Source: http://www.techlawjournal.com/alert/2008/08/11.asp
Timestamp: 2019-04-18 10:46:05+00:00

Document:
TLJ Daily E-Mail Alert No. 1,810, August 11, 2008.
August 11, 2008, Alert No. 1,810.
8/1. Three groups filed amicus briefs with the U.S. Court of Appeals (9thCir) in Bunnell v. MPAA, a case involving the question of whether acquiring e-mail by hacking into e-mail systems to cause forwarding to the hacker that is contemporaneous to the transmission of the e-mail constitutes a violation of the federal Wiretap Act.
The District Court held that there is no violation of the Wiretap Act because there is no interception. Rather, there was accessing of something in electronic storage.
On August 1, 2008, three groups concerned with privacy in the context of information technologies filed amicus curiae briefs urging the Court of Appeals to reverse the District Court. See, brief [21 pages in PDF] of the Electronic Privacy Information Center (EPIC) and brief [38 pages in PDF] of the Electronic Frontier Foundation (EFF). Stanford's Center for Internet and Society also filed an amicus brief. The plaintiffs / appellants filed their redacted brief [163 pages in PDF] on July 22, 2008.
This case arises out of ongoing battles between operators of peer to peer systems and the movie and record industries. However, while the fate of Justin Bunnell and the MPAA may not be of concern to readers, the issue in this case is significant for the privacy of e-mail communications.
There are two important statutes, the Wiretap Act and Stored Communications Act (SCA). The Wiretap Act offers more procedural protections when the government seeks access. The Wiretap Act offers more remedies to injured parties. Also, the Wiretap Act affects a wider range of actors; the SCA provides an exemption for service providers. Hence, if Bunnell prevails on this issue, e-mail privacy will be enhanced.
There are other issues on appeal not covered in this story, including trade secrets, federal preemption of the California Invasion of Privacy Act, and the California Unfair Competition Law.
Statute. The Stored Communications Act (SCA) is codified at 18 U.S.C. §§ 2701-2712. However, the plaintiffs assert violation of the Wiretap Act, which is codified at 18 U.S.C. §§ 2510-2522.
18 U.S.C. § 2511 provides, in part, that "any person who ... intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire, oral, or electronic communication ... shall be punished".
It also provides that "any person who ... intentionally uses, or endeavors to use, the contents of any wire, oral, or electronic communication, knowing or having reason to know that the information was obtained through the interception of a wire, oral, or electronic communication in violation of this subsection ... shall be punished".
The plaintiffs do not allege that the MPAA hacked or intercepted. However, the plaintiffs allege that the MPAA knew or had reason to know of the hacker's alleged violation of the Wiretap Act.
18 U.S.C. § 2510 provides definitions for the Wiretap Act.
It defines "intercept" to mean "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device".
It should be noted that the Electronic Communications Privacy Act of 1986 (ECPA), Public Law No. 99-508, added the phrase "any electronic storage of such communication" to the definition of "wire communication". Title II of the ECPA enacted the SCA. However, the inclusion of "electronic storage" within the definition of "wire communication" was removed by Section 209 of the USA PATRIOT Act in 2001.
Section 2510 defines "oral communication" to mean "any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation, but such term does not include any electronic communication".
The parties do not dispute that e-mail is an "electronic communication".
Section 2510 defines "electronic communications system" to mean "any wire, radio, electromagnetic, photooptical or photoelectronic facilities for the transmission of wire or electronic communications, and any computer facilities or related electronic equipment for the electronic storage of such communications".
It defines "electronic storage" to mean "any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof" and "any storage of such communication by an electronic communication service for purposes of backup protection of such communication".
Proceedings Below. The plaintiffs before the U.S. District Court (CDCal), and appellants before the Court of Appeals, are Justin Bunnell, Forrest Parker, Wes Parker, and Valence Media, Ltd. The District Court's order states that they "own and operate a website as part of an online computer network known as ``BitTorrent´´, which is a peer-to-peer network that facilitates the copying and distribution of large files". See also, BitTorrent web site.
The defendant below, and appellee before the Court of Appeals, is the Motion Picture Association of America (MPAA).
Another person, Rob Anderson, hacked into the e-mail system used by the plaintiffs. (The District Court's order places the word hacked within quotation marks.) The order states that "Once he obtained access to the administrative functions of Plaintiffs' email server software, he enabled the software's ``copy and forward´´ function. Anderson configured the server software to that every incoming and outgoing email message would also be copied and forwarded to his anonymous Google email account."
Anderson later sold copies of some of this e-mail to the MPAA for $15,000.
