Class Action Lawsuit Hopes To Hold GitHub Responsible For Hosting Data From Capital One Breach

from the into-the-breach dept

As soon as the Capital One breach was announced, you knew the lawsuits would follow. Handling the sensitive info of millions of people carelessly is guaranteed to net the handler a class-action lawsuit or two, but this one -- filed by law firm Tycko & Zavareeri -- adds a new twist.

The 28-page lawsuit filed Thursday in the U.S. District Court for the Northern District of California asserted that GitHub "actively encourages (at least) friendly hacking."

It notes that the hacked Capital One information was posted online for months and alleges that the company violated state law to remove the information. "GitHub had an obligation, under California law, to keep off (or to remove from) its site Social Security numbers and other Personal Information," the suit says

Weird legal theory, but one that could possibly to be stretched to target some of the $7.5 billion Microsoft paid to acquire GitHub. But it takes a lot of novel legal arguments to hold a third party responsible for content posted by a user, even if the content contained a ton of sensitive personal info.

The lawsuit [PDF] alleges GitHub knew about the contents of this posting since the middle of April, but did not remove it until the middle of July after being notified of its contents by another GitHub user. The theory the law firm is pushing is that GitHub was obligated to scan uploads for "sensitive info" and proactively remove third-party content. The lawsuit argues GitHub is more obligated than most because (gasp!) it encourages hacking and hackers.

GitHub knew or should have known that obviously hacked data had been posted to GitHub.com. Indeed, GitHub actively encourages (at least) friendly hacking as evidenced by, inter alia, GitHub.com’s “Awesome Hacking” page

GitHub had an obligation, under California law, to keep off (or to remove from) its site Social Security numbers and other Personal Information.

Further, pursuant to established industry standards, GitHub had an obligation to keep off (or to remove from) its site Social Security numbers and other Personal Information.

The "industry standards" the lawsuit references are voluntary moderation efforts engaged in by social media platforms. Certainly no platform would want to be known as the habitual host of exfiltrated credit card data, but comparing the removal of offensive or plainly illegal content to the removal of strings of numbers from a site hosting an unusually large amount of strings of numbers is quite another. The law firm feels this assertion helps its case. It probably doesn't.

Moreover, Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence. Individuals’ contact information such as addresses are similarly readily identifiable.

Thus, it is substantially easier to identify—and remove—such sensitive data. GitHub nonetheless chose not to.

Nine digits in a sequence. Oh, like phone numbers. And phone numbers tend to be found near addresses, especially when coders and developers are using GitHub as an offshoot of LinkedIn, posting their personal info for employers to find. Even long lists of personal info wouldn't necessarily be innately suspicious. Employers and recruiters looking for people with certain skills have probably compiled all of this freely-provided personal info for easy reference. It's not as easy to moderate content as the litigants believe.

But this belief, if backed by a judge, could add Github's money to the pool of damages. Things will get a lot more interesting once GitHub responds to unintentionally hilarious assertions like these:

GitHub knew or should have known that the Personal Information of Plaintiffs and the Class was sensitive information that is valuable to identity thieves and cyber criminals. GitHub also knew of the serious harms that could result through the wrongful disclosure of the Personal Information of Plaintiffs and the Class.

As an entity that not only allows for such sensitive information to be instantly, publicly displayed, but one that also arguably encourages it, GitHub is morally culpable, given the prominence of security breaches today, particularly in the financial industry.

Well, we'll see how "morally culpable" stands up in court, where "legally culpable" is the actual standard. GitHub will rely on Section 230 to be dismissed from this case and rightly so. The person responsible for posting sensitive data exfiltrated from Capital One is, unsurprisingly, the person who posted the sensitive data exfiltrated from Capital One. Capital One has a duty to protect the information it gathers from customers. A third party site with hosting capabilities does not and it's not nearly as easy to moderate and proactively remove content as this lawsuit says it is.

