook and MySpace turn over all current and deleted content from the accounts. (That consent was necessary because without it, the sites would violate the Stored Communications Act.) The court granted the motion to compel.

The court found that the information contained in the profiles was “material and necessary” to the case. In drawing its conclusion, the court dispensed with any notion that a user’s privacy settings should affect the analysis. Denying defendant access to the information, the court found, would not only go against New York’s policy favoring liberal discovery, but “would condone Plaintiff’s attempt to hide relevant information behind self-regulated privacy settings.” Plaintiff had put her physical condition at issue, so it was fair for defendant to get evidence that may contradict the assertions of injury.

The court rejected plaintiff’s argument that disclosure of the information would violate her right to privacy under the Fourth Amendment. Fatal to any assertion of privacy was the fact that plaintiff had voluntarily made her information available on the sites. The court looked to earlier New York cases dealing with email to find that plaintiff had no expectation of privacy in the social networking data.

And the court made a sweeping declaration about the state of online privacy that is worth noting. Quoting from a law review article, the court observed that in the social media environment, “privacy is no longer grounded in reasonable expectations, but rather in some theoretical protocol better known as wishful thinking.”

September 23, 2010 Computer Crime, Privacy

Lack of knowledge of interception causes ECPA claims against website owners to fail

Zinna v. Cook, No. 06-1733, 2010 WL 3604386 (D. Colo. September 7, 2010)

Plaintiff sued for violation of the Electronic Communications Privacy Act (ECPA) claiming that defendants intercepted his email messages and posted them to a website called ColoradoWackoExposed.com. Defendants moved for summary judgment. The court granted the motion.

It found that although similarities between messages and website content suggested that emails had been intercepted, there was no evidence showing the interception was “contemporaneous” with the messages’ transmission. (Several federal circuits require such contemporaneity. But see the Seventh Circuit’s recent opinion in U.S. v. Szymuszkiewicz for a different take.)

The court also held there was insufficient evidence to show that defendants knew the information posted on the website came about via any unlawful interception. The plaintiff’s assertions that defendants had worked with a non-party wiretapper failed to convince the court of this knowledge.

June 17, 2010 Anonymity, Electronic Discovery, Privacy

Illinois court sets standard for unmasking anonymous commenters

Maxon v. Ottawa Pub. Co., — N.E.2d —, 2010 WL 2245065 (Ill.App. 3 Dist. June 1, 2010)

The rules of civil procedure in Illinois permit an aggrieved party to file a petition with the court asking for an order requiring unknown potential defendants to be identified. This is called a Rule 224 petition.

A couple from Ottawa, Illinois got their feelings hurt over some anonymous comments left in response to content published by the local newspaper on its website. Wanting to sue for defamation, the couple filed a Rule 224 petition. The newspaper opposed the petition. (For something similar, see Enterline v. Pocono Medical Center.)

The trial court denied the petition, applying the standards articulated in Dendrite v. Doe and Doe v. Cahill, finding that the petitioners had not presented a strong enough case for defamation to justify the unmasking of the anonymous commenters. Those cases require, among other things, that a party seeking to identify an anonymous speaker make efforts to notify the anonymous party, and present enough evidence to establish a prima facie case of defamation (Dendrite) or survive a hypothetical motion for summary judgment (Cahill).

The aggrieved couple sought review with the Appellate Court of Illinois. Reviewing the decision to deny the Rule 224 petition de novo, the court reversed and remanded, ordering the identification of the anonymous speakers to be made.

In reaching its decision, the court rejected the newspaper’s (and amicis’) arguments that the trial court should apply the rigorous standards of Dendrite and Cahill. That’s not to say, however, that the court left anonymous speakers at great risk of having their First Amendment rights trampled upon.

The court held that the mechanics of Rule 224 adequately protect the potential First Amendment rights of anonymous internet speakers. Here’s why, according to the court:

The petition must be verified – the threat of the pain of perjury should keep out half-hearted claims.
The petition must state the reason discovery is necessary.
The discovery is limited only to learning the identity of the potential defendant.
Most importantly, before the discovery will be permitted, the court must hold a hearing and determine the petition sufficiently states a cause of action.

