Electronic Communications, Privacy, Data Protection, and More

Clorox: Looking for Attorney to Oversee Social Media Programs

Venkat — Mon, 25 Jan 2010 03:29:00 GMT

I'm guessing the headline from this Ad Age article (titled "Clorox: Seeking Attorney to Oversee Social Media Programs" / h/t John Lichtenberger) may be an example of a headline that doesn't precisely fit the article. From reading the article, Clorox seems to envision the prospective Colorox in-house lawyer as overseeing the legal aspects of the social media program, rather than overseeing the program itself.

I'm not sure what Colorox has in mind for the new lawyer's orientation, but it should think about giving him or her a copy of this cartoon I came across the other day titled "Corporate Twitter" (by Tom Fishburne):

The risk averse nature of lawyers coupled with our instinct for editing and re-editing documents at length will probably cause us to butt heads with the social media departments on occasion. This will probably result in the exaggerated version of the typical battle between the legal department and the marketing department in any company (or the legal department and the sales department).

Life Lessons Learned From Twitter

Venkat — Fri, 22 Jan 2010 18:23:00 GMT

My blogging energy went in a lot of different directions this year, but one of the biggest changes I experienced was that I spent a good chunk of time on Twitter. (I'm @VBalasubramani, if you are interested, but I should warn you that I don't tweet a ton about legal topics - I would say 20-30% of my posts there are relevant to my area of practice. As for the other 70-80%, if you are curious as to whether my tweets fall into the stereotypical "what I ate for breakfast" category, you'll just have to follow me to find out!)

There's a ton of digital ink spilled on what to do on Twitter, how to monetize or build business through it, and there is a big contingent of experts who for a small fee can school you in the ins and outs from Twitter. So I won't bore you (or waste your time with my own tips). One of the more interesting aspects of Twitter for me was self-reflection, and reaffirming some larger lessons. These mostly fall into the obvious (play nice, be honest, do unto others) category, but I thought a few were worth summarizing.

1. Everything you say says something about you. Twitter is all about saying what's on your mind, and in this sense, it's a giant container of "unsolicited information." An old friend and I used to joke about "unsolicited information," and in some ways Twitter reminds me of this. We were both starting out as lawyers, and worked at a firm. As in any other environment where you have people that are all starting out as a group, we spent a ton of time interacting with people who had all recently started. One thing we realized is that at least half of the stuff our fellow associates said were for their own benefit. For example, you are on your way to get a coffee, and you stop by and ask someone how they are doing and they say "I'm just busy. . . staffed on like 8 zillion matters, and feeling totally crushed." The goal of that comment is not to impart information to you, but to reaffirm to the speaker what is going on in his or her own mind: "I'm busy, important, and billing lots of hours." There's a lot of this on Twitter. Not that there's anything wrong with this, but it's helpful to remind yourself once in a while.

2. You don't need to weigh in on everything. This feels like advice a social media expert may dole out, but it really takes a lot of effort to not comment on what other people say. And you don't need to do so. In fact, you should restrict your comments to the exceptional circumstance. People will post on all sorts of topics, ranging from who should pay for the media coverage of the balloon boy debacle, to the merits of Apple's upcoming devices (comments about impending product offerings are rampant on Twitter). If you are at all opinionated, the impulse is often strong to comment on everything. There's a lot to comment on. As in real life, it's worth resisting this impulse, or at least checking it.

3. Everyone you follow will say stuff you think is unimportant. Your twitter stream is built by you following people who you generally share some affinity with. However, even these people will say stuff that will leave you scratching your head. I find myself constantly surprised by this, but on some level it's just basic reaffirmation of the fact that we're all different. What you think is important isn't necessarily what someone else thinks is important. And there's a certain social zen that comes along with seeing stuff you think is totally irrelevant in your Twitter stream. (On NFL game day it can get particularly taxing for some, but that's neither here nor there.)

4. Good people are where you find them. Another reaffirmation of a basic truth, but it's sometimes easy to lose sight of this in real life (particularly for lawyers). People from all walks of life have stuff to add to the mix. Some of the people with the most interesting stuff to say are well outside my area of professional interest.

***

By the way, what got me thinking about this is a wonderful Slate entry from Malcolm Gladwell about the "theory of disqualifying statements," which someone described as Gladwell's "10 year old argument against Tweeting":

Diaries, by their very seductively uninhibiting nature, are breeding grounds for disqualifying statements. Any one of these sentences could irrevocably alienate any one of you (not to mention the very real possibility that merely owning up to the Theory of Disqualifying Statements is in itself a Disqualifying Statement). Hence my trepidation, and why I don't feel I can do any more than the most cursory of explanations of my day . . . .

Something to keep in mind.

[Ouch! A friend emails to say "if you need Twitter to learn or re-learn these basic life lessons, you've got issues." He's got a point ...]

Is the Montgomery County DA Violating the Due Process Rights of Arrestees by Tweeting Their Names?

Venkat — Fri, 15 Jan 2010 05:16:00 GMT

I blogged a month or so ago about plans by the Montgomery County DA's office to tweet the names of DUI arrestees. (h/t Paul Kennedy "Drink. Drive. Tweet.") I speculated as to whether this raised any ethical issues and overall it just struck me as a bad idea. It turns out this may actually violate the rights of those who are arrested and whose names are tweeted.

Someone successfully challenged a similar practice in New York: Bursac v. Suozzi, 22 Misc.3d 328, 868 N.Y.S.2d 470 (Supreme Court, Nassau County New York 2008). In Bursac, the Nassau County Executive created a wall of shame, on which it posted a photo of people who were arrested for DUIs. Postings were accompanied by press releases. One arrestee (against whom charges were dismissed) requested that the posting be removed and when this request was refused, sued. The court found that the posting violated the petitioner's due process rights:

[the County Executive's actions,] in publishing and maintaining the petitioner's name, picture and identifying information embedded in a press release on the County's Internet website, which results in limitless and eternal notoriety, without any controls, is sufficient to be the `plus’ in the `stigma plus’ due process analysis in the case at bar. The Court finds that the petitioner's due process rights have been violated.

The decision is summarized at Cyb3rcrim3 here: "Stigma Plus." (An excellent blog that I recently started reading.) As Professor Brenner notes at her blog, the County Executive relied on Paul v. Davis, 424 U.S. 693 (1976). in Davis, the Court held that the Louisville police department's creation of a pamphlet containing the names of individuals recently arrested for shoplifting could not be challenged under section 1983:

reputation alone does not implicate any 'liberty' or 'property' interest sufficient to invoke the protection of the due process clause.

From my read of the Court's opinion in Davis, tarnishment of reputation alone is not sufficient to implicate the Due Process Clause - the state has to somehow interfere with a person's right to employment or take away something in which you have a property interest. Notwithstanding Davis, the court in Bursac found the publication of identifying information about DUI arrestees to be problematic because of the unique nature of the internet, and the fact that landlords, employers, and others screen people through internet searches. (Davis seemed to say that the government had to be the one depriving you of a job or other benefit, but Bursac didn't delve into this distinction. Also, maybe there are other cases out there on this issue, I haven't done an exhaustive search.) In the court's eyes, by labeling someone as a DUI arrestee on the internet, you may as well be denying them a job opportunity:

when the government agency voluntarily promotes and publishes arrest records, containing names, pictures and identifying information, on an Internet website with unlimited access to the public, [this] may affect a legal status and impose specific harm by being available to, inter alia, search engines ,credit agencies, landlords and potential employers, for a lifetime, regardless of the underlying outcome of the case. It is the scope and permanency of public disclosure on the Internet by a governmental agency that distinguishes the County's "Wall of Shame" from traditional and regular forms of reporting and publication such as print media.

There you have it. Regardless of whether Bursac is correct, it certainly seems like the Montgomery County arrestees have a colorable case. Another potentially distinguishing aspect of the Montgomery County scheme (from the one in Davis) is that the DA's Office admitted that its practice is designed to punish and deter. In Davis, there's at least a colorable justification that the publication is for the benefit of shopkeepers (however dissatisfying this explanation may be). I would think something with a punitive motivation raises an additional set of issues. I'm sort of hoping someone sues so we can find out!

BTW: my earlier post was picked up by a few media outlets, including IDG News ("Texas County to Name Drunk Drivers on Twitter") and Mashable ("Drunk Drivers in Texas to be Named on Twitter"). Of course, my all time favorite was a piece which contained this *somewhat* inaccurate description:

L’avvocato Venkat Balasubramani, famoso blogger americano che scrive in merito alla legge, ha espresso il suo parere: “Se i fatti possono essere resi noti dai media, ciò non significa che i legislatori stessi debbano pubblicizzarli”

NotizieFresche: "Texas: Una punizione per chi guida ubriaco? Il proprio nome pubblicato su Twitter." I think that's the translated version of the IDG article, but who is counting?

What Tibetan Goatherders Can Teach us About Lawyering

Venkat — Sun, 10 Jan 2010 14:02:00 GMT

I've noticed an unfortunate trend among bloggers that's worth flagging. Maybe it's a pet peeve. Either way, people lately seem to associate two totally random things that have no connection at all, and ask what one can teach the other (or what one can learn from the other). Mostly these posts come from people trying to move the legal profession along, which in my book is a worthy goal. But at a certain point, you have to ask, what does one really have to do with the other, and is there really a need to stretch the analogy so far?

Some examples:

Martindale.com: "What the NFL Playoffs Can Teach us About a Lawyer's Social Media Efforts"
ABA Journal: "What Susan Boyle Can Teach Trial Lawyers"
Larry Bodine: "What Law Firms Can Learn From Airlines"
Jay Shepherd "Why Law Firms Should be Treated Like Pizza Joints"
Arnie Herz "What President Obama can Teach us About Client Relationships"

There are a lot of other examples out there. Who knows, maybe there's some sort of blogging camp or webinar where this is taught as a tried and true method? It may appeal to some, but let me just say it doesn't work for me. It sort of brings to mind a jab in one of Justice Scalia's opinions:

Applying the ‘relate to’ provision according to its terms was a project doomed to failure, since, as many a curbstone philosopher has observed, everything is related to everything else.