Filed Under: class action, data breach
Companies: capital one, github

Facebook's Triple Woes Over Cambridge Analytica Data Harvesting Scandal

from the privacy?-what-privacy? dept

Earlier this week, Techdirt wrote about a defeat for Facebook in the Irish courts. In fact, the case in question is not about Facebook itself, but about transatlantic data transfers. Facebook will certainly have some problems if the EU's top court goes on to rule against the Privacy Shield framework -- the real issue here -- but it won't be alone. Moreover, if that were the company's only problem, it probably wouldn't cause Mark Zuckerberg to lose much sleep. However, it is far from his only headache. Recently, no less than three decisions specifically about Facebook were handed down, all related to the by-now infamous Cambridge Analytica data harvesting scandal, and all going the wrong way for Zuckerberg.

As Bloomberg reports, a San Francisco federal judge indicated he won’t dismiss lawsuits brought against Facebook on behalf of tens of millions of users. They blame the company for allowing their private information obtained from their friends' accounts to be shared with Cambridge Analytica:

U.S. District Judge Vince Chhabria is overseeing dozens of suits alleging users have no real control over their personal information, and that the company has repeatedly misled users to continue mining it.

The suits have a long way to go before users stand a chance of claiming billions of dollars in damages. Chhabria isn't addressing the merits of the complaints, only deciding whether the allegations are legally sufficient to proceed. The next step will be for users to seek internal information from the company to back up their claims.

Reuters says that Facebook suffered a similar fate in Washington, D.C.:

A U.S. judge on Friday denied Facebook Inc.'s request to dismiss a lawsuit by the Washington, D.C. attorney general over the social media giant's improper sharing of 87 million users' data with British political consulting firm Cambridge Analytica.

The U.S. capital city sued Facebook in December, accusing it of misleading users because it had known about the breach for two years before disclosing it and had allowed third-party app makers to access user information without their consent.

Around the same time, a court in Delaware was also ruling against Facebook in connection with Cambridge Analytica, reported here by Forbes:

A court in Delaware sided with Facebook shareholders who are suing the company for access to internal information that might show wrongdoing relating to the company's various privacy issues. The investors want access to emails and other documents relating to Facebook providing Cambridge Analytica with data on some 87 million users.

It's important to note that in all three cases, the rulings are preliminary, simply allowing things to proceed to a full trial. But we do have a sneak peek of what one of Facebook's main arguments might be. Speaking before the judge in San Francisco, a lawyer for Facebook claimed as follows:

"There is no invasion of privacy at all, because there is no privacy," on Facebook or any other social media site, company attorney Orin Snyder told U.S. District Judge Vince Chhabria.

A month before that interesting statement, Mark Zuckerberg was telling everyone that "The future is private". Given what one of his lawyers is now insisting in court, that seems to imply that Facebook's social network is not the future.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: class action, data sharing, lawsuits, privacy
Companies: cambridge analytica, facebook

All Four Major Wireless Carriers Hit With Lawsuits Over Sharing, Selling Location Data

from the somebody's-watching-you dept

We've noted repeatedly that if you're upset about Facebook's privacy scandals, you should be equally concerned about the wireless industry's ongoing location data scandals. Not only were the major carriers caught selling your location data to any nitwit with a checkbook, they were even found to be selling your E-911 location data, which provides even more granular detail about your data than GPS provides. This data was then found to have been widely abused from everybody from law enforcement to randos pretending to be law enforcement.

Throughout all this, the Ajit Pai FCC has done absolutely nothing to seriously police the problem. Meaning that while carriers have promised to stop collecting and selling this data, nobody has bothered to force carriers to actually confirm this. Given telecom's history when it comes to consumer privacy, somebody might just want to double check their math (and ask what happened to all that data already collected and sold over the last decade).

Compounding carrier problems, all four major wireless carriers last week were hit with a class action lawsuit (correctly) noting the carriers had violated Section 222 of the Federal Communications Act by selling consumer proprietary network information (CPNI) data:

"Through its negligent and deliberate acts, including inexplicable failures to follow its own Privacy Policy, T-Mobile permitted access to Plaintiffs and Class Members’ CPI and CPNI,” the complaint against T-Mobile reads, referring to “confidential proprietary information” and “customer proprietary network information,” the latter of which includes location data."

