Source: http://www.techlawjournal.com/alert/2006/10/06.asp
Timestamp: 2019-04-19 05:10:59+00:00

Document:
TLJ Daily E-Mail Alert No. 1,463, October 6, 2006.
October 6, 2006, Alert No. 1,463.
10/6. This article offers no conclusions regarding what laws may have been violated in the course of Hewlett Packard's (HP) spying on reporters, directors and employees, or other matters. Rather, this article, and accompanying articles in this issue, outline some of the statutes that may be implicated by the HP spying scandal, and by other pretexting related investigations.
There is not yet a factual record on HP. No court has issued a findings of fact. No evidentiary hearing has taken place. The House Commerce Committee's (HCC) Subcommittee on Oversight and Investigations (SOI) held hearings on September 28 and 29, 2006. However, most of the witnesses from HP, and the firms that it hired, invoked the Fifth Amendment privilege against self-incrimination.
The HCC did request, subpoena, and obtain many documents from the parties involved. The HCC has released many of these documents. Yet, these have yet to be identified, authenticated, and explained under oath in a public proceeding.
There are several pending legal actions. See, stories titled "California Charges Patricia Dunn and Others With Four Felonies", "Cingular Sues Pretexting Firm Involved in HP Scandal", and "Verizon Wireless Files John Doe Complaint Against HP's Pretexters" in yesterday's issue, TLJ Daily E-Mail Alert No. 1,462, October 5, 2006. The complaints in these actions provide further factual allegations regarding the HP scandal. Also, numerous complaints have been filed regarding pretexting relaters matters other than HP's scandal.
Also, the HCC heard testimony at its September 29 hearing from Federal Communications Commission (FCC) and Federal Trade Commission (FTC) officials regarding their investigations into pretexting practices. Also, representatives of the six largest wireless carriers testified about their own investigations into pretexting.
The series of articles in this issue provide an overview of some of the federal statutes that may have been violated, either in the HP spying scandal, or in other pretexting scenarios. This issue also briefly reviews some statutes that allow federal agencies to initiate civil or administrative actions. This issue also briefly reviews some federal private rights of action.
A subsequent issue will include articles that, in cursory fashion, examine some categories of state statutes that provide for criminal prosecution and/or civil actions, and some state common law actions.
For some persons and entities harmed by pretexting related activities, state law remedies may provide the best recourse.
There is, of course, no federal statutory ban that incorporates the words "pretexting to obtain phone records". However, federal statutes typically do not use the same terminology that is used in common conversation. Nevertheless, there are numerous federal statutes that may be implicated, depending of the particular facts.
1. CFAA. 18 U.S.C. § 1030.
2. Wire Fraud, 18 U.S.C. § 1343.
3. Mail Fraud, 18 U.S.C. § 1341.
4. Identification Fraud, 18 U.S.C. § 1028.
5. Access Device Fraud, 18 U.S.C. § 1029.
6. SCA, 18 U.S.C §§ 1701-1712.
7. GLB Act § 521, 15 U.S.C. § 6821.
8. Criminal RICO, 18 U.S.C. §§ 1961-1968.
9. CDA, 47 U.S.C. § 223.
10. Destruction of Records, 18 U.S.C. § 1519.
11. Witness Tampering, 18 U.S.C. § 1512.
Civil and Administrative Actions by Federal Agencies.
1. § 5 of FTC Act, 15 U.S.C. § 45(a).
2. CPNI Statute, 47 U.S.C. § 222.
3. § 521 of the GLB Act, 15 U.S.C. § 6821.
4. Civil RICO, 18 U.S.C. § 1964(b).
Federal Private Rights of Action.
1. CFAA, 18 U.S.C. § 1030(g).
2. RICO, 18 U.S.C. § 1964(c).
3. SCA, 18 U.S.C. § 1707.
FCC license revocation, renewal and transfer proceedings.
10/6. There is no federal criminal statute that bans "pretexting to fraudulent obtain phone records", or words to that effect.