While we are on the topic of analogies between lawyering and other activities, for me, one of my prior jobs that lends some good experience to lawyering is waiting tables. You deal with a bunch of customers in both situations and your ultimate goal is to keep them happy. You have to communicate and keep them apprised of where their matter is. But most importantly, you have to juggle. In my busy moments (like now) where I'm juggling a bunch of stuff, I feel exactly like I did back in my waiting table days. The possibility of being frazzled exists. I've experienced it in both situations.

As for Tibetan goatherders, I'm sure there's a lot they could teach us about lawyering. Then again, they can probably teach a lot of people about a lot of different things. Added: a money comment from David Sugerman in response to the question: "not much and an awful lot."

Legal Blog Watch: links to this post. More examples from the comments there.

BTW: check out Jay Shepherd's blawg review # 246, with predictions for 2010.

Montgomery County DA's Office Decides to Tweet the Names of DUI Arrestees

Venkat — Sat, 19 Dec 2009 19:57:00 GMT

Just when I thought many of the issues lawyers deal with through the use of social media were overblown and could be easily addressed by common sense, someone comes along to prove me wrong: the Montgomery County District Attorney's Office.

As defense lawyer Paul Kennedy notes, the Montgomery County DA's office has decided to tweet the name of everyone arrested for a DUI.

This is just a bad idea all the way around. As Paul notes, people are wrongly arrested all the time, and there is damage that can be done just by noting the fact of someone's arrest. To me it doesn't seem like there's any good justification for publicizing the names of people arrested for certain types of crimes (I suppose it could serve some deterrent value...).

The DA's office may come back and say that these are public facts and newspapers may publish the names of arrestees all the time. But just because facts are publicly known and made available by the media, doesn't mean the prosecutor has to actively publicize these facts.

I wonder if there are any ethical issues lurking around here?

Am I off-base on this one? I'm not a criminal lawyer so I may well be, but it just doesn't pass the gut-check test for me.

I guess we may want to look at the bright side. Tweeting the names of arrestees probably makes it much easier for lawyer-marketers to reach out (even via Twitter) to the people who have been arrested. (kidding)

Unsolicited Text Messages and the TCPA (and the Computer Fraud and Abuse Act)

Venkat — Fri, 18 Dec 2009 06:44:00 GMT

I have a pair of posts at Professor Goldman's blog on unsolicited text messages, and the Telephone Consumer Protection Act and the Computer Fraud and Abuse Act.

Last week, a federal court in Minnesota held that the transmission of unsolicited text messages does not constitute a violation of the Computer Fraud and Abuse Act (Czech v. Wall Street on Demand, Inc.). The court recognized that the Computer Fraud and Abuse Act is a statute designed to combat hacking, and that plaintiff's allegations that it repeatedly received unwanted text messages do not make out a claim - based on the extraction of information, transmission of harmful code, or access (without authorization) - under the Computer Fraud and Abuse Act.

This week, a federal court in Illinois (Abbas v. Selling Source, LLC) held that the transmission of unsolicited text messages could violate the Telephone Consumer Protection act, because unwanted SMS messages constituted "calls" under the TCPA. Interestingly, defendant raised a First Amendment defense, which the court rejected.

Both cases are worth reading.

Why Doesn't Facebook Make Company & Fan Pages More User Friendly?

Venkat — Mon, 07 Dec 2009 04:10:00 GMT

"Why is Facebook so hard to use?" is a question that has nagged me for the past year. Seriously. For a company that has raised as much money and garnered the amount of attention that Facebook has, the Facebook user experience stinks.

I consider myself reasonably able to figure out basic tools like these on my own. But to me it seems like you need to take a class in order to put together anything more than a basic "personal page" on Facebook. Worse yet, Facebook doesn't make available documentation that answers basic questions on how to set up and use the various types of pages on Facebook. (Maybe this is what they teach you at social media seminars?)

Here's the scenario: I have a personal page on Facebook which I've had for the past year or so (give or take). About six months ago I decided to set up a "company page" for a side-project I'm working on with my mom (selling Indian spice mixes and rubs). Here's a link to the spice mix page. (At the risk of sounding trite, and to use an over-used expression, "feel free to fan" the spice rub page [link].) The basic problem I have is that Facebook does not make it easy to disassociate my personal page from the company page. My recollection when I set up the company page was that you had to tie it to a personal page for the person who would be the administrator. This was a lame decision on Facebook's part. Maybe people want to set up a company page but they don't want to be "on Facebook" (personally)? Anyway, that's neither here nor there, but what I'm really having trouble figuring out is how to easily distinguish between posting to your personal page and and posting to the company page.

Here's an example of what's problematic. I did a test post on the company page - here's a screen cap of the post below:

You would think since I posted this under my company account profile, this comment would not be in any way associated with my personal account, right? Wrong:

I realize Facebook has a lot of different settings you can tweak (including privacy settings) but this seems like a pretty basic failure in the way that company pages and personal pages fit together.

I know I'm not alone in my experience. As a relatively light Facebook user who hasn't been really active on Facebook I still chat with a fair number of people who have had similar problems, and worse yet, people who generally can't figure out the process of how to easily set up a company account (or don't realize the difference between a company page, a cause page, event page, fan page, etc.).

Get it together Facebook -- user experience is all important, and judging from my experience, Facebook gets a big fat F.

[BTW: at the time I created the company page I was fairly certain that you needed to have a personal profile to "administer" a separate page, such as a company page, but maybe things have changed.]

Yahoo! Not Liable for Disclosure of Email Information to Chinese Officials

Venkat — Sat, 05 Dec 2009 17:55:00 GMT

A group of plaintiffs filed suit against Yahoo! and its Chinese subsidiary for disclosing the email information (identity) of a person who used an email address to engage in political/dissident activity in China. Tom O'Toole at the BNA TechLaw blog reports [link] that Judge Chesney (of the Northern District of California) dismissed the claims against Yahoo! and its subsidiary on the basis that the Electronic Communications Privacy Act does not apply extraterritorially. (Access a link to the order at TechLaw here [pdf].)

Among other arguments, plaintiffs tried to argue that since Yahoo! has servers all over the world, including in the United States, it doesn't necessarily make sense to reject the claims on the basis that the interception/disclosure occurred outside the United States. The court disagreed, noting that according to plaintiffs' own allegations, the "acquisitions and subsequent disclosures . . . were made 'locally.'" I'm not familiar with the case law here, but I was surprised the court didn't give this argument a bit more credence. I'm not familiar with the Alien Tort Claims statute either, but I'm surprised plaintiffs didn't bring an ATCA claim.

Yahoo! testified in front of Congress after taking heat over these types of disclosures, as reported by Wired here (2007).

Does Blogging Favor Smaller Firms?

Venkat — Fri, 04 Dec 2009 02:30:00 GMT

Drug and Device Law has a great post that asks "Why Big Firms Don't Blog Well." Mark Hermann takes a look at the ABA 100 and sees a dearth of blogs by larger law firms. (Congrats to those nominated by the way.) He sees two (SCOTUS Blog and Drug and Device Law) on the list. He offers a few reasons as to why bigger law firms don't seem to see the same "success" in blogging as smaller firms, but his key point is that one of the keys to success is to write in a "distinctive voice." This ties into the issue of big firm lawyers being less likely to be opinionated. I like Mark's take on this:

Crafting a distinctive on-line voice entails risk; most lawyers at big firms (perhaps intelligently) choose to avoid that risk; and so most big firm blogs just dangle out there, twisting slowly in the wind.

Mark's take happens to be roughly in line with my thoughts from a chat I did with the WSBA Young Lawyer's Division in 2005:

marketing can be a byproduct of a blawg, but at its root, blogging is more about finding your unique voice and participating in a community. It is a grass-roots medium, and as with any other grass roots phenomenon, the "pure marketing approach" is rarely effective. A blawgger who is primarily marketing (rather than having a conversation with his or her readers) is also likely to find a tepid response from the blogging community.
..
the appeal of a blawg is mostly the personality of the blogger (or bloggers), so it doesn't make sense to have a "corporate blog". Even the more successful blogs affiliated with corporations are run by individuals (for example, both GM and Boeing have blogs). Corporate blogs should still heavily reflect the personality of the individual blogger. Blogging to me is a bit counter-culture. On that level, it's tough to imagine a blogosphere where corporate blogs live in the center and not on the fringe.

It's a crazily painstaking endeavor in my opinion to maintain an up-to-date, relevant blog which contains substantive posts that add to the conversation. Coupled with the fact that it's far from clear that there's a direct correlation with revenue and blogging (and the fact that most - if not all - law firms do not credit lawyers for time spent blogging) it's no surprise that few large firms maintain interesting and relevant blogs (at least as recognized by the ABA).

There's also the fact that "interesting," usually equates to disclosing your particular personality quirks or your policy stance on an issue beyond the rule and implications of a particular case or piece of legislation. Some clients may agree with you and be drawn to your blog as a result. Other clients may be turned off. This can be tough to predict.

I'm curious about something else that's related to this topic. Most law bloggers seem to blog for their peers or for themselves. (I know I rarely take into account a client or potential client's perspective when I blog. If I did, I'd make my blog posts a lot easier to read and digest! But this would probably increase the costs of blogging significantly.) Do any firms really blog with clients in mind? Even if they do, do clients find these blogs useful? I guess a good place to find out the answer would be to ask the clients, but so far I haven't seen many good data points on this.

Added: don't I feel like a dolt after reading Randazza's succinct post about this.

More: see more in posts by Scott Greenfield ("Blawgospheric Darwinism"), Kevin O'Keefe ("Big Law Firms Don't Blog Well, Says Who"), Carolyn Elefant ("Why Big Firms Don't Blog Well: Not Too Much Risk, but Too Little Passion"), and Mark Bennett ("Born to Fail, But on Life Support"). A fine example of lawyers being lawyers . . . arguing over the finer points of inside inside baseball. (Hey, it's fun . . . that's why we do it!)

I should add that there are a slew of blogs by larger law firms on my regular reading list, for example "Proskauer's New Media & Technology Law Blog," and David Johnson's "Digital Media Lawyer Blog" (to name a couple). Both are excellent resources.

The Randazza Fan Club

Venkat — Wed, 18 Nov 2009 06:52:00 GMT

In the better late than never category, I wanted to mention Marc Randazza's victory over Glenn Beck. Glenn Beck brought a UDRP action against Isaac Eiland-Hall over Eiland-Hall's registration and use of the domain name <glennbeckrapedandmurderedayounggirlin1990.com>. Another way to put it is that Beck went to a non-US tribunal in an attempt to bypass a domain name registrant's First Amendment rights.