It's likely that the sale of 911 data is where carriers are in the most hot water, since that's their most obvious infraction of the law. It's of course worth pointing out that wireless carriers (and fixed-line ISPs, frankly) have been hoovering up and selling location, clickstream, and a vast ocean of other user data for decades with very few (any?) Congressional lawmakers much caring about it. It's another example of how Facebook's cavalier treatment of user data (and government apathy toward meaningful solutions) isn't just some errant exception -- it's the norm.

Back in 2016, the previous FCC uncharacteristically tried to impose some pretty basic rules that would have gone a long way in preventing these location data scandals by requiring that carriers be more transparent about what data is collected and who it's sold to. It also required consumers opt in to more sensitive (read: financial, location) data. But telecom lobbyists quickly convinced Congress to obliterate those rules in 2017 using the Congressional Review Act before they could even take effect.

Two years later finds the sector swimming in scandal, and everybody has a dumb look on their faces utterly perplexed as to how we got to this point.

Filed Under: class action, fcc, lawsuit, privacy, section 222, telcos
Companies: at&t, sprint, t-mobile, verizon

Vizio Customers Get A Pittance In Settlement Over Snooping Televisions

from the watching-you,-watching-me dept

As we frequently note, most of the "smart" products you buy are anything but intelligent when it comes to your privacy and security. Whether it's your refrigerator leaking your gmail credentials or your new webcam being hacked in mere minutes for use in massive new DDoS attacks, the so-called "smart" home is actually often dumb as nails and potentially hazardous. So-called smart-televisions have been particularly problematic, whether that has involved companies failing to encrypt sensitive data, or removing features if you refuse to have your daily viewing habits measured and monetized.

Last year Vizio joined this not-so-distinguished club when it was discovered that the company's TVs had been spying on users for the last several years, starting back in 2014. Vizio's $2.2 million settlement with the FTC indicates that the company at no time thought it might be a good idea to inform customers this was happening. The snooping was part of a supposed "Smart Interactivity" feature deployed in 2014 that claimed to provide users with programming recommendations, but never actually did so. Its sole purpose was to hoover up your data and help Vizio sell it, without your express consent.

Vizio was also hit with a class action lawsuit over its actions, and the finishing touches on a settlement are just getting hashed out now. Lawyers representing consumers in the case state Vizio secretly tracked and sold the usage habits of around sixteen million Vizio owners for around three years. They're demanding a settlement of $17 million and a promise from Vizio that this won't ever happen again:

"Under the terms of the proposed settlement, Vizio will establish a $17 million settlement fund that will deliver money directly to consumers who bought Vizio Smart TVs that were subsequently connected to the Internet between February 1, 2014 and February 6, 2017. Vizio has also stopped tracking what is displayed on its Smart TVs unless a consumer consents to this tracking after receiving a prominent notification. And Vizio will delete the remaining contested viewing data in its possession."

What this actually means for consumers is a bit less impressive. Ars Technica took a closer look at the court filings in the case and found that consumers are likely to get all of somewhere between $13 and $31 for the inconvenience of being spied on without their permission. Lawyers will, unsurprisingly, get significantly more:

"When it’s all said and done, new court filings submitted on Thursday say each of those 16 million people will get a payout of somewhere between $13 and $31. By contrast, their lawyers will collectively earn a maximum payout of $5.6 million in fees."

On the plus side, insiders tell Ars Technica that the $17 million being doled out is more than Vizio made from selling this data, which usually isn't the case in other similar failures of trust (especially by cellular carriers, who'll often be fined millions for privacy violations that potentially netted them billions). And while Vizio's promises are good and all, many argue we need stronger public deterrents for companies that fail to respect user privacy, starting first and foremost with efforts to include privacy and security oversights in product reviews.

