What is a reasonable cost that should count as loss under the Computer Fraud and Abuse Act?

1st Rate Mortg. Corp. v. Vision Mortgage Services Corp., 2011 WL 666088 (E.D.Wis. Feb. 14, 2011)

The Computer Fraud and Abuse Act (CFAA) is a popular weapon that employers use against former employees who steal information on the job. But since the employees just use their credentials to get information off the server, there really is no security breach that occurs in those inside jobs.

So you might tend to agree that the employer overreacts when, after discovering the nefarious acts of its employees, it conducts a thorough and expensive security analysis of its whole system. Just delete the offending employees’ accounts and move on, right?

And this overreaction shouldn’t give the employer something to sue over that it would not have had if it reacted reasonably to the threat, don’t you think? After all, plaintiffs have a duty to mitigate their damages.

The defendants (accused former employee information thieves) in a recent federal case in Wisconsin argued along these lines in their summary judgment brief. But the court did not buy it at the summary judgment stage – whether a CFAA plaintiff’s reaction to alleged theft is “reasonable” should be answered by the jury.

The CFAA allows a plaintiff to recover its “loss.” And courts have interpreted the term “loss” to include the cost of responding to a security breach. But the statute says that loss includes the “reasonable cost to any victim.”

In this case, defendants argued that the employer’s overreaction in doing a system-wide analysis caused the employer to incur an unreasonable (and therefore uncompensable) cost. The court held, however, that “[w]hat matters is whether the employer’s reaction was reasonable, not whether it was strictly necessary to continuing in business.” A jury may well conclude the reaction and its related costs were appropriate.

Tweet by friend of husband of jury foreperson did not taint jury trial

U.S. v. Forde, 2011 WL 63831 (4th Cir. January 10, 2011)

Defendant was convicted of bankruptcy fraud and some other similar crimes. One of his arguments on appeal was that the trial court judge erred by not holding a hearing to investigate alleged juror impropriety. The jury foreperson’s husband’s friend had posted the following tweet during the trial:

assume: suppose to be the case, without proof; presume: suppose that something is the case on the basis of probability.

The appellate court rejected the defendant’s argument. It held that the duty to investigate juror impropriety arises only when the party alleging misconduct makes and adequate showing of extrinsic influence to overcome the presumption of jury impartiality. “In other words, there must be something more than mere speculation.”

The court found that “the string of possibilities” about the tweet — i.e., that the foreperson possibly talked to her husband, who possibly talked to his friend, who possibly took to Twitter in response to what the husband possibly told him — was nothing but speculation and thus fell far short of establishing reasonable grounds for investigation.

Facebook account protected from disclosure in discovery, for now

McCann v. Harleysville Insurance, — N.Y.S.2d —, 2010 WL 4540599 (November 12, 2010)

Unlike some recent cases such as Romano v. Steelcase, which seem to give the impression that the information in a person’s social networking account is always fair game for discovery in litigation, one New York court has come down on the side of protecting the privacy of a Facebook user’s content.

Plaintiff was injured in an automobile accident and filed a lawsuit over her injuries. In the course of discovery, defendant sought photographs from plaintiff’s Facebook account and “an authorization” to access the account. Defendant claimed the sought-after discovery related to whether plaintiff sustained a serious injury.

After plaintiff did not respond to the discovery requests, defendant moved to compel. The trial court denied the motion, finding the discovery to be overly broad, and finding that defendant had failed to show the relevancy of the information to be discovered. Defendant sought review with the appellate court. On appeal, the court affirmed.

The court held that the discovery sought was too broad and that defendant had failed to show the relevancy of the information. It affirmed the denial of the motion as to avoid a “fishing expedition.”

But the holding is anything but reassuring from the plaintiff’s perspective. It affirmed the denial without prejudice to serving additional discovery requests. So it sounds as if defendant tailors its discovery a bit more closely, and shows how accessing plaintiff’s Facebook account will provide relevant evidence, it may see some success.