You can follow the links at Randazza's to get the details, but in a nutshell Randazza opened up a can of First Amendment whoop-ass on Beck. The WIPO arbitrator concluded that Beck was not entitled to transfer of the domain name since Eiland-Hall didn't commercially exploit any of Beck's rights and the site was clearly intended to mock Beck. (I haven't had time to read the ruling but this is what I gather from descriptions of it. See NPR's coverage here.)

After the ruling was handed down, Eiland-Hall offered to return the domain name to Beck, stating in a letter that he defended against the UDRP action in order to prove a point and vindicate the First Amendment.

The cool part? Randazza now has a fan club. Randazza's filings were entertaining, and more importantly effective.

On the heels of the Glenn Beck win, Randazza also convinced a law professor who sued Above the Law to drop his claims.

In the midst of all this activity, he continues to blog up a storm. Head on over and check out his blog, if you haven't already.

Added: The Daily Beast as a nice piece on Eiland-Hall and the dispute.

Prof. Goldman Interviews Cindy Cohn of the EFF

Venkat — Tue, 17 Nov 2009 19:21:00 GMT

Professor Goldman interviews Cindy Cohn, legal director of the EFF. Access the interview here.

It's well worth listening to for a couple of reasons:

as far as organizations go, the EFF has probably been most influential in shaping the law in cyberspace (purveyors of adult content and other less mainstream content peddlers have been pretty influential but they obviously don't influence the law in a concerted policy-driven manner);
great career advice - they chat in the interview about the "call that changes your career" .. great advice for students, lawyers, and people who are just looking to get into a particular area ("just do it" probably sums up the advice, but it's always always healthy to hear about how chance plays a role);
good discussion on the Google Books Settlement and the privacy issues that the EFF brought to light;
the discussion about whether she's a "geek" and what "geekiness" is was funny as well.

I'm a big fan of the EFF, and I think they've done a tremendous amount of valuable work.

Starbucks Data Breach Plaintiffs Try Their Luck in the Ninth Circuit

Venkat — Mon, 16 Nov 2009 05:49:00 GMT

A lost laptop computer containing the personal information of Starbucks employees prompted a class action lawsuit against Starbucks (in Washington). The lawsuit received some coverage (see, for example Bob McMillan here, and Starbucks Gossip here), but the trial court's dismissal of the lawsuit received almost no coverage. (I mentioned the lawsuit, but failed to note the court's dismissal of it. Here is the one mention I came across.) Plaintiffs appealed the dismissal to the Ninth Circuit, and their just-filed appeal brief is worth a look. Access a copy of the brief at scribd here.

Background: As described in the complaint, in 2008, someone stole a laptop containing the personal information of approximately 97,000 employees. Starbucks notified the police and affected employees (plaintiffs claim Starbucks was slow in effecting this notice). Starbucks also offered one year of free credit monitoring to affected employees. The plaintiffs fall into a couple of categories, but significantly, one of the plaintiffs was notified that someone tried to open a bank account without his authorization. It was never determined whether this attempt to open a bank account with the information of one of the plaintiffs was connected to the underlying breach.

Ruling by Judge Jones: Judge Jones granted the motion to dismiss filed by Starbucks, finding that Washington courts would not recognize a cause of action as asserted by plaintiffs. (Access a copy of the order by Judge Jones dismissing the claims here: [scribd].) After concluding that plaintiffs had standing (given the broad scope of Article III standing this wasn't a surprise), Judge Jones focused on the issue of whether plaintiffs stated cognizable claims in negligence under Washington law. Judge Jones noted that Washington courts don't typically recognize claims where the sole injury is "risk of future harm," and if Washington courts were to recognize a common law cause of action arising from a data breach, they would be alone in doing so. Judge Jones also noted that the overwhelming majority of courts that have looked at the issue have declined to find that plaintiffs could recover merely because their data was stolen, and those that have recognized a possible cause of action have typically ruled against plaintiffs due to insufficient proof of misuse of the data. In Judge Jones's view, the Washington Supreme Court would likely conclude that the issue is best left to the legislature. In a footnote, he notes the enactment of data breach laws in other states, but points out that none of those laws provide for private causes of action, "much less a private right to damages."

With respect to the plaintiffs who did not have any proof that their personal information was misused, the court found that they could "claim only monitoring costs" as a potential injury, and these wouldn't fly under Washington law. With respect to the plaintiff who presented proof that someone tried to open a bank account in his name, the court acknowledged that "the timing of the [events permitted] the inference that someone acquired [plaintiff's] personal information from the laptop and misused it." Nevertheless, the court concluded that he did not assert a cognizable claim because he didn't suffer any out of pocket loss. The plaintiffs also asserted a claim based on implied contract, but the court didn't need to address whether Starbucks breached any implied obligations since it found that plaintiffs did not suffer any type of injury for which Washington law affords a remedy.

What to Make of the Appeal? Plaintiffs' appeal brief (filed on Monday) sort of canvasses the various theories under which plaintiffs should be entitled to relief under Washington law. Plaintiffs spend a fair amount of space discussing how Starbucks breached its (implied) contractual obligations to plaintiffs - Starbucks obtained this information in the employment context, and had policies in place which required employees to safeguard employee information. Given that Starbucks failed to fulfill these obligations, plaintiffs argue that the law would fashion some sort of remedy for the injured plaintiffs. Plaintiffs also attack the trial court's dismissal of the negligence claim from all angles, pointing out that stolen data is often misused long after it is compromised, and the fact that the underlying data breach is unsolved means that Starbucks can't conclusively show that the data will not be misused at some point in the future.

The dispute raises the familiar issue of whether the harm in the data breach context lies in the breach, or the actual misuse of the data. Courts have pretty uniformly taken the view that the harm flows from the actual misuse of the data, rather than the loss of the data. That said, the outcome here depends on the vagaries of state law, and what the Ninth Circuit predicts the Washington Supreme Court would do. My anecdotal observation is that Washington courts are very privacy friendly, but somewhat middle of the road when it comes to crafting "new" causes of action. Plaintiffs also asked the Ninth Circuit to certify the issue to the Washington Supreme Court, something the Ninth Circuit did recently in a spam case (Kleffman v. Vonage).

The Ninth Circuit has dealt with this issue once in an unpublished decision (Stollenwerk v. Tri-West Healthcare Alliance, 254 Fed. Appx. 664 (9th Cir. 2007).) In that case the Ninth Circuit affirmed the dismissal of data breach claims brought by plaintiffs who did not allege misuse of their data, but reversed as to the plaintiff who made a basic showing that the data could have been misused. Stollenwerk was inconclusive in that the Ninth Circuit (again, in an unpublished decision) merely stated that if the plaintiff was able to show actual damages, he would be entitled to relief. Interestingly, Stollenwerk was settled shortly after remand, on the heels of the district court's denial of a motion for class certification. One possibility to consider is that a monitoring claim seems much easier to fit into a class. An "actual damage" claim may be less amenable to class resolution.

On a related note, there's talk of federal data breach legislation winding its way through Senate. (Two proposals are mentioned here.) To my knowledge, neither of the proposals contain a private right of action, and both merely speak to notification upon a breach. There's also the familiar call for a federal standard which would displace disparate state standards. This debate sounds somewhat similar to the one that surrounded the passage of the CAN-SPAM Act.

Related: Tom O'Toole has a post from a while back about Ruiz v Gap Inc., a case from the Northern District of California also involving the loss of employee/applicant data (coincidentally, from an unencrypted laptop): "Court Finds No Cognizable Damages in Gap Laptop Theft Case."

[Cross posted at Prof. Goldman's blog.]

Dane's Claims Against Gawker Look Flimsy

Venkat — Fri, 13 Nov 2009 06:04:00 GMT

Gawker published a homemade videotape of Grey's Anatomy star Eric Dane and his wife (along with one other person). Dane and his wife sued Gawker for damages. Gawker declined to remove the tape and is defending against Dane's lawsuit. MediaShift raises the issue of whether Gawker is likely to be able to take advantage of fair use in publishing the tape. Rob Arcamona walks through the fair use factors and gives "a three point spread," after concluding that Dane has valid claims, and Gawker has a "formidable" defense.

Fair use is fact-specific and it's notoriously difficult to predict whether a court will ultimately conclude that someone is entitled to the fair use defense. I'm somewhat surprised that Gawker is taking a hard line on the fair use issue. Maybe they are taking a stand in order to show everyone that the disappearance of so-called "old media" entities will not leave institutional First Amendment interests hanging? They could have taken down the tape (although they published it after receiving a demand from Dane's lawyers) after-the-fact, and likely come to some sort of easy settlement with Dane and company. However, aggressively defending the case, as they seem to be doing, only escalates the stakes. (Good for them for sticking to their guns.)

Dane's claims are somewhat curious. Celebrities have been fairly successful in preventing publication of these types of tapes (see, e.g., Michaels v. Internet Entertainment Group, 5 F. Supp. 2d 823 (C.D. Cal. 1998)). (News organizations successfully asserted a fair use defense as to excerpts of the tape, but the court determined that full blown commercial exploitation of the tape by IEG was likely to infringe.) That said, given the snippets of the tape published by Gawker, it can probably assert a colorable fair use defense. But what is odd about Dane's claims is that he is only asserting copyright claims, and Gawker's publication pre-dated Dane's registration of the copyright in the tape. In other words, Dane should only be entitled to actual damages, or so Gawker argues pretty persuasively in a motion to strike [pdf] Dane's request for statutory damages. This puts Dane in an awkward spot. If the court agrees with Gawker and Dane ends up with only actual damages I'm not sure what Dane will end up doing. Some cases define actual damages as lost licensing revenues, or damage to the owner's ability to license the work. Gawker can argue that its own commercial exploitation of the tape did not impair the market for the tape since Dane had no intent to commercialize it. End result: Dane is awarded nominal damages and doesn't get his fees either. Ironically, Gawker's publisher Nick Denton invoked the words of Dane's own lawyer when commenting on the lawsuit:

To quote the great Marty Singer - Eric Dane's lawyer – 'If you don't want a sex tape on the Internet, don't make one!'