However, information that has been disclosed regarding the HP spying scandal, and similar investigations, and in various hearings, indicates that there is a wide range of activities that are associated with spying operations. Many of these activities might violate various federal criminal statutes.
1. Federal Computer Fraud and Abuse Act (CFAA). The Computer Fraud and Abuse Act (CFAA), as amended, is codified at 18 U.S.C. § 1030. It is sometimes referred to as the computer hacking statute. Although, the term "hacking" does not appear in the statute. Rather, it addresses unauthorized access to certain computers and electronic storage systems.
Subsection (a)(2) contains a very broad criminal ban. It criminalizes intentionally accessing a computer without authorization if any of three conditions are met. The third, interstate commerce, may be met by using the internet to access the computer system.
(C) information from any protected computer if the conduct involved an interstate or foreign communication;"
(B) by conduct described in clause (i), (ii), or (iii) of subparagraph (A), caused (or, in the case of an attempted offense, would, if completed, have caused) -- (i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value; (ii) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals; (iii) physical injury to any person; (iv) a threat to public health or safety; or (v) damage affecting a computer system used by or for a government entity in furtherance of the administration of justice, national defense, or national security;"
Subsection (5) is also important because the CFAA also contains a private right of action, but only when there are violations of Subsection (5).
It should be noted too that there is some overlap between this statute and the federal Stored Communications Act (SCA), and various state statutes.
The testimony at the HCC hearings of September 28 and 29, and the records released by the HCC, reflect that HP's investigators and pretexters extensively used phone calls to customer service representatives (CSR) of wireless carriers to fraudulent obtain customer phone records. Phone companies use computer systems to storage phone records. But, it might be a stretch to argue that inducing a CSR in a two way voice communication to access stored phone records, or to change account information, violates the CFAA.
Moreover, information disclosed regarding the HP scandal indicates that HP's scheme included sending, under fraudulent circumstances, e-mail to a target of its investigation, that included undisclosed software code that would transmit information back to the investigators regarding who opened an attachment to that e-mail. Various witnesses and members at the HCC/SOI hearings characterized this as "spyware" or "tracers".
These practices may give rise to a violation of the CFAA, in several ways: (1) by unauthorized access to protected computer storage systems to obtain information therein, (2) by unauthorized access to protected computers to alter or destroy data, and (3) by unauthorized transmission of code to a protected computer.
The e-mail tracer practice may give prosecutors reason to pause. Nevertheless, the argument would be this. An e-mail sender has implied authorization to send an e-mail, and to have that e-mail enter the in-box of the e-mail program on the computer of the recipient. However, there is no implied authorization to hide an undisclosed tracer program in an e-mail attachment.
HP obtained no actual authorization from CNET or its reporters. Hence, the argument might proceed, HP intentionally exceeded authorized access to a computer within the meaning of § 1030(a)(2). Moreover, (had the scheme worked) HP would have obtained information from the computer in the form of the secret sending out of a message indicating that the attached file had been opened, and by which account. § 1030(a)(2) requires no damage to any computer, or to any person.
In conclusion, Section 1030 presents federal prosecutors with ways to charge people who engage in a variety of different pretexting related practices.
2. Federal Wire Fraud. If federal prosecutors do bring criminal charges against persons involved in the HP scandal, this may be one of the most used sections.
18 U.S.C. § 1343 pertains to "Fraud by wire, radio, or television". It provides that "Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, transmits or causes to be transmitted by means of wire, radio, or television communication in interstate or foreign commerce, any writings, signs, signals, pictures, or sounds for the purpose of executing such scheme or artifice, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both."
HP's pretexters used telephones to contact wireless carriers. That is, they "transmitted by means of a wire". The indictment or complaint would likely allege that telling lies to dupe carriers into disclosing information that they cannot disclose by law (see, 47 U.S.C. § 222) is intent to defraud within the meaning of the wire fraud statute.