Filed Under: class action, privacy, smart tv, surveillance
Companies: vizio

Judge OKs Class Action Status For Illinoisans Claiming Facebook Violated State Privacy Law

from the face-off dept

The last time we discussed Illinois' Biometric Information Privacy Act, a 2008 law that gives citizens in the state rights governing how companies collect and protect their biometric data, it was when a brother/sister pair attempted to use the law to pull cash from Take-Two Interactive over its face-scanning app for the NBA2K series. In that case, the court ruled that the two could not claim to have suffered any actual harm as a result of using their avatars, with their real faces attached, in the game's online play. One of the chief aspects of the BIPA law is that users of a service must not find their biometric data being used in a way that they had not intended. In this case, online play with these avatars was indeed the stated purpose of uploading their faces and engaging in online play to begin with.

But now the law has found itself in the news again, with a federal court ruling that millions of Facebook users can proceed under a class action with claims that Facebook's face-tagging database violates BIPA. Perhaps importantly, Facebook's recent and very public privacy issues may make a difference compared with the Take-Two case.

A federal judge ruled Monday that millions of the social network’s users can proceed as a group with claims that its photo-scanning technology violated an Illinois law by gathering and storing biometric data without their consent. Damages could be steep — a fact that wasn’t lost on the judge, who was unsympathetic to Facebook’s arguments for limiting its legal exposure.

Facebook has for years encouraged users to tag people in photographs they upload in their personal posts and the social network stores the collected information. The company has used a program it calls DeepFace to match other photos of a person. Alphabet’s cloud-based Google Photos service uses similar technology and Google faces a lawsuit in Chicago like the one against Facebook in San Francisco federal court.

Both companies have argued that none of this violates BIPA, even when this face-data database is generated without users' permission. That seems to contradict BIPA, where fines between $1,000 and $5,000 can be assessed with every use of a person's image without their permission. Again, recent news may come into play in this case, as noted by the lawyer for the Facebook users in this case.

“As more people become aware of the scope of Facebook’s data collection and as consequences begin to attach to that data collection, whether economic or regulatory, Facebook will have to take a long look at its privacy practices and make changes consistent with user expectations and regulatory requirements,” he said.

Now, Facebook has argued in court against this moving forward as a class by pointing out that different users could make different claims of harm, impacting both the fines and outcomes of their claims. While there is some merit to that, the court looked at those arguments almost purely as a way for Facebook to try to get away from the enormous damages that could potentially be levied under a class action suit, and rejected them.

As in the Take-Two case, Facebook is doing everything it can to set the bar for any judgement on the reality of actual harm suffered by these users, of which the company claims there is none.

The Illinois residents who sued argued the 2008 law gives them a “property interest” in the algorithms that constitute their digital identities. The judge has agreed that gives them grounds to accuse Facebook of real harm. Donato has ruled that the Illinois law is clear: Facebook has collected a “wealth of data on its users, including self-reported residency and IP addresses.” Facebook has acknowledged that it can identify which users who live in Illinois have face templates, he wrote.

We've had our problems with class actions suits in the past, but it shouldn't be pushed aside that this case has the potential for huge damages assessed on Facebook. It's also another reminder that federal privacy laws are in sore need of modernization, if for no other reason than to harmonize how companies can treat users throughout the United States.

Filed Under: bipa, class action, face recognition, face scanning, illinois
Companies: facebook

EU's Highest Court Says Privacy Activist Can Litigate Against Facebook In Austria, But Not As Part Of A Class Action

from the new-EU-law-will-soon-make-that-possible-anyway dept

Last November we reported on the legal opinion of one of the Advocates General that advises the EU's top court, the Court of Justice of the European Union (CJEU). It concerned yet another case brought by the data protection activist and lawyer Max Schrems against Facebook, which he claims does not follow EU privacy laws properly. There were two issues: whether Schrems could litigate against Facebook in his home country, Austria, and whether he could join with 25,000 people to bring a class action against the company. The Advocate General said "yes" to the first, and "no" to the second, and in its definitive ruling, the CJEU has agreed with both of those views (pdf). Here's what Schrems has to say on the judgment (pdf):

The Court of Justice of the European Union (CJEU) confirms that Max Schrems can litigate in Vienna against Facebook for violation of EU privacy rules. Facebook's attempt to block the privacy lawsuit was not successful.

However, today the CJEU gave a very narrowly definition of the notion of a "consumer" which deprives many consumer from consumer protection and also makes an Austrian-style "class action" impossible.

