as you know by this point this case is primarily about facebook users using the appellant's service to access their own facebook accounts and send communications to their facebook friends facebook has made this attempted to make this case about unauthorized access about  accessing data that does dot does not actually belong to facebook and about messages that they would like the court to believe constitute spam and  these messages that were sent by facebook users to their facebook friends contained purely factual information that was merely a link and a brief description of a  promotion offered by appellant power ventures for users to invite their friends to join power ventures service invite one hundred friends one hundred bucks and notice that its access to facebook was not permitted it took copied or made use of data from facebook website without facebook permission to do so that's if that doesn't speak to access this is an ownership issue and in direct response to your question the the data that was copied was is the user's data facebook express disclaims any ownership to this day it even even if this is ok even if power's access to to base book was not authorized why don't the undisputed facts stablished that he mr power knowingly access facebook and used its data without permission giving rise to liability under section five o two i'm sorry because it's access as not without permission it seems to prohibit knowingly accessing a computer and then using the data without permission facebook has no ownership rights damage to computer data service there's no impairment whatsoever and facebook never offered that there is so there is no standing to begin with second powers powers access they  of users facebook users to access their accounts that doesn't constitute does not constitute an authorised access because the users were using their own user names and their own passwords i think that maybe there's a different way to ask this question because i think i think i may be tracking words which were giving after that is that in question some court distinguished unauthorized access from an authorized to use and said there are some statutes that deal with access and some statutes that we use and the admission of which she is referring seems to talk about use that is we used t k copied or made use of information from the facebook website without facebook's permission so your are your answer to that is well it doesn't matter that  never gave any permission because he wasn't their data it wasn't their data they didn't have the permission to give and also be i believe that distinction  that you references because if i that he does not deal with this idea with the use of deals with the access i want to ask you separately about the question of whether the messages sending messages to their friends but that is not how it appeared because they sensually the argument is hijacked the facebook header to send these massive and also that it made it sound like it was from a friend where it really wasn't what is your response to that argument but i am more than happy to clarify that this is from our perspective the most significant issue in this case and do give permission they say sure check the yes i do button and i'm going to send messages to my hundred friends but it doesn't say jane no sans your message it sounds facebook is sending you a message and that just as anybody with a g mail account who sends an e mail with an ad g mail dot com address no recipient would take that to mean google is sending them an email if it's they have their settings such that they will receive an e mail the media is the medium is facebook and i think that the message to an external email address actually sounds from facebook their power ventures has no control over this just like if i send a message to you through facebook if your settings are such that you want to receive an e mail notification and you have control over this this is all going through facebook none of this is out information as to who sent the message in this case it's coming from it's not taking the look and feel of facebook messages it is actually going through facebook and it comes from the friend it doesn't appear to come from the friend it actually comes from the friend so they can identify who it's coming from a friend who intended to send a message to their facebook friend and they can also see that it is associated with power dot com because power dot com was running the promotion there was no there's no reason for them to mislead the public they want the public to know where to go to sign up they want them to go to p would be inherently bad business for them to send this in any way that would have been misleading to the extent that the header information the information that neither the the users or the recipients  technology more or less so then that was launched facebook said use our facebook connect and power said ok so they worked on implementing that facebook they didn't have it done in a certain amount of time they stopped using their service and then facebook suit so well thanks but no i mean didn't your client say i'm not going to go through facebook connect no they were actively working to implement facebook connect and then what happen then they didn't finish in the time that the school gave them and they stayed stopped all activity i thought your client did a technical work around so that it wouldn't have to know that no facebook expressly allowed them to team despite facebook's demands that they stop and then that's when the power blocking or blocking started that happened so maybe you can clarify them yes but first of all there they continued to use  a run around it was a single attempt to block a single ip address that power dot com was no longer using that's why it was ineffective power was not going they didn't change the ip address they weren't trying to go around any block even if that were relevant issue there were they were no run around they were actively working with facebook to implement facebook connect during december two thousand and eight january two thousand