The interstate commerce clause is easily met if the carrier's call service center is in one state, and the pretexter is in another. However, it may prove significant that HP used no pretexters in the state of California. It used pretexters in other states, and particularly, states where carriers' call centers are located.
Also, HP personnel cannot escape liability on the basis that they did not make the calls. 18 U.S.C. § 1349 provides that "Any person who attempts or conspires to commit any offense under this chapter shall be subject to the same penalties as those prescribed for the offense, the commission of which was the object of the attempt or conspiracy."
3. Federal Mail Fraud. The testimony at the HCC/SOI hearings of September 28 and 29, and the records released by the HCC, do not reflect that HP, or its investigators and pretexters, used the U.S. Mail.
However, use of mail is an important tool of other pretexters. For example, witnesses for wireless carriers testified on September 29 that after they learned of large scale pretexting and data brokering in 2005, they tightened their procedures for releasing information. One change was to only provide certain records by mailing them to the customer. The pretexter in this situation cannot get the records recited over the phone.
This hearing also revealed the a response of pretexters to this tactic is to pretext to get the customer's address changed (to a false address used by the pretexter), and to have phone records mailed to that address.
This tactic may constitute a violation of the federal mail fraud statute. First, 18 U.S.C. § 1341 pertains to "Frauds and Swindles". It provides that "Whoever, having devised or intending to devise any scheme or artifice to defraud, or for obtaining money or property by means of false or fraudulent pretenses, representations, or promises, or to sell, dispose of, loan, exchange, alter, give away, distribute, supply, or furnish or procure for unlawful use any counterfeit or spurious coin, obligation, security, or other article, or anything represented to be or intimated or held out to be such counterfeit or spurious article, for the purpose of executing such scheme or artifice or attempting so to do, places in any post office or authorized depository for mail matter, any matter or thing whatever to be sent or delivered by the Postal Service, or deposits or causes to be deposited any matter or thing whatever to be sent or delivered by any private or commercial interstate carrier, or takes or receives therefrom, any such matter or thing, or knowingly causes to be delivered by mail or such carrier according to the direction thereon, or at the place at which it is directed to be delivered by the person to whom it is addressed, any such matter or thing, shall be fined under this title or imprisoned not more than 20 years, or both. If the violation affects a financial institution, such person shall be fined not more than $1,000,000 or imprisoned not more than 30 years, or both."
Then, 18 U.S.C. § 1342 provides that "Whoever, for the purpose of conducting, promoting, or carrying on by means of the Postal Service, any scheme or device mentioned in section 1341 of this title or any other unlawful business, uses or assumes, or requests to be addressed by, any fictitious, false, or assumed title, name, or address or name other than his own proper name, or takes or receives from any post office or authorized depository of mail matter, any letter, postal card, package, or other mail matter addressed to any such fictitious, false, or assumed title, name, or address, or name other than his own proper name, shall be fined under this title or imprisoned not more than five years, or both."
4. Federal Identification Fraud. 18 U.S.C. § 1028 pertains to "Fraud and related activity in connection with identification documents, authentication features, and information". Much of this section is inapplicable in the context of pretexting. However, two prohibitions are important.
It provides, in part, that "Whoever, in a circumstance described in subsection (c) of this section" either "(1) knowingly and without lawful authority produces an identification document, authentication feature, or a false identification document" or "(7) knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law, or that constitutes a felony under any applicable State or local law" "shall be punished as provided in subsection (b) of this section".
The "circumstance described in subsection (c)" includes "in or affects interstate or foreign commerce".
The testimony at the HCC hearings of September 28 and 29, and the records released by the HCC, do not reflect that HP, or its investigators and pretexters, used false identification documents. The pretexters called people over the phone and lied about their identity, or fraudulently accessed online account systems. This did not involved identity documents.
However, witnesses from the carriers testified at the September 29 hearing that one heightened security feature is to require customers who want to change certain account information to visit service centers in person and present identification. Hence, if a pretexter goes in person, with a fake identification document, pretends to be another person, and for example, changes a password for online access to account information, that may constitute a criminal violation under Section 1028.