Coverage at THR, Esq. here and here.

In these circumstances, celebrities also bring privacy (and personality rights) based claims, but Dane didn't assert any such claims. (Access a copy of the complaint here: [pdf].)

On a related note, a funner battle would be if someone decided to run the photos and videos described here.

There are Email Gaffes..and Then There are Email Gaffes

Venkat — Wed, 11 Nov 2009 05:05:00 GMT

It's safe to say the affair-having couple discussed in this Gawker post had one of the worst email gaffes imaginable. [NSFW text]

The short version: they're engaged in a steamy discussion regarding the details of their affair when he accidentally copies the entire school listserv. The story is so crazy it's almost unbelievable. "Guest of a Guest" - which appears to have first noted the story - sums it up best [link]:

Everyone has had at least one bad email incident that they have had to learn from. Some involve, say, sending an invitation and forgetting to bcc everyone. Or worse, sending an email complaining about your boss to, er, your boss, named Sarah (instead of your best friend Sarah). But, NO ONE, and we mean NO ONE has had a worse email gaffe than John X did about an hour ago.

I'm not even sure what to say to that, except it's well outside the "everyone will have at least one email gaffe in their professional lives" rule that I believe is true.

(h/t Gideon)

Verizon Privacy Failure

Venkat — Fri, 06 Nov 2009 20:59:00 GMT

It's probably hard to read the notice below which I received from Verizon:

It says:

Unless you provide us with notice that you wish to opt out within 45 days of receiving this letter, we will assume that you give us the right to share your CPNI with the authorized companies described above.

Who is the information shared with? "affiliates," "parent companies," and "agents". "Agents" (??) The policy also states that the information will not be shared with "unrelated third parties." Legal issues aside, I have no idea from reading this who exactly my information will be shared with.

Interesting Reads -- November '09

Venkat — Mon, 02 Nov 2009 06:35:00 GMT

A partial list of interesting reads from the past month or so:

The Law of Social Media: Glenn Manishin has a series of essays on the legal issues raised by social media ("The Law of Social Media").
Do Employers Own Social Content Created by Employees?: Jeremiah Owyang has a post on this issue ("Your Company May Own Your Tweets, Pokes, and YouTube Videos"), with comments from Lisa Borodkin. What I want to know? Who owns the underlying relationships formed by employees through social media?
Spammy Advertising on Facebook: An interesting guest post on TechCrunch on this topic: "How to Spam Facebook Like a Pro: An Insider's Confession"
Privacy Class Actions: Wendy Davis @ MediaPost: "Are Consumers Being Stiffed in Privacy Case Settlements?" N.D. Cal. judge rejects proposed settlement in class action involving TD Ameritrade data breach.
Online Communities: From Wired: "The Assclown Offensive: How to Enrage the Church of Scientology". Very interesting article on the dynamics of the ongoing battle between 4chan and Scientology.
Sanford Wallace: Word to the Wise: "While I hate to actually say 'Sanford Wallace changed my life,' it's not that far from the truth"
California: Threat Level: "Schwarzenegger Flips Off Lawmakers in Hidden Message"
Blogging: Simple Justice: "Blogging is Alive, And Aggravating"
Lawyers: Vanity Fair (Bryan Burrough): "Marc Dreier's Crime of Destiny"... $380mm stolen through fake paper, embezzled escrow funds, etc.
Licensing Agreements: WSJ: "Lawyerese Goes Galactic as Contracts Try to Master the Universe"
Social Networking: Seth Godin: "Dunbar's Number Isn't Just a Number, It's the Law" ("the typical human being can only have 150 friends")
Law Firms: ATL: "Quinn Emanuel Believes in 'C.B.A.' (Check Blackberry Always)" ... good response here.

A Social Network / First Amendment Question

Venkat — Sat, 31 Oct 2009 16:44:00 GMT

Mickey Kaus raises the issue of whether Twitter censors posts to protect celebrities ("Paranoid's Corner: Does Twitter Semi-Censor to Protect Celebrities"). I think the issue raised in his post and update could just as easily be attributed to Twitter's reliability as it could to intentional conduct by Twitter, but his post got me thinking about something else. What if the government paid social networks to "censor" certain types of speech?

I use the word "censor" in quotes because that's not really government censorship in the classical sense. The typical definition of censorship is when the government prohibits a private party from saying something. Outright prohibition (whether through judicial action or laws which regulate speech) lies at one end of the spectrum. A law prohibiting certain type of speech is a good example of this. At the other end of the spectrum, the government can try to penalize you for your speech. Firing you from government employment is one example of this, and courts agree that this type of a penalty raises First Amendment concerns. These situations are often treated differently from the circumstance when the government itself is the speaker. Courts agree that government speech does not raise the same First Amendment concerns as government interfering with private speech. It raises other concerns (e.g., Establishment Clause), but that's a separate issue. The government may even subsidize private speech, subject to other considerations such as the Establishment Clause, but this is also not typically viewed through the same lens as outright prohibition or regulation. The case law on this is a maze, and not surprisingly, the Supreme Court is less than unanimous on this issue. But at least some members of the Court adhere to the view that there is a fundamental distinction between funding speech and "abridging" speech. (See this discussion (from 1998) of a case challenging NEA funding on the grounds that it improperly required consideration of "decency". The current wikipedia page for "government speech" contains some good discussion.)

So, how about the scenario where the government pays someone not to speak? Say for example, you regularly protest the war on the street corner on Main Street, USA. The government doesn't like this, and it can't prohibit you or try to regulate your speech, but the government can probably pay you not to speak? (There are cases dealing with whether the government can require you to waive constitutional rights as a condition to receiving certain benefits, but this seems different.) Can the government pay a newspaper not to run a story? How about the government paying Facebook to take down certain types of fan pages. How about the government paying Twitter to filter out certain types of tweets? Most likely this would be politically untenable, because the government could not keep this type of an arrangement secret, but how would this be analyzed from a First Amendment standpoint? Must the government be content-neutral when it engages in this conduct?

These are probably far-fetched hypotheticals, unless you live in certain countries (see "US lawmakers scold tech companies for China censorship"), but they are interesting to think about.

Court: Prosecutors Can't Rummage Around in a Defendant's Gmail Account

Venkat — Thu, 29 Oct 2009 03:41:00 GMT

The government is prosecuting a couple of Bear Stearns hedge funds managers for securities fraud and related offenses. I came across a story that prosecutors obtained evidence from the gmail account of one of the defendants which prosecutors recently disclosed. ("E-Mails Seen as a Flash Point in Bear Stearns Fund Managers' Fraud Trial") In some ways I think this illustrates one of the pitfalls of using a service such as gmail. Gmail stores your data forever - or at least doesn't give you a ton of control over when it is deleted - so it's much easier for prosecutors to obtain this evidence. If you stored the data on your own servers, you may be able to get by with deleting the data pursuant to a regular document retention/destruction policy. And more importantly, there's a much higher likelihood of you knowing when the data has been or is about to be seized. (It's more difficult to obtain email from a service provider in a civil case.)

Interestingly, the defendant whose email was disclosed by the government as evidence in the Bear Stearns case prevailed in a motion to suppress the gmail evidence. (US v. Cioffi, et al., Case No. 08-CR-415 (FB) (E.D.N.Y.; Oct. 26, 2009).) (Access a copy of the ruling at Scribd [pdf] here; see the WSJ story here ("In Setback for Bear Stearns Case, Judge Suppresses Email").)

Facts: The government initially obtained an email sent through non-company email accounts between Cioffi and Tannin (the two defendants) talking about how the "subprime market looks prettyugly . . . ." The government used this email to support its allegation sthat Tannin used his personal (gmail) account to commit or further the crimes. The government's affidavit argued it needed to search the gmail account, but offered certain limitations on the access - for example,the search would be limited to emails created on or before the day prior to the defendant's retention of counsel, in order to avoid interception of privileged communications. The affidavit also noted that "the nature of electronically stored data" required the authorities (rather than Google) to search through the email account.

The magistrate judge issued the warrant, but did not attach the affidavit to the warrant. The government went to Google, which initially wrote to the government that "it was no longer able to extract the information requested in [the warrant] because Tannin's account had been deleted." Several months later, "on the eve of trial,"Google advised that it had located a copy of the account and delivered a copy of its contents to the government. (??)

The Court's Ruling: The critical issue in front of the court was whether the warrant was sufficiently particular as to minimize unnecessary invasions into the suspect's privacy. The court noted at the outset that Tannin had "a reasonable expectation of privacy in the contents of his personal email account." The government did not dispute this point. (This doesn't seem to be a settled issue,as noted in the case mentioned below.) Turning to particularity, the court notes that searches of documents, data, computers, and email accounts raise tricky issues as to what level of particularity is required. A couple of different approaches have been used to avoid a general search by the government: (1) providing keywords or other search parameters in advance; or (2) having a third party conduct the search and segregate responsive information from non-responsive information.

The court noted that an overly broad warrant may be cured by incorporation of an affidavit that would constrain the agents' search,but Second Circuit cases have been less receptive lately to this approach. (In the context of a digital search, it would seem that this wouldn't work as well as it would with respect to physical objects. Exposure to data that doesn't fall within the search warrant would compromise the suspect's privacy and would undermine the whole point of particularity in this context.) Regardless of whether the affidavit could have cured the warrant's particularity problem, the affidavit was not actually attached to the warrant, so this argument was not in play.

The court ultimately concludes that the warrant did not comply with the Fourth Amendment. The government sought to invoke exceptions in order to have the evidence admitted notwithstanding these issues, but the court rejected both of these attempts. With respect to the good faith exception, the court was emphatic:

[t]his case. . . is not about search terms or firewalls. It is, rather, about the fundamental and venerable prohibition on general warrants. Since 'it is obvious that a general warrant authorizing the seizure of evidence without mentioning a particular crime or criminal activity to which the evidence must relate is void under the Fourth Amendment . . . no reasonably well trained officer could believe otherwise.'

As to inevitable discovery - the second exception - the court's ruling is also interesting. The court seemed to say that the government could only satisfy particularity after having seen the emails procured by the overbroad warrant: "the government's timing still presents a problem:[h]aving seen the November 23rd email, the government is now in a position to obtain a warrant with perfect particularity. There is, in other words, no way to purge the taint of its unconstitutionally overbroad search."