Domain name owner gets swift relief against impostor website

Starcom Mediavest Group v. Mediavestw.com, No. 10-4025, 2010 WL 3564845 (September 13, 2010)

In rem actions over domain names are powerful tools. A trademark owner can undertake these actions when it identifies an infringing domain name but cannot locate the owner of that domain name. In a sense, the domain name itself is the defendant.

The Anticybersquatting Consumer Protection Act (which is a part of the federal trademark statute dealing with the unauthorized registration of domain names) says that a court can enter ex parte orders requiring a domain name to be turned over when: (1) the plaintiff owns a registered trademark, (2) the domain name registry is located in the judicial district in which the action is being brought, (3) the domain name violates the plaintiff’s trademark rights, and (4) the plaintiff cannot locate the owner of the domain name even though it has diligently tried.

An “impostor” registered mediavestw.com, and “tricked” at least one of plaintiff’s business partners into signing up for advertising services. Plaintiff owns a trademark for MEDIAVEST and operates a website at mediavestww.com. Plaintiff filed an in rem action and sought a temporary restraining order (TRO).

The court granted the motion for TRO. It found that plaintiff had met its burden for a temporary restraining order in that it had shown that it was likely to succeed on the merits and that it would suffer irreparable harm in the absence of preliminary relief. As for the showing of harm to its trademark rights, the court noted the efforts on the part of the domain name registrant to fraudulently enter into business arrangements with plaintiffs’ business partners.

The court found that the TRO would serve the public interest because such interest favors elimination of consumer confusion. (Consider whether there really was any consumer harm that took place here if the alleged fraud was on a business-to-business level. Compare the findings in this case with the finding of no consumer nexus in the recent Reit v. Yelp case.)

The court found that plaintiff had made such a strong showing of the likelihood of success that it did not require plaintiff to post a bond. It ordered the domain name transferred into the court’s control immediately. Behold the power of in rem actions.

Juror internet research again causes criminal conviction to be overturned

Child molester’s conviction vacated because juror read articles about victim’s alleged injuries.

Lockwood v. State, 2010 WL 3529416 (Nev., September 3, 2010)

Last week it was manslaughter. This week it’s child molestation.

Defendant was convicted on multiple counts of the heinous crime of sexual assault of a child under the age of sixteen. He moved for a new trial when he learned that the jury foreperson did some internet research on the nature of the injuries suffered by the victim. The trial court denied the motion for a new trial, but the Nevada supreme court overturned the conviction on the basis of the juror misconduct.

To be successful on a motion for new trial, the defendant had to show (1) the occurrence of juror misconduct, and (2) that the misconduct was prejudicial.

The court held that although independent research by a juror generally would not give rise to the presumption of prejudice, in this case, the independent research did rise to that level.

The jury foreperson consulted eight to ten internet articles on the nature of the victim’s injuries over the course of forty-five minutes and shared her research with the rest of the jury during deliberations. The court held that by conducting her own research and relaying that information to the rest of the jury, the foreperson engaged in misconduct that was prejudicial.

The information related directly to whether it was possible that the victim was assaulted. Moreover, by sharing that information, the foreperson might have bolstered the credibility of both the victim and the State’s expert witness and thereby infected the deliberations such that there was a “reasonable probability that the information affected the verdict.”

Internet transactions support exercise of personal jurisdiction over out of state cigarette seller

Seal of the United States Court of Appeals for...
Image via Wikipedia

Illinois v. Hemi Group LLC, — F.3d —, 2010 WL 3547647 (7th Cir. September 14, 2010)

Seventh Circuit declines once again to adopt the Zippo test for personal jurisdiction in internet cases.

The State of Illinois filed a civil suit in federal court in Illinois against a New Mexico-based online cigarette seller. The trial court denied the defendant’s motion to dismiss for lack of personal jurisdiction. The defendant sought review with the Seventh Circuit. On appeal, the court affirmed the denial of the motion, holding that the defendant’s website satisfied the minimum contacts requirement for the exercise of personal jurisdiction.

