ACLU Files Challenge To CFAA Over Blocking Research Into Discrimination Online

from the fix-the-cfaa dept

There's been a lot of talk lately about the possibility of discrimination being built into the algorithms that determine our lives. In the past year, multiple publications have discussed what happens when algorithms are racist in a time when algorithms decide more and more of our lives. Just recently, we talked about judges using proprietary algorithms in sentencing, and how those algorithms themselves may judge people based on things like skin color. And just a few days ago, there was a fascinating NY Times article about inherent bias in artificial intelligence systems. I even went to a conference recently, where there was a whole discussion on the question of what do you do "if your algorithm is racist." It's not an easy question to answer, honestly, but one thing that we should not be doing is holding back research into these systems.

And yet... that's exactly what's happening. And the culprit, once again, is the Computer Fraud & Abuse Act (CFAA), which we've written about for years. The law, which is woefully out of date, and was passed (literally) by a Congress that was freaked out over the movie WarGames, is supposed to target evil "computer hackers." But it's written so broadly, including terms like "unauthorized access" or "exceeding authorized access," that it's been used against things like violating a terms of service (that you didn't read or even agree to) or against downloading too many files. And that's scaring the hell out of researchers.

Given that, the ACLU has now filed a lawsuit on behalf a group of academic researchers, computer scientists and journalists who want to investigate these issues, but are held back by the CFAA.

Our plaintiffs want to investigate whether websites are discriminating, but they often can’t. Courts and prosecutors have interpreted a provision of the CFAA—one that prohibits individuals from “exceed[ing] authorized access” to a computer—to criminalize violations of websites’ “terms of service.” Terms of service are the rules that govern the relationship between a website and its user and often include, for example, prohibitions on providing false information, creating multiple accounts, or using automated methods of recording publicly available data (sometimes called “scraping”).

The problem is that those are the very methods that are necessary to test for discrimination on the internet, and the academics and journalists who want to use those methods for socially valuable research should not have to risk prosecution for using them. The CFAA violates the First Amendment because it limits everyone, including academics and journalists, from gathering the publicly available information necessary to understand and speak about online discrimination.

In terms of the specific challenge, the ACLU is arguing that it violates both the First Amendment and the due process clause of the Fifth Amendment. The crux of the First Amendment argument in the filing:

The Challenged Provision impermissibly burdens speech about business practices and other activity on the internet because websites can determine what speech and expressive activity to prohibit, and these prohibitions become criminal violations of the Challenged Provision. In other words, a website can explicitly target speech or expressive activities. For example, if a website’s terms of service provide that access by certain types of speakers (such as researchers) is unauthorized, or that engaging in certain speech (false or misleading speech, for example, or subsequent disparaging speech about the website) renders access unauthorized, then violations of those private terms of service become crimes through the phrase “exceeds authorized access” in the Challenged Provision. Such speech or expressive activity thus becomes prohibited under pain of criminal sanctions simply because it occurred on the internet.

Because the Challenged Provision incorporates websites’ terms of service into the federal criminal code, its applications are virtually infinite; any speech or expressive activity that the private operator of a website has prohibited as a condition of access to its website becomes a criminal violation, even where that prohibition covers speech subsequent to the visit and in a different forum. In a good number of cases, a website’s ToS will prohibit speech that cannot constitutionally be prohibited. Accordingly, although the Challenged Provision may have legitimate applications, its unconstitutional applications are substantial in relation to its legitimate scope.

There's some more as well, including the idea that setting up fake profiles to test a site for discrimination may be considered a terms of service violation and one that violates the free speech of the researchers.

As for the Fifth Amendment:

The Challenged Provision fails to notify ordinary people of what conduct is criminal because the phrase “exceeds authorized access” does not provide sufficient notice that an individual must comply with a website’s written terms of service at all times. The plain meaning of the phrase “exceeds authorized access” does not clearly cover instances where a website places no barriers, such as technological or physical barriers, to access by individuals.

While I've been quite vocal for years about the problems of the CFAA and how it chills a variety of activities, including ones similar to those described here, and while I have enormous respect for the ACLU, I do wonder how successful this case will be. Courts are not always happy to take on cases that can be seen as more "speculative" than over a clear issue (i.e., after someone's been charged with violating the CFAA for this kind of activity). At the same time, courts also like to avoid dealing with Constitutional questions, if they can avoid it -- and so far, multiple courts have rejected attempts to claim that mere terms of service violation violates the CFAA. So they can get out of handling the Constitutional question by just saying "well, that particular use is not a CFAA violation."

So while I think this is a really important issue, and I'd love to see a constitutional challenge to these aspects of the CFAA succeed, I'm at least somewhat skeptical of the chances of this particular case. Hopefully, I'm proven wrong.