***

I can't tell if the government just dropped the ball here or whether there's something more to it. One view is that if the government had a narrow warrant application and the magistrate judge issued a narrow warrant, the government could have probably obtained the information they ultimately sought? On the other hand, the court is rightly skeptical that the government could have obtained the emails at issue by providing a set of keywords to Google. After all, wasn't this the argument the government used to justify the fact that the search needed to be conducted by the government, rather than by Google or by a third party? The court's rejection of the government's inevitable discovery argument seems significant. [My practice does not stray into the realm of criminal cases so take that with a grain of salt. I'm curious to see what people like Orin Kerr and Scott Greenfield have to say. Congrats to Professor Kerr, whose "Searches and Seizures in a Digital World" article is cited by the court. He has also posted extensively on a recent Ninth Circuit decision that bears on these issues: United States v. Comprehensive Drug Testing, Inc., 579 F.3d 989 (9th Cir. 2009).]

Interestingly, Professor Kerr notes a recent decision from federal court in Oregon where the court held that email was not covered by the Fourth Amendment. Pointing to the Google terms of service, the court held that most users expect their emails to be shared with Google employees and other third parties, and the account-holder was thus not entitled to notice before the government obtained a warrant to search someone's gmail account. I think the account-holder still has the ability to challenge the search after-the-fact (as did the defendant in Tannin). Either way, the ruling obviously raises issues around process in the garden variety case. When do you as the account-holder receive notice of a government search?Does Google have a consistent policy on this?

I'm still sticking with my instinct that using a third party service such as gmail raises the risk that your emails end up in the hands of prosecutors. I'm also curious about Google's policies for dealing with these sorts of issues.

[Added: You can check out Professor Kerr's post on this ruling here. His conclusion: "the basic Fourth Amendment holding was likely right," but the court should have applied the good faith exception. He also posts a clarification to his earlier post about the Oregon decision, which I linked to above: court's conclusion only speaks to notice to subscribers, which the court concludes is not required under the Fourth Amendment.]

Judge Rejects Attempts by Texas Plaintiffs to Intervene in Beacon Class Action

Venkat — Sun, 25 Oct 2009 22:44:00 GMT

I mentioned last week that a group of plaintiffs sought to intervene in the class action filed against Facebook in the Northern District of California. The Texas plaintiffs who sought to intervene were part of a class action filed against Blockbuster (Harris v. Blockbuster- this lawsuit was filed before the the Northern District of California class action). The Texas plaintiffs argued that the two lawsuits were"related," and that the parties to the California lawsuit should have filed a "notice of related action," so the California court could have evaluated whether the lawsuits should be consolidated.

In orders issued today, Magistrate Judge Seeborg denied the request to intervene brought by the Texas plaintiffs and conditionally approved the class certification and settlement ironed out by the parties to the Northern District of California lawsuit. Judge Seeborg noted that although the lawsuits were "related," the Texas plaintiffs were aware of the California class action in September 2008. Thus, their request to intervene was untimely.

Quick thoughts on the ruling:

1. The court notes that to the extent the Texas plaintiffs have substantive objections to the settlement, these objections can be raised at a later date.

2. With the caveat that I'm not familiar with the nuances of class action procedure, I would guess it will become tougher to object to a settlement further down the road. As a practical matter, conditional approval will set in motion the process of notifying potential class members and providing them the opportunity to opt-out. A low number of opt-outs may be viewed as an indication that there's not really enough of a separate class that objects to the terms of the settlement conditionally approved by Magistrate Judge Seeborg to warrant a second class action. (On a related note, I wonder if the Texas plaintiffs will mount some sort of campaign to try to demonstrate that a substantial number of potential plaintiffs object and the settlement should not be given final approval. I'm guessing they won't set up a Facebook group as part of this campaign, but you never know!)

3. It's sort of awkward for a group of putative plaintiffs who filed their lawsuit first to have their claims extinguished by a later filed class action. Blockbuster was named in the second filed action (in California) and to the settlement in the California lawsuit is approved, my instinct is that this may effectively kill the class claims asserted in the Texas lawsuit against Blockbuster. (There was some activity in the Texas lawsuit about whether the claims are subject to arbitration. The court in Texas found that Blockbuster's terms of service were "illusory," and rejected Blockbuster's request to arbitrate. Blockbuster has appealed this ruling.)

4. The terms of the settlement in the California lawsuit do not provide for payment of compensation to non-named class members. (See the notice approved by the court here: [pdf].) On the other hand, the Texas lawsuit alleged violations of the Video Privacy Protection Act, which provides for statutory damages.

5. The notice of settlement will be published through newspapers, and of course, "through Facebook updates."

It will be interesting to see how this plays out. [Cross posted at Prof. Goldman's.]

Power.com Counterclaims Dismissed - Facebook v. Power Ventures

Venkat — Sat, 24 Oct 2009 00:33:00 GMT

Facebook and Power Ventures have been involved in a lawsuit over whether Power.com can allow its users to access user data on Facebook's network. Facebook brought suit against Power.com asserting a slew of claims ranging from copyright infringement to violations of the Computer Fraud and Abuse Act. Power.com brought a motion to dismiss, which the court denied. This ruling was noteworthy, among other reasons because it recognized Facebook's potentially tenuous copyright claims and gave credence to Facebook's argument that access of user data by Power.com (or Power.com users) in violation of Facebook's terms of use was potentially actionable by Facebook. (For comments on this ruling, see Cyberlaw Cases; BNA's TechLaw blog; Jeff Neuberger; and an earlier post from me.)

After the court denied Power.com's motion to dismiss, Power.com answered the complaint and asserted counterclaims against Facebook. Power.com's counterclaims garnered some attention, likely due to the fact Power.com alleged that Facebook engaged in anti-competitive conduct by restricting consumers' access to their data. (See, e.g., NYT/Bits Blog ("Power.com Fights Back Against Facebook").)

In a recent order, Judge Fogel granted Facebook's motion to dismiss, finding that Power.com failed to sufficiently articulate the bases for its counterclaims. (Access a copy of the order here: [pdf].) There's not much to say about Judge Fogel's order, except that it was brief (four pages!), and the court was not moved by Power.com's vague allegations of misconduct by Facebook. As noted by the court:

Power's Answer and Counter-Complaint contains a seven and a half page 'Introduction and Background' narrative untethered to any specific claim. The claims themselves each consist of a conclusory recitation of the applicable legal standard and a general 'reference [to] all allegations of all prior paragraphs' . . . .[T]his form of pleading does not enable the Court to surmise which facts in the introductory narrative support which claims, if in fact they do.

The court observes that antitrust claims require a heightened standard of pleading, and throws in a reference to Twombly for good measure. The court also strikes Power.com's affirmative defenses (of misuse and estoppel) as unsupported by "any factual allegations." Although the court grants Power.com leave to amend its counterclaims and affirmative defenses, I would guess Power.com will think twice about filing amended counterclaims unless these claims have solid factual backup.

Rumors of an impending settlement between the parties swirled around, even after Facebook filed its complaint. Then it looked like Power.com was looking to fight back. It's always tough to tell from the win or loss of a particular motion which way the lawsuit will go, but Judge Fogel's order certainly lets the air out of Power.com's counterclaims. To the extent Power.com was looking to gain leverage by asserting counterclaims, it may be out of luck.

[Cross posted at Prof. Goldman's Technology and Marketing Law blog]

Can Creditors Go After Domain Names - Bosh v. Zavala

Venkat — Wed, 21 Oct 2009 22:30:00 GMT

Most people take it for granted that domain names are property. As such, there shouldn't be much dispute that domain names are subject to the claims of judgment creditors. But I've seen enough resistance to this position that I thought a recent case was worth a quick mention.This recent case (Bosh v. Zavala (08-CV-04851-FMC-MANx) (C.D. Cal.Sept. 24, 2009)) also raises some interesting questions about the mechanics of trying to use a domain name to satisfy a judgment. For more perspectives, see Marc Randazza's post on this case here; see also NYT; Domain Name News; Deadspin.

Background: One of the early and often-cited cases for the proposition that a judgment creditor cannot get a domain name is Network Solutions, Inc. v. Umbro Int’l, Inc., 259 Va. 759, 770 (Va. 2000). In Umbro, the Virginia Supreme Court held that "a domain name registrant acquires the contractual right to use a unique domain name for a specified period of time...[but this] contractual right is inextricably bound to the domain name services that [Network Solutions]provides." Umbro concluded that the domain name registration agreement was a "contract for services" (which was not subject to"garnishment") rather than property. (Umbro was preceded by the Eastern District of Virginia's decision in Dorel v. Arel where the court punted on the "issue of whether a domain name is personal property subject to[a lien]" because the judgment creditor could take advantage of an easier, practical solution: "the registrar's policies.")

Kremen v. Cohen: Enter Kremen v. Cohen,decided by the Ninth Circuit in 2003. Kremen cast a shadow over Umbro. Kremen involved an action for conversion where the underlying property was a domain name. One of the big questions in front of the court was whether a domain name was property which could support a claim for conversion. The court pretty definitively answered that a domain name was property and therefore could support a claim for conversion. Following Kremen, courts started to realize that since domain names are property,they should be subject to the claims of judgment creditors. (See Office Depot, Inc. v. Zuccarini, 621 F. Supp. 2d 773 (N.D. Cal. 2007).) More recently, in Bosh, Judge Florence Marie-Cooper of the Central District of California allowed Toronto Raptors basketball player Christopher Bosh to seize a slew of domain names held by Luis Zavala, based on acybersquatting judgment obtained by Bosh.

The key conceptual question to resolve is whether domain names are freely transferable, or whether domain name registration services are contracts personal to the registrant. Given the emergence of the flourishing secondary domain name market, you would think there would be no dispute as a practical matter as to whether domain names are freely transferrable. But it's not as hard you may think to encounter people who argue that domain names are just personal contract rights.For example, in 2009, Network Solutions took this position in the Kentucky domain name case where the Kentucky AG tried to seize numerous domain names based on the fact that they were "gambling devices" used in contravention of Kentucky law. (See pages 7 through 11 of their amicus brief filed in Kentucky: [pdf].)The Kentucky AG's decision was on questionable legal grounds for a variety of reasons, but I was surprised to see Network Solutions' reliance in its amicus brief on Umbro.