Also, there was a separate civil action in the U.S. District Court (CDCal), Columbia Pictures, et al. v. Justin Bunnell, et al., CV-06-1093, in which MPAA members sued Bunnell asserting various theories of secondary copyright infringement liability (inducement, contributory, and vicarious) in connection with their operation of the TorrentSpy web site. That case was active at the time that the District Court issued the order under appeal. However, TorrentSpy has since shut down, and the District Court ruled in favor of the movie companies.
In the present action Bunnell and others filed a complaint in the District Court alleging, among other claims, violation of the federal Wiretap Act.
The District Court issued its order [12 pages in PDF] granting summary judgment to the MPAA on August 22, 2007. It held that there was no interception within the meaning of the Wiretap Act.
It wrote that "An electronic communication may not simultaneously be actionable under both the Wiretap Act and the SCA." Moreover, "the duration of the storage of the electronic communication is immaterial", as is whether they had been read by the intended recipient.
Precedent. The District Court relied upon Konop v. Hawaiin Airlines, 302 F.3d 868 (9th Cir. 2002), Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), and Quon v. Arch Wireless, 445 F.Supp.2d 1116 (2007).
In Konop, the Court of Appeals held that the unauthorized accessing of messages posted to a password protected web site does not violate the Wiretap Act because the Wiretap Act only covers messages intercepted during transmission, not those intercepted in storage. See, opinion [39 pages in PDF] and story titled "9th Circuit Rules on Application of Wiretap Act and Stored Communications Act to Secure Web Sites" in TLJ Daily E-Mail Alert No. 498, August 26, 2002.
In Theofel, the Appeals Court held that overbroad Rule 45, FRCP, subpoenas for e-mail messages may give rise to a private right of action under the Stored Communications Act or the Computer Fraud and Abuse Act, but not the Wiretap Act. See, August 28, 2003, opinion [15 pages in PDF] and story titled "9th Circuit Holds That An Unlawful Subpoena to ISP for E-Mail Can Violate the Stored Communications Act" in TLJ Daily E-Mail Alert No. 729, August 29, 2003. See also, February 17, 2004, amended opinion [23 pages in PDF].
The District Court's opinion in Quon v. Arch Wireless has since been affirmed in part and reversed in part by the June 18, 2008, opinion [PDF] of the Court of Appeals.
The District Court's opinion does not cite US v. Councilman, 418 F.3d 67. On August 11, 2005, the U.S. Court of Appeals (1stCir) issued its divided en banc opinion holding that the Wiretap Act does apply to e-mail in transient storage.
EPIC Brief. The EPIC urges the Court of Appeals to reverse the District Court. It focuses on the language of the statute, its legislative history, and its interpretation by the 1st Circuit in its opinion in Councilman.
The EPIC brief states that "According to the Defendant's theory, the absence of the phrase ``electronic storage´´ in the definition of ``electronic communication,´´ when viewed in light of its inclusion in the definition of ``wire communication,´´ reflects an intention to exclude stored electronic communications from the Wiretap Act's protections."
The EPIC brief argues that this misconstrues the statute, and the analysis in Councilman.
"The fact that the communications intercepted in this case were briefly in ``electronic storage´´ tells us nothing about whether the Defendant's conduct violated the Wiretap Act."
The EPIC brief continues that "To appreciate this point in greater detail, it helps to step back and recall Congress's basic goal of expanding the electronic privacy laws in light of technological change when it passed ECPA in 1986. By the mid 1980s, computer networks had created a new kind of private, non-voice communication susceptible to interception -- electronic communications -- and also introduced a new form of both wire and electronic communications -- stored communications subject to one-time access. ECPA dealt with each development under different Titles of the Act. To protect ongoing and continuous accesses to the new communications, Title I of ECPA extended the highly protective Wiretap Act to computers; in the argot of the Wiretap Act, Congress added ``electronic communications´´ where the law before had protected only ``wire communications.´´ Then, Congress regulated one-time access to stored electronic communications by creating Title II of ECPA," the SCA.
"These significant changes left a category unaddressed, however: they did not address how to regulate one-time access to stored wire communications such as voicemail." The EPIC brief argues that the Congress' odd method of addressing voicemail led to the addition of the "electronic storage" phrase to the definition of "wire communication".
The EPIC brief argues that "Congress added ``electronic storage´´ to the definition of wire communications in order to apply the Wiretap Act to circumstances involving criminal investigators who seek one-time access to stored voicemail", and not to exclude stored electronic communications from the Wiretap Act's protections.
