MySpace Tries To Play Dead To Avoid Lawsuits

from the hide-and-seek dept

Yes, let's get this out of the way already, so you don't need to make this joke in the comments: as a social network, MySpace is considered pretty damn dead already. It lost its cool many, many years ago. And I do still love to point out this 2007 article suggesting that MySpace's dominant position in the social networking market was almost impossible to crack (that didn't age well). But that's not what this post is about. You see, MySpace, still does exist -- you can even visit it and double their traffic for the day. Even as the punchline in bad jokes, MySpace exists and (believe it or not) Time Inc. actually owns it, having bought the company, Viant, that owned it previously.

This story, however, is about how, soon after Time took over MySpace, its lawyers literally tried to hide the company from a plaintiff (and the court) by having the company play dead -- even though it was very much alive. I'm not exaggerating. Time Inc. appeared to play a bunch of legal shenanigans to pretend that MySpace no longer existed, even as the company kept operating -- to the point that Viant's CEO was publicly hyping MySpace. Hell, months after Time Inc. tried to pretend MySpace was dead, Time's CEO was talking up how amazing MySpace was in the press.

The background here: years ago, a guy named Stephen Aguiar was arrested and convicted for drug distribution. He's in prison, serving 25 years. Sometime after his conviction he discovered that some of the evidence against him, that was supplied by MySpace (way back when MySpace was still a big thing), quite likely violated the Stored Communications Act.

Additional background: We've written about the Stored Communications Act before. It's a part of the Electronic Communications Privacy Act (ECPA) that controls what kind of electronic information can be given up without a warrant. As we've also discussed for years, ECPA is woefully out of date for a variety of reasons including the fact that it says that all communications stored on a server for more than 180 days should be considered abandoned and no longer need a warrant to access. But communications less than 180 days do require a warrant.

Back to Aguiar. In late 2013 he discovered that back in 2009, the DEA sent an administrative subpoena to MySpace, under the Stored Communications Act, asking for certain content related to his MySpace account. An administrative subpoena is not a warrant. As we've described in the past, it's basically a fishing expedition by law enforcement, in which they send an official looking document asking for information they may not actually have the rights to. MySpace, back in 2009, apparently had lawyers who fell for this and handed over basically all of Aguiar's account info, despite at least some of it being protected under the SCA and requiring an actual warrant (which would require probable cause and a judge's review).

Thus, in 2014, he sued MySpace for violating the Stored Communications Act, representing himself (pro se). At this point, MySpace was owned by Viant and it hired some lawyers to defend the case. All well and good. But, within weeks of Time Inc. buying Viant, something sketchy started happening. Without telling anyone, Time claims that it changed the name of its "MySpace LLC" subsidiary to "Legacy Vision LLC." Then, it "transferred" all of MySpace's assets to Viant. Four days later, it registered a brand new company... also called MySpace LLC. While this was happening, Time/MySpace basically told no one about this. The people operating MySpace had no idea and nothing changed. Even the lawyers who were representing MySpace in the case knew nothing about it and continued to represent the company for months -- only to be told about six months later that the company they were representing stopped existing months earlier.

Prior to this MySpace had moved to dismiss the lawsuit, and was denied. So the case was supposed to move forward and MySpace was supposed to file an answer to the complaint. Except... it didn't. It didn't do anything at all. The magistrate judge, Patrick Walsh, demanded that the lawyer representing MySpace, Jane Rheinheimer, show up in court leading to a hearing last December with a fairly incredible transcript. Some excerpts:

RHEINHEIMER: My name is Jane Rheinheimer, I’m former counsel, well, counsel for the former MySpace LLC.

THE COURT: Okay. And who’s the representative from MySpace or Legacy?

RHEINHEIMER: There is none, your honor.

THE COURT: Why not?

RHEINHEIMER: Neither MySpace nor Legacy Vision LLC exists as an operating entity anymore, your honor.

THE COURT: Well that sounds like a lawyer talking, like as an operating an entity. Somebody signed a change in the name change in the spring.

RHEINHEIMER: It’s my understanding, your honor. And- My understanding is that Legacy Vision LLC currently exists only in name with the secretary of state. There is no management; there is no employees; there is no asset; there is no anything; there is no operating entity there, your honor.

Got that? There's a sneaky game being played here. Effectively, it appears that Time is claiming that the MySpace that was sued became Legacy Vision, but that Legacy Vision shut down and isn't operating at all. And that this operating MySpace is someone else entirely. The judge was... not impressed, leading to this crazy exchange between the judge and Aguiar (again, representing himself in court, where the judge is helping by explaining what's going on):

THE COURT: Okay. All right, Mr. Aguiar, what do you want to do?

AGUIAR: I’m kind of out of my area of expertise, your honor. My understanding was that the name changed in March. Weren’t the parties obligated to notify either me or the court?

THE COURT: Of course they were. This is middle school stuff, right?

AGUIAR: Right.

THE COURT: This is how four year olds play hide-and-go seek. When you tell them to go hide and go seek, they cover their eyes, and they think you can’t see them, right?

AGUIAR: Right.

THE COURT: So MySpace changed its name to Legacy and they’re like, “There’s no more MySpace, Court.” Okay, here’s what I’m going to do. I’m adding Legacy. I’m going to give you a default... and you can do what you want with it. All right?

In other words, the court was making it clear that it wasn't buying this game. Of course, that same transcript included the court refusing to let MySpace's former lawyer withdraw from the case, even as she was pointing out that she no longer has a client to pay her, because her "client" claims the company no longer exists:

THE COURT: We’ll be entering the default and you make your motion for default judgment. Ms. Rheinheimer, I understand you’re in a tough spot, but your request to withdraw as counsel is denied, okay? Corporations cannot proceed in the federal court without a lawyer and there’s no good reason for you to be off this case. I think it’s just gamesmanship that’s going on with Legacy and MySpace and Mr. Lee, and I’m not letting you off. We’re going forward. He’s going to file a motion for default judgment and if you don’t want to fight that, don’t fight it. I’ll enter the default judgment, okay? And you can go back…

RHEINHEIMER: Very well, your honor. There is no entity to pay me. I have no way of, I have no way of getting paid. There is noth…

THE COURT: I want to tell you I’ve been in this- as a law clerk, I worked at DOJ at the US attorney’s office and I’ve been a Judge for 15 years. I want to tell you what I understand what’s always been the practice since 1984, when I externed for Judge Layton at the federal district court in Chicago. We’re not here, we’re not bill collectors. The fact that you can’t get paid, the rules don’t provide ‘you have to represent your client diligently unless you client is not paying you’. And our local rules don’t require, don’t allow you to get out from under a case because your client isn’t paying you. That’s something you have to- I’m not in the middle of those negotiations. You need to call up Mr. Lee and say, “Hey Judge Walsh is leaving me on this case. I need to get paid.” And I think you should get paid, okay? I’m on your side there, but you’re not flipping the district court upside down because you’re not getting paid. All right?