The rest of his press release gives background details of the case. Schrems explains why being able to bring a class action in Austria is important:

If a multinational knows that they cannot win a case, they try to find reasons so that a case is not admissible, or they try to squeeze a plaintiff out of the case by inflating the costs.. Facebook wanted to ensure that the case can only be heard in Dublin [where its EU headquarters are located], as Ireland does not have any class action and litigating even one model claim would cost millions of Euros in legal fees. In this case we'd have a valid claim, but it would be basically unenforceable.

EU consumer groups agree that an option to bring class actions is needed, as EurActiv reports:

The ECJ's finding has caused outrage among consumer groups that have campaigned for years for the [European] Commission to propose legislation allowing for EU-level class action lawsuits involving complainants from different member states. They argue that collective redress will make it easier and cheaper for consumer to sue.

The same articles notes that Schrems and the consumer groups may soon get their wish: the European Commission is expected to unveil proposals for a new law that will allow collective redress to be sought across the EU. Even if that does happen, it's likely to take years to implement. Before then, Facebook has many other problems it needs to confront. First, there is Schrem's personal suit against the company, which can now proceed in the Austrian courts. As he points out:

Facing a lawsuit, which questions Facebook's business model, is a huge risk for the company. Any judgement in Austria is directly enforceable at Facebook's Irish headquarter and throughout Europe.

That is, if Schrems wins his case, other EU citizens will be able to use the judgment to sue Facebook more easily. And Facebook may have headed off the threat of a class action under existing law, but the EU's new General Data Protection Regulation (GDPR), which will be enforced from May of this year, explicitly allows non-profit organizations to sue on the behalf of individuals. Article 80 of the GDPR says:

The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf

With that in mind, Schrems is crowdfunding just such a public interest, not-for-profit body, None of Your Business (noyb), which Techdirt discussed in December. At the time of writing, noyb is within a few percent of achieving its goal of €250,000. Facebook is naturally well-aware of the GDPR's likely impact. The company's Chief Operating Officer Sheryl Sandberg said recently:

We're rolling out a new privacy center globally that will put the core privacy settings for Facebook in one place and make it much easier for people to manage their data

Satisfying the requirements of the GDPR is not the only looming problem for Facebook. In Germany, the company is facing what is potentially an even more serious challenge, as the FT reports (paywall):

Germany is threatening curbs on how Facebook amasses data from millions of users in what would be an unprecedented intervention in the social network's business model.

Andreas Mundt, head of Germany's main antitrust agency, the Federal Cartel Office, said Facebook could be banned from collecting and processing third-party user data as one possible outcome of an investigation that in December concluded the US technology group was abusing its dominant market position.

If Germany goes ahead with these plans, it will drastically reduce the scope for Facebook to make money by using consolidated data about its users to sell advertising space, and may well encourage other EU nations to follow suit.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: austria, cjeu, class action, eu, max schrems, privacy
Companies: facebook

Court Dumps Lawsuit Against Zillow Over Its Inaccurate 'Zestimates'

from the conclusory-arguments-are-empty-arguments dept

Earlier this year, real estate litigator and aggrieved homeowner Barbara Andersen sued Zillow for providing a lower "Zestimate" than she believed her house was worth. She alleged Zillow violated Illinois state law by portraying its estimates as appraisals, even though it lacked the proper licensing to perform appraisals. Andersen sought an injunction blocking Zillow from posting information about her home (even publicly-available information) and offering a "Zestimate" on its selling price.

Andersen has just had her case tossed, although she's now representing others in a proposed class action against Zillow. At some point between February and earlier this week, Andersen's case was moved to a federal court and she's now listed on the bottom of court documents (as counsel of record), rather than up top as a plaintiff.

The new lead plaintiffs are three Patels disputing Zestimates of their multi-million dollar properties. (This rearranging of plaintiffs and lawyers [and lawyers who were also plaintiffs] is unsettling, especially for those of us who learned what we know of the real estate business via repeated viewings of "Glengarry Glen Ross.")