From a practical standpoint, the big question is whether a judgment debtor has assets that can be sold to satisfy a judgment. If there are such assets (whether in the form of domain names or otherwise), most courts are going to find a way to let the judgment creditor get at them. There may be tweaks around whether the particular statute in question covers a certain type of property (see, e.g., Palacio Del Mar Homeowner's Association, Inc. v. McMahon, 174 Cal. App. 4th 1386 (2009) (domain names are not subject to "turnover order," coincidentally, the same type of order Bosh obtained)), but it's a mistake to see these cases as somehow rejecting the theory domain names are properly subject to the claims of creditors. One caveat: even if domain name registration services are not contracts personal to the registrant, not every domain name can be easily bought and sold. As discussed in a moment, certain types of domain names - including potentially those involved in Bosh - are tougher to monetize without stepping on the toes of third parties.

Process Questions: In Bosh, the domain names all related to the names of famous athletes and celebrities and were ordered "turned over" to Bosh. Bosh plans on distributing them to other athletes whose names the defendant was squatting on. (Bosh plays for the Toronto Raptors and the defendant squatted on the names of Bosh and many other athletes.) Bosh is somewhat atypical since Bosh didn't really care about satisfying the judgment he obtained and probably will not undertake further efforts to collect. But one of the problems with Bosh is that it doesn't set any sort of process to value the domain names. Is the defendant's judgment satisfied based on the turnover? Who is to say? A turnover to Bosh is sort of an awkward result, and seemingly precluded by the statute (see McMahon), but Zavala was not around to contest the issues, so it is what it is.

A related problem is that Bosh would have a tough time selling the domain names, given that there would be little guarantee that any purchaser would steer clear of engaging in the same conduct that the defendant did in Bosh. The court in Zuccarini alludes to this. (See Zuccarini, 621 F. Supp. 2d at 778, fn. 7.) It's unlikely a court would ever conclude this, but if Bosh decided to auction off the names that were turned over, would he be treading close to the cybersquatting line?

Back to the typical case. Some would argue there's some sort of non-infringing use for all domain names, and that it's up to the purchaser to figure out non-infringing uses. There are plenty of established auction houses that regularly deal in domain names (e.g.,Moniker; Sedo). The best bet is to sell a domain name through a court-blessed third party auction. Theoretically, the market price at an auction will accurately reflect the assessment of purchasers as to how the domain name can be used. I guess a very rough analogy is that real property is freely exchangeable, but you can only use it without injuring the rights of your neighbors. No one argues based on the hypothetical nuisance claims of neighbors that real property is not freely exchangeable and therefore not subject to the rights of creditors.

At the end of the day, there are plenty of issues around the fringes, but domain names are likely not off limits for judgment debtors based on the theory that domain names are not "property". Most courts will find a way to let judgment creditors get at domain names.That's not to say that the process of seizing the names and disposing of them does not raise thorny issues.

[Cross posted at Professor Goldman's blog and CircleID]

Texas Class Action Aims to Derail Facebook Beacon Settlement

Venkat — Fri, 16 Oct 2009 23:49:00 GMT

[cross-posted at Professor Goldman's blog]

In late September, Facebook announced the settlement of a class action challenging its ill-fated "Beacon" program. Facebook set aside $9.5 million to settle the class claims and agreed to set up a privacy foundation. Facebook also agreed to not oppose a request for fees up to $3 million. A group of plaintiffs who filed a separate class action against Blockbuster are trying to object to this settlement.

The California Class Action (Lane v. Facebook): Facebook launched Beacon in late 2007. Consumers were not particularly happy, and in 2008, one set of plaintiffs filed a class action in the Northern District of California. (Lane v. Facebook, Inc.; Justia Page.) After "thorough, extensive, ongoing negotiations," which started in December 2008, a settlement was finally reached in this lawsuit. (Some details are recounted in the motion to approve settlement: [pdf].)

The Texas Class Action (Harris v. Blockbuster): Meanwhile, a separate set of plaintiffs sued Blockbuster in April 2008 in the Eastern District of Texas, also alleging injuries based on beacon. This lawsuit was filed before the class action in the Northern District of California, and Facebook was not named. Blockbuster argued that the claims were subject to arbitration. In April 2009, Judge Lynn of the Northern District (where the lawsuit was transferred) issued a ruling [pdf] rejecting Blockbuster's motion to compel arbitration. Judge Lynn found that Blockbuster's terms of service were "illusory," because the terms could be unilaterally changed by Blockbuster. (This ruling raised some eyebrows. See, e.g., BNA's TechLaw here, and an earlier post from me here.)

The Harris Plaintiffs File Against Facebook in Texas: Apparently the two sets of plaintiffs were not keeping each other apprised of what was going on. The Harris (Blockbuster) plaintiffs recently filed a class action in the Northern District of Texas against Facebook alleging violations of the Video Privacy Protection Act based on Facebook's implementation of beacon. (Here's a link to the complaint: [pdf].) The Harris plaintiffs are not too happy about the fact that apparently "[d]espite the requirements of the Local Rules of the Northern District of California, neither Blockbuster nor Facebook informed the District Court in the California Litigation of the pendency of the Texas Litigation." The Harris plaintiffs allege that Facebook agreed to indemnify Blockbuster of all wrongdoing, including those acts underlying the Harris action, and this agreement was a violation of public policy. They also argue that Facebook "in furtherance of the civil conspiracy outlined [in the complaint], also sought to achieve for Blockbuster what Blockbuster could not achieve for itself - resolution of any [Video Privacy Protection Act] liability through a non-arbitral forum." Predictably, the Harris plaintiffs also filed a motion in the Northern District of California seeking leave to intervene and object to the Lane settlement: [pdf]. According to a minute entry, the court heard argument on this motion and will issue a written ruling. The motion to intervene contains one fact which is potentially damning if true. The Harris plaintiffs informed all parties to the Lane action (in April 2008) that the two cases were related and that the parties to the Lane action should bring this to the court's attention. The parties to the Northern District of California lawsuit apparently declined to do so. On the other hand, I did not come across anything indicating that the Harris plaintiffs informed the court in Texas about the existence of the Lane class action.

What to Make of all This? I don't have a sense of how viable these arguments are. The dispute smacks of some amount of jockeying between two sets of plaintiffs' lawyers around the fee award that will be paid out. (Not that there's anything wrong with this.) My instinct is that the two cases were related enough that it was worth being conservative and informing both judges as to what was going on in the other cases. Blockbuster was named as a party in both cases, although the Northern District of California lawsuit was being defended primarily by Facebook. Also, the proposed settlement in the Northern District of California class action lets Blockbuster off the hook. Since there was a class action going in Texas while the Northern District of California settlement was being negotiated, it strikes me as odd that all of the parties were not folded into one big settlement (particularly since the Texas lawsuit was filed first). In an earlier post at Circle ID looking at the terms of the Facebook settlement, I mentioned the Blockbuster case, and wondered what would happen if a chunk of plaintiffs opted out and pursued their claims separately. I guess we may have an opportunity to see what happens.

One thing is for sure. Someone could end up getting an earful from one or both of the judges.

State of the Blog - Guest-Posting

Venkat — Wed, 14 Oct 2009 12:42:00 GMT

I wanted to point out for the handful (one or two) readers of this blog who do not read Professor Goldman's Technology & Marketing Law Blog, that I will be guest-posting at his excellent blog. My first post is on a recent case from the Western District of Washington that deals with copyright and the first sale doctrine . . . when is a software a license and when is it a sale? ("Vernor v. Autodesk - Does the Right to Possession Distinguish Between Sales and Licenses"). I was very excited to chat with Professor Goldman about guest-blogging and contributing since his blog has been a must read for many years now. We've left things open and we'll see where it goes. Either way, I'm excited about it.

So what does that mean for this blog? Good question. I don't think I'm quite ready to abandon it totally, but I may put some of my personal or quick posts here and some more substantive posts over there? We'll see. This blog's focus has shifted slightly over the years. As spam litigation becomes much less important, I've focused a bit more broadly on other topics in the space, such as privacy, informational security, and legal issues around social networks. I've also considered changing the domain name/name for the blog. I'm partial to "Spam Notes," but I've received plenty of feedback that if you have "spam" in the domain name or incorporated into the name of your blog, this puts you a few clicks behind the starting line. I've also thought about a re-design as far as look and feel. Moving to WordPress is probably the best place to start as far as a re-design, but it's easier said than done to port three years worth of entries to WordPress. I'm guessing it would be easy for someone who knew what they were doing. Just not so easy for me. (Before you say "it should be easy to find someone who will do it for a few hundred bucks," let me stop you and say that I've tried to find that person. Also easier said than done.)

I've been somewhat bogged down at work, which is not entirely a bad thing. (Complaining about how busy you are is gauche, particularly for lawyers, but "it is what it is." How's that for tackling two pet peeves in one sentence?) This has somewhat sapped my blogging energy in the past couple of weeks. But the blogging energy will return with a vengeance, it always does. Also, as much as I hate to admit it, Twitter has been taking up some of the energy that I used to spend blogging. It's a useful medium to get information and chat with others, but boy is it easy to get into a compulsive cycle of "checking out what's going on on Twitter." All those articles you read about information overload, attention spans, etc. They're true!

Kindle 1984 Settlement: Amazon Agrees to Not Disappear Kindle Content

Venkat — Thu, 01 Oct 2009 15:08:00 GMT

As reported by Eric Engleman in TechFlash, Amazon is one step closer to settling the class action brought against it alleging that Amazon wrongly deleted copies of 1984 from Kindles. Counsel for plaintiffs and Amazon have agreed on a settlement agreement [pdf], and it's waiting approval by the court.

What struck me about the settlement is the fact that Amazon seems to have agreed to a complete change in policy - i.e., it agreed to not delete Kindle content from anyone's Kindle, ever, except in certain narrow circumstances:

That's how I read the language above, anyway. (The definition of "Work" is fairly broad.) I don't think it's quite a consent decree, or some type of an order a third party could enforce rights under (not sure about this one), but it's interesting that Amazon agreed to such a broad change in policy. Sure, their CEO had made statements to the effect that "this would never happen again," but I didn't expect to find such a sweeping change in policy here. That's exactly why these cases often settle, because a company does not want to set adverse precedent. But here, Amazon is agreeing to a global change, not just as to these consumers, but as to all consumers.