In this fourth step, the court is to apply the standard it would apply in a Section 2-615 motion. Such a motion is, essentially, the Illinois version of a motion to dismiss for failure to state a claim. That is no insignificant test, because unlike federal court and other state jurisdictions, Illinois requires fact pleading. That means the petition needs to include a significant amount of specific information to survive the motion to dismiss.

A troubling aspect of the ruling is the omission from the test of a requirement that the party seeking discovery attempt to notify the anonymous target of the inquisition. The appellate court held that a trial court may, in its discretion, impose such a requirement.

But it would be nice to know that the real party whose First Amendment interests are at stake (the anonymous speaker) is guaranteed a fair opportunity to argue from his or her perspective. After all, it’s that party with the real incentive to do so. Let’s hope the trial courts exercise that discretion wisely (and that they know in the first place that they have that discretion).

Photo courtesy Flickr user TheTruthAbout… under this Creative Commons license.

June 15, 2010 Computer Crime, Privacy

Access to private email server supports Stored Communications Act claims

Devine v. Kapasi, 2010 WL 2293461 (N.D. Ill. June 7, 2010)

Kapasi and Devine were equal shareholders in a corporation. In August 2009, the two decided to part ways. The corporation transferred one of its servers to Devine, and he immediately put it into the service of his new company.

After the server was transferred, Kapasi and some employees of the old company allegedly logged on to the server to access and delete email messages stored on that machine. Devine and his new company sued for violation of the Stored Communications Act (at 18 U.S.C. §2701) and the Computer Fraud and Abuse Act (at 18 U.S.C. §1030).

The defendants moved to dismiss under FRCP 12(b)(6) for failure to state a claim. The court denied the motion as to the Stored Communications Act claims but granted the motion (with leave to amend) as to the Computer Fraud and Abuse Act claims.

The Stored Communications Act claims

The defendants argued that the Stored Communications Act did not apply to access to the server because plaintiffs did not provide an electronic communications service to the public. Defendants relied on the case of Andersen Consulting LLP v. UOP, 991 F.Supp. 1041 (N.D.Il.1998) to support this argument. In that case, the court dismissed a Stored Communications Act claim for unauthorized disclosure of emails under 18 U.S.C. §2702. The Andersen Consulting court held that disclosure of emails obtained from the server of a company not in the business of providing electronic communications services to the public did not violate the Stored Communications Act.

This case, however, arose under 18 U.S.C. §2701, which does not impose the same scope on potential defendants – the term “to the public” does not appear in connection with the provision of electronic communication services in §2701. Section 2701 deals with unauthorized access, while §2702 deals with unauthorized disclosure.

So the court held that “[w]here, as here, a plaintiff pleads that it stores electronic communications on its own systems, and that a defendant intentionally and without authorization got hold of those stored communications through the plaintiff’s electronic facilities, the plaintiff states a claim under § 2701 of the [Stored Communications Act].”

The Computer Fraud and Abuse Act claims

The court dismissed the Computer Fraud and Abuse Act claims, finding that the plaintiffs failed to plead that they suffered a cognizable “loss” under the statute. The plaintiffs were required to plead that the defendants’ conduct “caused . . . loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in value.” Such allegations were simply missing from the complaint.

The defendants tried an interesting argument that the court rejected as premature at the motion to dismiss stage. They argued that since one of the plaintiffs was a technology company, it should have had a backup of all the data allegedly deleted. Therefore, any cost in excess of the $5,000 statutory threshold would not be a “reasonable cost.” Though it didn’t fly at the motion to dismiss stage, such an argument may fare better in a motion for summary judgment.

Photo courtesy Flickr user Jordiet under this Creative Commons License.

May 4, 2010 Computer Crime, Employment, Privacy

Judge: the concept of internet privacy is a fallacy upon which no one should rely

People v. Klapper, — N.Y.S.2d —, 2010 WL 1704796 (N.Y.City Crim.Ct., April 28, 2010)

Let’s hope that’s an overstatement.

A recent case from a criminal court in New York dealt with whether an employer violated the state’s law prohibiting unauthorized use of a computer (Penal Law 156.05). Though the court probably came to the right decision in dismissing the case, it said some puzzling things along the way about internet privacy.

