UK Court Says Company Is Innocent In Massive Data Breach Caused By Vindictive Employee, But Must Nonetheless Pay Compensation

from the who-said-life-is-fair? dept

It's well known that the EU has laws offering relatively strong protection for personal data -- some companies say too strong. Possible support for that viewpoint comes from a new data protection case in the UK, which follows EU law, where the judge has come to a rather surprising conclusion. Details of the case can be found in a short post on the Panopticon blog, or in the court's 59-page judgment (pdf), but the basic facts are as follows.

In 2014, a file containing personal details of 99,998 employees of the UK supermarket chain Morrisons was posted on a file-sharing Web site. The file included names, addresses, gender, dates of birth, phone numbers (home or mobile), bank account numbers and salary information. Public links to the file were placed elsewhere, and copies of the data sent on a CD to three local newspapers, supposedly by someone who had found it on the Internet. In fact, all the copies originated from Andrew Skelton, a Senior IT Auditor in Morrisons, as later investigations discovered. According to the court, Skelton had a grudge against the company because of a disciplinary process that took place in 2013. As a result of the massive data breach in 2014, Skelton was sentenced to eight years in prison.

The current case was brought by some 5,500 employees named in the leaks, who sought compensation from Morrisons. There were two parts to the claim. One was that Morrisons was directly to blame, and the other that it had "vicarious liability" -- that is, liability for the actions or omissions of others. The UK judge found that Morrisons was not directly liable, since it had done everything it could to avoid personal data being leaked. However, as the Panopticon blog explains:

having concluded that Morrisons was entirely legally innocent in respect of Skelton's misuse of the data, the Judge held that it was nonetheless vicariously liable for Skelton's misdeeds

That is a legal bombshell as far as UK privacy law is concerned, since it means that a company that does everything it reasonably can to prevent personal data being revealed can nonetheless be held vicariously liable for the actions of an employee, even a malicious one. That clearly offers an extremely easy -- if potentially self-damaging -- route for disgruntled employees who want to harm their employers. All they need to do is intentionally leak personal data, and the company they work for will have vicarious responsibility for the privacy breach. In fact, even the judge was worried by the implications of his own decision:

The point which most troubled me in reaching these conclusions was the submission that the wrongful acts of Skelton were deliberately aimed at the party whom the claimants seek to hold responsible, such that to reach the conclusion I have may seem to render the court an accessory in furthering his criminal aims.

As a result, the judge granted leave for Morrisons to appeal against his judgment that it was vicariously liable. Hundreds of thousands of companies around the UK will now be hoping that a higher court, either nationally or even at the EU level, overturns the ruling, and sets a limit on those super-strong data protection laws.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data breach, data protection, employees, eu, liability, responsibility, uk

How Congress' Attempt To Break CDA230 Could Kill Airbnb

from the liability-liability-liability dept

Earlier this week, we wrote about a dangerous bill to punch a giant hole in Section 230 of the CDA. We spent a lot of time in that post detailing how problematic the bill is and how it would actually be counterproductive to the stated goal of stopping human trafficking. But, beyond just being counterproductive to the stated goal, the bill would likely create fairly massive negative consequences for tons of internet companies. If anyone used any part of that company's products and services for trafficking, it would open up companies not just to liability, but to costly legal action, even if they're eventually vindicated.

And I wanted to dig into one example: Airbnb. As we've discussed in the past, Airbnb relies heavily on CDA 230, because otherwise, any time anything went wrong with an Airbnb hosted place, Airbnb would face potentially crippling lawsuits. And I'm thinking about Airbnb specifically, because of a recent ruling that Eric Goldman pointed out, in which Airbnb's largest competitor VRBO was saved by CDA 230. You can go over to Eric's blog to read the details, but the really short version is that someone booked a "luxury resort" via VRBO for a ridiculous sum of money, and the rental units never happened. The victims targeted VRBO with the lawsuit, but the court has none of it.

The plaintiffs claimed VRBO qualified as a “seller of travel services,” which would subject it to heightened regulation. The court disagrees: “HomeAway merely provides a venue for others to sell or provide lodging, but does not provide the actual facility where people can ‘lodge.'” See the uncited SF Housing Rights Committee v. Homeaway ruling. Further, if VRBO did constitute a seller of travel services, Section 230 would apply: “To hold HomeAway liable for misleading or inaccurate material (e.g., images from another property listing appearing on a different HomeAway website being duplicated on the VBRO.com Jewels of Belize rental account) in the third party created Jewels of Belize listing contravenes Section 230 of the CDA.”