Soon after this, a few things happened. First, the "new" MySpace got angry at being added to this case, and hired some new lawyers who filed to "intervene" in the case (even though they should already be in the case as it's the same MySpace) in order to try to fight the ruling. The filing is a work of art if legal bullshit were an artform. It insists that MySpace LLC is some totally unrelated company to the MySpace LLC in the lawsuit and acts positively shocked that anyone might think they are the same:

Plaintiff’s Motion constitutes his latest attempt to obtain a default judgment against a company that: (1) never had any dealings with Plaintiff; (2) was never named as a party to this lawsuit; (3) did not exist until well after the conduct complained of in Plaintiff’s complaint occurred; and (4) is both factually and legally a separate entity from the “Myspace LLC” identified in Plaintiff’s complaint which Plaintiff admits now operates under the name Legacy Vision LLC (hereinafter “Judgment Debtor”).

In a separate filing, MySpace attempts to argue that when Time bought Viant/MySpace it structured a complicated agreement in which it was buying the assets, not the liabilities -- and thus the complicated shell corporation and asset movement was really about fulfilling that agreement.

Second, Aguiar got legal representation from lawyer Caleb Mason, who some of you may recognize as a partner of Ken "Popehat" White's. Mason then opposed the intervention and detailed much of the history I summarized above -- including pointing out that despite the name changes and new corporations, MySpace hasn't changed. The same lawyer who accepted service for the original lawsuit is still VP of legal affairs. The same lawyer representing the firm now represented the firm earlier in other cases. The same CEO of Viant/MySpace is still CEO of Viant/MySpace (now a Time Inc. subsidiary).

Third, the original MySpace/Viant lawyer filed a declaration to the court more or less burning MySpace/Viant for telling her to stop doing anything on the case in September way after all the shell games happened, and then completely ignoring her every time she tried to contact them about things moving forward in the case (including the court refusing to let her withdraw):

As is set forth in more detail in the Motion to Withdraw and Declaration of Jane A. Rheinheimer which is filed concurrently with the instant Declaration of Inability to File Opposition or Notice of Non- Opposition, all communication from Viant, Inc. and/or MYSPACE, LLC has ceased. I was advised by the previous corporate counsel for Viant, Inc. on September 16, 2016, that my firm’s services would no longer be required in connection with this matter. Additional written communications from my office on September 16, December 20, December 21, December 22, December 27, and December 29, 2016 and January 10, January 31, February 1, and February 3, 2017 have gone unanswered. I have sent corporate counsel copies of all pleadings, motions, and minute orders of this Court. All of these communications were sent via electronic mail, none of which have been returned.

Given all that, a few days ago the judge, James Otero, ruled in the case... and to say that he's less than pleased with Time Inc./MySpace's games here would be an understatement. The ruling denies "MySpace LLC"'s request to intervene, because the judge notes it was already a party to the case and just chose to ignore it. All the maneuvering is written off as "gamesmanship and evasion." This is the kind of thing you generally don't want to hear a judge saying about your actions in a case:

The Court agrees that this is not a run-of-the-mill motion for default judgment. Although it claims otherwise, MySpace has been actively opposing the motion and has concealed material information or otherwise muddied its representations to the Court.

As for the claim that Time only bought the assets and not the liabilities, the court isn't buying it:

Through a complicated series of transactions not previously disclosed to the Court, Proposed Intervenor argues that a Time, Inc. subsidiary transferred MySpace's assets–but none of its liabilities–to Proposed Intervenor, which currently operates under the same.... MySpace fails to provide any documentation to support these purported transactions.

Also, as to the claims in MySpace's attempt to "intervene" that MySpace LLC didn't exist prior to all of this, the judge points out, wryly, some oddities if that's the case:

A search of "MySpace LLC" on the California Secretary of State website reveals that it has the same address as the headquarters of Time, Inc., the parent company of Viant.... A search of "Legacy Vision LLC" on the website shows that Legacy Vision filed a Statement of Information on November 2, 2015–four months before Defendant MySpace allegedly changed its name to Legacy Vision–with the following information: the limited liability company name is listed as "MYSPACE LLC"; the manager of the entity is "Viant Technology Inc."; and the "AUTH PERSON" who completed the form was Timothy C. Vanderhook, Chief Executive Officer of MySpace LLC and Viant Technology LLC.... "Viant Technology Inc." is listed as the "Manager" of Legacy Vision, and has an address that matches that of Viant Technology LLC's headquarters in Irvine, California....

Moreover, Proposed Intervenor's counsel, LTL Attorneys LLP ("LTL"), was counsel of record for MySpace LLC in another action in the District of Delaware, captioned FO2GO LLC v. MySpace LLC, No. CV 15-00095 RGA (the "Delaware Action"), filed January 27, 2015.... In other words, assuming Proposed Intervenor did not exist until March 2016, it was somehow represented by the same firm over a year before.

The court further calls out attempts by this MySpace to also pretend that Viant Technology LLC and Viant Technology Inc. are somehow different companies (they are not). It goes on and on along these lines, including pointing out that the company had a legal obligation to update the court and the plaintiff in the case to changes in ownership to the defendant -- and eventually orders MySpace to pay Aguiar $1,000 for violating his rights under the SCA, but also to pay nearly $75,000 in Aguiar's legal fees.

What a mess. This kind of bullshit gamesmanship — having Time Inc. pretend that MySpace is dead just to avoid a court case — is the reason lawyers (especially corporate lawyers) have such a bad reputation among so many people. Thankfully it's not always so easy to get away with.