Filed Under: 1st amendment, 5th amendment, academics, algorithms, cfaa, discrimination, journalism, research, terms of service
Companies: aclu

Oculus Users Freak Out Over VR Headset's TOS, Though Most Of It Is Boilerplate

from the watching-the-watchers-watch dept

So Facebook's Oculus technically "launched" the Rift VR headset on March 28, and while the press generally seem to like the gear, the launch itself hasn't been going particularly well. Most users that pre-ordered still haven't received not only their headset -- but any kind of hard shipping date from the company. Initially, all users had to go on were some anonymous posts at Reddit implying that Facebook lawyers wouldn't let Oculus communicate a reason for the delays. Over the weekend however users received an e-mail informing them that because of an "unexpected component shortage" shipments have been delayed by a few weeks. To soothe the angry hordes, Oculus has decided to offer free shipping on all pre-orders.

But it's another part of the Oculus launch that has some people up in arms: the headset's terms of service.

Prompted almost solely by one complaint over at Reddit, numerous outlets have penned missives blasting the "super shady things" going on in the Oculus TOS. Among them are paragraphs like this one, that gives Oculus (and by proxy Facebook) the right to distribute user-contributed content the way they see fit:

"By submitting User Content through the Services, you grant Oculus a worldwide, irrevocable, perpetual (i.e. lasting forever), non-exclusive, transferable, royalty-free and fully sublicensable (i.e. we can grant this right to others) right to use, copy, display, store, adapt, publicly perform and distribute such User Content in connection with the Services. You irrevocably consent to any and all acts or omissions by us or persons authorized by us that may infringe any moral right (or analogous right) in your User Content."

The problem with getting hysterical over the TOS is that this language is essentially boilerplate, and attached to the terms of service for pretty much every service in existence so they can make a sharing technology work without being sued over copyright. While certainly worded poorly there's no real nefarious intent; it's CYA lawyer language. We've had to note this every single time one of these mass TOS freak outs occur, whether it has been Snapchat or Pinterest. And the laundry list of websites with exactly this kind of language is endless, including YouTube, Imgur, Instagram, Tumblr, etc.

But there's also been a number of users concerned about the fact that the Oculus headset communicates the user's usage behavior back to Facebook using "always on" processes like "OVRServer_x64.exe." Under the din of hive-mind Reddit outrage, the original poster used Wireshark for at least a preliminary, rough look at what's being transferred. So far it appears to be the sort of things you'd expect any gaming device to transmit (update checking, social and buddy list sharing systems, a system that detects when the headset is mounted to your face so the Oculus store can be launched on your PC).

While Facebook and Oculus certainly could be up to no good, nobody's actually been able to identify the software doing anything untoward, which is kind of important if you're going to hold a mass freak out about your privacy being trampled.

Facebook's certainly no saint on the privacy front, but it seems unlikely that Facebook or Oculus would want to sabotage the first major foray into VR by saddling the tech with too much snoopvertising (which its target audience would be savvy enough to ferret out). That's not to say that can't happen later, nor is it to say that the boilerplate language being using in the TOS couldn't use more plain English. But the alien nature of VR combined with a lust for VR headlines and Facebook's history as a data hoover has created a bit of a monster that appears to be more smoke than fire (for now).

If Oculus has a problem, it's that they've been doing a piss poor job communicating any of this to customers. In the same way the company remained mute about its shipping problems, neither Oculus nor Facebook has managed to get ahead of this story with a simple update on how the data collection is fairly routine -- or what OVRServer_x64.exe is watching (they're likely too busy freaking out about the shipping issues). The most Oculus has managed to say on the subject is this short and plucky post at Reddit by Oculus founder Palmer Luckey, which fails to offer anything of substance outside of calling the original Reddit thread "a yarn."

All of this may become a problem for Oculus given the HTC Vive's upcoming launch. Between the Vive having "room scale" at launch (the ability to stand and move around in VR space using hand controllers), this privacy scuff up (genuine or not) and the Oculus shipping delay (meaning Vives could arrive in user homes first), the company has dug itself a bit of a PR hole. Oculus had already soured some gamers by partnering with arguably the 21st Century's biggest data collection apparatus in the first place. If Oculus really wants to be the VR headset to buy this year, its PR and public communications team is going to have to start doing a little more than the occasional grunt on Reddit.

Filed Under: oculus rift, privacy, terms of service

Game Developer Rewards 100 Users For Actually Reading The EULA

from the too-much-time-on-my-hands dept

Traditionally, we all know that the end user license agreement is used to try and give companies all manner of legal advantages, while attempting (often ridiculously) to strip away ordinary consumer rights. Of course, the legally binding nature of these agreements is dubious, and nobody bothers to read them anyway. We've historically noted that occasionally companies bury something fun in the ocean of mouse print to make just that point. Years ago, anti-spyware firm PC Pitstop promised to give away $1,000 to the first person to e-mail them at a specific address (it took 3,000 downloads for that person to appear).