To get around Section 230, the plaintiffs invoked VRBO’s “Basic Rental Guarantee,” which provides reimbursement for certain types of fraud (but doesn’t cover direct wire transfers like those at issue here). VRBO denied the reimbursement claim, concluding that the listing came from an authorized property owner and the property actually existed (but apparently had serious problems). The court says VRBO did what it promised to do in the “guarantee.” The fact VRBO used the term “guarantee” (a term I wouldn’t have chosen personally) didn’t convert the reimbursement promise into something more.

Now, there's a somewhat reasonable argument to be made that it would be smart business strategy for VRBO to handle the situation better and to reimburse these people. But making the company legally liable is another story.

So, now let's get back to SESTA, the bill that was released earlier this week. Surely, some of you are thinking, that's not a big deal for Airbnb? After all, everyone's just talking about how it's designed to takedown Backpage (ignoring that Backpage already shut down its adult section, and current law already lets the DOJ go after Backpage if it violated federal trafficking laws). And Airbnb isn't Backpage. But... there actually have been a whole bunch of stories this year claiming that prostitutes are now using Airbnb. And, with some folks trying to conflate prostitution with trafficking, is it any stretch of the imagination to think lawyers will start suing Airbnb, claiming it's violating federal anti-trafficking laws?

As Eric Goldman asks in his post:

In light of that, how would Airbnb and VRBO change their behavior to reduce their potential liability for sex trafficking pursuant to the proposed bills? Heck if I know, and I doubt Congress knows either.

Put yourself in the shoes of Airbnb and tell me: how would you completely rule out that anyone could possibly abuse the Airbnb service for trafficking? It's... not easy. This doesn't mean Airbnb wants this activity to happen via it's platform. I'm 100% sure that it does not. It would be thrilled if there were an easy to way to stop it. But... it's not. Like, this is a basic impossibility. And yet, if it happens, then suddenly the companies themselves could be liable for criminal activity. Criminal activity that was done by others, that Airbnb would have no effective way to stop, short of shutting down the site or doing something ridiculous and drastic. That... seems like a pretty big overreaction. Yes, trafficking is a problem, but this bill is sending a wrecking ball through the internet as it seeks out one particular company.

And, yes, I get that some people don't like Airbnb, so maybe they're fine with this kind of collateral damage, but Airbnb is just one example here. Plenty of other sites that you probably do like will face similar problems. This is a bad bill that won't even help with its stated goals, but will create serious problems for people around the globe.

Filed Under: cda 230, intermediary liability, liability, prostitution, section 230, trafficking, unintended consequences
Companies: airbnb, vrbo

Russia Does A 'Copy/Paste' Of Germany's New 'Hate Speech' Online Censorship Law

from the well,-that-wasn't-predictable-at-all dept

A few weeks ago, we warned about a dangerous new German law that would fine social media companies if they didn't magically block "hate speech" on their platforms. As we pointed out, this would lead to widespread censorship, as the risk of liability for leaving up even borderline speech would be massive. And, equally important, this would embolden oppressive, dictatorial and autocratic regimes to press on with their own crackdowns on free speech by using laws like this one and claiming that they're doing the exact same thing as supposedly democratic nations like Germany.

We didn't have to wait long. Reporters Without Borders points us to the news that Russia has now rushed out a bill that is basically a cut and paste of the German law:

Reporters Without Borders (RSF) condemns a Russian bill that would force social networks to remove “unlawful” content within 24 hours of notification. It is based very closely on a law that was adopted in Germany on 30 June.

The Russian bill shows that when leading democracies devise draconian legislation, they provide repressive regimes with ideas. Submitted to the Duma on 12 July by members of President Vladimir Putin’s United Russia party, the bill’s references to the German law are explicit.

Just like the German bill, the Russian bill would allow anyone to claim certain content is "unlawful" and then the platforms would have 24 hours to remove the content or face massive fines. This will, inevitably, enable much greater control and censorship (already an issue in Russia). But it will be more difficult to argue that Russia is doing something "bad" here as the Russians will quickly point out that Germany has identical legislation. And I wouldn't be surprised to see other countries, such as Iran or China, put in place similar "laws" themselves.

