Court Refuses To Protect Whistleblower's Email Uncovered In Sham Lawsuit

from the expectations-of-privacy dept

Earlier this year, we wrote about a troubling lawsuit involving a whistleblower, and an attempt to access his email. I'll repeat the EFF's summary of the case:

The whistleblower, Charles Rehberg, uncovered systematic mismanagement of funds at a Georgia public hospital. He alerted local politicians and others to the issue through a series of faxes. A local prosecutor in Dougherty County, Ken Hodges, conspired with the hospital and used a sham grand jury subpoena to obtain Mr. Rehberg's personal email communications. The prosecutor then provided that information to private investigators for the hospital and indicted Mr. Rehberg for a burglary and assault that never actually occurred. All the criminal charges against Mr. Rehberg were eventually dismissed. Hodges is currently running for Attorney General of Georgia....

Mr. Rehberg filed a civil suit against the prosecutors and their investigator for their misconduct, but the appeals court erroneously ruled that he did not have a reasonable expectation of privacy in his private email.

The EFF is now reporting that the Eleventh Circuit has basically ruled that, because Rehberg's "privacy interest" in his emails, as held by his ISP was not "clearly established" that he has no expectation of privacy. The key issue is whether or not there's an expectation of privacy in emails held by a third party -- in this case, the ISP. The court apparently clarified that it wasn't saying that there's no 4th Amendment protection for emails held by a third party ISP, but that it didn't really want to rule on that topic:

Rather than embracing the obvious conclusion that our constitutional protections need to be recognized for email content, the court ducked the question, claiming that email is simply too new a technology for them to decide whether the Constitution applies.

While some are saying that at least this ruling gets rid of the bad earlier ruling that effectively said there was no 4th Amendment protections at all for emails held by an ISP, it does seem like the court could have, and probably should have, gone further to state that there is a reasonable expectation of privacy for such emails, and they deserve 4th Amendment protections.

Filed Under: email, privacy, whistleblowing

NTP Keeps On Making The Case For Patent Reform As It Sues More Companies

from the milking-it dept

NTP, a patent holding firm that is really just a bunch of lawyers with incredibly broad and questionable patents, is at it again. As you probably know, NTP was locked in a long and contentious patent fight with RIM over NTP's claimed patents covering the concept of mobile email. Even as the US Patent Office was telling the world that NTP's patents almost certainly weren't valid, pressure from investors (and the judge in the case who refused to wait for the Patent Office's final rejection of the patents) resulted in RIM settling the case for $612.5 million. For RIM, it became something of a no brainer. Even though its legal position was strong, its investors were killing the company over the uncertainty (there were threats that the judge could issue an injunction shutting down the entire Blackberry network). Settling the case helped RIM's stock price jump up (increasing its market cap more than the cost of the settlement).

But, from a legal perspective, the lawsuit and the end result became the centerpiece of attention for efforts at patent reform. While I still think that the patent reform process in Congress has been misguided and the end result probably a lot more damaging than helpful, many of the politicians involved will point to the RIM-NTP case as evidence of the problems with the patent system. You might think, then, that NTP's investors might sit back and enjoy the spoils of the RIM settlement, but the company quickly went back out and sued all the major mobile operators in the US for violating its patents. However, judges in those other suits said (unlike the judge in the RIM case) that those trials should wait until the Patent Office has made a final decision on the validity of NTP's ridiculously overbroad patents.

However, NTP is not waiting around. It's now suing again. This time, rather than the mobile operators, it's going after device makers and platform vendors, suing Apple, Google, Microsoft, HTC, LG and Motorola. Basically, it appears that NTP has decided that if anyone does email on a phone, they have to pay NTP.

There might not be a better example of how incredibly screwed up the patent system is than this. NTP was involved in an attempt to do mobile email ages ago (and it wasn't the first actually... but NTP paid off some folks who had prior art). The idea itself wasn't new or all that innovative, and the timing was off, so NTP failed. In a functioning free market, that's a good thing. If a company can't execute, it should fail. Unfortunately, thanks to a ridiculously overbroad patent award, NTP has been able to live on as a bunch of lawyers suing any company that does figure out how to execute.