However, the other basis for a Section 1028 violation quoted above may implicate some persons involved in the HP scandal.
That is, the pretexters who made the fraudulent calls to the carriers had to have been given some personal information about the accounts for which they sought call information. And this information may have come from HP.
That is, someone at HP may have knowingly transferred to the pretexters "a means of identification of another person with the intent to commit, or to aid or abet, or in connection with, any unlawful activity that constitutes a violation of Federal law", within the meaning of this statute.
The definitional subsection provides that the phrase "means of identification" means "any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any -- (A) name, social security number, date of birth, official State or government issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number;"
One document released by the HCC states that "DeLia supplied ARG with Social Security Numbers for all subjects of pretexting".
5. Federal Access Device Fraud. Access device fraud is codified at 18 U.S.C. § 1029. This section is often used to prosecute financial crimes, such as credit card fraud. However, it is drafted broadly enough to reach a range of other activities.
There are numerous prohibitions that relate to people who "knowingly and with intent to defraud" use either "counterfeit access devices" or "unauthorized access devices".
For example, subsection (a)(1) provides, in part, that "Whoever ... knowingly and with intent to defraud produces, uses, or traffics in one or more counterfeit access devices ... shall, if the offense affects interstate or foreign commerce, be punished as provided in subsection (c) of this section ..."
But, the term access device encompasses not only credit cards and electronic devices, but also numbers, and any other means of accessing an account.
Moreover, the statute not only extends to theft of money, but also to theft of services and anything else of value.
Phone company customers have accounts with their carriers. To access data from those accounts one needs account information. The unauthorized use of this information, to access the account, with intent to defraud, may fall within the scope of the statute.
Specifically, subsection (e)(1) provides, in part, that "the term ``access device´´ means any card, plate, code, account number, electronic serial number, mobile identification number, personal identification number, or other telecommunications service, equipment, or instrument identifier, or other means of account access that can be used, alone or in conjunction with another access device, to obtain money, goods, services, or any other thing of value, ..."
and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished ..."
Chapter 121 has no definition of "electronic communication service". However, it incorporates the definitions found in Chapter 119, at 18 U.S.C. § 2510.
§ 2510(12) provides that an "``electronic communication´´ means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce, but does not include ... any wire or oral communication ..."
Then, § 2510(15) provides that "``electronic communication service´´ means any service which provides to users thereof the ability to send or receive wire or electronic communications".
The SCA may be violated by a pretexting scheme in various ways. For example, one tactic of investigators may be to access an account for the purpose of terminating a service, or blocking messages for a particular service. For example, if the investigator is frustrated by the target's infrequent use of cell phone voice communications, he might gain access to the target's account to stop e-mail or text messaging service, to induce the target to talk on the phone, and thus create a record of phone calls that can latter be obtained by other pretexting tactics. Or, the investigator may change a password, to prevent the target from gaining access to his own account.
In these hypothetical scenarios, the investigator "intentionally accesses without authorization", within the meaning of the statute. Moreover, what he accesses is a "facility through which an electronic communication service is provided", as the statute defines this term. Finally, he both "prevents authorized access" to "a wire or electronic communication while it is in electronic storage in such system". That is, he is preventing the target from accessing his e-mail or text messages.
Secondly, hypothetically, if a pretexter also uses the personal and account information that it has obtained to actually obtain the content of stored communications, this is an obvious violation of the SCA. However, many investigators may be willing to engage in any amount of deceit to obtain call records, account information, and transactional data, but draw the line at obtaining the content of communications, either stored, or in transit in real time, because of the history of federal prosecutions.
Finally, there is the argument that obtaining access, via online account systems, of call records stored by wireless carriers, is also a violation of the SCA. The argument is that these phone call records are a communication from the carrier to its customer held in electronic storage.