Filed Under: caleb mason, corporate lawyers, dea, ecpa, shell corporations, stephen aguiar, stored communications act
Companies: legacy vision, myspace, time, viant

New York Appeals Court Says Facebook Can't Challenge The 381 Broad Warrants Handed To It By New York Prosecutors

from the no-standing-and-no-remedy dept

Almost four years ago, Manhattan DA Cyrus Vance's office issued 381 warrants seeking information on Facebook subscribers. The warrants arrived almost immediately after the first Snowden leaks, which quite possibly pushed Facebook towards challenging the multitude of overbroad warrants.

Once the gag order was lifted, Facebook was able to reveal the astonishing breadth of the DA's demands. Hoping to dig up info on participants in a disability fraud scheme -- one that had already resulted in the arrests of more than 100 former police officers and firemen -- the 381 warrants demanded everything Facebook had on the named accounts, including private messages, Friends lists, and a variety of non-public content.

Facebook spent the next three years fighting the warrants in New York courts. It hasn't gone particularly well. There's the issue of standing, which few courts are willing to grant to third parties seeking to protect the privacy of their subscribers and users.

The case has reached the top of the New York judicial system, and the result is a loss for both Facebook and its users. The state's top court has rejected Facebook's appeal on procedural grounds, saying the company lacks standing to challenge the warrants. According to the court, it's up to individual users to challenge the validity of the warrants, something they can only do after the warrants have been served and fulfilled.

Facebook sought to have the warrants treated as subpoenas, which would have given it a bit more standing to challenge prosecutors' demands. It pointed out the warrants used by Vance's office more resembled subpoenas, as they weren't deployed by law enforcement to perform a search of the target's residence/papers, but rather served to a third party to demand digital data. A subpoena would be challengeable by Facebook, seeing as it's both the target and the recipient.

The lower court didn't find this persuasive and neither does the New York Supreme Court. From the decision [PDF]:

[A]n SCA warrant compels a third party -- here, Facebook -- to compile and turn over digital data under its control, and the presence of a law enforcement officer is not required for service or execution of the warrant. A traditional search warrant, by comparison, authorizes law enforcement to enter, search, and seize property. These differences in execution, however, can be easily explained by the nature of the material sought. The service provider is more likely to be better equipped to access and conduct a search of its own digital information than law enforcement personnel, and the data may be stored in different locations. Thus, the framework of execution for SCA warrants ensures efficiency and minimizes intrusion into the provider's business while promoting and protecting legitimate law enforcement interests in criminal investigation.

Despite the minor similarities between SCA warrants and subpoenas, in this post-digital world, we are not convinced that SCA warrants -- which are required under the statute to obtain certain content-based information that cannot be obtained with a subpoena due to heightened privacy interests in electronic communications -- should nevertheless be treated as subpoenas.

With that argument out of the way, the court affirms the lower court's ruling: Facebook does not have standing to challenge the 381 warrants issued by prosecutors. If Facebook doesn't like it, it's welcome to take it up with its Congressional representatives.

The dissenting opinion is less kind to the majority's opinion -- and to the actions of DA Vance's office. Judge Wilson lays down this scathing description of the warrants the court says Facebook can't challenge.

The facts are these: On the basis of a single 93-page affidavit (not subsequently shown to Facebook, or to its users whose files were seized, or to the Appellate Division, or to this Court), Supreme Court issued 381 warrants. Those bulk warrants authorized the seizure of what the District Attorney tepidly describes as "specified categories of information," but which functionally amounts to 381 users' entire histories on the platform. At least several of the users were high school students who are unlikely to have themselves been suspects in the investigation.

The warrants compelled Facebook to produce not only any and all text, photos, or videos a user had shared with her limited universe of friends, but also any private messages exchanged between the user and another individual (who could have been a spouse, doctor, religious figure, or attorney), as well as information the user had chosen to no longer share with anyone, such as a previous email address, a deleted friend, or a hidden post, and information the user had never intended to share with anyone, such as her searches and location.

It also compelled Facebook to produce content shared by users who were not named in the 381 warrants, and may not even have known anyone named in the 381 warrants, but had the misfortune of posting on the timelines of those users, uploading photos of those users, or simply belonging to any one of the groups with which a named user was affiliated.

Wilson's dissent goes on to point out the end result of this "our hands are tied by a perverse combination of federal, state, and local laws" decision: Facebook will be forced to entertain even more of these overly-broad warrants. The court's decision eliminates any possible remedy for service providers.

Finally, this appeal is the only opportunity to litigate fully the rights Congress granted to Facebook. The grounds underlying at least one portion of Facebook's motion to quash are specific to Facebook, not its users, and Facebook is before us to defend not only the constitutional rights of its users (where the majority has focused its analysis), but also its own business interests.

Even if those users could realistically seek relief for their own injuries through pretrial suppression hearings or Section 1983 suits -- which the majority believes, but I dispute -- Facebook will not be a party to those actions and the hypothetical resolution of their claims would not address or remedy Facebook's injuries. The majority does not suggest an alternative means for the company to vindicate its right to be free of unusually voluminous or unduly burdensome requests.

[...]

Under the majority's decision, this Court is powerless to protect the business interests of a major company [or] return information seized from either the 381 individuals, many of whom were never suspected of wrongdoing, or the thousands of innocent individuals who communicated or simply happened to share an interest with a user named in the bulk warrants…

This is a straight-up win for DA Cy Vance's office and New York law enforcement. It does nothing for anyone else involved in the equation, including the vast majority of those swept up in the "search." As the dissent notes, only 62 of those named in the warrants ever faced criminal charges. Most of those whose information was sought were innocent bystanders who had the unforeseeable misfortune of communicating with -- or being Facebook friends of -- people caught up in an incredibly broad and far-reaching fraud investigation.

Filed Under: cyrus vance, new york supreme court, sca, stored communications act, warrants
Companies: facebook

Court Says Microsoft Can Sue Government Over First Amendment-Violating Gag Orders

from the prior-restraint,-but-for-forever-wars dept

One of several service providers to sue the government over its gag orders, Microsoft received some good news from a federal judge in its lawsuit against the DOJ. Microsoft is challenging gag orders attached to demands for data and communications, which the DOJ orders is statutorily-supported by the Electronic Communications Privacy Act (ECPA) and, if not, by supposed national security concerns.

As Microsoft pointed out in its lawsuit, the government rarely justifies its secrecy demands and frequently issues gag orders with no endpoint. Microsoft received nearly 2,800 of these gag-ordered requests over an 18-month period, with over two-thirds of them demanding silence indefinitely.