Filed Under: censorship, germany, hate speech, intermediary liability, liability, platforms, russia
Companies: facebook, google

Should Tumblr Be Forced To Reveal 500 People Who Reblogged A Sex Tape?

from the bad-cases-make-bad-law dept

What were we just saying about how it's important to defend Section 230 of the CDA even when it's hard? Well, here's a hard case in New York City where the situation is very unfortunate. It appears that a woman discovered that an old sex tape of hers had surfaced online from 10 years earlier when she was 17. Someone had posted it to Tumblr, where over 1,000 people apparently viewed it -- and somewhere around 500 "reblogged" it or commented on it in some manner. This is, undoubtedly, traumatic for the woman. She appears to believe that "an angry ex" posted it to Tumblr originally, which would make this a classic "revenge porn" situation.

But... rather than go after that ex, her lawyer is going after everyone who reblogged it on Tumblr and somehow got a judge to agree to force Tumblr to cough up identifying information on all of them. So let's be clear: this is clearly a horrifying story and an awful thing for the woman to live through. And, on top of that, the people who not only viewed, but further shared the video are awful human beings who should feel bad about their choices in life.

But... there are all sorts of legal questions here that should raise concerns. First up: Section 230. That should have kept Tumblr from being liable if it fails to hand over this info, as it's not supposed to be held liable for the actions of its users. And that's even -- as noted by Scott Greenfield -- after Tumblr failed to show up in court and the judge gave the plaintiff a default ruling. Second issue: protecting anonymity online. As we've detailed many times before, and as the Supreme Court has stated, the right to speak anonymously is also protected by the First Amendment. There are standards for revealing identifying information on anonymous speech, but it requires those in court clear a pretty high bar in proving why it's necessary to strip that right of anonymity. It does not appear that any such high bar was met in this case. Third issue: on Tumblr, "reblogging" something is basically a click of a button and is often the functional equivalent of a "retweet" for those more familiar with Twitter. That is, it does not signal endorsement -- but really just a way of marking something that you saw.

So, again, this is one of those cases where it certainly feels very difficult to defend the other side here. I have nothing good to say about the people who watched or reblogged the video. But getting Tumblr to reveal their identities so that she can proceed to sue them is a bad idea fraught with all sorts of problems.

Filed Under: anonymity, liability, manhattan, reblogging, revenge porn, section 230
Companies: tumblr

Judge Dumps Two Lawsuits Attempting To Hold Facebook Responsible For Acts Of Terrorism

from the not-how-this-works dept

Two lawsuits filed by victims of terrorist attacks against Facebook have been dismissed. Both suits alleged Facebook was complicit in acts of terrorism simply because it (subjectively) didn't do enough to discourage use of the platform by alleged terrorists.

One lawsuit (Cohen v. Facebook) plead on behalf of "20,000 similarly-situated" residents of Israel who continue to face the threat of violence at the hands of terrorist organization Hamas. The other (Force v. Facebook) also featured multiple plaintiffs but was limited to families of victims of Hamas attacks. Neither case presented legitimate complaints and both advanced novel arguments in an attempt to avoid a dismissal under Section 230.

The alternative routes to judgment worked out no better for the plaintiffs, as Eric Goldman reports. The Cohen class action presented a legal theory that couldn't even be addressed by the court due to a lack of jurisdiction. From the decision [PDF]:

the Cohen Plaintiffs do not seek redress for past actions but instead seek prospective, injunctiye relief based on their allegation that Facebook’s actions increase their risk of harm from future terrorist attacks. This claimed harm relies on multiple conjectural leaps, most significantly its central assumption that the Cohen Plaintiffs will be among the victims of an as-yet unknown terrorist attack by independent actors not before the court. The Cohen Complaint contains no factual allegation that could form a basis to conclude that those individuals in particular are at any “substantial” or “certainly impending” risk of future harm. At most, the Complaint shows a general risk of harm to residents of Israel and impliedly asks the court to extract a risk of harm to the Cohen Plaintiffs based on this risk. Without further allegations, however, the court sees no basis to conclude that the Cohen Plaintiffs “specifically will be the target of any future, let alone imminent, terrorist attack.”