The Patels (and "others similarly situated") aren't happy with Zillow. The Patels (collectively) have multiple properties on the market, all listed at prices considerably higher than Zillow's Zestimates. They claim, as Andersen did, that Zillow violates state law by offering something homebuyers might believe is an appraisal. A variety of interconnected laws results in the Patels attempting to coax a federal court into killing Zillow's estimates. As Eric Goldman summarizes, the Patels have gone down on strikes.

An Illinois putative class action was brought against Zillow over the zestimate on three grounds: (1) the zestimate was an unlicensed appraisal, (2) the house profile and zestimate constituted an intrusion into seclusion, and (3) Zillow’s practices violate state consumer protection laws. Zillow wins on a 12(b)(6) motion to dismiss.

Unlicensed Appraisal: The applicable licensure statute expressly excludes “the procurement of an automated valuation model.” Furthermore, the law doesn’t support private causes of action.

Privacy Invasion. There’s no intrusion when the zestimate is based on public data sources. The plaintiffs also don’t explain how the intrusion is “offensive” or plead the required “anguish and suffering.”

Consumer Protection Laws. The court says the zestimates are not false, misleading or confusing

Goldman also points out no serious person is likely to confuse a Zestimate with an appraisal… at least not if they expect to be taken seriously. Courts in cases dug up by Goldman have called Zillow Zestimates everything from "inherently unreliable" to "incapable of accurate" valuations. One judge concluded "internet searches are insufficient evidence of property value," spreading the besmirchment to Zillow's competitors and pre-trial Googlers.

Zillow pled a First Amendment defense for its publication of lousy Zestimates and other public data. The court [PDF] doesn't make any attempt to address this pleading as it finds plenty it doesn't like about the state law claims.

Zillow argues that the First Amendment requires dismissal of all of Plaintiffs’ claims. (R. 18, Mem. Supp. Mot. Dismiss, 3.) Additionally, Zillow contends that First Amendment concerns aside, Plaintiffs fail to plead the required elements of their claims. (Id. at 9.) While Zillow makes persuasive arguments with respect to the First Amendment, the Court need not and should not rule on them conclusively because Plaintiffs’ claims fail under Illinois statutory law.

As the court points out, Zestimates are nothing more than "nonactionable statements of opinion" -- statements that result from no intrusion in personal privacy (because publicly-available info is used) nor violation of real estate regulations in Illinois.

All claims have been dismissed without prejudice, meaning real estate litigator (and litigant) Barbara Andersen is welcome to try again. But she -- like the Patels she now represents -- will need to find a better angle than alleged state law violations to take another run at estimates they all subjectively feel are on the low end.

Filed Under: barbara andersen, class action, illinois, lawsuit, zestimates
Companies: zillow

Mayweather V. McGregor: Showtime Got Injunctions On Pirate Stream Sites Which Didn't Work & Neither Did Their Own Stream

from the oops dept

As you will already know, a boxing match recently took place between Floyd Mayweather Jr. and Conor McGregor. The fight itself was far better than it should have been, but you may not know it if you couldn't manage to actually see it. Much as it did in the run up to the Mayweather v. Pacquiao fight of a couple of years ago, Showtime went out and got some rather questionable injunctions against 44 sites it believed would be offering up the fight via an illegitimate stream during the live pay-per-view broadcast. That effort resulted in, ahem, only three million viewers watching the fight via illegal live streams. Thousands more downloaded video of the fight illicitly after it occurred. So, Showtime got a court to agree to questionable pre-crime activities with the result being rather mixed.

But if the steady mantra from the content industries that "every infringement is a lost sale" were true, then perhaps Showtime should be thanking its lucky stars that illegal streams were available, because its own streaming service wasn't able to handle the viewership load it did have.

Showtime was hit with a federal class-action lawsuit amid reports that it delivered shoddy or non-existent $99 streams of the Floyd Mayweather-Conor McGregor fight Saturday. This is contrary to Showtime's promise of 1080p resolution at 60 frames per second.