The good news is a federal judge has (partially) waved away the DOJ's motion to dismiss and will allow Microsoft to proceed with its lawsuit, as Politico's Josh Gerstein reports.

U.S, District Court Judge James Robart issued a 47-page opinion [PDF] Thursday allowing Microsoft to proceed with a lawsuit claiming a First Amendment violation when the government restricts internet providers from notifying subscribers about requests for their data.

"The orders at issue here are more analogous to permanent injunctions preventing speech from taking place before it occurs," Robart wrote. "The court concludes that Microsoft has alleged sufficient facts that when taken as true state a claim that certain provisions of Section 2705(b) fail strict scrutiny review and violate the First Amendment."

Section 2705(b) refers to the Stored Communications Act, which allows the government demand notice be withheld under certain circumstances, unless otherwise forbidden to by another section of the same law (Section 2703). Microsoft is looking to have both sections declared unconstitutional, especially given the severe upheaval the communications landscape has undergone in the thirty years since the law was passed.

Microsoft contends that Section 2705(b) is unconstitutional facially and as applied because it violates the First Amendment right of a business to “talk to [the business’s] customers and to discuss how the government conducts its investigations.” Specifically, Microsoft contends that Section 2705(b) is overbroad, imposes impermissible prior restraints on speech, imposes impermissible content-based restrictions on speech, and improperly inhibits the public’s right to access search warrants. Microsoft also alleges that Sections 2705(b) and 2703 are unconstitutional facially and as applied because they violate the Fourth Amendment right of “people and businesses . . . to know if the government searches or seizes their property.”

Microsoft contends that the statutes are facially invalid because they allow the government to (1) forgo notifying individuals of searches and seizures, and (2) obtain secrecy orders that “prohibit providers from telling customers when the government has accessed their private information” without constitutionally sufficient proof and without sufficient tailoring.

The DOJ argued Microsoft didn't have standing to bring this complaint, as its Fourth Amendment rights aren't implicated. Only its customers' are. But the court points out that, if nothing else, the company does have standing to pursue its claims of First Amendment violations.

The court finds that Microsoft has sufficiently alleged an injury-in-fact and a likelihood of future injury. Microsoft alleges “an invasion of” its “legally protected interest” in speaking about government investigations due to indefinite nondisclosure orders issued pursuant to Section 2705(b)... The court concludes that Section 2705(b) orders that indefinitely prevent Microsoft from speaking about government investigations implicate Microsoft’s First Amendment rights.

The court goes on to point out that frequent use of indefinite gag orders certainly appears to be unconstitutional, given that they act as a "forever" application of prior restraint.

The court also concludes that Microsoft's assertions of further civil injuries aren't speculative, as the DOJ claimed. Judge Robart points to the government's own actions as evidence of continued harm to Microsoft's civil liberties.

Microsoft bolsters its prediction by alleging that over a 20-month period preceding this lawsuit, the Government sought and obtained 3,250 orders–at least 4504 of which accompanied search warrants—that contained indefinite nondisclosure provisions. In addition, Microsoft alleges that in this District alone, it has received at least 63 such orders since September 2014. Because these orders have been frequent and issued recently, the Government will likely continue to seek and obtain them. Accordingly, Microsoft’s “fears” of similar injuries in the future are not “merely speculative.”

Unfortunately, the court won't grant Microsoft the standing to represent its users for Fourth Amendment purposes. Judge Robart points to a whole bunch of precedential decisions declaring otherwise, but at least takes a bit of time to discuss how denying Microsoft this opportunity likely means denying several of its users any sort of redress.

The court acknowledges the difficult situation this doctrine creates for customers subject to government searches and seizures under Sections 2703 and 2705(b). As Microsoft alleges, the indefinite nondisclosure orders allowed under Section 2705(b) mean that some customers may never know that the government has obtained information in which those customers have a reasonable expectation of privacy... For this reason, some of Microsoft’s customers will be practically unable to vindicate their own Fourth Amendment rights.

Expect the government to make heavy use of its "national security" mantra as it defends itself in this case. Those magic words have allowed all sorts of civil liberties violations in the past and still tend to move courts to the government's side when deployed in DOJ motions. If the court does side with Microsoft when this is all said and done, it's likely the remedy won't be a restriction on gag orders, but more likely something analogous to the rules that now govern National Security Letters -- periodic review of gag orders by the government and better avenues for raising challenges for companies affected. Then again, the court could simply punt it back to legislators and push them to fix the 30-year-old law whose dubious constitutionality is the source of numerous lawsuits against the federal government.

Filed Under: doj, ecpa, first amendment, gag orders, sca, stored communications act, surveillance
Companies: microsoft

Barrett Brown's Donors Sue DOJ/FBI For Monitoring Their Donations

from the what-kind-of-world-do-you-want-to-live-in? dept

We've written numerous stories about Barrett Brown, the reporter who was sentenced to 63 months in jail after being pressured into signing a plea deal. If you don't recall, Brown's "crime" was trying to get a bunch of people together to crowdsource an investigation into the famous Stratfor email hack. The feds went after him for posting a link (yes, posting a link) to a group to investigate, and because some of the Stratfor info included credit card data, the feds argued that Brown was trafficking in stolen credit cards. Really. And while the feds eventually dismissed the specific charges related to the links, the judge justified the long sentence against him because he copy/pasted that link.

The whole thing was a travesty. Brown is thankfully out of jail now, but earlier this week, Kevin Gallagher, who helped organize a legal defense fund for Brown, sued the Justice Department over claims that the DOJ illegally tracked and monitored everyone who donated to support Brown. Gallagher is looking to make this a class action lawsuit. You can read the full complaint here. From the filing:

The government agents responsible for the arrest and prosecution of the journalist violated the First Amendment by seeking the identities of the donors to the crowd-funding campaign, as well as the amounts of each donation. This violation began when Assistant United States Attorney Candina Heath sent a subpoena (the “WePay Subpoena”) to WePay, Inc. (“WePay”), the host of the crowd-funded legal defense fund, directing WePay to send “any and all information” pertaining to the legal defense fund to Special Agent Robert Smith of the Federal Bureau of Investigation (“FBI”). The subpoena claimed that the information it requested would be used at the trial of the jailed journalist. However, the identities of, and the amounts donated by, the journalist’s supporters are completely irrelevant to the charges levied against the journalist. On information and belief, the WePay Subpoena was part of a larger scheme by Ms. Heath and Mr. Smith to unlawfully surveil the donors in violation of the First Amendment. As the Ninth Circuit has recognized, “[t]he right of those expressing political, religious, social, or economic views to maintain their anonymity is historic, fundamental, and all too often necessary. The advocacy of unpopular causes may lead to reprisals – not only by government but by society in general. While many who express their views may be willing to accept these consequences, others not so brave or so free to do so will be discouraged from engaging in public advocacy.”