Nor can the Cohen Plaintiffs rescue their claims by arguing that they suffer a present harm resulting from their fear of such attacks, as “allegations of a subjective [fear] are not an adequate substitute for a claim of specific present objective harm or threat of a specific future harm.” While the court does not question the sincerity of the Cohen Plaintiffs’ anxieties, their subjective fears cannot confer standing absent a sufficient showing of the risk of future harm.

The Force plaintiffs did not entirely avoid a Section 230 argument, but posited the immunity does not apply to content posted outside of the United States. The court grants that this legal theory is mostly unexplored at this point, but that the plaintiffs cannot avail themselves of an extraterritorial-reliant legal theory while bringing legal action in a US court against a US-based company.

In light of its focus on limiting civil liability, the court concludes that the relevant location is that where the grant of immunity is applied, i.e. the situs of the litigation. Section 230(c)(1) suggests a number of "territorial relationships and events," which are generally divisible into those associated with the underlying claim (e.g., the location of the information content provider, the intemet service provider, or the act of publishing or speaking) and the location associated with the imposition of liability, i.e. where the intemet service provider is to be "treated" as the publisher or speaker. Given the statutory focus on limiting liability, however, the location of the relevant "territorial events" or "relationships" cannot be the place in which the claims arise but instead must be where redress is sought and immunity is needed.

With this in mind, the court concludes that the Force Action does not require an impermissible extraterritorial application of Section 230(c)(1). As the situs of the litigation is New York, the relevant "territorial events or relationships" occur domestically. Accordingly, the court rejects the Force Plaintiffs argument that Facebook should be denied immunity under Section 230(c)(1).

As Goldman points out, this looks like a routine and logical application of Section 230 immunity, but if arguments like these are entertained in other courts, it could pose some serious, irreparable problems for social media platforms.

The plaintiffs essentially sought to treat Facebook as the financial guarantor of all terrorist-caused harms to all victims, regardless of what role Facebook played in causing those harms. Such an unbounded financial exposure could dwarf Facebook’s market capitalization, meaning that the theories behind these lawsuits pose an existential threat to Facebook, other social media sites, and possibly the entire Internet. Thus, the judge’s well-reasoned and clear rejection of the plaintiff’s claim is a big win for Facebook and the Internet.

This decision will be appealed by both parties. There's been no decision yet on a similar suit filed in the Ninth Circuit, but the chances of these legal theories succeeding is very slim. But it's not impossible to end up with a bad ruling or, at the very least, precedent that weakens Section 230 without removing it completely. We've seen it happen before. But so far courts haven't felt the urge to hold social media platforms directly responsible for terrorists' acts of violence and it's unlikely these two complainants are going to change that.

Filed Under: intermediary liability, liability, material support for terrorism, terrorism
Companies: facebook

German Court Rules Parents Must Out Their Family Members For Copyright Trolls Or Pay Fines Themselves

from the family-first dept

Copyright trolls are a plague spreading across the world, one which has received far too little social medicine for the taste of many. This virulent form of rent-seeking tends to put out some of the more despicable strategies, from flatout falsely accusing people of piracy, lying to international students about the punishment for copyright infringement, and threatening those that expose their actions.

But a case that was winding its way through German courts sees copyright trolls there now going even further, winning the argument over whether parents should have to serve their own children up to the courts for copyright trolls.

In 2011, a family received a letter from Universal Music, demanding cash alongside claims that Rihanna’s album ‘Loud’ had been illegally shared via their Internet connection. The parents, to whom the letter was addressed, indicated that they had no interest whatsoever in the R&B star. However, one of their three children apparently did, and the parents knew which one had committed the infringement. Perhaps understandably, however, the parents didn’t want to throw their child to the lions. It’s a position that’s supported by a local law which protects family members from having to testify against each other.

The case ended up at the Munich Court of First Instance and the parents were held liable for copyright infringement and ordered to pay almost 3,900 euros. From there the case progressed to the Federal Court of Justice (Bundesgerichtshof – BGH), which handed down its ruling Thursday. In a big win for Universal, the BGH upheld the decision of the lower court, holding the parents liable for copyright infringement.