Then, in Section 209 of the USA PATRIOT Act, the Congress granted "stored voicemail the SCA's lesser protections ... The PATRIOT Act adds ``wire communications´´ to the Stored Communications Act and removes the ``electronic storage´´ clause from the definition of wire communication."
EFF Brief. The EFF brief also urges the Court of Appeals to reverse the District Court. It focuses on 9th Circuit precedent, and particularly the Konop case.
The EFF brief argues that the Konop case is distinguishable from the present case, because the present case, but not Konop, involved "contemporaneous acquisition of the communication".
Moreover, in the present case "the acquisition occurred before the communications were placed in storage on the server, when the server first acquired them". That is, the EFF brief argues that not even a momentary storage before the forwarding can lead to the conclusion that stored communications were accessed, because the intercept occured before momentary storage.
The EFF brief states that "The legally relevant moment of acquisition was not when the emails were copied and forwarded by the reconfigured server, but rather, when the reconfigured server first acquired the emails transmitted to it. To ``intercept´´ is to acquire using a device; as already explained, the relevant device here was the reconfigured email server being used by Anderson; therefore, the relevant ``acquisition´´ was the initial acquisition by the email server."
This case is Justin Bunnell, et al., v. MPAA, U.S. Court of Appeals for the 9th Circuit, App. Ct. No. No. 07-56640, an appeal from the U.S. District Court for the Central District of California, D.C. No. CV-06-03206-FMC, Judge Florence Marie Cooper presiding.
8/9. President Bush traveled to the People's Republic of China. In his radio address of Saturday, August 9, 2008, he stated that "over the past eight years, America has sought to put our relationship with China on a more solid and principled footing. We've advanced both our nations' interests by expanding free and fair trade and encouraging the rise of a Chinese middle class -- which can be an enormous market for American exports". He also said that "We have seized opportunities for prosperity by negotiating new free trade agreements, including an historic agreement with South Korea -- an agreement which our United States Congress must pass."
8/8. The Copyright Office published in its web site a notice [PDF] that will also be published in the Federal Register that extends the deadlines for submitting comments in, and schedules a hearing for, its rulemaking proceeding regarding the scope and application of the Section 115 compulsory license to make and distribute phonorecords of a musical work by means of digital phonorecord deliveries. The old deadlines for initial and reply comments were August 15 and September 2, 2008. The new deadlines are August 28 and September 15, 2008. The hearing will take place at 10:00 AM on September 19, 2008, in the Copyright Hearing Room, Library of Congress, Room LM-408, 4th Floor, James Madison Building, 101 Independence Ave., SE.
8/8. The Federal Communications Commission (FCC) released the text [90 pages in PDF] of its Report and Order and Further Notice of Proposed Rulemaking regarding its collection of FCC regulatory fees for Fiscal Year 2008. The FCC adopted, but did not release, this item at an event on August 1, 2008. This item is FCC 08-182 in MD Docket No. 08-65 and RM-11312. Initial comments in response to the NPRM portion of this item will be due within 30 days of publication of a notice in the Federal Register. Reply comments will be due within 60 days of such publication. This notice had not been published as of the August 11, 2008, issue of the Federal Register.
8/5. The Entertainment Software Association (ESA), which, among other things, brings judicial challenges to state laws that attempt to regulate video games, announced in a release that the state of California paid it $282,794 for attorney's fees "after the state attempted to defend an unconstitutional law restricting the constitutional rights of video game publishers, developers and consumers". Mike Gallagher (at left), head of the ESA, stated in this release that "California deserves more from its legislators than pursuing flawed legislation. ... Rather than tackling real problems affecting Californians, they chose to waste time, money and state resources. It is shameful that legislators pursued personal agendas in spite of the facts."
8/1. A set of groups and law professors filed an amicus curiae brief [46 pages in PDF] with the U.S. District Court (CDCal) in U.S. v. Drew, a criminal prosecution charging violation of the computer hacking statute, 18 U.S.C. § 1030, by a MySpace user who allegedly violated MySpace's terms of service.
These groups and professors argue that violating a web site's terms of service does not constitute a criminal violation of Section 1030, which is also known as the "Computer Fraud and Abuse Act", or "CFAA".
They also argue that the government's application of Section 1030 violates the First Amendment right to speak anonymously.
Finally, they argue that criminal prosecution based upon violation web site terms of service (TOS) violates due process of law because TOS do not constitute adequate notice.
Background. On May 15, 2008, a grand jury of the District Court returned a four count indictment [PDF] that charges Lori Drew with violation of the Section 1030, as well as conspiracy and aiding and abetting.