The lawsuit further argues that the subpoena violated the Stored Communications Act (part of ECPA), because it sought the content of electronic communications without a warrant. That's because, in using WePay, donors were able to also include messages of support for Barrett Brown -- and the feds requested that info without a warrant (and the content was less than 180 days old, which still does require a warrant). That's... a problem.

The details of the lawsuit also question whether or not the administrative subpoena that was used to request the info was issued under false pretenses (i.e., it was claimed that the info was necessary for the prosecution of Brown, but instead of being sent to the prosecution team, it was sent instead to the FBI):

The WePay Subpoena indicated that the information it requested would be used in the trial of Barrett Brown. Oddly enough, however, instead of asking WePay to send its response directly to Ms. Heath, the prosecutor, or to lodge its response with the court, the WePay Subpoena compelled WePay to produce information directly to Agent Smith of the FBI. This renders the WePay Subpoena improper under Federal Rule of Criminal Procedure 17(c). It also demonstrates that Defendants’ claimed purpose of using the information produced in response to the WePay Subpoena at Barrett Brown’s trial was purely pretextual. The true goal of the WePay Subpoena, rather, was to facilitate the unlawful surveillance of the anonymous donors to the crowd-funding campaign.

I have no idea if this case has any chance at all. My suspicion is that the courts will figure out a way to dump it pretty quickly, but at the very least, it should call attention to the question of why the FBI felt that it needed all of the info on everyone donating to Barrett Brown, a journalist they railroaded into jail.

Filed Under: barrett brown, class action, doj, donations, ecpa, fbi, first amendment, kevin gallagher, sca, stored communications act

Pennsylvania Court Shrugs Off Microsoft Decision; Says Google Must Turn Over Emails Stored At Overseas Data Centers

from the redefining-'seizure' dept

Just south of the Second Circuit Court of Appeal's district, a Pennsylvania (3rd Circuit) federal judge has come to (nearly) the opposite conclusion on law enforcement's access to emails stored overseas. This case deals with two FBI SCA (Stored Communications Act) warrants seeking emails that Google says aren't stored in the United States. Google, however, also says the sought emails could be at any of its data storage sites -- which would include those in the US. It all depends on when it's asked to retrieve the communications.

And there's where this decision parts ways with the Second Circuit, which found that emails stored in an Irish data center weren't subject to US-issued warrants. The court explains [PDF] Google's process for handling user data, which is built for efficiency, rather than what's central to the FBI's demands: efficiency of retrieval in response to law enforcement requests.

Google stores user data in various locations, some of which are in the United States and some of which are in countries outside the United States. Some user files may be broken into component parts, and different parts of a single file may be stored in different locations (and, accordingly, different countries) at the same time. Google operates a state-of-the-art intelligent network that, with respect to some types of data, including some of the data at issue in this case, automatically moves data from one location on Google's network to another as frequently as needed to optimize for performance, reliability, and other efficiencies.

As a result, the country or countries in which specific user data, or components of that data, is located may change. It is possible that the network will change the location of data between the time when the legal process is sought and when it is served. As such, Google contends that it does not currently have the capability, for all of its services, to determine the location of the data and produce that data to a human user at any particular point in time.

Because of the way Google handles data, it theoretically could refuse every US law enforcement request for communications. (It could do the same to foreign requests as well.) This makes Google's case distinguishable from Microsoft's legal battle. Microsoft knew exactly where the stored communications were located. Google says the communications might be anywhere -- in one place upon receipt of a warrant and in another when retrieval efforts begin. As the court sees it, the Second Circuit's ruling would basically make Google completely immune to law enforcement requests.

[I]f the court were to adopt Google’s interpretation of the Microsoft decision and apply such a rationale to the case at bar, it would be impossible for the Government to obtain the sought-after user data through existing MLAT channels.

The "fix," according the Pennsylvania court, is to have Google round up the sought communications in the US, putting them within reach of the FBI's warrants.

In contrast, under this court’s interpretation, Google will gather the requested undisclosed data on its computers in California, copy the data in California, and send the data to law enforcement agents in the United States, who will then conduct their searches in the United States.

Of course, this means compelling Google to do something with its data that it doesn't normally do, which would make it a seizure. And since the data sought is constantly in transit, the court is giving the government the power to step in and alter Google's data-handling. This would obviously be a seizure of data potentially stored (at least temporarily) in foreign countries. To get around the Fourth Amendment concerns this raises -- not to mention the expansion of the US government's power to compel the production of data from foreign servers -- the court decides no seizure actually takes place until the government takes control of the data Google has been ordered to compile.

In contrast to the decision in Microsoft, this court holds that the disclosure by Google of the electronic data relevant to the warrants at issue here constitutes neither a "seizure" nor a "search" of the targets' data in a foreign country. This court agrees with the Second Circuit's reliance upon Fourth Amendment principles, but respectfully disagrees with the Second Circuit's analysis regarding the location of the seizure and the invasion of privacy.

[...]

Electronically transferring data from a server in a foreign country to Google's data center in California does not amount to a "seizure" because there is no meaningful interference with the account holder's possessory interest in the user data. Indeed, according to the Stipulation entered into by Google and the Government, Google regularly transfers user data from one data center to another without the customer's knowledge. Such transfers do not interfere with the customer's access or possessory interest in the user data. Even if the transfer interferes with the account owner's control over his information, this interference is de minimis and temporary.

This is a really weird -- and wrong -- interpretation of the word "seizure." While it's true the FBI won't actually have taken possession of the emails until after Google has gathered them in a California datacenter to make them more Fourth Amendment-compliant (or whatever), the fact that Google has to interrupt its normal flow of data at the government's request would appear to make that initial interruption a "seizure" -- de minimis or not.

In essence, the court is saying the Fourth Amendment doesn't apply to data in transit. The government can compel the collection of overseas data and have the Fourth Amendment applied to it after it's already been gathered and stored locally. The decision makes a mess of the Fourth Amendment cart-horse configuration, but figures this is more acceptable than informing the FBI that its warrants might be useless.

