A personal cell phone is not a “facility” within the meaning of the Stored Communications ActNavarro v. Verizon Wireless, L.L.C., 2013 WL 275977 (E.D. La. Jan.24, 2013)

A federal court in Louisiana recently ruled that a hacking and “sexting” victim could not sue under the Stored Communications Act (SCA).  The plaintiff (Navarro) visited a cell phone store and accepted the offer from a Verizon sales associate to try a new cell phone model for two weeks.  Navarro later returned the trial phone to the store and had a different Verizon sales associate (Stillwell) transfer data from the trial phone back to her phone.  After leaving the store, she received a message on her phone from an unknown number.  The message contained nude photographs of Navarro that she had taken using her phone’s camera.  When Navarro’s mother confronted the manager of the cell phone store, Stillwell admitted that he copied the photos from Navarro’s phone for his own use and accidentally sent them to Navarro from his phone.

Navarro sued Verizon and the cell phone for violating the SCA, among other theories.  She inadvertently omitted a claim for punitive damages under the SCA, however, and asked the court for permission to add such a claim.  The defendants argued that the claim would be futile because a personal cell phone is not a “facility” under the SCA.  Liability under the SCA requires the unauthorized intentional access of “a facility through which an electronic communication service is provided” to obtain, alter, or prevent “authorized access to a wire or electronic communication while it is in electronic storage in such system.”  18 U.S.C. § 2701(a).

The court agreed with the defendants.  In a Fifth Circuit case, the court concluded that the SCA envisions regulation of network service providers (like Verizon).  A home computer of an end user does not qualify for SCA protection.  Relying on that case, the court ruled that a personal cell phone is not a “facility.”  While a cell phone enables the use of an electronic communication service, it is not itself such a service.  The information stored on a cell phone therefore is not in “electronic storage.”  Navarro suggested that the defendants might have copied her photographs from a “cloud based” storage system run by Verizon, but there was no evidence of that, so the court rejected the theory.  Navarro was denied permission to add a punitive damages claim under the SCA.

It’s time for a roundup of recent Stored Communications Act (SCA) decisions.  The issues addressed in these decisions include: (1) is a company network a “facility” subject to the prohibitions of the SCA; (2) what is “electronic storage”; (3) can there be secondary liability for violating the SCA; and (4) how broadly is “authorization” under the SCA defined.

Is a company network a “facility”?

Freedom Banc Mortgage Services, Inc. v. O’Harra, 2012 WL 3862209 (S.D. Ohio Sept. 5, 2012)

A terminated employee remotely accessed her ex-employer’s company computers to transmit spyware and monitor network communications.  The company sued the ex-employee under the Computer Fraud and Abuse Act (CFAA) and SCA.  (I discussed the CFAA claim in this case in an earlier post.)  The SCA makes it an offense to intentionally access without authorization (or exceed one’s authorization to access) a “facility through which an electronic communication service is provided” and thereby obtain, alter, or prevent authorized access to a wire or electronic communication “while it is in electronic storage in such system.”

The company alleged that its computers are “facilities” because they enable the use of electronic communication services.  The court rejects that interpretation of “facilities.”  Information that an individual stores to his or her hard drive, such as images, personal information and emails that he or she has downloaded, is not in “electronic storage” as defined by the SCA.  The “facilities” the SCA is designed to protect are not computers that enable the use of an electronic communication service, but facilities operated by electronic communication service providers and used to store and maintain electronic storage.  The court dismissed the SCA claim.

(LegalTXT Note: This decision conflicts with a number of other federal district court decision that have held that private servers are within the scope of the SCA)

What is “electronic storage”?

Jennings v. Jennings, 2012 WL 4808545 (S.C. Oct. 10, 2012)

Gail Jennings initiated a divorce proceeding after discovering that her husband (Lee Jennings) was having an affair. Gail’s daughter-in-law (Broome) decided to help Gail by hacking into Lee’s Yahoo! email account to retrieve messages between him and his mistress.  In the lawsuit that followed, the trial court granted summary judgment for the defendants on all claims, including those brought under the SCA.  The court of appeals affirmed except as to the SCA claim against Broome.  The court of appeals found that the emails at issue were in “electronic storage” as defined in 18 U.S.C. § 2510(17), and therefore within the SCA’s prohibition against unauthorized accessing of an electronic communication while it is in “electronic storage.”