Larian Studios, developers of the game Divinity: Original Sin, recently decided to have some fun of its own. The company just released a completely, massively-revamped version of the game it had been giving away for free to customers of the old title. But buried in the fine print for this new offering was a little message ignored by the lion's share of customers who downloaded the title:

"16. Special Consideration. A special consideration in material or immaterial form may be awarded to the first 100 authorized licensees to actually read this section of the EULA and contact LARIAN STUDIOS at info@larian.com. This offer can be withdrawn by LARIAN STUDIOS at any time."

Larian has yet to confirm what these folks won, but did note on the company's Facebook page that it pulled the fine print once the developers were satisfied that 100 people had actually bothered to read the fine print:

"We're telling you now because the results are in and it turns out that you in fact do read these things. Our lawyer feels good about this. He's also revoking the consideration because we're making him pay for every mail we get."

Frankly, it's pretty astonishing that even that many users could be bothered to read the EULA. More frequently, the gaming industry (like all other industries) is obsessed with using EULAs to strip away consumer rights or make consumer-owned products less useful, so it's refreshing to see a company with a sense of humor. That doesn't make it any less true that the standard EULA remains a ridiculous, unread beast and that keeping it simple is a better bet if winning consumer hearts is anywhere on your radar.

Filed Under: divinity: original sin, easter egg, eula, reading, terms of service
Companies: larian studios

Stop Freaking Out About Snapchat's Terms Of Service; You Read It Wrong

from the not-this-again dept

This seems to happen every year or so with tech companies that involve hosting photos: people totally misreading terms of service completely freak out that the company is claiming copyright on their photos. In 2011, it was Twitpic's new terms of service that everyone freaked out about. At the beginning of 2012, it was Pinterest. At the end of 2012, it was Instagram's new terms of service. In every case, it was kicked off by people who don't realize that these terms are pure boilerplate standard stuff that basically says, "if you use our platform, you're granting us a license to actually show your photos, so you don't then sue us for violating your copyright." There's nothing nefarious about this at all, but the freakout still occurs, and the media pushes it along.

This year's flavor of the exact same freakout is around Snapchat's new terms of service and, once again, the media has been stupidly pushing the story along, led by the Telegraph in the UK, which has an article suggesting its reporter has no clue what she's talking about. The terms of service are pure boilerplate, standard legal language that any site hosting photographs basically needs to have (which is why this same freakout happens every year or so with photo hosting sites). You can read the terms here. The key part that everyone is talking about is this:

Many of our Services let you create, upload, post, send, receive, and store content. When you do that, you retain whatever ownership rights in that content you had to begin with.

But you grant Snapchat a worldwide, perpetual, royalty-free, sublicensable, and transferable license to host, store, use, display, reproduce, modify, adapt, edit, publish, create derivative works from, publicly perform, broadcast, distribute, syndicate, promote, exhibit, and publicly display that content in any form and in any and all media or distribution methods (now known or later developed). We will use this license for the limited purpose of operating, developing, providing, promoting, and improving the Services; researching and developing new ones; and making content submitted through the Services available to our business partners for syndication, broadcast, distribution, or publication outside the Services. Some Services offer you tools to control who can—and cannot—see your content under this license. For more information about how to tailor who can watch your content, please take a look at our privacy policy and support site.

To the extent it’s necessary, you also grant Snapchat and our business partners the unrestricted, worldwide, perpetual right and license to use your name, likeness, and voice in any and all media and distribution channels (now known or later developed) in connection with any Live Story or other crowd-sourced content you create, upload, post, send, or appear in. This means, among other things, that you will not be entitled to any compensation from Snapchat or our business partners if your name, likeness, or voice is conveyed through the Services.

Again, this is absolutely standard and there's nothing nefarious about this. The company is just covering its bases so that it's actually allowed to display your images/videos the way you want them to. It's not about doing something sneaky. It's about making sure that you are actually giving the site a license to display your stuff. In fact, right after the bolded stuff in the first paragraph, the terms make it clear that this is "for the limited purpose" of making Snapchat work -- and not for running off and doing other stuff with your photos and videos.

Nearly identical language can be found in nearly every such service that involves sharing information. Here's Pinterest's:

You grant Pinterest and its users a non-exclusive, royalty-free, transferable, sublicensable, worldwide license to use, store, display, reproduce, re-pin, modify, create derivative works, perform, and distribute your User Content on Pinterest solely for the purposes of operating, developing, providing, and using the Pinterest Products.

And Instagram's:

...you hereby grant to Instagram a non-exclusive, fully paid and royalty-free, transferable, sub-licensable, worldwide license to use the Content that you post on or through the Service....

And here's Facebook's:

For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License).

And Twitter's:

By submitting, posting or displaying Content on or through the Services, you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content in any and all media or distribution methods (now known or later developed).