"Instead of being a 'witness to history' as defendant had promised, the only thing plaintiff witnessed was grainy video, error screens, buffer events, and stalls," declared the lawsuit (PDF) filed in federal court on behalf of a Portland man named Zack Bartel. The suit seeks to represent "thousands of other consumers" unable to stream the Mayweather fight in HD as Showtime advertised.

By all accounts, it was bad. Really bad. The fight was delayed for paying streamers for over half an hour as Showtime's service was unable to handle all of those customers who paid for the fight. I don't want to spend any time on this class lawsuit, because these kinds of class lawsuits are generally pretty silly and the fact that Showtime failed to deliver on its own streaming product isn't in and of itself the point. The point is that if the company really wanted to go to war with streaming sites prior to the fight, it should have made sure that money and effort wouldn't have been better spent actually catering to its paying customers.

What if the content industries were right and the injunctions had worked? What if Showtime had to accommodate three million more customers with pirate streams unavailable? How bad would the streaming experience to all of those paying customers have been then? Likely it would have merely added 3 million more individuals to the class action lawsuit.

Meanwhile, of those that did pay for the fight and had their experience range from "delayed and sub-par" to "holy shit, I can't even watch this thing", how many might give this whole pirate stream thing a whirl the next time Showtime puts on a fight? All because Showtime would rather play whac-a-mole with streaming sites than make its own product function, never mind actually competitively good.

Filed Under: class action, conor mcgregor, copyright, floyd mayweather, piracy, streaming

Comcast Tries, Fails To Kill Lawsuit Over Its Hidden, Bogus Fees

from the I-see-what-you-did-there dept

Cable TV and broadband providers have created an art form out of advertising one price, then charging you something else entirely when your bill actually arrives. They accomplish this via the addition of sneaky below the line fees, which allow them to covertly raise rates while proudly crowing that they've keep their base rates the same. Some of these fess are downright obnoxious in how fraudulent they are, like CenturyLink's "internet cost recovery fee." Others, like the increasingly common "broadcast TV fee," simply take a part of the cost of doing business (in this case programming), then bury it below the line to jack up the advertised price.

Comcast, an expert at this particular behavior, was sued for the practice late last year. The lawsuit specifically focused on Comcast's use of the broadcast TV fee, which has quickly ballooned for Comcast customers from $1.50 per month to $6.50 since introduction, and the "Regional Sports Fee" that has quickly jumped from $1 to $4.50 since 2015. The lawsuit was also was quick to point out that when people call Comcast to complain, the company's support reps often lie and insist that the fees are somehow government mandated to dodge accountability.

Amusingly, the company responded to the suit by trying to claim that covertly jacking up their advertised rate was just their way of being "transparent" (nothing quite says "transparency" like not knowing what your bill is going to be until after you've signed up for service). Comcast subsequently filed a motion to dismiss, arguing that the company's order submission process doesn't technically create a binding contract with its customers, and that customers agreed to pay the fees by agreeing to the Comcast "Subscriber Agreement" and "Minimum Term Agreement."

But US District Court Judge Vince Chhabria recently shot down this argument in a ruling that will keep the suit alive, for now:

"The motion to dismiss the breach of contract claim is denied. The plaintiffs have alleged the existence of a valid contract, which was created when [Comcast customers Dan] Adkins and [Christopher] Robertson submitted their order for Comcast services through Comcast's website. It is plausible to infer from the complaint that, by clicking "Submit Your Order," Adkins and Robertson agreed to pay Comcast's advertised price, plus taxes and government-related fees, in exchange for the services Comcast offered them. It is also plausible to infer from the complaint that Comcast breached its agreements with the plaintiffs when it sent them bills charging them Broadcast TV and/or Regional Sports Fees (alleged to be neither taxes nor government-related fees) in excess of the agreed-upon price, and when it subsequently sought to raise the amount of the fees."

Judge Chhabria also disputed Comcast's claim that users technically agree to pay these fees by agreeing to the Comcast subscriber agreement, which only references "permitted fees and cost recovery charges," and not these additional surcharges Comcast appears to have hallucinated out of whole cloth:

"As to the Minimum Term Agreement, the plaintiffs plausibly allege that they never saw this agreement at the time they submitted their order for services and have never consented to it," the judge wrote. "Whether the plaintiffs had access to this agreement at the time they submitted their orders for services, or whether they subsequently consented to it, are disputed factual questions more appropriate for summary judgment."