The South Carolina Supreme Court disagreed that the emails in questions were in “electronic storage.”  Part of the SCA’s definition of “electronic storage” involves storage of an electronic communication “by an electronic communication service for the purposes of backup protection of such communication.”   The emails in Lee’s account were left on the Yahoo! server after they were opened.  Keeping an email after opening it does not amount to storing it for “backup protection,” the court ruled.

Can there be secondary liability for violating the SCA?

Can a person have secondary liability for violating the SCA, such as by “aiding and abetting” a violation?  A Florida court suggests that the answer is yes, but the federal district court for the District of Columbia says no.

Vista Marketing, LLC v. Burkett, 2012 WL 3860435 (M.D. Fla. Sept. 5, 2012)

Plaintiff’s wife (Burkett) accessed the webmail account of Plaintiff’s company (Vista) to read Plaintiff’s emails so as to gain a strategic advantage in their divorce proceeding.  She did not have authorization to access the Vista email account.  Vista alleged that told her divorce attorney (Park) what she had done, and that Park encouraged Burkett to continue accessing Vista’s webmail account and advised her to compile and print many of the communications for use in the divorce proceeding.  Vista sued Park under Florida common law for conspiracy to violate the SCA.  Park moved to dismiss, but the court denied the motion, holding that Vista adequately alleged facts supporting the conspiracy claim.

Council on American-Islamic Relations Action Network, Inc. v. Gaubatz, 2012 WL 4054141 (D.D.C. Sept. 17, 2012)

Chris Gaubatz obtained an internship with a national Muslim advocacy organization (CAIR-AN) under false pretenses to infiltrate the organization and collect information that would cast the organization in a negative light.  Chris is the son of David Gaubatz, an investigator hired by the Center for Security Policy, Inc. (CSP) and the Society of Americans for National Existence (SANE) as an independent contractor to collect “field data” about CAIR-AN.  Chris was able to collect thousands of documents, which he turned over to David.  David disclosed the stolen information on his blog and in a book he co-authored.  CAIR-AN sued Chris and David, CSP and its employees, and SANE and its employees.  One of the claims in the lawsuit alleged that the Defendants “conspired with” or “aided and abetted” Chris in violating the SCA.

The court concluded that the text of the SCA did not support a theory of secondary liability.  According to the court, the SCA’s “plain language shows that Congress had one category of offenders in mind—i.e., those who directly access, or exceed their authority to access, a facility through which an electronic communication service is provided.”

(LegalTXT Note:  Although Vista Marketing discussed the SCA, the claim at issue there was based on Florida’s common law of conspiracy rather than the SCA itself.  In contrast, Gaubatz squarely involved an SCA claim.)

What’s the scope of “authorization”?

Is after-the-fact authorization effective?

Shefts v. Petrakis, 2012 WL 4049509 (C.D. Ill. Sept. 13, 2012)

There is an exception to the SCA’s prohibitions for conduct authorized by the entity providing the electronic communication service that was accessed.  But what if the authorization was provided after there has already been access?  Is authorization effective if it is given after the fact?

The answer is yes, according to the court in Shefts.  (Some of the facts relevant to the case are supplied by an earlier published decision, Shefts v. Petrakis, 758 F. Supp. 2d 620 (C.D. Ill. 2010).  Access2Go, Inc., a telecommunications company, initiated a program to monitor the email and texting activity of its president after learning of concerns that he was sexually harassing Access2Go employees and violating his fiduciary duties.  As part of the monitoring program, a shareholder and member of the Access2Go board of directors (Petrakis) accessed Shefts’ company email account.  The board appointed Petrakis as its liaison of security.  Petrakis collected emails allegedly showing Shefts engaged in sexually harassing behavior and other improper acts.  Based on this and other evidence, the board suspended Shefts and recommended his termination.

When Shefts sued the board members under the SCA, the board members countered that the company had authorized access to his email account.  Since Shefts’ company email account was maintained by and resided on Access2Go’s servers, Access2Go could legitimately authorize access to the account.  The question is, when did Access2Go give the authorization?  The board never voted to allow an employee to access another employee’s computer.  However, the board members were aware that Petrakis had accessed Shefts’ company email account, and they relied on the emails that Petrakis collected in suspending Shefts and recommending his termination.  Based on these facts, the court concluded that the board had “ratified” Petrakis’ actions, and such ratification qualified as “authorization” under the SCA.

You’re in, now what?