7. § 521 of the Gramm Leach Bliley GLB Act. There is a specific criminal ban of pretexting to obtain financial records. The testimony at the HCC hearings of September 28 and 29, and the records released by the HCC, do not reflect that HP, or its investigators and pretexters, accessed financial records. However, pretexting of financial records is common, and the Federal Trade Commission (FTC) has brought actions pursuant to this ban.
Section 521 of the Gramm Leach Bliley (GLB) Act is codified at 15 U.S.C. § 6821. Subsection (a) contains the prohibition of obtaining customer information by false pretenses. It provides that "It shall be a violation of this subchapter for any person to obtain or attempt to obtain, or cause to be disclosed or attempt to cause to be disclosed to any person, customer information of a financial institution relating to another person -- (1) by making a false, fictitious, or fraudulent statement or representation to an officer, employee, or agent of a financial institution; (2) by making a false, fictitious, or fraudulent statement or representation to a customer of a financial institution; or (3) by providing any document to an officer, employee, or agent of a financial institution, knowing that the document is forged, counterfeit, lost, or stolen, was fraudulently obtained, or contains a false, fictitious, or fraudulent statement or representation."
Subsection (b) contains the prohibition on solicitation of a person to obtain customer information from financial institution under false pretenses. It provides that "It shall be a violation of this subchapter to request a person to obtain customer information of a financial institution, knowing that the person will obtain, or attempt to obtain, the information from the institution in any manner described in subsection (a) of this section."
15 U.S.C. § 6823 provides for criminal enforcement. It states that "Whoever knowingly and intentionally violates, or knowingly and intentionally attempts to violate, section 6821 of this title shall be fined in accordance with title 18 or imprisoned for not more than 5 years, or both."
8. Federal Racketeer Influenced and Corrupt Organizations (RICO). The federal RICO is codified at 18 U.S.C. §§ 1961-1968. This is a criminal statute that is used to put mobsters in prison.
The RICO can apply only when certain underlying crimes enumerated in the statute are involved. However, these enumerated offenses include wire fraud, mail fraud, identification fraud, and access device fraud, all of which are discussed above, and may be involved in schemes to pretext for phone records, depending upon the facts of the scheme. Hence, prosecution under the RICO may be appropriate for some spying schemes.
18 U.S.C. § 1962(a)-(c) contain the prohibitions. Subsection (a) provides, in part, that "It shall be unlawful for any person who has received any income derived, directly or indirectly, from a pattern of racketeering activity ... in which such person has participated as a principal ... to use or invest, directly or indirectly, any part of such income, or the proceeds of such income, in acquisition of any interest in, or the establishment or operation of, any enterprise which is engaged in, or the activities of which affect, interstate or foreign commerce."
Subsection (c) provides that "It shall be unlawful for any person to conspire to violate any of the provisions of subsection (a), (b), or (c) of this section."
18 U.S.C. § 1963 provides criminal penalties.
9. Communications Decency Act (CDA). The relevant portion of the CDA is codified at 47 U.S.C. § 223. Most of its provisions pertain to use of telephones in an obscene or indecent manner, or in connection with sending obscene or pornographic material.
However, there is one subsection, 47 U.S.C. § 223(a)(1)(C), for which indecency is not an element, and which may implicate some pretexting activity.
It provides that "Whoever ... in interstate or foreign communications ... makes a telephone call or utilizes a telecommunications device, whether or not conversation or communication ensues, without disclosing his identity and with intent to annoy, abuse, threaten, or harass any person at the called number or who receives the communications ... shall be fined under title 18 or imprisoned not more than two years, or both".
The elements are (1) interstate nexus, (2) use of a telephone, (3) failure to disclose identity, and (4) intent to abuse the callee. The core practice of phone pretexters is use of a phone, and pretending to be either the customer, or a phone company employee. This is "without disclosing his identity".
The fourth element, intent to abuse, may present an obstacle to prosecutions. Pretexter defendants would no doubt argue that "abuse" means harassment, as in the case of making obscene phone calls. On the other hand, prosecutors might argue that stealing confidential records from phone companies, and thereby harming their relations with customers, and their reputations, is abuse of the phone companies. It may also be significant that some of the subsections of Section 223 reference only "harass", while other include "harass", "abuse" and other terms. Courts would therefore likely construe the word "abuse" to mean something different from the word "harass".