You agree that this license includes the right for Twitter to provide, promote, and improve the Services and to make Content submitted to or through the Services available to other companies, organizations or individuals who partner with Twitter for the syndication, broadcast, distribution or publication of such Content on other media and services, subject to our terms and conditions for such Content use.

And Tumblr's:

When you provide Subscriber Content to Tumblr through the Services, you grant Tumblr a non-exclusive, worldwide, royalty-free, sublicensable, transferable right and license to use, host, store, cache, reproduce, publish, display (publicly or otherwise), perform (publicly or otherwise), distribute, transmit, modify, adapt (including, without limitation, in order to conform it to the requirements of any networks, devices, services, or media through which the Services are available), and create derivative works of, such Subscriber Content.

Okay, how about Imgur's:

With regard to any file or content you upload to the public portions of our site, you grant Imgur a non-exclusive, royalty-free, perpetual, irrevocable worldwide license (with sublicense and assignment rights) to use, to display online and in any present or future media, to create derivative works of, to allow downloads of, and/or distribute any such file or content.

Also YouTube's:

by submitting Content to YouTube, you hereby grant YouTube a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, prepare derivative works of, display, and perform the Content in connection with the Service and YouTube's (and its successors' and affiliates') business, including without limitation for promoting and redistributing part or all of the Service (and derivative works thereof) in any media formats and through any media channels. You also hereby grant each user of the Service a non-exclusive license to access your Content through the Service, and to use, reproduce, distribute, display and perform such Content as permitted through the functionality of the Service and under these Terms of Service.

And, just for fun, how about Reddit's where the freakout first started:

By submitting user content to reddit, you grant us a royalty-free, perpetual, irrevocable, non-exclusive, unrestricted, worldwide license to reproduce, prepare derivative works, distribute copies, perform, or publicly display your user content in any medium and for any purpose, including commercial purposes, and to authorize others to do so.

I'm sure if you looked up any other similar service you'd find similar things. They need to get a license. And this is the language by which it's done. Some word it more broadly than others, and people seem to be focusing on Snapchat, in part, because of how it was mainly billed as a place to send quickly deleting photos/videos (though it's been making that a less and less prominent part of its business lately), and thus there's a fear that Snapchat will suddenly start "displaying" or otherwise sharing the images and videos you thought were being deleted. Of course, if the company actually did that, it would destroy its reputation.

Having read through all these terms of service, though, I will say that some of the other ones have done a much better job in trying to cut off such freakouts. Both Tumblr's and Twitter's include "plain English" explanations next to the legalistic paragraphs, explaining why there's this nutty language and why you shouldn't freak out about it. A few of them, such as Pinterest, put something directly in the terms that the reasons for this are "solely for the purpose of operating, developing, providing and using the Pinterest products," which makes it a little more clear what's going on.

It's reasonable to suggest that perhaps Snapchat and its legal team should have anticipated this situation, and done something like a few of the others in getting people not to freak out -- but, really, people appear to be totally overreacting. Indeed, if you actually read through Snapchat's terms, they do immediately make it clear that there are limited reasons why they need this license, and that they're still limited by their privacy policy.

In short: this is standard, boilerplate language that's more or less considered necessary for sites like these, and the people who are freaking out (including reporters) are totally overreacting.

Filed Under: copyright, license, ownership, photo sharing, terms of service
Companies: facebook, instagram, pinterest, snapchat, tumblr, twitter

Ireland Becoming The Key Spot In Fights Over Data Privacy: Both Concerning Governments And Tech Companies

from the this-is-the-big-fight dept

There's a really big battle brewing concerning privacy protections online that involves some Silicon Valley tech companies, Ireland and the US government. And chances are this fight is going to get nasty. A few weeks ago, you might have heard that Twitter announced an interesting change in its privacy policy and terms of service, saying that all non-US users would technically now be managed under Twitter International Company, based in Dublin, Ireland. And, last week, Dropbox made a very similar announcement, noting that all non-North American users were now technically under Dropbox Ireland, while users in the US, Canada and Mexico remain under Dropbox in the US. Twitter's new terms go into effect on May 18th, and Dropbox's on June 1st (unless you're opening a new account before then, and the new terms apply immediately).

Over the last decade, Ireland has become a popular destination for US tech firms to set up international operations, in part because of Ireland setting itself up as sort of a tax haven for tech firms via its "Double Irish" tax dodge. A bunch of tech companies have been criticized for this, though the response of "we're following exactly what the law allows" is reasonable enough. Either way, that tax loophole is closing, though others may show up instead.

But this move doesn't seem predicated by that. Instead, there are two related elements that may be at work here. First: Ireland is also seen as having some of the most company-friendly privacy laws in the EU, though those are also coming under some amount of scrutiny. But, at the same time, by claiming that users are now under the Irish company, it gives Twitter and Dropbox at least some power to try to say no to US government requests for information. So, depending on if you're more afraid of government intrusions in your data than corporate intrusions (as I am), then these moves are probably good for your privacy.