Perhaps the only good thing coming out of this is that it may help draw more attention to just how broken the patent system is.

Filed Under: email, mobile phones, patent reform, patents
Companies: apple, google, htc, lg, microsoft, motorola, ntp, rim

Is It Better To *Require* Or *Request* Something In Return For Free Content?

from the the-debate-goes-on dept

Over at Music Think Tank there's a blog post provocatively titled: Why Music Should Never Be Given Away For "Free", which brings up a point I've heard multiple times from various music industry marketers (many of whom I generally agree with). They say it is okay to give away music without a monetary transaction taking place, but instead you should demand something else in return. In this post, he suggests requiring an email address, a retweet or a Facebook share in order to get free music.

I definitely understand the general rationale for this line of thinking, but I'm afraid that people are going too far with it, and it's actually harming the value of free music in some cases. Obviously, it's great if you can get something (monetarily or not) in exchange for the music, but putting up a barrier can also be harmful. First of all, if it's truly a brand new fan who hasn't heard your work, they might not be willing to commit to you in that way. Especially when it comes to Tweeting or Facebooking an artist. If I don't know the artist, there's no way I'm mentioning them to all of the people who follow me on various social networks. On the flip side, when I do see friends who make those kinds of Tweets, they feel like spam. They're not at all convincing and they don't feel authentic. They feel forced. Honestly, when I see people post social networking messages in exchange for free tracks, it actually makes me less interested in the musical act, because I feel like they need to beg for attention, rather than letting the fans organically give them attention.

Finally, part of the reason the whole "free music" world exploded the way it did was because of the massive simplicity and lack of friction in music sharing, which made music discovery and promotion much more seamless and easy. Putting required friction back into the process seems like a mistake, and will likely just drive fans (or potential fans) either to other artists or back to the same file sharing systems that remove that friction. That doesn't help anyone.

So rather than requiring an explicit exchange, it always seems a hell of a lot more effective to offer the content for free, but ask for the exchange as a voluntary setup: "If you like these songs, tell your friends or sign up for our mailing list" or something like that. This way it's not forced. It's not inauthentic. It's not friction. It's about trusting the listeners, rather than trying to force them to act in a certain way.

Filed Under: business models, economics, email, fans, free, music, social media, transactions

Guy Charged With Harassment For Sending Email Complaint To Senator Jim Bunning

from the careful-who-you-get-angry-with dept

We've talked multiple times about the problems with various online "harassment" laws, many of which are written so broadly as to outlaw using email to try to "annoy" someone. Basically, they try to outlaw being a jerk, which doesn't seem to make sense if you believe in the First Amendment.

With the recent situation involving AT&T threatening to take legal action against a customer for sending a complaint email to AT&T's CEO, it seems like lots of people are overreacting to email complaints. The latest is Senator Jim Bunning, from Kentucky. Bunning got a lot of attention back in February when he decided to become a one-man filibuster against extending unemployment benefits (much to the annoyance of politicians from both major parties). DavidClerk alerts us to the news that Bruce Shore, an unemployed man in Philadelphia, got so upset at Bunning that he sent some angry emails to Bunning and his staff. Fair enough. These are the basics of representative democracy.

The emails were definitely angry, but it's a stretch to claim they are real harassment. Yes, the final line could cut it close, but is hardly a direct threat.

Hello,

I am at a LOSS of words for SENATOR BUNTING blocking unemployment benefits for me and my children. If I do NOT get my check next week I WILL HAVE NO FOOD AND WILL BE ON THE STREET.

What kind of people are you? 10 Billion goes to the war every couple days and to Wall street weekly. I want my benefits or there will be people starving and dying.

What is wrong with you people. NOW is NOT the time to play politics with childrens lives.

ARE you'all insane. NO checks equal no food for me. DO YOU GET IT??

IF THIS POLITICAL GRANDSTANDING DOES NOT END TODAY - WE WILL COME TO YOUR OFFICES AND MAKE OUR POINT. YOU ARE PLAYING A LIFE AND DEATH GAME HERE.