In other words, in the name of copyright trolls that have naught but an IP address to go on, parents in Germany may now face a flavor of Sophie's Choice: give up your children to the copyright troll or pay all fines themselves. Given that we're talking about children here, that likely amounts to the same result, as parents will be the one footing the bill. Still, there is something sadistic about trying to cooerce parents into naming their own children before the court. Keep in mind that this is mere copyright infringement we're talking about, not the typical crimes for which parents have long been expected to be responsible for when their children violate the law. And keep in mind as well how often these copyright trolls are wrong, have faulty or incomplete evidence, and so on.

Levying responsibility for the failure to out one's own family member is almost comically pernicious. That the court saw fit to route around local laws protecting families from this sort of thing in the name of copyright trolls seems doubly so.

Filed Under: children, copyright, copyright trolling, families, germany, liability

FBI Arrests Creator Of Remote Access Tool, Rather Than Those Abusing It To Commit Crime

from the nice-work,-g-men! dept

The DOJ is attempting to prosecute the creator of a remote access software -- not because he used it for nefarious purposes -- but because it can (and has been) used by criminals. Kevin Poulsen has the whole bizarre story at The Daily Beast -- one that involves a 26-year-old programmer and the remote administration tool (RAT) he created and sold.

Taylor Huddleston, creator of NanoCore, a RAT that has been linked to intrusions in ten countries, had his home raided by FBI agents on December 6th. The 14-page indictment paints Huddleston as a willing accomplice -- someone who sold his product to bad people to do bad things.

But the facts of the case -- things that can be proven with forum chat logs and Huddleston's proactive efforts to prevent his RAT from being abused -- disagree with the government's narrative. NanoCore does all the things an administrative tool is expected to do, including keylogging and granting control to remote administrators. But Huddleston claims he created the tool to be a low-cost solution for cash-strapped businesses and small government agencies. His actions appear to back up the claims that he never intended this to be a plaything for criminal hackers.

While Huddleston did debut and offer his product for sale at HackForums -- hardly the best marketplace if one wants to be seen as purely innocent -- he took corrective actions and issued strict warnings about illegal deployment.

[H]uddleston found himself routinely admonishing people not to use his software for crime. “NanoCore does not permit illegal use,” he wrote in one post. In another, “NanoCore is NOT malware. It is intended to be used legitimately and I don’t want to see words like ‘slave’ and ‘infect.’” Huddleston backed his words with action. Whenever he saw evidence that a particular buyer was using the product to hack, he’d log in to Net Seal and disable that user’s copy, cutting the hacker off from his infected slaves.

Net Seal is another of Huddleston's creations. It allows users to protect their IP by allowing them to shut down questionable copies of their software -- like copies purchased with stolen credit cards. Oddly enough, this IP protection tool is also named in the indictment as more evidence of Huddleston's criminal intent.

“Net Seal licensing software is licensing software for cybercriminals,” the indictment declares. For this surprising charge—remember, Huddleston use the licenses to fight crooks and pirates—the government leans on the conviction of a Virginia college student named Zachary Shames, who pleaded guilty in January to selling hackers a keystroke logging program called Limitless. Unlike Huddleston, Shames embraced malicious use of his code. And he used Net Seal to protect and distribute it.

That ridiculous claim shows how far the government is willing to go to pin the bad deeds of criminals it can't catch on the creator of the software they're abusing. But the government has to show Huddleston created the software with the intent that it be used for criminal activity. That's going to be extremely tough to prove. So, it looks like the government's hoping to turn Huddleston into a cooperative witness or pressure him into a plea deal that will prevent it from having to climb this evidentiary mountain.

One of the tools at the government's disposal is particularly nefarious. Huddleston wrote and sold software to get his head above water financially. The small amount of money he made from selling Net Seal and NanoCore (he fully divested his ownership of the latter late last year for a whole $5,000) allowed him to purchase a very modest $60,000 house for him and his girlfriend. The government wants to seize the house, claiming it was purchased with the proceeds of illegal activity. But it has yet to prove the sale of these two tools was a criminal act in and of itself. The horrible thing about forfeiture is the government can uncouple this from the prosecution and file an administrative claim which would place Huddleston's new home in its hands and shift the burden of proof to the indicted programmer.

The only way this case doesn't blow up in the government's face is if it can convince Huddleston not to go to trial. This placement of secondhand guilt on the creator of a remote administration tool is idiotic and disingenuous. No one's going after Microsoft for building the same functionality into its operating system, even though it's routinely abused by criminals and scam artists.