Except... the US government still thinks that it can do whatever the hell it wants. First, in some ways, data inside the US has potentially more protections against the US government in a somewhat bizarre way. Whether you believe it or not, the NSA cannot "hack" its way into US computer systems. It can only use the various other processes it has to demand information from companies. Overseas, however, there are no such restrictions. The NSA has interpreted Executive Order 12333 to mean that it can hack into anything overseas, and this was the authority it used to break into the data centers of Google, Yahoo and likely more overseas (sneaking in via Level 3 and others).

But, that still requires hacking into stuff. If US tech companies believe they can successfully fend off such hacks, putting non-US users under Irish law does give them greater protection from the NSA. The NSA can no longer use its other authorities in the US to get the FISA Court to demand information (along with gag orders) from these companies. Or... maybe not. As we've been discussing, there's an ongoing court battle between the US Justice Department and Microsoft, over whether or not the DOJ can issue a warrant demanding Microsoft hand over information stored in Ireland. Microsoft has resisted, but the courts have so far sided with the DOJ. Ireland recognizes this is an important fight, and has asked for the EU to come out in support of Microsoft's position.

Meanwhile, with a new Attorney General in office, the DOJ has made it clear that it's going to continue this course of action:

US prosecutors will continue to seek data stored in Ireland using a federal search warrant, despite leadership changes at the Justice Department.

A spokesperson confirmed in an email that the department's position has "not changed," two weeks after Loretta Lynch, the Obama administration's choice to head up the federal agency, was confirmed by Congress as the new US attorney general.

This battle is going to be rather important for those other companies seeking to protect users under Irish law. Warrants aren't supposed to apply outside of the US. But the DOJ (and the courts) have been simply making up new laws, in arguing that if it's a US company, but the data is overseas, the warrant magically morphs into a quasi-warrant/subpoena hybrid. But that's ridiculous. Warrants and subpoenas have different purposes and different protections -- and the DOJ wants the best of both worlds. As Microsoft itself explained in one of its legal filings:

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this.

This fight is far from over -- and with companies like Twitter and Dropbox now trying to shift more non-US users under Irish laws, the fight with Microsoft is going to become even more important.

And, that's not even getting into the discussion of how all of this is, effectively, driving US businesses overseas. The US's efforts to spy on everyone is, once again, harming the US economy, rather than helping it.

Filed Under: data protection, ireland, lawsuits, privacy, surveillance, terms of service
Companies: dropbox, microsoft, twitter

Prison Messaging Service No Longer Claims It 'Owns' All Of Your Communications

from the good-for-them dept

We recently wrote about some dangerous terms of service from a big prison messaging service, JPay, in which the company claimed to flat out own any content that anyone sent through its service. While the company itself did not appear to be doing stupid things to enforce this, this clause did allow prison guards to put one prisoner in solitary confinement after his sister posted a video he had sent via JPay to social media. The prison claimed it was doing so to protect JPay's intellectual property.

The company has now told Dave Maass at EFF that it has dropped this clause from its terms of service:

It has recently come to our attention that there is language in our Terms of Service that impacts our customers and their families. The language states that JPay owns all content transmitted through our Email, VideoGram and Video Visitation services. Our intention was never to take ownership and profit in any way from our customers’ content. That is not and has never been JPay’s business and we have removed this language from our Terms of Service. From its inception, JPay has pledged to make our customers our top priority and we will continually strive to meet this pledge as best and as quickly as we can.

Maass is suggesting that they take it a step further and ask prison officials not to punish inmates who use their system, claiming that it's to protect JPay's intellectual property.

Filed Under: copyright, messaging, ownership, prison, terms of service
Companies: jpay

Complaints To FTC About Roca Labs Shows Company Threatening, Ignoring Unhappy Customers

from the '24/7-customer-service'-must-refer-to-the-hours-it-DOESN'T-respond-t dept

Roca Labs says it can help you lose weight by pumping your stomach full of its proprietary Fix-a-Flat-but-for-humans concoction. Once the product sets in, your stomach will have much less room for food. You'll eat less, lose weight, or spend hundreds of dollars trying!

If you find Roca Labs' product suspect or aren't happy with the results, you have a few options available. You can try to get your money back, but that seems to be a route not worth taking. You can complain about the product, but then you'll face the possibility of being sued.

Roca Labs has sued people for posting negative reviews. Roca Labs has threatened to sue people for writing about the lawsuits filed against reviewers. Roca Labs has also sued opposing lawyers, alleging some sort of internet conspiracy to ruin its "good" name. Roca Labs has also threatened to sue us two separate times. Those it hasn't sued, it has hit with bogus DMCA notices.