The better conclusion to reach would be the one the Second Circuit reached: if the concern is that the 30-year-old SCA limits law enforcement's ability to demand data from overseas data centers run by US companies, the solution lies with the entity that created it (Congress), rather than the courts. This decision will be appealed and it's safe to assume the Third Circuit Court of Appeals will arrive at the same conclusion.

Even if Congress doesn't "fix" the SCA to make US companies with foreign data centers more responsive to law enforcement demands, cases going forward may start applying the Rule 41 changes that went into effect at the beginning of this year, which greatly expand the jurisdictional reach of US court-issued warrants. As for Google, its system isn't built with law enforcement's needs in mind, nor should it be. It does what works best for it, which is what we expect from private companies. This ruling gives law enforcement a workaround for dealing with the SCA's limits, so some forum shopping should be expected until this decision is (hopefully) overturned.

Filed Under: 4th amendment, ecpa, emails, pennsylvania, stored communications act, subpoena, third circuit, warrant
Companies: google, microsoft

Airbnb Goes To Court To Stop San Francisco's New Anti-Airbnb Law

from the section-230 dept

Back in May, we noted that large cities around the country were rushing to put in place anti-Airbnb laws designed to protect large hotel companies. In that post, we noted that many of the bills almost certainly violated Section 230 of the CDA by making the platform provider, Airbnb, liable for users failing to "register" with the city. Section 230, again, says that a platform cannot be held liable for the actions (or inactions) of its users. San Francisco was the first city to get this kind of legislation pushed through. And while the city's legislators insisted that Section 230 didn't apply, they're now going to have to test that theory in court. Airbnb has asked a court for a preliminary injunction blocking the law, based mainly on Section 230, but also mentioning the Stored Communications Act and tossing in a First Amendment argument just in case.

As designed and drafted by the Board of Supervisors, the Ordinance directly conflicts with, and is preempted by, Section 230 of the Communications Decency Act, 47 U.S.C. § 230 (the “CDA”). According to its own sponsors, the law holds “hosting platforms accountable for the hundreds of units (rented by) unscrupulous individuals” posting listings on their websites, and holds “Airbnb Accountable for Listing Illegal Short Term Rentals.” Declaration of Jonathan H. Blavin (“Blavin Decl.”)... As such, the Ordinance unquestionably treats online platforms like Airbnb as the publisher or speaker of third-party content and is completely preempted by the CDA. In addition, the law violates the Stored Communications Act, 18 U.S.C. §§ 2701 et seq. (the “SCA”), by requiring disclosure to the City of customer information without any legal process, and the First Amendment as an impermissible content-based regulation.

As Airbnb points out, the city even recognized that the bill probably runs afoul of Section 230, but signed it into law anyway:

The City was not blind to the fact that the Ordinance might run afoul of the CDA and other laws. Following its passage, the Mayor’s office said that the “mayor remains concerned that this law will not withstand a near-certain legal challenge and will in practice do nothing to aid the city’s registration and enforcement of our short-term rental laws.” ... The City Attorney’s Office acknowledged that the Ordinance could raise “issues under the Communications Decency Act” but claimed that it had been drafted “in a way that minimizes” those issues by regulating “business activities” instead of “content.” ... Despite the City’s best efforts to tiptoe around the CDA through such semantic devices, the problem for the City is that the substance of what the Ordinance seeks to do violates the CDA. No amount of creative drafting can change that reality.

The Stored Communications Act argument involves the requirements of Airbnb to turn over information on its users. The SCA is a part of ECPA, the Electronic Communications Privacy Act, that is supposed to protect the privacy of electronic communications (though, it's in deep need of an update). Here, Airbnb points out that the city ordering it to release customer information almost certainly violates the SCA.

The verification provisions of the Ordinance separately are barred by the SCA. In a futile effort to sidestep the CDA, the Ordinance requires Hosting Platforms to verify listings by disclosing to the City host names and addresses “prior to posting” a listing—and without a subpoena.... But in this failed endeavor to avoid Section 230, the Ordinance runs smack into the SCA, which bars state laws that compel online services like Airbnb to release customer information to governmental entities without legal process.

The First Amendment argument is basically a backstop in case the CDA and SCA arguments fail, and then there's a Constitutional argument to appeal. If the court deals with the case on CDA and SCA grounds, it probably will avoid the First Amendment question altogether. But, the basis is that regulating types of advertisements on Airbnb's platform is a form of a content-based restriction on speech. And there is a strong argument that in restricting the content on the platform, rather than merely punishing the people who post their content to Airbnb, that the law violates the First Amendment. There are exceptions but, generally speaking, the First Amendment doesn't like any law that blocks out speech entirely, even if it's commercial speech.

The Ordinance also violates Hosting Platforms’ First Amendment rights. The prohibition on the publication of certain rental advertisements—i.e., those listings without verified registration numbers—is a content-based speech restriction subject to “heightened judicial scrutiny” under the First Amendment.... The City cannot meet its burden of demonstrating that this speech restriction directly advances a substantial state interest and does so in a narrowly tailored way. Even assuming the Ordinance actually advances a substantial state interest (which is questionable), it places a far greater burden on speech than is necessary to achieve that end. The “normal method of deterring unlawful conduct” is to punish the conduct, rather than prohibit speech or advertising regarding it.... The City cannot show that the obvious alternative of enforcing its existing laws against third-party residents who rent properties in violation of the law, rather than against Hosting Platforms, would be ineffective or inadequate. Just the opposite: it is clear the City could enforce its laws directly against hosts who violate them—as it already has begun to do with increasing effectiveness and success—rather than indirectly against Hosting Platforms that publish listings. Further, the law is unconstitutionally overbroad as it punishes platforms for publishing any listing without complying with its “verification” procedures—including those listings that may be lawful.

Whatever you think of Airbnb (and people seem to get more emotional about it than seems reasonable...), this lawsuit could become quite important in making sure that Section 230 remains strong in protecting internet services providing useful services to individuals. In the past month or so, we've seen a number of questionable Section 230 rulings (especially in California) that have started to chip away at this law. However, I don't see how any of those rulings directly apply to this case. The most direct comparison is probably the Model Mayhem case but, in that case, the court was clear that it allowed the California law requiring the platform to "warn" users to stand in part because it did not require the platform "to remove any user content or otherwise affect how it publishes or monitors such content." That's clearly not the case with this Airbnb law.

