Attorney Evan Brown

May 26, 2011 Computer Crime, Employment

CFAA violation where employee’s access to work computer violated fiduciary duty to employer

Plaintiff former employer sued defendant former employee for violation of the Computer Fraud and Abuse Act, 18 U.S.C. 1030, alleging that defendant, while still in the employ of plaintiff, accessed confidential business information and destroyed other important data. Defendant moved to dismiss the CFAA claim. The court denied the motion.

Defendant had argued that the complaint failed to establish that access to the work computer was had without authorization. He assserted that plaintiff did not allege that at any time while defendant was employed by plaintiff his access to his work-issued computer was restricted, or that plaintiff ever told him that he was no longer permitted to access the computer.

But the plaintiff had alleged that defendant’s access violated the fiduciary duty defendant owed. The court held that under Int’l Airport Ctr., L.L.C. v. Citrin, 440 F.3d 418, 420–21 (7th Cir.2006), allegations of a breach of duty are enough to properly allege that defendant lost his authorization to access his company computer.

Compare this holding (and Citrin) with the Ninth Circuit’s holding in LVRC Holdings v. Brekka.

May 25, 2011 Miscellaneous

Ninth Circuit: FACTA does not apply to credit card receipts sent via email

Simonoff v. Expedia, Inc., — F.3d —, 2011 WL 1991211 (9th Cir. May 24, 2011)

Plaintiff sued Expedia under the Fair and Accurate Credit Transactions Act (“FACTA”). He was upset that the electronic receipt Expedia emailed him contained the expiration date of his credit card.

The district court dismissed plaintiff’s case and he sought review with the Ninth Circuit. On appeal, the court affirmed that the electronic receipt did not violate FACTA.

FACTA provides that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”

The restriction applies only to “receipts that are electronically printed.” The court found that the electronic receipt did not fall into this scope. It looked to the general notion of what it means for something to be “printed”:

“Print” refers to many different technologies—from Mesopotamian cuneiform writing on clay cylinders to the Gutenberg press in the fifteenth century, Xerography in the early twentieth century, and modern digital printing—but all of those technologies involve the making of a tangible impression on paper or other tangible medium.

Since the electronic receipt was not a “tangible impression on paper or other tangible medium,” it wasn’t “printed” as defined by FACTA.

(Copyright folks might be tempted to think about how well this logic holds up, given that copyright protection extends to creative works that are reduced to a tangible medium of expression, and there is no dispute that digital works are copyrightable.)

This opinion is in line with cases from the Seventh Circuit, including Kelleher v. Eaglerider and Shlahtichman v. 1-800 Contacts.

May 21, 2011 Anonymity, Defamation

Court protects identity of anonymous email sender

Sandals Resorts Intern. Ltd. v. Google, Inc., — N.Y.S.2d —, 2011 WL 1885939, (N.Y.A.D. 1 Dept., May 19, 2011)

Some unknown person sent an email to a number of undisclosed recipients containing information that was critical of the hiring and other business practices of the Caribbean resort Sandals. Irritated by this communication, Sandals filed an action in New York state court seeking a subpoena to compel Google to identify the owner of the offending Gmail account.

The trial court denied the petition seeking discovery. Sandals sought review with the appellate court. On appeal, the court affirmed the denial of the petition for discovery.

Under New York law, a person or entity can learn the identity of an unknown possible defendant only when it demonstrates that it has “a meritorious cause of action and that the information sought is material and necessary to the actionable wrong.” In this case, the court held that the petition failed to demonstrate that Sandals had a meritorious cause of action.

The court found that nothing in the petition identified specific assertions of fact as false. It also found that the lower court did not err in reasoning that the failure to allege the nature of the injuries caused by the statements in the email were fatal to the petition.

It went on to find that even if the petition had sufficiently alleged the email injured Sandals’ business reputation or damaged its credit standing, it would still deny the application for disclosure of the account holder’s identification on the ground that the subject email was constitutionally protected opinion.

In discussing this portion of its decision, the court said some interesting things about the nature of internet communications, apparently allowing a certain characterization of online speech to affect its rationale:

The culture of Internet communications, as distinct from that of print media such a newspapers and magazines, has been characterized as encouraging a “freewheeling, anything-goes writing style.” […] [T]he e-mail at issue here . . . bears some similarity to the type of handbills and pamphlets whose anonymity is protected when their publication is prompted by the desire to question, challenge and criticize the practices of those in power without incurring adverse consequences such as economic or official retaliation. […] Indeed, the anonymity of the e-mail makes it more likely that a reasonable reader would view its assertions with some skepticism and tend to treat its contents as opinion rather than as fact.

The court made clear that these observations were “in no way intended to immunize e-mails the focus and purpose of which are to disseminate injurious falsehoods about their subjects.” The real cause for concern, and the thing to protect against, in the court’s view, was “the use of subpoenas by corporations and plaintiffs with business interests to enlist the help of ISPs via court orders to silence their online critics, which threatens to stifle the free exchange of ideas.”

May 11, 2011 Computer Crime, Employment

Employee did not violate Computer Fraud and Abuse Act by checking Facebook and personal email at work

Lee v. PMSI, Inc., 2011 WL 1742028 (M.D.Fla., May 6, 2011)

Former employee sued the company she used to work for alleging pregnancy discrimination. The company countersued under the Computer Fraud and Abuse Act (“CFAA”) alleging that the former employee violated the CFAA by using her work computer to access Facebook and check her personal email. She moved to dismiss the counterclaim, and the court granted the motion. The court found that the company failed to allege that its computer system was damaged by plaintiff’s internet usage, and plaintiff was alleged only to have accessed her own information, not that of the employer.