The defendant-boss was alleged to have installed keylogging software on his employee’s work-issued computer. Through those means he acquired the password for the employee’s “personal” email account, and copied some messages from that account.

The court dismissed the case, finding that the prosecution had not alleged that defendant, the computer owner, had notice of any limited access to the computer or the email account. (After all, it was the employer’s computer.) The allegations further failed to allege that the employee had installed a security device to prevent unauthorized access or use.

That last part is a bit puzzling (wouldn’t the password protection on the “personal” email account satisfy that point?). But the real puzzling part of the opinion is how the court essentially destroyed the idea that there’s any hope for an expectation of privacy in internet communications.

Here’s the first paragraph of the opinion:

In this day of wide dissemination of thoughts and messages through transmissions which are vulnerable to interception and readable by unintended parties, armed with software, spyware, viruses and cookies spreading capacity; the concept of internet privacy is a fallacy upon which no one should rely.

Apart from grossly overstating the death of a reasonable expectation of privacy in internet communications, the pronouncement was not needed to dispose of the case. The matter only dealt tangentially with whether the victim had any privacy rights violated. The real analysis was on whether the defendant had notice that access to his employee’s email account was unauthorized.

Though the court was correct on focusing its analysis on that point, i.e., whether the access was authorized, the more general obituary of internet privacy would seem to elminate the need for that proper analysis.

If there’s no internet privacy, why should we even bother to ask ourselves whether access to an account is authorized? If the concept of internet privacy is a “fallacy,” as the court declared, aren’t all our communications open for inspection and review by anyone?

Privacy photo courtesy Flickr user rpongsaj under this Creative Commons license.

March 31, 2010 Electronic Discovery, Employment, Litigation, Privacy

Emails sent through Yahoo account using work computer protected under attorney-client privilege

The New Jersey supreme court has held that emails an employee sent to her lawyer using her company-issued computer and a personal Yahoo account are protected by the attorney-client privilege.

Stengart v. Loving Care Agency, Inc., — A.2d —, 2010 WL 1189458 (N.J. March 30, 2010)

The New Jersey courts have a reputation of being protective of “informational privacy.” See, e.g., State v. Reid. A recent decision concerning employee privacy in personal emails adds to that reputation.

Plaintiff-employee used a work-issued laptop to access her Yahoo email account, through which she communicated with her lawyer about her lawsuit against the employer. During the discovery phase of that employment discrimination lawsuit, the employer used computer forensics to recover those Yahoo emails that had been copied to the computer’s temporary internet files folder.

Counsel for plaintiff demanded that the employer turn over the recovered emails, arguing that the communications were protected by the attorney-client privilege. When the employer agreed to turn them over but not discontinue use of the information garnered from them, plaintiff sought relief from the court.

The trial court denied relief and plaintiff sought review with the appellate court. That court reversed, and the employer sought review with the state’s supreme court. The supreme court upheld the appellate court’s decision, holding that the employee had a reasonable expectation of privacy in the communications.

The employer relied on a broadly-written company policy through which the employer reserved the right to review and access “all matters on the company’s media systems and services at any time.” But the court rejected those arguments.

Framework for the analysis

The supreme court considered two aspects in its analysis: (1) the adequacy of the notice provided by the company policy, and (2) the important public policy concerns raised by the attorney-client privilege.

As for the adequacy of the notice provided by the policy, the court found that because the policy did not address the use of password-protected personal email accounts, the policy was “not entirely clear.” As for the importance of the attorney-client privilege, the court lavished it with almost-sacred verbal accoutrements, calling it a “venerable privilege . . . enshrined in history and practice.”

“Intrusion upon seclusion” as source for standard

The court noted that the analysis for a reasonable expectation of privacy in dealings between two private parties was a bit different than the analysis in a Fourth Amendment case. The common law source for the standard in this context is with the tort of “intrusion upon seclusion.” Under New Jersey law, that tort is committed when one intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, in a manner that would be highly offensive to a reasonable person. (This language comes from the Restatement (Second) of Torts § 652B.)

In this situation, the court found that plaintiff had both a subjective and objective expectation that the messages would be private. Supporting her subjective belief was the fact that she used a private email account that was password protected, instead of her work email account. And she did not store her password on the computer. Her belief was objectively reasonable given the absence of any discussion about private email accounts in the company policy.