The mechanics of the website were important in the minimum contacts analysis. The site expressly said that the company would sell to consumers in any state except those in New York. The court interpreted this to relate to the personal jurisdiction question in two ways. First, such a statement implicitly said that the defendant would do business in Illinois. Second, it revealed that the defendant knew that it could be subject to the jurisdiction of out-of-state courts (i.e., New York) and also knew how to prevent such an exercise (by not selling there).

In this analysis, the court expressly declined to adopt the well-known Zippo sliding scale test, which evaluates the interactivity of a website in the personal jurisdiction analysis.

Restating a hesitancy “to fashion a special jurisdictional test for Internet-based cases,” the court applied the traditional constitutional approach of the “effects test” found in Calder v. Jones. It made the interesting observation, as it did in Jennings v. AC Hydraulic A/S, that “although technological advances may alter the analysis of personal jurisdiction, those advances may not eviscerate the constitutional limits on a state’s power to exercise jurisdiction over nonresident defendants.”

Enhanced by Zemanta

Court orders anonymous accused Bittorrent defendants to be identified

West Bay One v. Does 1 – 1,653, — F.Supp.2d. —, 2010 WL 3522265 (D.D.C. September 10, 2010)

Achte/Neunte Boll Kino Beteiligungs v. Does 1 – 4,577, — F.Supp.2d —, 2010 WL 3522256 (D.D.C. September 10, 2010)

In mass copyright infringement cases against alleged traders of copyrighted movies via Bittorrent, unknown defendants had no reasonable expectation of privacy in their subscriber information held by internet service provider.

Several unknown “Doe” defendants who were sued for copyright infringement for trading movies via Bittorrent moved to quash the subpoenas that the plaintiff copyright owners served on the defendants’ internet service providers.

The subpoenas sought subscriber information such as the defendants’ names, addresses and MAC addresses, so that they could be named as defendants in the copyright litigation.

Defendants moved to quash the subpoenas, arguing that their subscriber information was private information that should not be disclosed pursuant to a Rule 45 subpoena. The court denied the motions and ordered the subscriber information produced.

The court held that the defendants did not have a reasonable expectation of privacy in their subscriber information held by the internet service providers. It cited to a number of cases that supported this holding, each of which had found that a person loses his or her expectation of privacy in information when that information is disclosed to a third party. See Guest v. Leis (6th Cir.), U.S. v. Hambrick (4th Cir.), and U.S. v. Kennedy (D. Kan.).

In footnotes, the court also addressed the potential First Amendment rights that the defendants would have to engage in anonymous file sharing. It quickly dispensed with any notion that such activities were protected in this case, as the pleadings on file set forth a prima facie case of infringement. “[C]ourts have routinely held that a defendant’s First Amendment privacy interests are exceedingly small where the ‘speech’ is the alleged infringement of copyrights.”

iPhone using juror causes manslaughter conviction to be overturned

Tapanes v. State, — So.3d —, 2010 WL 3488709 (Fla.App. 4 Dist. September 8, 2010) [Opinion (PDF)]

Defendant was accused of killing his new neighbor and was indicted for murder. The jury convicted him of the lesser charge of manslaughter.

One of the key concepts in the case, and mentioned specifically in the jury instructions, was whether the defenant acted with “prudence” in his dealings with the victim.

During a break from deliberations, the jury foreperson used his iPhone to access Encarta and look up the word “prudence”. Adding to this misdeed, the foreperson shared this information with the other jurors.

Based on this misconduct, defendant filed a motion seeking a new trial, and the trial court denied that motion. So defendant sought review with the Court of Appeal of Florida. On appeal, the court reversed, holding that the defendant was entitled to a new trial.

The appellate court observed that the concept of “prudence” was one that could have been key to the jury’s deliberations. Using the smartphone in this way was analogous to using a dictionary, and that conduct has generally been prohibited in juror deliberations. The appellate court found that at the very least, it could “not say that there [was] no reasonable possibility that the . . . misconduct . . . did not affect the verdict in this case.”