Comcast's being additionally disingenuous here in part because as the owner of NBC, it very often is the broadcaster, and often owns the regional sports networks in question. Granted Comcast's use of covert fees to covertly jack up the cost of service is something that has plagued the broadband and TV sectors in particular for years, though regulators and lawmakers have consistently turned a blind eye to the practice. Similar suits have been filed against Charter Communications, at which point the nation's other extremely-disliked cable provider tried to claim it was simply providing an amazing consumer benefit.

Filed Under: cable tv, class action, fees, hidden fees, truth in advertising
Companies: comcast

AT&T Claims Forced Arbitration Isn't Forced... Because You Can Choose Not To Have Broadband

from the heads-I-win,-tails-you-lose dept

For years, AT&T worked tirelessly to erode its customers' legal rights, using mouse print in its terms of service preventing consumers from participating in lawsuits against the company. Instead, customers were forced into binding arbitration, where arbitrators employed by the companies under fire unsurprisingly rule in their employer's favor a huge percentage of the time. Initially, the lower courts derided this anti-consumer behavior for what it was, critics highlighting that however brutally-flawed the class action system can be, binding arbitration in many ways made things worse.

But these lower court roadblocks quickly evaporated when the Supreme Court ruled in 2011 (Mobility v. Concepcion) that what AT&T was doing was perfectly OK. While lower courts saw this as an "unconscionable" abuse of consumer rights and the law, the Supreme Court bought into the ongoing myth that binding arbitration is a hyper-efficient, modern alternative to class actions. The Supreme Court reiterated its position in 2015, and now, thanks to AT&T, most companies employ similar language in their terms of service fine print.

This year, CBS News launched an investigation into AT&T and DirecTV's business practices and found a huge number of customers that were being systematically over-charged by the company, facing significantly higher rates after they'd signed up for what they thought would be a fixed, advertised rate. In response, a number of Senators fired off a letter to AT&T, urging it to explain itself and noting that binding arbitration appears to have removed a layer of accountability at the company, allowing problems like this to only get worse:"

Forced arbitration provisions in telecommunications contracts erode Americans' ability to seek justice in the courts by forcing them into a privatized system that is inherently biased in favor of providers and which offers virtually no way to challenge a biased outcome. Forced arbitration requires consumers to sign away their constitutional right to hold providers accountable in court just to access modern-day essentials like mobile phone, Internet, and pay-TV services.

AT&T's response? To deny that they use forced arbitration at all, despite the last decade of debate on the subject and AT&T's obvious legal win. According to AT&T you see, it can't be "forced" arbitration, because consumers have the freedom not to subscribe to TV or broadband service:

"At the outset, no AT&T customer is ever 'forced' to agree to arbitration," AT&T Executive VP Tim McKone wrote in a letter to US senators today. "Customers accept their contracts with AT&T freely and voluntarily; no one 'forces' them to obtain AT&T wireless service, DirecTV programming, or other products and services."

Except FCC data indicates that two-thirds of households only have access to one ISP at "next-generation" (25 Mbps) broadband speeds, meaning if many people want to be connected, it has to be via AT&T. Even if you happened to have alternative broadband options, those companies would also employ binding arbitration thanks to AT&T's win. It's a lose-lose scenario for consumers, and one that's not getting resolved any time soon given the current dysfunction in Congress, and the downright hostility toward consumers at the current FCC.

And yes, again, it's very true that the class action system is a broken mess that all-too-often results in lawyers getting far more than the people they're supposed to be representing. But in telecom, class actions do have a history of forcing change (remember when wireless providers used to extend your long-term contract every time you made a minor billing change?). And replacing that broken system with an even worse system that minimizes accountability, erodes consumer legal rights and reduces already dwindling incentive to behave certainly didn't do American consumers any favors.

Filed Under: arbitration, broadband, class action, forced arbitration, tv
Companies: at&t