and nine right before the lawsuit was filed and through extra means the users found power dot com they log in with their own information to facebook through the power through the power web browser ok that as an initial matter so friendster my space facebook and other active social media platforms at that time ok every every every instigation was the users so they selected the friends they knew what they were you know as a promotion there they knew what they were sending and everything went through facebook not through not actually through power you know they were also the medium of so is there no way i guess just even how you understand this to happen that they were still trying to work through facebook connect there's no way that face but that facebook could ever say no we don't authorize you to for the record you're not your head yes correct but they continue to write yes so power your client kept going on and your response to it is that will facebook this was part of an ongoing sort of yes they continued and then with facebook's permission and they were working together over the course again of about a month my taishan is because that is not that isn't relevant to any of the elements of three criminal statutes at issue here facebook's demand that they stop and they're well compliance or noncompliance is not relevant under no sol is that the case you're relying on for  not want them to and they and if you know they if there were intellectual property you know infringements if there were business competition violation action i was thinking that well exactly and that we argued early on and they could have brought those so i also in response to your question how could they have stopped them while they didn't communicate with them they could also have brought brought a different type of civil action they didn't and i can't tell you why they didn't all i know is that the activities that they putting of that were completely ceased by the time in the very short period of time from when the activity started to in this lawsuit was filed were not criminal activities they were not intentionally alleged period and there was no interruption to their service they never alleged any interruption that's undisputed and those are the types of damages that would would give facebook standing in this case and those are not present thompson you've exceeded your filed against all power employ one hundred power employees and against all directors shareholders and everyone else independent of the power corporation between two thousand and six two thousand and nine power grew to over ten million users raised over ten million dollars of investment from top silicon valley venture investors had approximately one hundred employees more than six executive managers and was a professional professionally and well managed board with all proper corporate governance and over twenty shareholders with no individual personal with no individual person executive having control in interest of this company obviously i bring that up because the district court made a an unprecedented decision to pass personal liability to an individual executive of a  yeah yeah i think that's correct i thought today one thing that would also be helpful is just because we're seven years later actually ten years later and it's hard to understand the world we were in back then it's easy today to say power was nothing but at the time why did someone give ten million dollars to this company what were we creating and there was a serious competition between these two companies in particular power had invented back in two thousand and six three innovations one was the concept of apps today we know apps it's one of the core infrastructures on the internet back then facebook had not yet launched its applet form so power had created a way to serve apps on all your social networks not just on facebook and millions of users  said would love to have my site have value added things beyond just the core platform so this was a pretty significant innovation power also created connect technology this is well before facebook launched facebook connect and face what this connect technology did it lets you connect not only to facebook but to all your sites so all your data and all places was available to you wherever you went and finally we invented a new type of browser called the power browser and what this power browser did is i receive these apps in all your sites not just in facebook and all sites and enabled this connection with all your sites to be active wherever you went so we were thinking about the future of the internet this very this this amazing new internet where everything was there upper bowl where you control your data facebook was thinking about this with a very different perspective and i only bring this up because it's important to understand that these were two well funded venture funded companies by top of the season the silicon valley with great momentum looking at the future of the web and today of course this apple google facebook are the dominant company power did not win this battle a big this lawsuit obviously we want to understand why a seven years later is facebook still fighting fighting fighting over a very questionable spam artificially created spam spam issue but it's important to look back at the context of where we were at and i obviously there was nobody here where they've tried to position all of us as as these thieves of data trying to do all kind of try to position us as notorious spammers but we're talking i think they tried to switch the focus of this case and i think that the f s f and all these other people would not be involved speaking very on this case if if if this if this were the case and i think that in when you have lots of lawyers involved when you have all kinds of documents and seven years of history it's easy to lose perspective of what was really happening back then and i think this is this is what i when i came speak personally i think it's easy to lose that voice and finally i know my time is limited i just wanted to bring bring back this issue