Cheng v. Romo, 2012 WL 6021369 (D. Mass Nov. 28, 2012)

Just because the owner of an email account gives you permission to access his account doesn’t mean you are “authorized” to read every email in there.  In Cheng, the plaintiff (Cheng) and the defendant (Romo) and her husband worked for a medical imaging company.  Cheng maintained a Yahoo! email account while working at the company, the password for which he shared with Romo.  Although Cheng never qualified Romo’s access to his email account in any way, never stated a time limit on his grant of access to Romo, and never changed his password during the relevant time, his purpose in sharing his email account was to enable Romo to review radiologic images for their work.  Romo testified that she would check Cheng’s email account to read consultant reports that radiologists emailed to Cheng.  Initially, Romo did not look at any personal items in Cheng’s email account.  But after Romo and her husband’s relationship with Cheng and others at the company deteriorated—leading ultimately to their separation from the company—Romo accessed Cheng’s account to find out about the state of the company.  Romo shared with her husband the emails she printed from Cheng’s account.  Cheng sued Romo for violations of the SCA and invasion of privacy under Massachusetts law.

The court denied Romo’s motion for summary judgment as to both claims.  Regarding the SCA claim, the court found genuine issues of material fact as to whether Romo had authorization to access Cheng’s email account.  The fact that Cheng had given Romo his password years earlier was not determinative, given the context in which the password was given and the later use that Romo made of it.  It was up to the factfinder to look at the circumstances in which the password was given and to determine whether Romo was authorized, or exceeded her authorization, to access Cheng’s email account, the court said.

As for the privacy claim, the court held that it was cognizable, but there were genuine issues of material fact concerning whether Cheng had a reasonable expectation of privacy in his email messages and whether Romo’s actions interfered with Cheng’s privacy.

(LegalTXT Note: The court in Cheng noted that the term “authorization” in the SCA could have analogous meaning as the same term in the CFAA.  The court summarized the different approaches court take in defining the term in the context of the CFAA, including those finding “authorization” where there was no breach of technical barriers to access, and those finding no “authorization” where permission to access was granted but the information collected via such access was misused (see my post on Wentworth-Douglass Hosp. v. Young & Novis Prof’l Ass’n, 2012 WL 2522963 (D.N.H. June 29, 2012), a case the Cheng court cites).  Ultimately, the court does not indicate which approach it adopts, although its summary judgment ruling suggests that it considers the purpose behind the grant of access, and not the mere grant of permission itself, relevant to determining the existence of authorization.)

Facebook is being sued in a $15 billion lawsuit alleging that the popular social media company secretly tracked the Internet activity of its users after they log off (the First Amended Complaint is available here).  The case is a consolidation of nearly two dozen lawsuits filed in ten states, including one here in Hawaii (Quinn v. Facebook, Inc., 1:11-cv-00623).  The lawsuit alleges violations of the U.S. Wiretap Act, the Stored Communications Act, and Computer Fraud and Abuse Act.

In July, Facebook filed a motion to dismiss the lawsuit on the ground that the plaintiffs failed to allege sufficient injury.  At the hearing on the motion on October 5, Facebook’s attorneys argued that the plaintiffs haven’t identified the websites they visited, the kind of information that Facebook collected, or whether Facebook disclosed any information to anyone else.  The lawyer representing the subscribers countered that generalized allegations of harm are sufficient at this stage of the case, and that Facebook’s alleged practice of tracking their users’ Internet activity was not disclosed as part of Facebook’s privacy policy.   The court’s ruling on the motion to dismiss is pending.

Can employers ask job applicants for their Facebook password in a job interview?  Employers and recruiters argue they should be allowed to vet potential employees, and let’s face it–an applicant’s social media profile is likely to be much more revealing than a 30-minute interview.  But what about the privacy rights of applicants?  Some commentators have compared password demands to requests to read a job applicant’s private mail.

Although no law directly prohibits employers from demanding access to the social media accounts of prospective employees, the practice is fraught with legal risks.  Facebook has issued a statement frowning upon password demands and warned that it will “take action to protect the privacy and security of our users, whether by engaging policymakers or, where appropriate, by initiating legal action, including by shutting down applications that abuse their privileges.”  Federal and State legislators are also considering making the practice illegal.  Sen. Robert Blumenthal (D-Conn.) has told Politico he is drafting a bill that will be ready “in the very near future.”  Password demands could also run afoul of federal law.  The New York Times reports that Sen. Blumenthal and Sen. Charles Schumer (D-NY) have asked the Justice Department and Equal Employment Opportunity Commission to investigate whether the practice violates the Stored Communications Act and Computer Fraud and Abuse Act.

The bottom line?  If you’re an employer and you demand to look at the social media accounts of your potential employees, you do so at your peril.