Also, in these types of circumstances, companies often leave themselves plenty of wiggle room: "we can delete content, if we believe leaving the content on the device is contrary to our interests" or something like that. It's a win for the consumer to not find any of that loophole language here. There's not any room to remove content even if Amazon itself receives a notice of infringement or a takedown request. As I read the language, they actually need a "judicial or regulatory" order to remove content. (I guess the "protect the consumer" language is broad enough to encompass this.)

Finally, it looks like counsel for plaintiffs will be donating the entire amount of fees to charity.

So...Can you Subpoena Someone's Facebook Page?

Venkat — Fri, 25 Sep 2009 17:34:00 GMT

I don't know the answer to this question, but an order issued by the Northern District of Illinois in the context of an AOL subpoena gone awry sheds some light on the issue. (The case is Thayer v. Chiczewski, 2009 U.S. Dist. LEXIS 84176 (N.D. Ill.; Sept. 11, 2009). Access the order [pdf] here.)

Background: Plaintiff Andy Thayer sued the City of Chicago and its police officers alleging that the city wrongly arrested him for voicing his dissent against the Iraq war (in 2005). Defendants issued a subpoena to AOL seeking email messages from plaintiff's account. Defendants identified certain key words AOL could use to narrow down the relevant emails. Plaintiff and AOL both objected on numerous grounds. (I would think the subpoena should have been issued through federal court in Virginia, but everyone ultimately abandoned the lack of jurisdiction argument.) Defendants issued a modified subpoena. Plaintiff successfully brought a motion to quash this modified subpoena. In granting plaintiff's motion, the court suggested that the parties negotiate the appropriate scope of the subpoena. Defendants issued a second modified subpoena. AOL in response reiterated its previous objections and stated based on its personal knowledge that AOL did not "maintain any email on its computer servers that is not directly accessible to the user of the mail screen name." Defendants then filed a motion to compel.

Procedural Wranglings: The court directed AOL to respond to defendants' motion to compel. In response, AOL did not respond, but plaintiff's counsel filed a joint response to the motion advising that neither plaintiff nor AOL had access to the requested email. Plaintiff also sought to recover attorney's fees due to being forced to respond to a subpoena for material that defendants "knew did not exist."

That's when things went South.

Several days after filing the joint response, plaintiff faxed the court a letter "promptly" advising the court of a "recent development": AOL did have emails responsive to defendants' subpoena after all. Defendants then filed a reply, and plaintiff - in disregard for the applicable rules and without leave of court - filed a sur-reply attacking defendants' accusations of misconduct on the part of the plaintiff. To date, AOL did not file any pleadings. On September 10, after the flurry of pleadings from plaintiff and defendant, AOL finally filed . . . a letter through its counsel. The letter advised the court that AOL had acted strictly in good faith. The letter also advised that AOL receives approximately 350 civil subpoenas per year, has a standard procedure in place (of raising objections), and in this instance, AOL raised the initial objections, but when it took a second look, located relevant emails.

The Substantive Issue: After recounting this procedural saga and chastising plaintiff and AOL, the court finally comes to the core question of whether AOL can be compelled to produce the emails:

Plaintiff and AOL have cited numerous cases supporting their position that the [Stored Communications Act, 18 U.S.C. 2701(a)(1)] prohibits an internet service provider, like AOL, from divulging to a civil litigant the contents of any communication that is carried, maintained, or stored on or by the services. See, e.g., Federal Trade Commission v. Netscape Communications Corp., 196 F.R.D. 559, 561 (N.D. Cal. 2000) . . . These holdings are consistent with Congress's intention, in enacting the SCA, to protect from disclosure private, personal information that happens to be stored electronically . . . . And it is clear that, at the heart of these decisions, lies the courts' interest in advancing the legislative intent to protect from unauthorized disclosure electronically-stored documents, which would have otherwise remained private. See, Id. citing Theofel v. Farey-Jones, 359 F.3d 1066, 1073-74 (9th Cir. 2004).

These holdings are useful to the extent that [defendants' subpoena], if enforced, would result in the production of such private and personal documents. The instant case is distinguishable, however, because [defendants' subpoena] is targeting, largely, documents that [plaintiff] would be required to produce if he had not deleted them from his email accounts. But while [plaintiff] cannot retrieve these emails from his accounts, [defendants have] presented evidence indicating that AOL does have access to these deleted emails. Importantly, the SCA permits the disclosure of otherwise protected communications, if the subscriber, or the author or the intended receiver of the communications gives his consent.

***

So, ultimately the court concludes that AOL can be forced to produce the emails in question since plaintiff should have produced them in the first instance? I'm not familiar enough with the statute and precedent to say for sure, but the court's conclusion that AOL could be required to produce the emails since plaintiff should have produced them seems off.

In any event, the decision contains a slew of interesting points that are relevant to civil litigants seeking emails, Facebook page contents, etc. Along with Theofel v. Farey-Jones and other decisions, it belongs on the reading list for people who may have occasion to subpoena emails and other electronic communications in civil litigation.

Coming back to the title of the post: "can you subpoena someone's Facebook page in civil litigation"? I don't know. On a related note, Facebook pages were subpoenaed in a Virginia worker's comp dispute and Facebook successfully resisted the subpoena. [link] In that case the plaintiff - whose Facebook materials were sought - consented to the disclosure of the material in question. Interestingly, the court ruled that Facebook could not be compelled to produce the materials, although there were jurisdictional issues in that case as well. Also, it's not clear (to my knowledge) whether all Facebook (Twitter or other) communications are treated similar to email for purposes of the SCA and other statutes.

Finally, the decision contains some teaching to service providers as to what not to do. AOL ended up in the court's cross-hairs because it wasn't terribly diligent in its initial responses. Also, it made statements based on its "personal knowledge" that turned out to not be true. That's an obvious no-no.

Added: one way to get access to a Facebook page is from a friend of the person whose page you are trying to track down. There are some ethical issues here, as noted in the Philadelphia Bar Association report linked in this post.

Rocky Mountain Bank / Gmail Fiasco Takes a Turn For the Worse

Venkat — Fri, 25 Sep 2009 00:56:00 GMT

As reported by Wired, MediaPost, Informationweek, and numerous others, Rocky Mountain Bank did the equivalent of setting off a firecracker in a dark room by seeking permission to file its pleadings against Google under seal. The problem was that the lawsuit involved the bank's attempts to locate a gmail account-holder, and the bank was trying to keep quiet the fact that it had inadvertently sent an email containing sensitive private information . . . to the wrong email address.

The saga took another turn yesterday when (as reported by Wendy Davis) the court granted the bank's request to "deactivate" the account in question. Access a copy of the order [pdf] here. The order also enjoined the account-holder from accessing the confidential information, and required Google to (unless the account was dormant) disclose the identity and contact information of the account-holder.

Oy.

Quick thoughts on what went wrong:

The Bank: The bank (or a bank employee) fumbled to say the least. Sending an email containing confidential information . . . to a random gmail address? Then trying to keep it under wraps? The decision is "begging to be mocked and ridiculed," as one person said.

Bank's Lawyers: Potentially bad call on their part to sue Google and file under seal, but how else could they have handled it? One minor suggestion to the bank's lawyers: they may have been better off filing a John Doe action. People probably search lawsuits by parties, and any lawsuit involving a company like Google ends up being on everyone's radar screen. I'm not sure a John Doe lawsuit could have avoided the backlash, and whether they satisfied the requisite standards, but it was worth a shot. (As a side note, I was involved in a case in the Northern District where the other side tried to file something under seal, and the court wasn't very happy about this. The decision to file under seal wasn't unreasonable in that case, but that experience taught me to think twice about filing anything under seal.)

Google: Google did the right thing in refusing to shut down the account or turn over its contents without a court order.

That brings us to the final actor. The court. Did the court just issue an order without notice to the account-holder that the gmail account be "deactivated"? As John Morris of CDT and Prof. Goldman note, disabling an account-holder's email account is pretty serious and the order implicates the account-holder's First Amendment and privacy rights. And it didn't seem like the account-holder had much notice either? Problematic from a Due Process standpoint? At least the court's order does not require disclosure of the contents of the email account (laws regulating the access and disclosure of emails (e.g., Stored Communications Act) probably do not leave room for this type of disclosure).

I feel bad for the person at the bank that sent the email! We will all have one or more email snafus in our lives. Guaranteed. This one turned out to be plenty costly.

Update: Howard Bashman reports that the parties filed a joint motion to vacate the TRO as moot. Access a copy of the joint motion here [pdf].

Also, this post from BNA's TechLaw blog ("Selective Outrage in Rocky Mountain Bank Case") is worth reading.

Guest Post at TechFlash: Privacy Policies and Acquisitions

Venkat — Mon, 21 Sep 2009 13:58:00 GMT

I have a guest post at TechFlash, Seattle's technology news source (an awesome project of former Seattle PI technology reporters). My basic point is that privacy policies tell consumers little about what happens when there is an acquisition, and this is important, particularly when it comes to acquisitions that involve large amounts of user data:

Did Facebook’s acquisition of FriendFeed comport with FriendFeed’sprivacy policy? In arguing this point, lawyers may debate the nuancesof the policy, but consumers are largely left in the dark.

Thanks to the folks at TechFlash for letting me post on this . . . I was pretty excited about it.

BTW: the first commenter checks me on something. It's tough to say that Facebook's acquisition of FriendFeed was about the user base. FriendFeed's user base is truly a drop in the Facebook bucket. The larger point is that Facebook gained control over user information which FriendFeed users may not have given to Facebook in the first place.

A Look at the Facebook Privacy Class Action (Beacon) Settlement

Venkat — Sat, 19 Sep 2009 13:36:00 GMT

Facebook announced on Friday that it settled the class action challenging its "Beacon" advertising program. [Inside Facebook; h/t Jim McCullagh on Twitter] You can access the key docs here: [pdf] (Settlement Agreement; Motion for Preliminary Approval).

Net result? Facebook establishes a privacy foundation funded with $9.5 million (or what's left of this amount after attorneys' fees, costs, and class claims are deducted).