What this really boils down to is law enforcement laziness, which it commonly refers to as "efficiency." It's incredibly easy to find the creator of software abused by criminals because a creator who doesn't feel he's committed any criminal act isn't going to do much of anything to cover his tracks or get off the grid. It's punishment that only makes sense to misguided prosecutors and FBI officials who feel any successful bust is a good bust. And if they do succeed in putting Huddleston in prison, absolutely no one will be vindicated.

In the meantime, Huddleston has to fight back with his hands tied. He was released on bond but forbidden to use the internet. His arraignment takes place in a city 16 hours from where he lives. His recently-purchased home may not be his for much longer. And all the criminals misusing his product -- the ones he actively fought back against -- are still out there committing criminal acts.

Filed Under: doj, fbi, liability, nanocore, net seal, rat, remote access, secondary liability, taylor huddleston

German Judge Fines Father Because He Didn't Tell His Kid Not To Engage In Piracy

from the going-to-fine-you-so-hard-your-dad-will-feel-it dept

Time for German parents to have "The Talk" with their kids. Unprotected sexual activity is probably fine. But casual seeding? That's a problem.

TorrentFreak reports that a German court has decided to hold a parent responsible for his child's infringing activity. This doesn't have much to do with the rightsholder being unable to extract fines from a minor, but rather a perceived parenting failure.

In a case before a Leipzig court the defendant denied having downloaded an audiobook, as he wasn’t home at the time of the infringement. His wife and 11-year-old son were, and as the case progressed it became clear that the latter was the offender.

Nonetheless, in a rather unique verdict the court decided to hold the father liable. Although it’s not uncommon for parents to be held responsible for the actions of their children, the court specifically referenced a lack of anti-piracy education.

The father countered that he had instructed his child to be safe out there -- to not do anything "dangerous" or "download random things." Apparently, that's not good enough, not when entities like GEMA roam the post-fatherland, slapping kindergarten classes with licensing fees, and courts show a willingness to hold registrars responsible for the illegal activities of their registrants. It appears that parents are supposed to act as anti-piracy educators -- a burden that usually falls on rightsholders and their representation, many of which have lobbied for intellectual property instruction to be inserted somewhere between the second and third "R."

In her order the judge writes that for proper parental supervision, it’s required to “instruct a child on the illegality of participating in illegal file-sharing exchanges, and to explicitly prohibit this behavior.”

To do otherwise is legally "negligent," according to the court. And it hinted the father lied about the computer use instructions he gave his child, presumably in hopes of avoiding fines and fees.

This is a ridiculous conclusion. Courts aren't going to be policing parental anti-piracy instruction until well after the fact, if at all. At that point, all it takes is a sworn affidavit to shift the culpability back on the child, and, at that point, the court is just going to shift it back to the parents of the minor defendant. There's no statutory basis for this sort of instruction and it's something that's (a) better handled by rightsholders and (b) likely to be just as ineffective in preventing piracy.

Filed Under: copyright, germany, kids, liability, parents

Recent Law School Grad Sues Twitter Because Someone Made A Parody Twitter Account

from the it's-a-feelony! dept

Another day, another wacky legal complaint. This one, first spotted by Eric Goldman was filed by a recent law school grad, Tiffany Dehen. She's fairly upset that someone set up a parody Twitter account pretending to be her that portrayed her in an unflattering light. So she has sued. For $100 million. And she's not just suing the "John Doe" behind the account... but also Twitter. Oh, and also the University of San Diego, because she's pretty sure that someone there is responsible for this account (she just graduated from USD's law school). Oh, and according to the exhibits that Dehen put in her own lawsuit, the account is labeled as a parody account.

The lawsuit... well... it doesn't reflect well on the University of San Diego law school and its ability to prepare lawyers. I don't know if the law school didn't teach Ms. Dehen about California's anti-SLAPP law, but she's likely about to get a quick post-graduate lesson about it. I won't even get into the reasons why this is unlikely to be defamation (parody, people, parody...), but the fact that Twitter and USD are included... is pretty nutty. Twitter will get out of the case pretty damn easily under Section 230 (does the University of San Diego law school not teach Section 230?!?). And, of course, there's this, which kind of speaks for itself:

If you can't read that, it says:

Additionally, it should be noted that Tiffany Dehen's real twitter account consists of posts supporting the elected President of the United States, not Adolf Hitler, the socialist communist dictator from Germany. The fact that John Doe used Tiffany Dehen's real name and linked the fictitious Twitter account to Tiffany Dehen's real name and linked the fictitious Twitter account to Tiffany Dehen's real account by retweeting Tiffany Dehen's posts shows that John Doe acted with actual malice and negligence.