DO YOU GET IT.

Brad Shore
Louisville, KY 40202

Now there are lots of ways Bunning and his staff could respond to such emails. But the way he did respond was to get the Capitol Police and the FBI involved leading to the guy being indicted for online harassment, specifically that he "did utilize a telecommunications device, that is a computer, whether or not communication ensued, without disclosing his identity and with the intent to annoy, abuse, threaten, and harass any person who received the communication." You can see the indictment here: Part of the issue appears to be that he also claimed to be in Kentucky when he was really in Philadelphia. Hence the "without disclosing his identity." But, no matter how you look at it, to charge him with harassment seems like a huge stretch and could present a clear chilling effect on people expressing their concerns to elected officials. Even if you think it made sense for the FBI to check things out to make sure there was no real threat implied by the email, to then go ahead and indict him seems like it's going way too far, and is hard to square with our concept of the First Amendment. Shore has since plead not guilty, but will face a trial starting in July. However, it seems like it never should have gotten this far. Expressing your displeasure with an elected official should not lead to felony charges against you.

Filed Under: email, harassment, jim bunning

Court Effectively Says No 4th Amendment Protection To Copies Of Emails

from the that's-not-good dept

Earlier this year, we wrote about some Fourth Amendment questions when it came to information stored in the cloud -- and a recent legal ruling provides some new troubling views on this matter. Slashdot points us to Orin Kerr's excellent analysis of a recent 11th Circuit decision, that basically says once an email is delivered, there's no Fourth Amendment protections of that email. But, as Kerr notes, the real problem here (as with so many issues in the digital world) is that the court seems to be confusing copies of digital content with the original:

For a real-world example, imagine you write a letter and photocopy it before you put it in the mail. You file the copy in your closet and send the original. During the course of delivery, the original is protected by the Fourth Amendment; when it arrives, you lose Fourth Amendment protection. But the fact that you lose Fourth Amendment protection in the original does not mean that the Government can break into your house and read the copy you made. Conversely, the fact that the recipient of the mail does not have Fourth Amendment rights in the copy does not mean that the government can break into the recipient’s house to read the original.

For these reasons, the court should have analyzed access to the e-mails stored with the ISP based on whether there was a reasonable expectation of privacy in that remotely stored copy accessed, independently of delivery of another copy....

We see this over and over again when it comes to the digital world. People try to automatically equate it to the physical world, not recognizing that they're dealing with independent copies, not the original (hence the argument that "file sharing is the same as theft.") Unfortunately, in this case the ruling could do some serious damage to how the government and law enforcement views your expectation of privacy with regards to your emails.

Filed Under: 4th amendment, copies, email

Forwarding A Defamatory Email Is Not Defamation

from the yet-again dept

We've seen some folks claim in the comments that Section 230 safe harbors go away if the person or company is involved in forwarding or posting the material of others -- but courts have repeatedly held otherwise. Now we've got yet another such case, that actually has pretty a pretty similar story line to some previous lawsuits. Basically a guy forwarded an email to a mailing list, which someone claimed was defamatory -- and they sued the guy who forwarded the email. But, once again, a court has found that the mere act of forwarding the email does not take away section 230 protections. The fact that the guy added a brief intro to the email also didn't change this -- though, the content of that intro could be reviewed for defamation (the court found there was none), since that was actually written by the guy.

Once again, this is exactly how Section 230 should act. It's designed to make sure liability gets applied to the right party -- the one actually making (for example) the defamatory remarks. Merely passing along what someone said shouldn't have the liability passed on to you as well, and that's exactly what the court found.

Filed Under: defamation, email, forwarding

Court Says Personal Email From Work Can Still Be Protected Attorney-Client Communications

from the well-that's-interesting dept

We've seen plenty of cases where courts have said that an individual has no expectation of privacy on emails sent from work, and therefore cannot protect those emails. However, in an interesting new ruling (found via the EFF), a court found that personal emails sent from work computers can still be considered privileged and confidential as an attorney-client communication.