Judging from its recent history and the complaints filed with the FTC (acquired via FOIA request), Roca Labs appears to spend a majority of its income on marketing and litigation. Customer service expenditures seem to be hovering around $0.

First, there are the legal threats.

Very concerned as this product line is promoted as a "gastric bypass" for children, pregnant women, and overweight persons, but is a ingestible supplement.   I wrote about the product on my site, and was contacted by a lawyer in Israel and threatened to remove it or BUY three containers of the product, USE IT and rescind my posting. Absolutely NOT.

---

If you as a blogger write anything about their product ads, which are incredibly outrageous, they send you a letter saying they will sue you. BUT, you can purchase the product, try it out, write a review and then they will refund your money.

---

I see the 5th paragraph of section of Merchandise Return & Refund Policy seems to violate the Right of Free Speech. The 5th paragraph says and I quote:"If, for whatever reason, you become dissatisfied with The Formula or The Support, you agree not to make, write, post, distribute or disseminate in any way any negative comments about,or relating to, Roca Labs, The Formula, or The Support. This includes writing anything on the internet and making a complaint with Paypal, your credit card company, the Better Business Bureau, etc... Doing so, in light of these clear terms and conditions, would constitute breach of contract and defamation and would be actionable in Florida court. If you can cannot agree to this, The Company asks you not to purchase The Company’s product.

Sure enough, Roca Labs' Terms and Conditions contain a stupid non-disparagement clause [emphasis mine]:

You agree that regardless of your personal experience with RL, you will not disparage RL and/or any of its employees, products, or services. This means that you will not speak, publish, cause to be published, print, review, blog, or or otherwise write negatively about RL, or its products or employees in any way. This emcompasses all forms of media, including and especially the internet. This paragraph is to protect RL and its current and future customers from the harm of libelous or slanderous content in any form, and thus, your acceptance of these Terms and Conditions prohibits you from taking any action that negatively impacts RL, its reputation, products, services, management, or employees. We make it clear that RL and its Regimen may not be for everyone, and in that regard, the foregoing clause is meant to prevent “one person ruining it for everyone.” Should any customer violate this provision, as determined by RL in its sole discretion, you will be provided with seventy-two (72) hours to retract the content in question. If the content remains, RL would be obliged to seek all legal remedies to protect its name, products, current customers, and future customers.

Noted directly below it is the fact that this clause is unenforceable in California -- the only state that bans non-disparagement clauses. It appears to be linked to a discount Roca will give you should you choose to be its gastric jelly ambassador, but it's worded in a way that it affects anyone who purchases its products. If you choose to disparage the company and have signed up to spread the Roca gospel, you'll forfeit the discount. Note the phrase "should ANY customer violate this provision."

Asking for a refund seems to be impossible. Complaints detail the fact that Roca Labs apparently offers no live customer service. On top of that, the company only gives you three hours to stop the shipment of your order. Anything later than that means you'll be charged the full amount. Roca Labs justifies its "no refund" policy by claiming each shipment is made from scratch and specifically tailored to each customer. Sales and shipments are one way only. If nothing else, customers can be assured their account balances will be thinner by the end of their Roca Labs experience.

[part of a CS chat transcript included in one complaint] Roca Labs Premium Support manager Sharon K. replied Hello (b)(6), There is nothing to cancel as no other shipments are due to you. Your procedural kit was shipped in full on 11413. When you ordered you chose to pay your balance in 3 easy installments, the first payment was taken out on 11313 and you have a balance of $420, which is 2 more payments of $210. You cannot cancel paying your balance as this is what you owe for what is shipped. We are so sorry to hear about the medical condition. The return policy was made clear to you several times before you ordered. http:www.RocaLabs.com/return We will be willing to consider partial refund after all payments are made and you have provided a letter from you doctor verifying your claim. You should note that unpaid balances are forwarded to the legal department and added fees are charged which can end up in Florida court with charges totaling $3,200 or so. We trust and love our customers and hope they will never abuse the credit we extend them so they can afford the procedure. Please get also familiar with the Terms of the purchase.

There are more than 100 complaints, most of which revolve around the fact that once Roca Labs has access to your credit card information (which it acquires during its "qualification" process), your account will be charged for the entirety of the purchase, no matter what. There are no refunds, no returns and -- as its Terms and Conditions state -- the company reserves the right to charge you even more if you make your unhappiness with the product public.

Roca Labs tells customers they need to cancel within three hours of placing an order and then makes it impossible for anyone to do that.

If you wish to cancel your order before it has been shipped, you must immediately contact the Customer Care Department via the Website in writing for a full refund.

But...

Generally, Customer Care/Support is available 24 hours, 7 days a week. We will make every effort to respond to you within one (1) business day of any written contact. For your protection after your order has shipped RL requires that all contact must be in writing with Customer Care/Support through the Website ONLY.