earlier there were there was a permanent injunction that was filed not only against myself but all the hundred employees that were a power all the shareholders all the board members is is so vague it essentially says that for the rest of our lives and any contact that we have in the industry with facebook not just me but all of us  employee found another company this injunction is is completely unprecedented for seven years i've gone through a personal bankruptcy i've had difficulty working at other companies and obviously this case it's chartered in and uncharted territory as far as personal liability and i think a summary judgment at the worst case is to define something so significant and is is is definitely an appropriate at the minimum if it does not get overturned i think this deserves a fair trial at least this personal the personal liability issue because it's a lot more complicated than it has can appear to be in the briefings thank you very much mr attorney and i apologize for mispronouncing your name  morning and may appease the court jimmy williams on behalf of the electronic frontier foundation thanks for granting us time to address the court today i am here today to discuss why the district court's interpretation of the see if a is inconsistent with this  how if this court were to uphold the district court's ruling it could have terrible consequences on internet users across the board in yours all this court recognize that there are important policy reasons for adopting a narrow construction of the phrase without authorization for purposes of the c if a and that's to make sure that we don't transform what's supposed to be a into hacking statute into a massive misappropriations statute and because the c f a isn't on this misappropriation statute it requires more than a computer owner just giving some indication that it doesn't want the you know i think it will be found by it but it doesn't make sense to me under just speaking personally because whether whether rightly or wrongly i can prevent people from coming onto my front lawn to use an example that i used in the previous case on a completely unrelated topic and if i tell someone they have to leave whether it's my home or a business and they refuse or they leave and they come back without my permission i can have them arrested for trespassing and i guess i don't understand why the same isn't true here in virtual intended to target inherently wrongful behavior such as breaking into a computer and that i assume that it may hurt me wrongful justice any trespass is inherently wrong for me there is nothing wrong with walking up to someone's house unless you don't have permission so i you that all first of all not all i think that you can't just take trespass loft in the physical world and apply it by only to the internet it's a very different place and different norms apply and here we have an people that was put up and and that just basically in most cases it doesn't even send a message to the person who's trying to access the website and i people walk in many cases doesn't send any message at all and here i think there needs to be circumvention of a technological access fear and so there needs to be two things that this court needs to look for one and access a technological access barrier and to behavior that falls into the category of inherently awful behavior that congress was trying to target when it passed the c f a and i don't think you have either here i think that in assessing whether this is an access barrier or a use barrier or a use impediment i think that it's important to look at the facebook users here facebook and i think that the facebook facebook and its priests very much doesn't want this court to think of the facebook users and that's because when you look at this from the perspective of the facebook users was at most a way to limit their ability to use their accounts in a way they wanted to they wanted to use power to access their accounts they wanted to have some kind of service to aggregate their social media and employment case and that person already had access and it was whether or not he went beyond the scope and or if it was use and i'm just trying to figure out here the situation seems different and it's i quite concerned because the access point here i guess is the user of facebook i mean the facebook client and then this person is coming in through that power developed a way to come in through the through the users and despite the fact that facebook clearly has indicated to them to cease and desist letter and trying to reach you know rescind their authorization power seems to from my view of the record have ignored that and just continue in that it's just something unsettling about that so two points in response to that question first facebook controls access to its website via  authentication requirement a user name or password and they have the ability here to revoke their users user credentials or send them a warning and say if you don't stop using power we're going to have to restrict your user name and if they did that and took away powers ability and they still through the back door but here they were authorized by the users so they had authorization for purposes of the cv c f a to access to access facebook in that way facebook could have rescinded access they could have that powers council submitted last week via twenty eight j a speed bump something that just slows down your access but it doesn't actually put up a fence between facebook and outside world and it's not it's very routine to get around these things it's not inhe definitely could have done that very clearly in peace books terms of service that you're not allowed to share your username and password with other people and access facebook automated means facebook users can do this all the time this is routinely ignore that facebook does indeed routinely ignore that i don't think that waves their ability to try to enforce that against users when they want to i mean it's in there it's in their terms of service and they continue to exhibit in there despite yeah i mean