Of course, there's a bit more to this case that makes the facts a bit different and makes me wonder if it would apply in other circumstances. In this case, it dealt with a federal prosecutor who was fired, and is trying to claim that the firing was for his whistle-blowing. He was trying to access the emails of a US Attorney that he believes will reveal why he was fired. So it wasn't a case of a company trying to review the email (which is normally the case in these types of lawsuits). And, as such, it makes sense. The attorney-client privilege should be seen as one that has an incredibly high barrier. Any weakening of that privilege -- such as by saying that if you email your lawyer from work, it doesn't exist -- would be troubling. But what would be more interesting is what would happen in a lawsuit where it was the employer looking at the material. If a company has a regular program of recording and examining employee email (as many do), then how would the issue be resolved? It would seem that, in such circumstances, it would make a lot less sense to consider the content protected, since the employer is not asking for it, but already has access to it.

In related news, however, the Supreme Court will be hearing a case that looks at whether or not your text messages are private, even if sent from company mobile phones.

Filed Under: email, privacy, text messages, work

Court Rules That Using Domain Registration Privacy Services Represents 'Material Falsification'

from the that-doesn't-seem-right dept

Lots of people use private registration services for domain names, that lets them register a domain name while keeping their own identities private. There are plenty of legitimate reasons to do so: they don't want spam or they want to keep the identity of the site owners anonymous. However, in a recent spam lawsuit, the Ninth Circuit court of appeals has said that using such a service is "material falsification" of information:

[P]rivate registration is a service that allows registration of a domain name in a manner that conceals the actual registrant's identity from the public absent a subpoena. We fail to perceive any vagueness on this point. Based on the plain meaning of the relevant terms discussed above, private registration for the purpose of concealing the actual registrant's identity would constitute "material falsification." Defendants assert that many innocent people who privately register without the requisite intent may be subject to investigation for violation of § 1037 until their intent can be determined, allowing for abuse by enforcement authorities. This may be so, but it does not make the statute unconstitutionally vague.

While CAN SPAM requires a combination of both material falsification and intent to send spam, it does open up some questions about potential legal problems for anyone who uses such a private registration service in a variety of lawsuits (if those lawsuits are in the Ninth Circuit, of course). The court does seem to admit that this could cause problems, but the job of the court isn't to stop those problems, just to interpret the law.

Separately, in the same lawsuit, the court ruled that the appropriate "community" for judging obscenity standards in email is the "national community" rather than the local community. I have enough problems with the whole "community standards" method of judging "obscenity" in the first place (well, I have trouble with "obscenity" laws entirely), but if you have to have them, it does seem that a national standard makes more sense than a local standard when it comes to email that could go to anyone in any community. As Thomas O'Toole notes in his writeup, the ruling is a bit of a mess, and should keep First Amendment lawyers busy (though, the same is true of any obscenity laws...).

Filed Under: domain names, email, material falsification, private registration

Google Taken To Court To Explain Why It Shut Down Someone's Gmail Over Missent Email

from the explanation-please dept

Paul Alan Levy writes "Last month, you wrote about the travesty perpetrated by Rocky Mountain Bank when it sued Google to shut down the gmail account of a Google customer to whom the bank had mistakenly emailed a pile of customer records. Equally disturbing was the way that Google -- which is usually pretty good about standing up to subpoenas for customer identity -- just rolled over and obeyed the court's order even though a second's review of the company's ex parte arguments to the court showed both that the bank never explained what the Gmail customer did wrong, never explained how Google could be sued in the face of 47 USC 230, and never showed that there was diversity jurisdiction.

So we have gone back to court, representing MediaPost Communications, arguing that Google's report to the Court, showing its compliance, is a judicial record that should have been, and now must be, filed publicly. We agree of course that any actual customer identification in the compliance report should be redacted."