How will you know when your three-hour clock starts? Apparently, you won't. You have to run through Roca's "qualification" process before being approved. But apparently you'll only find out if you've been approved by Roca ringing you up for the purchase you haven't agreed to yet.

Went on line 2/16/14 and did app 2 c if qualify for product. Didn't receive any correspondence or confirmation, just a 210.00 charge on my CC.

----

Application' process does not exist and there is no two hour cancellation window. Your acceptance turns out to be supplying your credit card number. Using my credit card, I placed an order for Roca Lab's diet product on May 4th @ 6:04 in the morning. The website discloses a 24 hour 'approval' process. It also states that after receiving 'approval' you have a two hour window to cancel the order. In less than 12 hours, after doing further research on the company, I called customer service to cancel the order. I was advised to send an email to the company. I did that and received an email stating that ' You placed your order on date & time . Your kit went into production on 3/4/2014 6:07 AM . Cancellation can ONLY be done by contacting our support desk at: Support@RocaLabs.com within 2 hours of submitting your health application' The website does not state this in the application screen. In fact it states that cancellation can be done after being 'approved'. I never received 'approval' from the company.

The inability to speak to anyone directly is noted repeatedly in the FTC complaints.

Unable to contact a human to talk about the product effectiveness or to change payment methods.

----

I have been having problems because they arent deligently answering my every questions, everything is done by email

----

YOU CANNOT SPEAK TO A REAL PERSON - you get messages via email or text, no real person! I even tried contacting the manager option (option 3)and only got a message back saying they know about my call.

----

Tried to contact customer service on-line but found no way to do so. Everything was directed to a Nurse which cost money to get support…

----

I tried sending the product back and paid $15.62 to return it, (after calling and not being able to talk to a real person) then they would not accept it…

----

Charged twice for the 'processing of application fee I found it ironic that when contacted about the additional charge and the fact that we were concerned it may be a scam that we were notified it would be addressed within 24 hours. Their policy says if you cancel within the first 2 hours that they will refund. There is no way to contact them for immediate cancellation.

Then there's this, via Adam Steinbaugh -- taken from a deposition of a former employee of Roca Labs.

Q: At what point did you believe that Roca Labs was -- did you come to believe that Roca Labs was deceptive or unethical?
A. When he asked me to dress up like a fat person so I could talk to his customers online about the product that I had never taken and about the weight loss that I had never lost because I've never been on a diet in my life.

[...]

Q. Now, when -- when you were terminated on October 25th, that followed a conversation with Mr. Juravin; correct?
A. Uh-huh.
Q. And the gist of that conversation was that you refused to sign the contract because of the nondisclosure agreement and the reduction in pay; right?
A. Yes.
Q. And in the course of that conversation you talked about the fat suit incident in connection with the nondisclosure agreement?
A. I did.

And this, which ties into Roca Labs' claims that every product it ships out is made uniquely for the person ordering it (justifying the "qualification" questionnaire and fee):

A. I don't know exactly the time period between the phone call and when I took the product. But we had not been opening the product in the beginning of my employ with him. We just started opening the product towards -- I guess into October he got a second shipment that was not -- he thought it had too much product. So he wanted to take some out and put it in smaller bags and that concerned me when I saw that he was opening the powder.

[...]

A: I just thought that really shouldn't be -- you know, a product that people consume shouldn't be taken out of their packaging and repackaged without any type of sanitary handling of it. The handling of the product was not sanitary at all and there was roaches on the floor and dust everywhere, cars were being parked in the garage. You know, there was nothing sanitary about any of it.

From the FTC complaints:

I received a box that looked like it had been tampered with and when I emailed them about it, they said that I am just 'claiming that'.

The 100+ complaints lodged with the FTC are likely only a small fraction of those actually displeased with the company and its no-refund policy. Its Terms and Conditions have probably deterred others from speaking out, what with the threat of being charged even more for a product that they don't want constantly hanging over their heads. With this in mind, it's tough to take any positive reviews of Roca Labs seriously. Instead, they take the appearance of gunpoint cheeriness, where "participants" have the "option" of vehemently praising the company or watching an additional $500-1000 disappear from their bank accounts.

Filed Under: complaints, free speech, ftc, non-disparagement, reviews, slapp, terms of service, threats
Companies: roca labs

Suburban Express Changes Terms Of Service To Screw Sued College Students Out Of University-Provided Legal Aid

from the as-of-2015,-SE-will-be-fucking-you-in-a-new-location dept

Dennis Toeppen of Suburban Express is still deploying his highly-peculiar brand of "customer service" -- something that includes doxxing unhappy customers, suing unhappy customers, suing unhappy customers, suing unhappy customers and being arrested for "harassment through electronic communications."