This indictment alleges that she violated the TOS of the social networking web site MySpace. It alleges that Drew is an adult woman who created a fake MySpace profile of a teenage boy, and proceeded to cyber bully a teenage girl named Megan Meier who also used MySpace.
The key allegation in the indictment regarding harassment is that Drew, using her MySpace alias, "told M.T.M., in substance, that the world would be a better place without M.T.M in it." The indictment alleges that Meier killed herself the same day.
It alleges that Drew's registration with MySpace, use of MySpace information, and sending communications to Meier, constituted intentionally accessing "a computer used in interstate and foreign commerce without authorization and in excess of authorized access, and by means of an interstate communication, obtain information from that computer to further a tortious act, namely infliction of emotional distress, in violation of 18 U.S.C. §§ 1030(a)(2)(C), (c)(2)(B)(2).
See also, story titled "Lori Drew Pleads Not Guilty in Section 1030 Case" in TLJ Daily E-Mail Alert No. 1,784, June 23, 2008.
Amicus Brief. The amici argue first that "A MySpace account holder does not gain unauthorized access or exceed authorized access to MySpace servers by disregarding conditions set forth in that service's" TOS.
They also argue that "Individuals have the qualified right to speak anonymously, including on the internet, so criminal prosecution for failing to supply accurate identifying information to an online communications service endangers First Amendment rights. Yet one of the alleged violations of the MySpace terms of service on which the Government bases this Indictment is Defendant’s use of a fictitious name in registering for an account."
They add that "Under the Government's construction of the CFAA, speech that violates any terms of service would be unauthorized or in excess of authorization and potentially criminal. If the comment policy of a web site specified ``no comments favorable to Democrats´´ or ``no comments that are off-topic´´ or ``no bad stuff´´ those expressions too would be swept into the reach of the CFAA."
Third, the amici offer a due process notice argument. They argue that "Grounding criminal liability under section 1030(a)(2)(C), as the Government seeks to do here, on an interpretation of ``access without authorization´´ and/or ``exceeds authorized access´´ that is based entirely on whether a person has fully complied with the vagaries of privately created, frequently unread, generally lengthy and impenetrable terms of service would strip the statute of adequate notice to citizens of what conduct is criminally prohibited and render it hopelessly and unconstitutionally vague."
The amici offers several points in support of their due process argument.
The amici also note that "Many terms of service contain clauses which state that the website owner can unilaterally change the terms at any time, and that continued use of the website implies acceptance of the new terms."
Finally, they argue that "Many web site terms contain conditions that are themselves vague, arbitrary or even fanciful. They are not written by their private drafters with the precision and care that would be expected -- indeed required -- of operative provisions in a criminal statute. Yet operative criminal provisions are precisely what routine business terms would be transformed into under the Government's interpretation of § 1030(a)(2)(C)."
Case Information. The groups and law professors associated with this brief include the Electronic Frontier Foundation (EFF), Public Citizen, Center for Democracy and Technology (CDT), Susan Brenner (University of Dayton), Lauren Gelman (Stanford), Llewellyn Gibbons (University of Toledo), Eric Goldman (Santa Clara University), Mark Lemley (Stanford), Philip Malone (Harvard Law School's Berkman Center), William McGeveran (University of Minnesota), Paul Ohm (University of Colorado), Malla Pollack (Barclay School of Law), Michael Risch (West Virginia University), Jason Schultz (UC Berkeley), Brian Slocum (University of the Pacific), Daniel Solove (George Washington University), and Robert Weisberg (Stanford).
The District Court has scheduled a hearing or September 4, 2008, at 8:30 AM.
The Federal Communications Commission (FCC) will commence Auction 78, the AWS-1 and Broadband PCS auction. See, Public Notice (DA 08-1090) and notice in the Federal Register, May 29, 2008, Vol. 73, No. 104, at Pages 30919-30938.
9:00 AM - 12:15 PM. The DC Bar Association will host a panel discussion titled "Legal Cybersleuth's Guide to Investigative Research". The speakers will be Carole Levitt and Mark Rosch (both of Internet For Lawyers). The price to attend ranges from $109 to $149. For more information, contact 202-626-3463. See, notice. Location: DC Bar Conference Center, B-1 Level, 1250 H St., NW.
12:00 NOON - 1:30 PM. The Center for American Progress (CAP) will host an event titled "A Progressive Strategy Toward China". The speakers will be Stapleton Roy (Kissinger Associates), Harry Harding (George Washington University), Michael Schiffer (Stanley Foundation), Robert Sussman (CAP), and Nina Hachigian (CAP). See, notice. Location: CAP, 10th floor, 1333 H St., NW.