This is a tricky issue. After all, Google, as a private company, has the right to shut down an email account on its own. But, seeing as this was all a part of a legal case, with a number of questionable elements, it does seem like the information that led to the account being shut down should be a part of the public record.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank

Google Destroyed Missent Bank Info Email Unopened... As More Legal Questions Are Raised

from the still-doesn't-make-sense dept

Last week, Google was ordered to deactivate someone's Gmail account, because Rocky Mountain Bank had totally screwed up and sent the Gmail account holder an email by accident, which contained all sorts of confidential information. It's still not at all clear how Rocky Mountain Bank made such a monumental screw up, but we'll leave that aside for now. On Monday, the two companies asked the judge for permission to restore the email, after they realized that the email in question had never been opened, and Google had deleted it from its servers. Case closed?

Well... not so fast. Paul Alan Levy, from Public Citizen, sees a number of serious problems with the whole episode, starting with the legal complaint in the first place -- which offered no opportunity for the email account user to speak up and argue for his or her own rights, against having the account deactivated. But just the legal proceedings themselves suffered from some serious problems:

First, the complaint. Rocky's complaint is based on the contention that, having botched its obligation to keep its own customers information secret, it was obligated under various state and federal banking regulations to seek to recover the information and prevent its further dissemination. The complaint further alleges that regulatory officials expressed their endorsement of efforts by the Bank to protect the confidentiality of the information. The complaint sought a declaratory judgment that Rocky Mountain was entitled to information about the account holder, and that Google was obligated to prevent use of the information sent to the account. It sought an injunction enjoining Google and the account holder from accessing or distributing the information mistakenly sent to the email account, and compelling Google to identify the account holder. But curiously absent from the complaint was any allegation about how either Google or the owner of the gmail account had violated the plaintiff's rights, or any assertion of a cause of action against either Google or the anonymous account holder, that would form the basis for granting relief against either. Nor did Rocky Mountain's papers explain why section 230 of the Communications Decency Act entitled it to bring an action against Google, or to obtain any relief against Google, even assuming that it had a claim against the gmail account holder. Without a cause of action and without a violation of the plaintiff's rights, why was Rocky Mountain entitled to relief, and why should the defendants be subjected to an injunction? Neither the complaint, nor the brief in support of the TRO, explains this.

Second, the lack of federal court jurisdiction. Although the complaint identified only Google as a defendant, Rocky Mountain asked for relief against the anonymous gmail account holder, which is obviously, therefore, a defendant just as Google was. Indeed, if either Google or the account holder was the right defendant here, it is the account holder. But this poses a serious problem, because the law is clear that a Doe defendant cannot be sued under diversity jurisdiction. If there had been any party with any incentive to protect the Doe's rights in this case, that party could have pointed this jurisdictional defect out to the Court, which would therefore have been obligated to dismiss the case instead of issuing a TRO.

Oops. And, from there, Levy also wonders why Google was so quick to roll over without trying to defend the user's rights:

Rocky Mountain's papers recount that it asked Google for help freezing the account and identifying the account holder but that Google refused to do so without "a valid third party subpoena or other appropriate legal process." Yet despite the filing of plainly defective papers, there is no indication in the publicly filed papers that Google either opposed the requested order or insisted that it be given the opportunity to notify the Doe gmail user so that he or she could obtain counsel and oppose the requested order. Nor do the papers contain any discussion of efforts to notify either Google or the anonymous user about the requested order, even though Rule 65(b)(1) of the Federal Rules of Civil Procedure requires either notice to the parties sought to be enjoined, or a compelling explanation of why notice was not possible. (Because the Bank noticed the problem on August 13, and waited until September 17 to file its suit, it is hard to believe that a few more days' delay to give proper notice would have been catastrophic). And within a day of the issuance of the order (one day before the compliance deadline), Google provided the court with a document explaining how it had complied with the TRO and asked, jointly with Rocky Mountain, that the TRO be vacated.

Indeed. It's certainly understandable why everyone wanted to make sure the data was not compromised, and in this case, it sounds like the account in question was probably inactive or rarely used (or the email went to spam). So everything may have ended up okay. But that's no excuse for potential violations of an individual's rights in trying to correct a mistake by the bank.

Filed Under: confidential information, court order, deactivated, email
Companies: google, rocky mountain bank