Nothing has changed. Toeppen is still a lawsuit fan who believes negative reviewers or anyone who doesn't fully appreciate how hard it is to run a shuttle bus service should be forced to pay $500 (at least) in "liquidated damages." Now, he's looking to pave himself a downhill slope for his future lawsuit filing. Techdirt reader Kionae sends over this article from the University of Illinois' campus newspaper which contains a small detail that shows just how far Toeppen is willing to go to get his $500.

Suburban Express recently changed its “Terms & Conditions” so any legal action arising on the online transaction of tickets should take place in Ford County, roughly 30 miles north of Champaign.

In a statement on its website, the company said it chose Ford County “because of high availability of court dates, efficient court operation, excellent staff work ethic, low costs for both parties, easy parking, and other factors.”

This has nothing to do with "efficient court operations" and has everything to do with making it economically unfeasible for sued college students to fight back. Taking the action 30 miles away strips students of the following protection:

According to the Student Legal Services Operational Plan, Student Legal Services can only represent eligible students who have cases in or originating in Champaign County.

Toeppen's change of venue is carefully calculated to extract the most money/misery from the situation. That situation, of course, is Toeppen's inability to run a business and field criticism at the same time. In Toeppen's defense, he'll say he's never wrong and it's these spoiled brat students with overactive mouths who are to blame. (What? Did you think I was going to half-heartedly defend any aspect of Toeppen's behavior?)

With students forced to pay for their own defense against Toeppen's frivolous, vindictive lawsuits, the needle moves towards a higher default judgment rate. That's what Toeppen wants, considering his legal arguments are mostly indefensible. This should see his lawsuit-filing rate approaching the stratospheric highs of 2012-13, a two-year span in which Suburban Express filed 126 lawsuits. Toeppen is misusing the judicial system. Hopefully, the judges there will recognize his venue-shifting for what it is and push cases back to the proper courts.

Filed Under: criticism, dennis toeppen, terms of service
Companies: suburban express

Facebook's Updated Privacy Policy Breaches EU Law, Belgian Study Claims; Other Countries Investigating

from the must-try-harder dept

Europeans have a rather ambivalent attitude to Facebook. On the one hand, millions of them love using it. On the other, many people are worried about the huge stores of personal information it is building up on its users -- and what it does with it. This has led to various attempts by the Austrian Max Schrems to find out what Facebook knows about him -- and to establish whether its handling of his data is compliant with EU data protection laws. Separately from those efforts, the Belgian privacy commission has been investigating Facebook's privacy policy. It asked researchers at a pair of local universities to provide an analysis. Here's what they found, as reported by the Guardian:

A report commissioned by the Belgian privacy commission has found that Facebook is acting in violation of European law, despite updating its privacy policy.

Conducted by the Centre of Interdisciplinary Law and ICT at the University of Leuven in Belgium, the report claimed that Facebook's privacy policy update in January had only expanded older policy and practices, and found that it still violates European consumer protection law.

The report runs to over 60 pages (pdf). The key findings are as follows:

To be clear: the changes introduced in 2015 weren't all that drastic. Most of Facebook's "new" policies and terms are simply old practices made more explicit. Our analysis indicates, however, that Facebook is acting in violation of European law. First, Facebook places too much burden on its users. Users are expected to navigate Facebook's complex web of settings (which include "Privacy", "Apps", "Adds", "Followers", etc.) in search of possible opt-outs. Facebook's default settings related to behavioural profiling or Social Ads, for example, are particularly problematic. Moreover, users are offered no choice whatsoever with regard to their appearance in "Sponsored Stories" or the sharing of location data. Second, users do not receive adequate information. For instance, it isn't always clear what is meant by the use of images "for advertising purposes". Will profile pictures only be used for "Sponsored Stories" and "Social Adverts", or will it go beyond that? Who are the "third party companies", "service providers" and "other partners" mentioned in Facebook's data use policy? What are the precise implications of Facebooks' extensive data gathering through third-party websites, mobile applications, as well recently acquired companies such as WhatsApp and Instagram?

Unfortunately for Facebook, this is just the start of a much wider investigation across Europe:

The Belgian Privacy Commission is also part of a European task force, which includes data protection authorities from the Netherlands, Belgium and Germany. [Leuven University's] ICRI/CIR and [Vrije Universiteit Brussel's] iMinds-SMIT will continue to support the Privacy Commission in the context of its investigation and future updates to the report will also be shared with their German and Dutch colleagues.

The Guardian notes that other European groups are scrutinizing Facebook's privacy policy:

Facebook is already being investigated by the Dutch data protection authority, which asked Facebook to delay rollout of its new privacy policy, and is being probed by the Article 29 working party formed of data regulators from individual countries across Europe, including the UK’s Information Commissioner’s Office.

Looks like Facebook has a busy few years ahead of it -- and what applies to Facebook is also likely to apply to a host of other companies that offer online services based on gathering large amounts of personal data in Europe.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: belgium, data protection, eu, privacy, privacy policy, terms of service
Companies: facebook