Either way, this is a case worth following, and hopefully one where the courts don't lop off another chunk of Section 230's protections (or, for that matter, the SCA's privacy protections).

Separately, there's a very, very bizarre NY Times article about this, falsely claiming that Airbnb is suing over a law it helped pass. That's just wrong. It's really bad reporting. Airbnb is clearly suing over the new language voted in by the SF Board of Supervisors earlier this month, and not the broader law that passed a few years ago.

Filed Under: cda 230, first amendment, intermediary liability, platforms, privacy, san francisco, sca, stored communications act
Companies: airbnb

Court: Cell Site Location Records From Five Minutes Ago Are 'Historical,' Not 'Real Time'

from the rewriting-history-multiple-times-per-hour dept

The word "historical" tends to conjure up images of musty buildings with plaques attached to them denoting the original construction and possibly who did what when, but several dozen years ago. While anything that happened just before right now could literally be termed "historical," most people tend to associate the word with things that happened well before the exact present.

Not so much the courts, though. "Historical" data involves anything not collected in "real time," apparently. The North Carolina Court of Appeals has ruled that something occuring at nearly any time before right now is "historical," even if the "history" itself traces back less than ten minutes.

Superior Court Judge Lucy N. Inman signed the order and Detective Mitchell submitted it to AT&T, the cellular phone service provider and holder of the account associated with the phone number. AT&T provided the records of the location of the cell phone tower “hits” or “pings” whenever a call was made to or from the cell phone. AT&T sent emails of the longitude and latitude coordinates of these historical cell tower “hits” to Detective Mitchell every fifteen minutes. Detective Mitchell testified an approximately five- to seven-minute delay occurred between the time the phone “pinged” a cell phone tower and the time AT&T received and calculated the location and sent the latitude and longitude coordinates to him.

This location info helped track the defendant to a motel and he was arrested shortly thereafter. The defendant sought to suppress the warrantless "search" of his cell phone and its location (obtained via a phone records production order that ran from a month before it was requested to two days after the request was granted [December 10, 2012]). The location data that traced the defendant back to the motel room was acquired (with a 5-7 minute delay) on December 11.

The defendant argued that the "real time" tracking of his location violated his Fourth and Fourteenth Amendment rights (as well as analogous parts of North Carolina's constitution). The court doesn't buy these arguments, citing the Stored Communications Act, which allows government entities to obtain certain third party records without a warrant. It says the difference between what's been considered unconstitutional by several courts -- obtaining real-time location information with a tracking device -- isn't what's happening here.

It argues that because the police didn't intercept these "records," everything is above-board, even if the sought "historical" data included two days of "records" that were created after the court order was approved.

Several courts have held the SCA permits a government entity to obtain cell tower site location information from a third-party service provider in situations where the cell tower site location information sought pre-dates the court order and where the cell tower site location information is collected after the date the court order issues. Although the former may technically be considered “historical” while the latter is “prospective” in relation to the date of the court order, both are considered “records” under the SCA. The government entity only receives this information after it has been collected and stored by the third-party service provider.

In plainer English, this means law enforcement entities can seek "historical" records from the "future," with the mitigating factor being that the records are collected by third parties first. A short delay of a few minutes is enough to call these records "historical" under this interpretation.

In a slightly-dissenting concurrence, Judge C.J. McGee diagrees with the court's definition of "historical" records (while finding the overall opinion valid because of the good faith exception).

Because most federal courts recognize that historical cell site information consists of information generated prior to the issuance date of a judicial order that allowed law enforcement to obtain such records for a given defendant, and because I believe allowing the majority’s characterization of the information provided by AT&T to law enforcement, based on the facts in this case, would effectively obliterate the distinction between “historical” and “real-time” cell site information, I must respectfully disagree with the majority’s characterization.

McGee points to a few details that make this "historical" location data far more analogous to real-time tracking: the fact that the court order allowed for the acquisition of cell site location records for two days past the point of issuance, that the police and AT&T remained in constant contact during the tracking of the suspect and the same short delay ("5-7 minutes") that the majority declared made the records "historical."

While the majority's interpretation dilutes the meaning of "historical" by including location data yet to be generated under its warrantless wing, it does point out to possible future problems with the use of Stingray devices. These have often been deployed with the same sort of court orders, but contain the ability to track individual phones in real time. Once more details on these deployments come to light, the courts will be forced to confront a plethora of Fourth Amendment violations -- at least if they're going to remain consistent with this interpretation of "historical."

Filed Under: 4th amendment, cell site location info, csli, ecpa, law enforcement, north carolina, sca, stored communications act
Companies: at&t

Appeals Court Says Warrantless Phone Tracking Doesn't Violate 4th Amendment Because 'Third Party Doctrine'

from the oh-boy dept

For about a year now, we've been following the Quartavious Davis en banc appeal case, in which Davis's lawyers were challenging the use of historical cell phone location data (not real time GPS info) that was collected without a warrant in order to convict him (technically, they used a 2703(d) order, which is a much lower standard than a warrant, which requires probable cause, rather than "specific and articulable facts that there are reasonable grounds" to believe that the info is "relevant and material to an ongoing criminal investigation"). Given the renewed interest of the Supreme Court (and other courts) in issues related to the 4th Amendment when it meets up with modern technology, this case got a lot of attention in the last few months. The 11th Circuit has now ruled and it isn't going to make 4th Amendment supporters happy. The court ruled that warrantless tracking of your mobile phone location is not an "illegal search" under the 4th Amendment... because of the old (and ridiculous) third party doctrine.

In case you've been living under a rock and not following such things, the third party doctrine basically says you have no expectation of privacy in data that third parties hold on you -- such as... phone records. This doctrine has a lot of problems (going all the way back to the Smith v. Maryland case that is generally cited in support of the doctrine). But, here, the court just runs with it. It spends a few pages restating the ruling in Smith v. Maryland, clearly agreeing with it, and then it drops the hammer:

For starters, like the bank customer in Miller and the phone customer in Smith, Davis can assert neither ownership nor possession of the third-party’s business records he sought to suppress. Instead, those cell tower records were created by MetroPCS, stored on its own premises, and subject to its control. Cell tower location records do not contain private communications of the subscriber. This type of non-content evidence, lawfully created by a third-party telephone company for legitimate business purposes, does not belong to Davis, even if it concerns him. Like the security camera surveillance images introduced into evidence at his trial, MetroPCS’s cell tower records were not Davis’s to withhold....