president obama does not post messages but so but and the other point is that this is and as this court made clear in knows all the surveys not in massive misappropriations statute not everything that happens online on the basis of the facebook users violation of their terms of service so yes this is a case where facebook did have options but they instead chose to bring in that cause of action under the c f a and can spam despite the fact that the statute the congress was not thinking of this type of behavior when it passed either statute but those statutes of course have much more severe consequences and quite frankly have the ability to put a company out of business as we've seen in this case and i think that is inappropriate and this court should consider what news will hold that this if it is meant in target inherently wrongful behavior such as breaking into a computer not routine behavior such as circumventing an ip address and limit the statute to it's in the hacking purpose you counsel you've exceeded your time but we very much appreciate your contribution to the discussion and now we're finally ready to hear from good morning honors and may please the court america chomsky i represent facebook judge i want to start where you started with your very first question the record on what happened here is absolutely striking and absolutely unmistakable and it's not just the amid the admissions that your honor alluded to there were admissions in the form of iraq atory requests there were again is absolutely unmistakable and showing a few different things it shows that power ventures understood that in the language of braca it's permission to access the computer had been revoked it also took technical measures and the expressed purpose of the technical measures before during and after was to circumvent what facebook had put in place  see irrelevant the uncontested expert submission on this point was that first one ip address was blocked but then when power started using facebook went on to block multiple ip addresses but isn't it true i mean i mean i think i have so many different devices in computers in several different courtrooms that my i if i may your honor not only the congress but also the second circuit last week and judge brier in the craigslist case have all explained a couple of things first of all hacking in this context really is akin to trespass it is a digital version of trast pass and so the senate reports talk about it in precisely those terms but i want to answer the question about the ip blocking with reference to the question that you asked judge margot which was what else could facebook have done and that question was an am surrogate and there's a very good reason facebook could not have done anything else and again i want to refer back to the analogy to trespass if someone comes on your land or if someone wants to come on your land or if you don't want them to come on your land you can do a few different things you can tell them in the model penal code is quite clear about  to get this out of the mcgee and melling declarations which are in the vicinity of as c r e three eight hundred through about four hundred make very clear and again it is undisputed here there were cross motions for this that power was accessing facebook's computers the way this works is that facebook has an actual computer actually lots of them somewhere that operated swed sites and it was undisputed that there was access to facebook's computers going on the question i'm sorry finish that but then i haven't they were if i have a question so the only question here being disputed was whether that access was without authorisation that's my question because i was authorisation is required and let me go back to my more simplistic concrete world example let's say that i have loaned my house to somebody while i'm out of town and they give permission for someone to come onto the property even if i don't like that person and i wouldn't have allowed them authorized the connection with power so so so so who's whose authorization counts in this peculiar context so let me start by by responding to the analogy and  answer the legal question in the hypothetical that your honor suggested it is true that if you lend your house to someone else perhaps they will be able to lend it to a third party but the relevant question here is could you upon finding out about someone else being lent the house then say you know what no this is crazy i don't want third parties in my house so let me offer another analogy say that i want someone to access my safe deposit box the bank has rented me a safe deposit box and i give my accountant the keys and say i'd like you to go to the box and get something out of it for me surely that's permissible and i'm authorizing it but if the account shows up at the bank naked and the bank says you can't come in no shirt no shoes no service no one would think that because i had said to the accountant go in the bank has lost the ability to keep people out and that's exactly what we have here the facebook users said signed up with power and again to your point judge facebook said to power in as many different ways as it could both expressly and through instituting technical measures keep out and power absolutely understood that at the time the internal correspondence on this is unmistakable within thirty minutes of the first ceas letter and this is in the record at s c r two eighty five mr rich on the writes an email saying we need to be prepared for facebook to try and block us and then turn this into a national battle that gets huge attention this is exciting he says the next day s c r eighty two writing to people on the team please just make sure they cannot block us if they can't block us this will give us a lot of power we can then create lots of media attention at the right time s e r one fifty nine talking about what facebook cease and desist manned and understanding that what facebook wanted was to quote remove the compatibility letter there was some there were it was ongoing sort of communication regarding this third party you know