Background: Beacon was an advertising program launched in November 2007 which (roughly speaking) allowed the transmission of purchase and consumer-related information between partner retailers, Facebook, and of course, your Facebook friends. [Wikipedia] I don't think many people have a sense of all of the contours of the program, but famous bad examples of the program involved Facebook users who rented videos from Blockbuster having their rental choices broadcast to friends in their "news feed," and one user who bought flowers for his girlfriend only to have his wife find out via Facebook. Purchasing decisions can often be private (as Robert Bork - who inspired the Video Privacy Protection Act and whose rental records were subpoenaed by Congress - can attest), and allowing Facebook and partner retailers to exploit this information was a fiasco waiting to happen. The fact that this program was even designed and approved by Facebook was for many a serious blow to Facebook's credibility. At any rate, several class action lawsuits were launched, and it looked like after much behind the scenes activity, a settlement was reached in this particular lawsuit. (The settlement docs note that Facebook filed a Motion to Dismiss in late 2008, but before the court ruled on this motion the parties entered settlement negotiations...culminating in yesterday's settlement.)

The Settlement: So what does the settlement involve?:

Privacy Foundation: Facebook sets up a privacy foundation, funded with whatever is left of the $9.5 million. The purpose of the foundation is to educate "users, regulators, and enterprises regarding critical issues relating to protection of identity and personal information online through user control, and to protect users from online threats." The (three) initial directors shall be decided by the parties (essentially by class counsel and Facebook's counsel).
Fees: Plaintiffs' counsel is entitled to attorneys' fees to the extent deemed reasonable by the court - Facebook agrees to not object if the amount is up to 1/3 of the 9.5 million dollar privacy fund. (Yowza.)
Named Plaintiffs: Named plaintiffs get $15,000 and $7,000 for their time and effort.
Who Gets a Release?: "Protected Persons" are released. This includes Facebook, and all "Beacon Merchants" (e.g., Blockbuster, Fandango, Zappos.com, Overstock.com).

How about damages for the class? I may be missing the boat on something (maybe it's doled out by the administrators) but there is little or no discussion of damages to the class. Maybe that's typical in a class action settlement? Is the privacy foundation funded with what's left? Maybe there are no damages to the class because the parties thought the class wasn't damaged?

Other thoughts.

Blockbuster is involved in a separate lawsuit in the Northern District of Texas around its Beacon activities. It lost a Motion to Compel Arbitration, which it decided to appeal. Since Blockbuster obtained a release here (in the N.D. Cal. case), this may dispose of the Northern District of Texas case as well (unless Blockbuster wants to appeal the arbitration ruling to try to get it off the books).

Facebook can reject the settlement if 1,500 or more class members opt out. That's a pretty low number. I wonder if someone will start the "opt out of the Beacon class action settlement" group on Facebook? Seriously, I wonder if anyone will opt out and decide to pursue claims against Facebook on an individual basis?

Big win for KamberEdelson, which is racking up a pretty impressive class action record against internet and technology companies.

Added: good overview from Caroline McCarthy at cNet here ("Facebook Beacon has poked its last").

Small Print + Below the Fold Undermine Browsewrap Agreement

Venkat — Thu, 10 Sep 2009 17:19:00 GMT

People take "browsewrap" agreements for granted - agreements that end users agree to when they browse websites. ("By browsing this website or accessing any of the content, you hereby agree to the following terms and conditions.") The core issue of whether these website terms create enforceable contracts has not been litigated very often (see, e.g., Specht v. Netscape Communications Corp., 306 F.3d 17 (2d Cir.2002), for one example). For the most part, the general consensus is pretty clearly that browsewrap agreements are enforceable, although the parties may dispute the enforceability of particular terms. Much of the action typically takes place around particular provisions such as arbitration, disclaimers of warranties or limitations of liability, or around other tweaks, such as whether parties can incorporate terms by reference.

So it was interesting to see a court rule that terms which were linked in fine print and under the fold were not sufficient to create a binding agreement. The case is Hines v. Overstock, 09 CV 991 (SJ) (2009 U.S.Dist. Lexis 81204 (Sept. 8, 2009) (E.D.N.Y.)). This was a class action where plaintiffs alleged that Overstock improperly assessed "restocking" fees. Overstock moved to compel arbitration, based on an arbitration clause in the browsewrap agreement on the Overstock website. Not only did the court deny the request to arbitrate, the court found that Overstock's website terms did not create an enforceable agreement at all - because plaintiff had no actual or implied notice of the terms.

Ouch:

In the instant case, it is clear that Plaintiff had no actual notice of the Terms and Conditions of Use. Defendant has also failed to show that Plaintiff had constructive notice. . . Despite Defendant's assertion. .. [no] evidence submitted by Defendant refute Plaintiff's . . .statement that she was never advised of the Terms and Conditions and could not even see the link to the without scrolling down to the bottom of the screen - an action that was not required to effectuate her purchase.
...
[Plaintiff] therefore lacked notice of the Terms and Conditions because the website did not prompt her to review the Terms and Conditions and because the link to the Terms and Conditions was not prominently displayed so as to provide reasonable notice of the Terms and Conditions. Very little is required to form a contract nowadays - but this alone does not suffice.

Overstock (and all retailers or anyone else who creates an account on behalf of end users and has some sort of ongoing relationship) should take the check the box route. Make the user check the box to indicate assent to the terms of use. This makes the "I didn't have notice" argument a bit harder. If you do not want to do that at least clearly disclose your terms and conditions and put them in an obviously visible location which the end user will necessarily come across in the course of completing transactions.

I don't have a sense of how significant this ruling will be, since in most instances, websites make terms readily available and there is pretty good evidence that the person challenging the agreement read or at least came across the terms. But it's tough to say. Overstock is a pretty large retailer. There are probably others out there who are in a similar position.

Also, it's interesting that many online agreements are being litigated and are being shot down in court. Blockbuster is one recent example that comes to mind - a court found its agreement illusory based on the "we can change the agreement anytime" clause. What's going on here? Did the early wave of online agreement drafters drop the ball? Were they [we] too aggressive? Did they all start off with the wrong “form”? Is there any trend here? Probably not, but it's tough to say. This decision wasn't based on any terms of the agreement, but just the fact that the terms were not obviously displayed to end users. While the court didn't find anything wrong with the terms, the decision reflects some skepticism as to whether anyone actually reads online terms. (I don't know that the blame falls on the shoulders of the lawyers here. Often you draft an agreement with clear instructions and the implementation on the website does not track your instructions, or the website changes.)

Related: BNA's TechLaw has a post on "hyperwrap agreements" that's definitely worth checking out. Ton of good posts at TechLaw lately.

The Admissibility of Tweets

Venkat — Mon, 07 Sep 2009 13:55:00 GMT

I guess a better question when talking about the admissibility of tweets is whether any exceptions to the hearsay rule apply? Tweets are out of court statements which are not admissible in court unless they fit into one of the exceptions or exclusions. But they will most likely be admissible, at least judging from the treatment by courts of email and other similar evidence.

Professor Brenner has a good post at Cyb3rCrim3 ("Evidentiary Tweets?") which looks at whether and in what circumstances Tweets (or similar messages) will be admissible. She links to a post by Joshua Konkle ("Twitter and Federal Rules of Evidence 803(1) and 803(2), hearsay exceptions"), which I've previously linked to as well.

Professor Brenner looks at the excited utterance and present sense impression exceptions to the hearsay rule, and thinks that while they may apply to allow the admission of tweets, there's another candidate:

I strongly doubt that the business records exception or many of the other hearsay exceptions will apply to tweets . . . but the exceptions contained in Rules 803(1) and 803(2) just might. ...

I don’t think these are the only exceptions that could be used for tweets. Under Rule 803(3) of the Federal Rules of Evidence, “[a] statement of the declarant's then existing state of mind, emotion, sensation, or physical condition . . . but not including a statement of memory or belief to prove the fact remembered or believed unless it relates to the execution, revocation, identification, or terms of declarant's will” is not excluded by the default hearsay rule. According to the Advisory Committee, this is “essentially a specialized application” of the present sense impression exception. Advisory Committee Federal Rules of Rule 803(3). The Committee also noted that excluding statements of memory or belief is “necessary to avoid the virtual destruction of the hearsay rule, which would otherwise result from allowing state of mind, provable by a hearsay statement, to serve as the basis” for inferring the event which “produced the state of mind.”

It seems to me Rule 803(3) may be a better fit for tweets than the other two rules. As a federal judge noted, “Rule 803(3) is particularly useful when trying to admit e-mail, a medium of communication that seems particularly prone to candid, perhaps too-candid, statements of the declarant's state of mind, feelings,emotions, and motives.” Lorraine v. Markel American Insurance Co., 241 F.R.D. 534 (U.S. District Court for the District of Maryland 2007). And at least one court relied on this exception in ruling that emails were admissible in a federal criminal prosecution. U.S. v. Safavian, 435 F. Supp.2d 36 (U.S. District Court for the District of Columbia 2006).

So the candidates are...present sense impression (803(1)), excited utterance (803(2)), and now the then-existing mental state (803(3)). I guess the answer will depend on the message in question. But all three are potential candidates. (If you are lucky enough to have an opposing party who tweets or Facebooks, the admission of a party opponent route works as well. This is technically not even considered hearsay.) Either way, this type of evidence is likely admissible for the reasons stated in Lorraine. Basically email, Twitter, Facebook, etc. lend themselves to candid conversations and admissions. The rules of evidence have exceptions which are designed to accommodate the admission of these types of communications, even when they are hearsay. [Sidenote: you mean there's not a "what I ate for breakfast" exception to the evidentiary rules for twitter!!]

Of course, remember to authenticate the evidence and demonstrate that the account is actually registered to the person you are claiming it's registered to. Sounds like a menial step, but could and probably will turn out to be costly if you ignore it.

Here's a previous post I did on email authentication at the summary judgment stage that discusses email authentication at length. My tentative impression at the time was that the present sense impression could be applicable to tweets and I still think that's right, but depending on the context, Professor Brenner's suggestion may also fit the bill. There may be other exceptions or bars to admission in specific cases obviously.

(h/t Moshe Glickman)

Added: good question from William Carleton in the comments about discovery requests and this type of evidence (i.e., how to go about tracking down this type of evidence). More on that later.