6:00 - 9:15 PM. Part two of a two part continuing legal education (CLE) seminar hosted by the DC Bar Association titled "Software Patent Primer: Acquisition, Exploitation, Enforcement, and Defense". The speakers will be Martin Zoltick (Rothwell Figg), Stephen Parker (Watchstone P&D), Brian Rosenbloom (Rothwell Figg), and David Temeles (Bean Kinney & Korman). The price to attend ranges from $105 to $160. For more information, call 202-626-3488. See, notice. Location: DC Bar Conference Center, B-1 Level, 1250 H St., NW.
10:00 AM - 4:00 PM. The U.S.-China Economic and Security Review Commission will hold a public meeting to work on its 2008 Annual Report to Congress. See, notice in the Federal Register, July 29, 2008, Vol. 73, No. 146, at Pages 43978-43979. Location: Conference Room 333, Hall of the States, 444 North Capitol St., NW.
6:00 PM. Extended end of settlement period for the Federal Communications Commission's (FCC) Auction 85, regarding LPTV and TV Translator Digital Companion Channels. See, Public Notice [PDF] of extension of settlement period, and notice in the Federal Register, August 7, 2008, Vol. 73, No. 153, at Page 46005.
Deadline to file Petitions to Participate and the accompanying $150 filing fee with the Copyright Royalty Judges regarding its proceeding to determine the Phase I distribution of 2004 and 2005 royalties collected under the cable statutory license. See, notice in the Federal Register, July 15, 2008, Vol. 73, No. 136, at Pages 40623-40624.
Deadline to file a Petition to Participate and the accompanying $150 filing fee with the Copyright Royalty Judges in connection with its proceeding to determine the Phase I distribution of 2004 and 2005 royalties collected under the cable statutory license. See, notice in the Federal Register, July 15, 2008, Vol. 73, No. 136, at Pages 40623-40624.
Deadline to submit comments to the National Institute of Standards and Technology's (NIST) Computer Security Division (CSD) regarding its SP 800-41 Rev. 1 [43 pages in PDF] titled "Guidelines on Firewalls and Firewall Policy".
EXTENDED TO AUGUST 28. Deadline to submit initial comments to the Copyright Office in response to its notice of proposed rulemaking regarding the scope and application of the Section 115 compulsory license to make and distribute phonorecords of a musical work by means of digital phonorecord deliveries. See, original notice in the Federal Register, July 16, 2008, Vol. 73, No. 137, at Pages 40802-40813.
Deadline to submit comments to the Bureau of Industry and Security (BIS) in response to its Notice of Inquiry (NOI) regarding recommendations made by the Deemed Export Advisory Committee (DEAC) with respect to BIS's deemed export licensing policy. The BIS seeks comments on, among other things, whether the scope of technologies on the Commerce Control List (CCL) that are subject to deemed export licensing requirements should be narrowed, and if so, which technologies should be subject to deemed export licensing requirements. See, notice in the Federal Register, May 19, 2008, Vol. 73, No. 97, at Pages 28795-28797.
Deadline to submit comments to the Federal Bureau of Investigation (FBI) in response to it notice of proposed rulemaking (NPRM) regarding fees for providing fingerprint based and name based Criminal History Record Information (CHRI) checks and other identification services for noncriminal justice purposes including employment and licensing. See, notice in the Federal Register, June 19, 2008, Vol. 73, No. 119, at Pages 34905-34913.
Deadline to submit comments to the U.S. Patent and Trademark Office (USPTO) in response to its notice of proposed rulemaking (NPRM) regarding revisions to its rules of practice to adjust the transmittal and search fees for international applications filed under the Patent Cooperation Treaty (PCT). See, notice in the Federal Register, June 18, 2008, Vol. 73, No. 118, at Pages 34672-34676.
Deadline to submit comments to the Department of Justice's (DOJ) Civil Rights Division (CRD) in response to its notice of proposed rulemaking (NPRM) regarding accessibility standards under the Americans with Disabilities Act of 1990. One topic addressed by this NPRM is regulation of state and local government agencies' communications with individuals with disabilities with the assistance of broadband video interpreting services (VIS). VIS allows an individual who is deaf or hard of hearing to view and sign to a video interpreter, who is at another location, who can see and sign to the individual through a camera. See, notice in the Federal Register, June 17, 2008, Vol. 73, No. 117, at Pages 34465-34508.

References: v. 
 § 2511
 § 2510
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 1030
 § 1030