Ed. note: If the jury foreperson was savvy enough to use an iPhone, why on earth was he consulting Encarta? Hello, 1995 called – it wants its web pages back.

Judge should have let lawyer Google potential jurors during jury selection

Carino v. Muenzen, 2010 WL 3448071 (N.J.Super.A.D. August 30, 2010)

The courthouse in Morris County, New Jersey provides wi-fi access. As jury selection began in a medical malpractice case, the plaintiff’s lawyer used his laptop to do some real time research on the members of the jury pool. The judge noticed the research taking place and called the lawyer out. Here is the exchange between the lawyer and the judge:

THE COURT: Are you Googling these [potential jurors]?

[PLAINTIFF’S COUNSEL]: Your Honor, there’s no code law that says I’m not allowed to do that. I-any courtroom-

THE COURT: Is that what you’re doing?

[PLAINTIFF’S COUNSEL]: I’m getting information on jurors-we’ve done it all the time, everyone does it. It’s not unusual. It’s not. There’s no rule, no case or any suggestion in any case that says-
….

THE COURT: No, no, here is the rule. The rule is it’s my courtroom and I control it.

The judge made the plaintiff’s lawyer close his laptop.

The trial proceeded and the jury found in favor of the defendant. Plaintiff sought review with the appellate court. On appeal, he argued that the court erred when it prohibited his attorney from accessing the internet during jury selection.

The appellate court found that although a trial judge is given wide discretion to control a trial in his or her courtroom, that authority is circumscribed by the responsibility to act reasonably. In this case, the appellate court found that prohibiting the web searches during voir dire was unreasonable:

There was no suggestion that counsel’s use of the computer was in any way disruptive. That he had the foresight to bring his laptop computer to court, and defense counsel did not, simply cannot serve as a basis for judicial intervention in the name of “fairness” or maintaining “a level playing field.” The “playing field” was, in fact, already “level” because internet access was open to both counsel, even if only one of them chose to utilize it.

Nevertheless, the court concluded that plaintiff did not demonstrate any prejudice resulting from the trial court’s ruling. He did not identify any juror who was unqualified or as to whom he claimed he would have exercised a peremptory challenge, even though he subsequently had the opportunity to perform an internet search concerning each juror.

The court went on to note that inasmuch as jury selection took two days, plaintiff’s counsel could have researched the prospective juror lists overnight or during breaks, and could have done so before the testimonial portion of the trial started on the third day.

Photo courtesy of croncast under this Creative Commons license.

Forum selection clause in clickwrap agreement enforceable

Meier v. Midwest Recreational Clearninghouse, LLC, 2010 WL 2738921 (E.D. Cal. July 12, 2010)

Plaintiffs live in California and bought an RV online from a vendor in Minnesota. The vendor’s website terms of service had a provision requiring that all disputes “arising out of or related to the use” of the website be brought in state court in Minnesota.

When plaintiffs — who were unhappy about the RV — brought a lawsuit in federal court in California, defendants moved to dismiss for improper venue. The court granted the motion.

The court noted that under the Bremen case, forum selection clauses are prima facie enforceable. And the Carnival Cruise Lines case takes that notion even further, giving forum selection clauses this presumption of enforceability in preprinted agreements.

In this case, plaintiffs argued that the court shouldn’t enforce the forum selection clause because it wasn’t freely bargained for. And they claimed that enforcing it would effectively deny them their day in court.

But that did not sway the judge. The court found that there was no bad faith motive that put the forum selection clause in the clickwrap agreement. And even though litigating in Minnesota might be inconvenient for California residents, it was not enough to bar them from the judicial system.

Moreover, just like the Supreme Court noted in Carnival Cruise Lines, the presence of forum selection clauses can reduce the costs of litigation because they cut down on the number of pretrial motions arguing over venue. And they also help consumers — this cost savings should ostensibly be passed on.

Related articles by Zemanta
Enhanced by Zemanta
Scroll to top