connect method and so therefore it was never really no authorization i do that's party connect or because the fact that that was still an option out there somehow he was still or power was still authorized so let me answer the question judge in their own words in the emails at the time as c r eighty eight this is on december twenty third after the second cease and desist letter internal e mail saying facebook has blocked our access and then a discussion about the use of technical measures and  then ultimately facebook is working again december twenty eighth this is it s e r eighty seven and internal discussion saying we need to get the proxy servers moving faster we need to update them every six hours so that we can avoid blocks quote i am sure they will continue blocking our service and then they go on to say they need to set up quote a diagnostic exclusively with facebook so to the extent that there is any suggestion here today that what was going on was cooperation it is absolutely be a lie by the undisputed record here so it's belied by the ways first of all it's about the exceeds authorized access provision of the statute not the language of without authorization it also looks very factually different and what it says is terms of use aren't enough to get you to a violation of the exceeds off arised access provision now of course we're not operating under that provision here and we're also not talking about a use violation i mean again continuing the analogy exactly the violation the statutory violation judge wardlaw is of the command saying you cannot intentionally access a computer without authorisation and here in the language of braca authorization facebook's subjective motivation for wanting to keep power out but that is not the thing that constitutes the legal violation again in the example of no shirt no shoes no service that's the reason you want to kick someone out but it's not the thing that creates the trespass the trespass is the access without authorization and let me let me see if i understand this before you sent the season  the least and just as i'm listening to you is well maybe they weren't doing anything wrong until you told them to leave but once you told them to leave they had to leave that is a much better way of putting it judge graber they were not doing anything in the very thoughtful decision in the craigslist case it's the exact same thing in this domain and so at the point at which you would indicate to someone keep out and whether you do it by saying that in express terms as was done or or whether you communicate it by building a digital fence you have communicated to someone the message you have to stay out and at that point it becomes a violation or in the language of the statute you are accessing  computer without authorisation otherwise you can't there anything you could do i mean there's been reference that you could have brought other actions against power the relevant question is whether we again in the language of brecker rescinded permission to access the facebook computers and what else could we have done to rescind that permission i'm honestly not sure we took technical measures w nothing they did previously that was wrong now that there's a sign but no longer want to hear there's even more than a sign you sent specific notification and the power it said yes i acknowledge that i don't have permission that's exactly launch right yes judge ward within the time period when when there was so called implied consent right and that that gets to the second part of my answer which is that whatever implied authorisation there might have been to go on facebook's digital land is legally irrelevant to the totally separate question of whether it was lawful for power adventurous to send out blast commercial spam messages that's governed by a different now you're talking your theory under the  united states code congress wanted to make sure that header information was accurate that it would give people the tools to tell essentially add a glance when they received commercial electronic e mail messages who they were from so they could decide whether to throw them out so that they wouldn't be induced to open them up and waste their time reading garbage or what congress did in order to implement that purpose was to require that the header information include certain information about who's sending the message and the one thing missing here and this judge margie had this is a long wind up to a short pitch the violation here is the total failure to indicate anywhere in the header information that it was power ventures that initiated these messages judge wardlaw i want to try and provide a little bit of clarification about a question  sion earlier and the way my friend on the other side characterize this said that it was facebook users who were sending the event invitations and i want to be as absolutely clear about  this is i can because it is really critical to the legal question and it is undisputed on the record expert declaration set forth and these are at s c r three eighty one to three eighty three and four eighty six to four ninety three that this was all being done in an automated fashion using the scripts using the computer program that was written by power ventures at s e r three eighty two mr mcgee and explains that there was not any code for individual users to authorize or send event invitations and this was the subject of lengthy discussion before judge where  not that was used by the individual users here there is no evidence in the record on that and that was exactly what i was getting to judge where was absolutely focused on this at the hearing he says it s e r two twenty four i know the people who grade my work are going to be looking to see whether there's a factual dispute here and so he goes through an asks the other side is there any reason i can't rely on the same expert materials that i had that i just cited a moment ago and it s c r to eighteen power ventures says no there's a whole discussion about this precise point the only evidence in the record and again remember that these