Huh? I'm still stumbling over "socialist communist" that I'm already having difficulty figuring out how parodying someone is proof of "actual malice and negligence."

As for Twitter's involvement, here's what Dehen thinks makes Twitter liable:

Plaintiff requests to enjoin Twitter, Inc, jointly and severally, the social media website which allowed this disparaging speech to stay broadcast to the world, costing plaintiff potentially millions of dollars in future earnings. Twitter was put on notice on January 30, 2017, and as of Feb 1, 2017, the false twitter account was still posted, even after Tiffany Dehen put Twitter on notice. The process Twitter adheres to is absolutely ridiculous and should be looked at as well and Plaintiff claims the process Twitter has in place to review defamation is unconstitutional.

Hooo boy. Where to start? Let's just skip over the awful run on sentences and note, again, as we did above, that Section 230 makes Twitter categorically immune from this lawsuit. I'm still at a loss as to how any lawyer today could file a lawsuit and not be aware of the basics of Section 230. Even without Section 230, Twitter would easily get out of this lawsuit. Notice that she cites no actual laws on the books or caselaw to back up this claim? She gives the company a grand total of two days of notice? And then I didn't know that "absolutely ridiculous" processes (which she doesn't actually seem to understand or describe) are illegal. I'd like to know the statute that says "absolutely ridiculous" policies for dealing with parody accounts are illegal, because, man, that would be useful. Oh, and "unconstitutional." Wha....? This is just... so, so awful. The University of San Diego law school should be ashamed.

Oh, right, about USD Law. Why is it a defendant? Beats me.

Plaintiff requests to enjon University of San Diego because of the fact that as seen in Exhibits 34 and 35, it appears as though there is a high probability John Doe is an University of San Diego student or alumni since the photo used to make the swastika headband, as shown in Exhibits 3, 4, and 5, is Plaintiff's profile photograph on LinkedIn. University of San Diego should be liable as well due to a prior matter that was not resolved appropriately by University of San Diego which led to USD acting recklessly, or at the very least negligently, to allow this matter to arise.

So... it sorta feels like perhaps Ms. Dehen thinks that "enjoin" means "make a party to the case" rather than the actual meaning, which is to have the court stop the party from doing something. Is it truly possible that someone can graduate from law school without knowing what enjoin means? Also, as for the rest of that paragraph, what is even going on? I keep reading it, and trying to understand why the fact that a LinkdedIn photo was used somehow makes it obvious that it was a USD student. Because she doesn't explain it at all, if you actually bother to go to the exhibits, it appears she's implying, without saying, that because LinkedIn tells her that some people from USD Law School visited her profile (among other people from other places) that's her proof. That's... not quite how it works.

And... even if it is a USD student, so what? That doesn't make USD liable.

And then the unexplained "prior matter"? Who graduates from law school and thinks that's how you put something into a complaint?

Oh, and then there's this:

Further, on the way to Federal Court in Downtown Sand Diego to file this complaint, Plaintiff was involved in a collision on the I-5 Freeway headed South, which resulted in neck and back pain for which Plaintiff is now seeking medical attention. Please see Exhibit 39.

So... um... it sucks that you were in a car accident. That's no fun. But what the hell does that have to do with the lawsuit? Why is that in here? And if she was on her way to file it when the accident happened, does that mean after the accident (in pain and all) she stopped to add this totally irrelelvant paragraph to the "complaint"?

Again, I'm not even going to go into why this account almost certainly isn't defamation, but among her evidence that this meets the "statutory malicious defamation claim" (?!?!) is this:

John Doe's fault in publishing the statement amounted to substantially more than just negligence. John Doe's meticulous planning of potentially creating a fake Facebook account in which he sought to befriend Plaintiff on social media (Please see Exhibit 38) and gain access to additional information, coupled with the time involved in setting up a false Twitter account, as well as downloading, altering, and reposting plaintiff's images, shows more than just the defendant's fault in publishing the statement. John Doe's deliberate actions amounted to much more than just mere negligence, but more so proves malice, an element of criminal crimes.