More importantly, like the bank customer in Miller and the phone customer in Smith, Davis has no subjective or objective reasonable expectation of privacy in MetroPCS’s business records showing the cell tower locations that wirelessly connected his calls at or near the time of six of the seven robberies.

It dives in a bit deeper on the "expectation of privacy" question and says that no one should have any expectation of privacy in their cell location data, basically saying that you should know that you're giving up such info to a third party who can give it to law enforcement:

We find no reason to conclude that cell phone users lack facts about the functions of cell towers or about telephone providers’ recording cell tower usage.

Thus, no "expectation" of privacy.

It also argues this is no different than the ruling in Smith v. Maryland, because, back then, just having the phone numbers (what that case was about) was the equivalent of also showing location, since in that pre-mobile phone era, a phone number also automatically revealed location since it was tied to an address. As for the public policy reasons why this result is pretty scary concerning the public's privacy, the court says, "Hey, take it up with Congress."

The court also distinguishes this case from the Supreme Court's ruling in US v. Jones from a few years ago, that said that attaching a GPS device to a car could violate the 4th Amendment due to it being a "trespass" (though on the side, some Justices raised concerns about the ongoing collection of location data). Basically the court here said it doesn't matter here, as there's no similar "trespass" situation with the MetroPCS data.

Two of the judges on the panel dissented, and pointed out just how crazy the third party doctrine is in this situation, and how it basically destroys the 4th Amendment:

We are asked to decide whether the government’s actions violated Mr. Davis’s Fourth Amendment rights. The majority says our analysis is dictated by the third-party doctrine, a rule the Supreme Court developed almost forty years ago in the context of bank records and telephone numbers. But such an expansive application of the third-party doctrine would allow the government warrantless access not only to where we are at any given time, but also to whom we send e-mails, our search-engine histories, our online dating and shopping records, and by logical extension, our entire online personas.

In short, those two judges rightly recognize just how problematic the third party doctrine is. In an age where all our info goes to third parties, the 4th Amendment basically goes away. Later, that same dissent notes:

The majority’s blunt application of the third party doctrine threatens to allow the government access to a staggering amount of information that surely must be protected under the Fourth Amendment. Consider the information that Google gets from users of its e-mail and online search functions. According to its website, Google collects information about you (name, e-mail address, telephone number, and credit card data); the things you do online (what videos you watch, what websites you access, and how you view and interact with advertisements); the devices you use (which particular phone or computer you are searching on); and your actual location.... Like in Miller and Smith, Google even offers a legitimate business purpose for such data storage and mining: “Our automated systems analyze your content (including emails) to provide you personally relevant product features, such as customized search results, tailored advertising, and spam and malware detection.” Id. Under a plain reading of the majority’s rule, by allowing a third-party company access to our e-mail accounts, the websites we visit, and our search-engine history—all for legitimate business purposes—we give up any privacy interest in that information.

And why stop there? Nearly every website collects information about what we do when we visit. So now, under the majority’s rule, the Fourth Amendment allows the government to know from YouTube.com what we watch, or Facebook.com what we post or whom we “friend,” or Amazon.com what we buy, or Wikipedia.com what we research, or Match.com whom we date—all without a warrant. In fact, the government could ask “cloud”-based file-sharing services like Dropbox or Apple’s iCloud for all the files we relinquish to their servers. I am convinced that most internet users would be shocked by this. But as far as I can tell, every argument the government makes in its brief regarding cell site location data applies equally well to e-mail accounts, search-engine histories, shopping-site purchases, cloud-storage files, and the like.

Either way, it's pretty clear this issue is heading to the Supreme Court sooner or later (even possibly with this very case). But, for today, this ruling is a pretty big hit against your privacy.

Filed Under: 4th amendment, expectation of privacy, privacy, quartavious davis, sca, smith v. maryland, stored communications act, third party doctrine, warrants

Can A Judge Force A Juror To Reveal Facebook Account Info?

from the we-may-soon-find-out dept

And here we go with yet another case about courts struggling with the idea that jurors use social networking tools. In the latest in a long line of such cases, a juror in a case about a gang beating, named Arturo Ramirez, has been ordered to turn over information from his Facebook account, after another juror claimed that Ramirez had broken the rules by mentioning the case on Facebook. Apparently Ramirez's big violation was to wonder if the case could "get any more BORING" on his Facebook account. Rather than just respond to that issue, the defense attorneys in the case sent a subpoena to Facebook asking for Ramirez' full account info. Facebook noted that giving out such info would clearly violate both the Stored Communications Act and the Electronic Communications Privacy Act. The judge, in attempting to get around those laws, has ordered Ramirez to sign a consent form allowing Facebook to hand over the info... or face contempt of court charges.

While I agree that it wasn't the smartest move by Ramirez to mention the case on Facebook, the reaction seems to go way beyond reasonable. In particular, having the judge basically force Ramirez to give up the rights granted by the SCA and ECPA seems to go way over the line. Ramirez is planing to appeal the order, as it clearly seems to go against the basic structure of those two laws to then force someone to give up those protections or risk a contempt of court claim. And, honestly, given that Facebook communications tend to be the sort of thing you say to your friends, when you step back and think about it, imagine if Ramirez had simply made the same point to a friend one day during the case. Would the court really go to such extreme lengths in such a scenario?

Filed Under: ecpa, juries, privacy, social networks, stored communications act
Companies: facebook

Ex-Employer Has To Pay Former Employees $4,000 For Email Snooping

from the watch-where-you-snoop dept

We've discussed a bunch of cases lately involving employers and the legality of reading emails of employees. The latest one is a bit strange. It involves the owner of a gym, who had two ex-employees set up a competing gym. Somewhere along the way, she became aware of some emails they wrote while still employed by her, planning out their new gym. It appears that this is because they accessed their private email accounts via the gym's computers, but left their accounts logged in. After a variety of back-and-forth maneuverings, the employer has been forced to pay $4,000 to the ex-employees for snooping on their emails, in violation of the Stored Communications Act. Of course, what's most interesting is that if the employer had wanted to get access to those emails legally, she could have probably used the normal discovery process during a lawsuit -- but by snooping, she ended up not being able to use those emails in her own lawsuit, and owing those ex-employees a few thousand dollars.

Filed Under: email, snooping, stored communications act