were cross motions for summary judgment and the only evidence is that this was being done in an automated fashion in bulk by power ventures it wrote the text of the emails it wrote the computer program that logged into each of the user accounts and blasted out massive jews sixty thousand of them in the evidence that wasn't destroyed and it was all done by power not by the individual users i have another question that has been over question we and some of our discussion we've sort of lumped all these names together but they're very different there at least three different statutes that we've been discussing and i want you to assume for the sake of this question something that i don't know to be true at all but let's assume that you were to prevail on one of the claims and not on the other two does that make any difference for the ultimate bottom line that is are the damages that are claimed the same under all of the claims both of those sought the damages that were the costs of investigation roughly the eighty thousand dollars and if i could just a brief aside with your question about christiansen and judge i think you asked a version of the same thing this court has said subsequent to the close of briefing in the christianson case that five o two is actually broader than the c f a in that regard but the damages for those two claims were the same the liquidated damages are supported soley by the can spam cause of action and the injunction as you'll see judge co goes through each of the four factors and with your or your honour's indulgence i know i'm over my time i was hoping just to say a brief word and this goes to your question judge wardlaw about why we care and there was a suggestion by e f f that facebook doesn't want facebook think of the users in all of this and it is legally irrelevant for the same reasons i was suggesting to you judge wardlaw but i think really important to understanding what was going on here facebook actually cares a great deal about the users the whole reason any of this matters to facebook is not a question about anti competitive conduct they brought a claim on that and it was dismissed years ago it's because facebook has obligations including regulatory obligations to maintain the security in the privacy of its user data and when third parties start going in through an approved and secure  all manner of problems the record here was undisputed for instance that power ventures was saving facebook user user names and passwords on their own servers that is exactly the thing that facebook has an obligation both legal and self imposed to worry about to make sure that the user data is being protected and so the suggestion that the users are out of the picture here i think  i was trying to provide some clarity that the relevant legal consideration here is that it was not the user's authorization to give for the something  disputed so we have to figure out whose authorization it was do they have the opposite viewpoint that it's only the users permission your view is that that's not correct c f a purpose is that is wrong as a matter of law the question here owner of the computer that has the power to give authorisation just like in the bank hypothetical you could have any manner of questions of agency out there but if the owner of the safe deposit box if your hon with the house that you're lending out says keep out it doesn't matter if your tenants are subtenants or sub sub tenants wish to be able to convey some form of authorisation thank you  exceeded your time and we've used a lot of it with questions and the same is true for ms anderson who has the opportunity for rebuttal i have will start with give me three minutes physical property i would like to offer that in this case the facts are more analogous to facebook owning a storage unit facility where users store and they users have the right to give authorization the key to power or to anybody else to access their data maybe and if you  want to go back to the to the physical analogy if i have a storage unit and i say nobody who's ever been convicted of a crime can come onto my property or nobody who's taller than six feet tall or whatever  i would say what is your property and that's a big problem in this case is facebook keeps saying it's our property it's our property well at this point facebook owns a substantial part of the internet but the beat and bounds are not clearly defined and that go on a computer the credentials revoking the authorization of access by their users ok but your claim is although they could tell their users they couldn't have access they can't tell power that they can't have since that's correct ok they have trouble understanding why that would be true there's no element in any of these criminal statutes that creates a problem with that they're not again striking starting at the beginning with withstanding there's no damage and if there's no if there's no damage there's no crime and they're trying to prevent you know take the bacon bank analogy somebody shows up naked they're not intending to break into the bank the bank might be able to say ok we don't want you in here but that's not the same thing as criminal trespass or are sorry for breaking into you know breaking into the vault they come in with the key to somebody  to the owner to somebodies deposit box they have permission to be there face the doesn't like that they're coming in because they don't like the look of them for whatever reason and where it's also not analogous to trespass on physical property is that on physical property it's a limited space they might not like trespassers because they take up space because because  they they caused damage in this case there is there's no space that's taken up by power accessing the user's accounts because the users are the ones accessing the count's they would be doing that whether they go directly to power facebook dot com they're also not causing any damage thank you counsel thank you thank yous just are just submitted and as you can tell from our questions it's very challenging we appreciate all the arguments both of