Plaintiff’s expectation of privacy was also bolstered by the fact that the email messages were not illegal, nor would they impact the performance of the employer’s computer system. And they bore all the “hallmarks” of attorney-client communications.

For all these reasons, not the least of which the priority of the courts “to keep private the very type of conversations that took place here,” the court found that the conversations were protected by the attorney-client privilege.

January 21, 2010 Privacy

Lawsuit against state officials for privacy violation moves forward

Welch v. Theodorides-Bustle, — F.Supp.2d —, 2010 WL 22365 (N.D. Fla., January 5, 2010)

Plaintiff sued the Florida Department of Highway Safety and Motor Vehicles and a number of state officials for violation of the federal Driver’s Privacy Protection Act, 18 USC §2721-25. Plaintiff claimed that the defendants turned over a large amount of protected personal information to a private party, and that that party then further disclosed the information to another entity that published the information on the web.

Florida driver

As a result, the personal information of a number of Florida drivers became available for viewing online by anyone.

The defendants moved to dismiss the suit for failure to state a claim. The court denied the motion.

There is an exception to the Driver’s Privacy Protection Act’s prohibition on disclosure of personal information when the disclosure is made by a government agency “in carrying out [the agency’s] functions.” The defendants did not deny that their conduct would violate the Act, but argued that the exception applied. The defendants essentially argued that the mere fact that the disclosure was made by a governmental entity made the disclosure to be automatically carried out in connection with that agency’s function.

The court rejected this ipse dixit assertion, holding that disclosure by a government agency being treated as automatically protected would accordingly make any violation of the Act by the government impossible.

Similarly, the court rejected the defendants’ argument that language in the contract with the entity to which the information had been provided rendered the disclosure proper. The receiving entity promised to use the information only for a proper purpose. But the self-serving recitals in that agreement, without specifying in detail what a proper purpose would be, would not bind third parties.

Alligator car photo courtesy Flickr user jeffdhartman under this Creative Commons license.

November 5, 2009 Miscellaneous, Privacy

Death scene photos posted on the web did not subject coroner to liability

Werner v. County of Northampton, 2009 WL 3471188 (3rd Cir. October 29, 2009) (Not selected for official publication).

Plaintiff’s son died in the family home. No one seems to know for sure whether it was an accident or suicide. Even Plaintiff gave conflicting statements to the court — in his complaint he said it was not suicide, but in a later-filed brief he said it was.

Do not cross this line and I mean it.

In any event, on the day the son died, the coroner came to the house to take pictures. Somehow the coroner’s son got a hold of the photos and posted them on the web with a caption “There is no better way to kill yourself.”

Plaintiff sued the coroner under 28 U.S.C. 1983 which, among other things, gives citizens a cause of action when their rights are violated by someone acting under the law. Plaintiff claimed the coroner committed a due process violation of Plaintiff’s liberty interests in his reputation by allowing the photos to be posted.

To succeed on his liberty interest claim, Plaintiff was required to satisfy the “stigma plus” test. The district court dismissed the complaint, finding Plaintiff’s allegations did not meet this standard.

A statement that is “stigmatizing” under this test must be (1) made publicly, and (2) false. In this cause, the court found that the death scene photos were the relevant statement. But there were no allegations in the complaint that the photos themselves were “false.” (What the court was probably saying here is that the photos had not been Photoshopped or otherwise changed in a way to make them not accurately portray the scene.)

The court made a fine distinction in the process of dismissing the case. In response to the motion to dismiss, Plaintiff argued that the thrust of his argument was that the website falsely suggested his son committed suicide. But the court found otherwise, carefully looking at the allegations of the complaint which, for example, said that the photos “fueled the false impression that the Plaintiff’s son committed suicide.”

There were no allegations that the photos themselves were the false statements. But what about the caption, “[t]here is no better way to kill yourself,” you ask? Though the opinion does not address this point, one is left to conclude that that language could not be attributed to the defendant coroner, since it was his son that posted the photos, and not himself.

Photo courtesy Flickr user Fabio Beretta under this Creative Commons license.