April 20, 2011 Anonymity, Copyright, Litigation

More subpoenas on the way to identify John Doe BitTorrent users in copyright cases

First Time Videos v. Does 1-37, 2011 WL 1431619 (N.D. California, April 14, 2011)

Hard Drive Productions v. Does 1-118, 2011 WL 1431612 (N.D. California, April 14, 2011)

There have been a couple of new cases filed in federal court in California alleging that unknown BitTorrent users committed copyright infringement and engaged in civil conspiracy by trading porn files online. [Read about some earlier, ongoing cases of this type here and here]. The court has issued orders that move the process of uncovering the identities of the John Doe defendant BitTorrent users.

Generally a plaintiff cannot start the discovery process in a case until it has had a “Rule 26(f)” conference with the defendant. But when the defendants are anonymous (as they are in these BitTorrent cases — they’re known only by IP address), the plaintiff has a bit of a problem. It needs discovery to find out the names of the defendants, but it cannot take discovery before the Rule 26(f) conference. [More on this]

So in cases like this, a plaintiff will ask the court to allow the early discovery to be had. Courts grant those motions allowing early discovery when good cause has been shown.

In this case, the court allowed the discovery because the following four criteria had been met:

(1) The plaintiffs had identified the Doe defendants with sufficient specificity that the court could determine that the defendants are real people who can be sued in federal court. On this point, the court credited the list of IP addresses associated with each of the unknown defendants.

(2) The plaintiffs recounted the steps taken to locate and identify the defendants. Again, the court looked to the fact that the defendants were known only by IP addresses. The names of the defendants could not be ascertained from the information available.

(3) The plaintiffs demonstrated that the action could withstand a motion to dismiss. In some cases this is a tough hurdle to get over. But in copyright cases the threshold can be met relatively easily — simply alleging ownership of a copyright and unlawful copying satisfies this element.

(4) The plaintiffs proved that the discovery was likely to lead to identifying information that will permit service of process. Getting the subscriber information from the ISPs would allow names to be associated with the IP addresses, for further action to be taken.

(The above 4-factor test is drawn from Columbia Ins. Co. v. seescandy. com, 185 F.R.D. 573, 578–80 (N.D.Cal.1999).)

So ISPs across the country will be getting peppered with more subpoenas, and sending out letters to their John Doe subscribers, giving deadlines to move to quash the subpoenas. More mad scramble to protect identities is on its way.

April 16, 2011 Anonymity, Defamation, Litigation

Texas supreme court says identities of anonymous bloggers should not be disclosed

In re Does, — S.W.3d —, 2011 WL 1447544 (Texas, April 15, 2011)

The issue of anonymity is a hot topic in internet law. The question of whether an internet user known only by an IP address or username or website name should be identified arises fairly often in the early stages of internet defamation and certain copyright infringement cases. For example, the issue is a big one in the numerous copyright cases that have been brought recently against BitTorrent users who get subpoenas after being accused of trading copyrighted works online.

The supreme court of Texas has issued an opinion that protects the anonymity of a couple of bloggers who were accused of defamation, copyright infringement and invasion of privacy by another blogger. The court ordered that a subpoena served on Google (who hosted the Blogger accounts in question) be quashed.

Texas rules of procedure (Rule 202) allow a petitioner to take depositions before a lawsuit is filed in order to investigate a potential claim. The petitioner in this case filed such an action, and Google agreed to turn over the information about the anonymous Blogger users.

But the anonymous bloggers objected, and moved to quash the deposition subpoena, arguing that the findings required for the discovery to be taken had not been made.

The trial court was required to find that:

(1) allowing the petitioner to take the requested depositions may prevent a failure or delay of justice in an anticipated suit; or

(2) the likely benefit of allowing the petitioner to take the requested deposition to investigate a potential claim outweighs the burden or expense of the procedure.

Neither of these findings were made. Petitioner had tried to argue that the findings were not necessary because he had gotten the agreement of Google to turn over the information.

But the court saw how that missed the point. It held that without the required findings, the discovery could not be taken in the face of objections brought by other interested parties (the parties whose identities were at risk of being revealed).

While many courts have evaluated this kind of question using a first amendment analysis (i.e., is the John Doe’s interest in speaking anonymously outweighed by the plaintiff’s right to seek redress), the court in this case looked to more general concerns of avoiding litigation abuse. Citing to a law review article by Professor Hoffman, the court observed that there is “cause for concern about insufficient judicial attention to petitions to take presuit discovery” and that “judges should maintain an active oversight role to ensure that [such discovery is] not misused”.

April 8, 2011 Evidence, Litigation

MySpace evidence was inadmissible hearsay

Musgrove v. Helms, 2011 WL 1225672 (Ohio App. 2 Dist. April 1, 2011)

An Ohio domestic relations court ordered an ex-wife to pay her ex-husband child support. Based on evidence that the ex-wife’s income had increased, the court increased the amount of support she had to pay. One of the pieces of evidence the court relied on was information from the ex-wife’s MySpace page where she had stated her income was “less than $30,000.” (This comported with other evidence suggesting her income was around $29,000).

The ex-wife sought review of the order increasing child support with the appellate court. On appeal, the court found the MySpace page to be inadmissible hearsay, and vacated that portion of the order.

The finding turned on a nuance of the rules of evidence pertaining to hearsay. Generally, hearsay is inadmissible as evidence, but there are exceptions. One of the exceptions is statements made by the declarant that are against her interest. The court found that although the MySpace information was used in a way adverse to the ex-wife’s interest (i.e., to increase her support obligation), as a declaration it was not adverse to her interest because it was not an assertion of fact which was by its nature contrary to her interest.

So this case is a reminder that notwithstanding any increased interest in the discoverability of social media evidence, the rules in place may serve to render the information discovered ultimately useless later in the litigation.