by ·0 Comments

A university may discipline a student for social media posts that violate academic rules based on the ethical code of the profession the student is studying to become part of — Tatro v. University of Minnesota, 2012 WL 2328002 (Minn. June 20, 2012)

When a student sues under the First Amendment for being disciplined by the school for his or her expression, a court will likely apply the line of cases stemming from Tinker v. Des Moines Independent Community School District, 393 U.S. 503 (1969), or Hazelwood School District v. Kuhlmeier, 484 U.S. 260 (1988).  Tinker ruled that a school district may limit or discipline student expression if school officials reasonably conclude that the expression will “materially and substantially disrupt the work and discipline of the school.”  Hazelwood said that a school may exercise editorial control over the style and content of student speech in school-sponsored activities if their actions are “reasonably related to legitimate pedagogical concerns.”  But what if the student expression isn’t disruptive per se, and isn’t sponsored by the school, but contrary to the professional code of ethics the students are being trained to follow?  It isn’t unconstitutional for the school to discipline the student for such expression, the Supreme Court of Minnesota recently said.

Amanda Tatro worked on human cadavers as part of the anatomy lab work for the University of Minnesota’s mortuary science program in which she was enrolled.  Tatro agreed to abide by various rules as a condition of being granted access to the cadavers, including the code of professional conduct governing mortuary science students and anatomy lab rules.  The lab rules prohibited “blogging” about the anatomy lab or cadaver dissection.  The lab students were told during orientation that blogging included Facebook and Twitter.

Tatro posted a series of comments on her Facebook page about the human cadaver she was assigned to.  As a result of the comments, the university imposed sanctions against Tatro, including a failing grade in the lab course and placement on probation for the remainder of her undergraduate career.  Tatro sued the school for violations of her constitutional right to free speech.

The court first considered the Tinker and Hazelwood lines of cases, but concluded that neither applied.  The university disciplined Tatro not because her Facebook posts created a substantial disruption on campus or within the mortuary science program, but because the posts violated established rules that require respect, discretion, and confidentiality in connection with work on human cadavers.  The Tinker analysis was therefore inapplicable.  Hazelwood did not apply either because no one would reasonably consider the Facebook posts as speech that the university sponsored or promote.

The discipline was constitutional for a different reason, the court said.  Dignity and respect for the human cadaver is an established part of the professional conduct standards for the mortuary science profession.  The academic rules that Tatro violated were narrowly tailored to the objective of promoting such professional standards.  The rules permitted “respectful and discreet” discussion of cadaver dissection outside the lab in a private setting, but prohibited blogging about cadaver dissection or the anatomy lab, which could reach a wide audience.  Tatro’s Facebook posts, for example, could be seen by the hundreds of people who were “friends” with Tatro on Facebook, as well as “friends of friends.”

LegalTXT Lesson:  Academic programs that prepare students to work in a particular profession may be able to limit off-campus student expression that violates the ethical standards of that profession.  The limits must still be “narrowly tailored” to the interest in training students to uphold professional standards, however, which means blanket bans on student expression often will not pass muster.

by ·2 Comments

LinkedIn announced on June 6 that it experienced a data breach compromising the passwords of some of its members.   Ten days later, LinkedIn got hit with a class action lawsuit.  The lawsuit was filed in a California federal district court.  You can read the complaint here.

A few key points about the lawsuit:

  • The plaintiffs consist of two classes — (1) anyone in the U.S. who had a LinkedIn account on or before June 6, 2012, and (2) anyone in class #1 who paid for a premium account.
  • The lawsuit alleges that LinkedIn did not comply with industry standard encryption protocols, contrary to its Privacy Policy.  Specifically, the plaintiffs contend that LinkedIn stored member passwords in “unsalted SHA1 hashed format.”
    • In simple terms, adding “salt” to a password means assigning random values to a password to make it more difficult to decipher.  For example, if the password were “JohnDoe,” you could salt it by adding the characters “5a6b7c,” giving you “JohnDoe5a6b7c.”
    • Hashing refers to the process of running a password into a cryptographic function to convert it into an unreadable and encrypted format.  The plaintiffs say that LinkedIn used an outdated hashing function that was first published by the NSA in 1995.
    • The plaintiffs say that LinkedIn should have at least salted the passwords before running them through the hash function.  Better yet, LinkedIn should have salted the passwords, input them into the hash function, salt the resulting hash value, and then run the hash value through a hash function.   Then, LinkedIn should have stored the fully encrypted password on a separate and secure server apart from all other user information.
  • The lawsuit brings claims based on California’s unfair competition law, California’s Consumers Legal Remedies Act, breach of contract, breach of implied covenant of good faith and fair dealing, breach of implied contract, and negligence.
  • The plaintiffs in the first class (all LinkedIn users) say they were in the form of loss of value in their personal information.  (Whether the court will accept that damage theory is questionable.)  Those in the second class (premium members who paid fees) say they were injured in the form of the fees they paid to LinkedIn for premium membership.