That's... quite a paragraph. But I just want to point out that this is (1) a civil lawsuit and (2) she says that this is an element of "criminal crimes." Criminal. Crimes.

Finally, I'm no lawyer, but I read and write a lot about court cases, and I can't recall ever seeing a legal complaint written in this manner. It doesn't seem to match with any typical legal complaint format that I've ever seen. It doesn't name any laws. And, I hate to give her any ideas, but normally when people make these kinds of questionable legal attacks on parody claims, they at least try to throw in an ill-advised publicity rights claim. Perhaps that wasn't taught at USD? Anyway, the 3-page "brief" (as she calls it) is then followed with another 20 pages of "exhibits" which are mostly screenshots that she seems to think proves a point, but as noted above, require anyone looking at them to make giant leaps and inferences to even figure out what her complaint is actually alleging.

And yet, she argues that John Doe, Twitter and USD should pay her $100 million because this parody account is "damaging to plaintiff's name, especially in this crucial juncture of her life where she is applying to California bar admittance and looking for a legal job in San Diego."

I think free speech lawyer Ari Cohn sums this one up nicely:

Filed Under: cda 230, defamation, free speech, lawsuit, liability, parody, section 230, tiffany dehen
Companies: twitter, university of san diego

Yet Another Lawsuit Hopes A Court Will Hold Twitter Responsible For Terrorists' Actions

from the law-firms-basically-setting-up-franchises dept

So, this is how we're handling the War on Terror here on the homefront: lawsuit after lawsuit after lawsuit against social media platforms because terrorists also like to tweet and post stuff on Facebook.

The same law firm (New York's Berkman Law Office) that brought us last July's lawsuit against Facebook (because terrorist organization Hamas also uses Facebook) is now bringing one against Twitter because ISIS uses Twitter. (h/t Lawfare's Ben Wittes)

Behind the law firm are more families of victims of terrorist attacks -- this time those in Brussels and Paris. Once again, any criticism of this lawsuit (and others of its type) is not an attack on those who have lost loved ones to horrific acts of violence perpetrated by terrorist organizations.

The criticisms here are the same as they have been in any previous case: the lawsuits are useless and potentially dangerous. They attempt to hold social media platforms accountable for the actions of terrorists. At the heart of every sued company's defense is Section 230 of the CDA, which immunizes them against civil lawsuits predicated on the actions and words of the platform's users.

The lawsuits should be doomed to fail, but there's always a chance a judge will construe the plaintiffs' arguments in a way that either circumvents this built-in protection or, worse, issues a precedential ruling carving a hole in these protections.

The arguments here are identical to the other lawsuits: Twitter allegedly hasn't done enough to prevent terrorists from using its platform. Therefore, Twitter (somehow) provides material support to terrorists by not shutting down (one of) their means of communication (fast enough).

The filing [PDF] is long, containing a rather detailed history of the rise of the Islamic State, a full rundown of the attacks in Brussels and Paris, and numerous examples of social media posts by terrorists. It's rather light on legal arguments, but then it has to be, because the lawsuit works better when it tugs at the heartstrings, rather than addressing the legal issues head on.

The lawsuit even takes time to portray Twitter's shutdown of Dataminr's feed to US government surveillance agencies -- as well as its policy of notifying users of government/law enforcement demands for personal information -- as evidence of its negligence, if not outright support, of terrorist groups.

The problem with these lawsuits -- even without the Section 230 hurdle -- is that the only way for Twitter, Facebook, etc. to avoid being accused of "material support" for terrorism is to somehow predetermine what is or isn't terrorist-related before it's posted… or even before accounts are created. To do otherwise is to fail. Any content posted can immediately be reposted by supporters and detractors alike.

And that's another issue that isn't easily sorted out by platforms with hundreds of millions of users. Posts and tweets are just as often passed on by people who don't agree with content, but arguments made in these lawsuits expect social media platforms to determine what intent is… and take action almost immediately. Any post or account that stays "live" for too long becomes a liability, should courts find in favor of these plaintiffs. It's an impossible standard to meet.

These lawsuits ask courts to shoot the medium, rather than the messenger. They make about as much sense as suing cell phone manufacturers because they're not doing enough to prevent terrorists from buying their phones and using them to communicate.

Filed Under: cda 230, isis, liability, material support, section 230, social media, terrorism
Companies: twitter