One thing that is notable about this section is that there is no law enforcement exemption. Most other federal criminal statutes the might be implicated by pretexting contains a law enforcement exemption. Thus, if agents of a rogue law enforcement are in need of being prosecuted for pretexting, this section might provide the basis.
There is another application of this statute that should not be overlooked -- use of actual obscenity by pretexters. Wireless carriers record many customer service calls. They have also brought civil actions against pretexters. In some of these actions the carriers have attached as exhibits transcripts of calls involving pretexting. Some of these transcripts reflect indecent language, usually late in the conversation, by the pretexter. This may only reflect the low moral character of persons associated with pretexting. Or, it may be a final tactic, in an otherwise unsuccessful pretexting effort, to intimidate a customer service representative into divulging information. Whatever, the case, these transcripts provide federal prosecutors yet another opportunity for bringing criminal charges.
10. Destruction of Records. One characteristic of HP's spying effort was its enormous scope. Numerous person within HP were involved. Numerous outside businesses, in many states, employing numerous individual investigators, were also involved. Moreover, the investigations took place over a long period of time, and the information collected required considerable analysis.
The extensive, and dispersed, nature of this scheme meant that many records were collected, created, aggregated, summarized, communicated and stored.
Whenever there is activity that violates criminal laws, and creates potential civil liability, there are incentives on the part of the participants to destroy records. The more records there are, the greater the likelihood that some will be destroyed.
In the HP matter, the California DOJ filed papers on October 4, 2006, that allege that one of the persons who engaged in pretexting activities, Bryan Wagner, after learning of the investigation, destroyed his computer.
18 U.S.C. § 1519 provides in full that "Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both."
11. Witness Tampering. One might wonder whether Bryan Wagner was instructed to destroy his computer. One might wonder what efforts might have been undertaken to limit the incriminating testimony obtained from witnesses. The relevant federal criminal statute is codified at 18 U.S.C. § 1512.
Perhaps it is the case that persons who commit crimes associated with spying and pretexting may prove prosecutable for their criminal efforts to cover up their crimes.
10/5. The Federal Communications Commission (FCC) released the agenda [PDF] for its event on Thursday, October 12, 2006, titled "Open Meeting". The agenda reflects that the FCC is scheduled to adopt several significant items. The FCC will consider a Memorandum Opinion and Order regarding the merger of AT&T and BellSouth (nominally an approval of the transfer of licenses). The FCC will consider the long awaited white space order (proceeding regarding unlicensed operation in the TV broadcast bands). The FCC will consider a Notice of Inquiry (NOI) regarding broadband industry practices. The FCC will consider an order regarding Qualcomm's request for declaratory ruling regarding the interference protection requirements applicable to the 700 MHz Band. Finally, the FCC will consider a NOI seeking information to assist it in preparing its annual report on the status of competition in the market for the delivery of video programming.
10/5. The U.S. Court of Appeals (6thCir) issued an order [2 pages in PDF] in ACLU v. NSA, that stays the August 17, 2006, order of the U.S. District Court (EDMich) pending appeal. The District Court enjoined the National Security Agency's (NSA) extrajudicial electronic intercepts where one party is within the U.S. and the other is outside. See, opinion [44 pages in PDF] of the District Court, and story titled "District Court Holds NSA Surveillance Program Violates Constitution" in TLJ Daily E-Mail Alert No. 1,433, August 17, 2006.
10/4. President Bush signed HR 5441, the Department of Homeland Security (DHS) appropriations bill. See, statement by Bush and DHS release. Sections 671-675 deal with emergency communications.
10/4. The U.S. Court of Appeals (5thCir) issued its opinion [PDF] in Southwestern Bell v. PUC of Texas, affirming the District Court's judgment in favor of the PUC and AT&T. This is an interconnection case.
The House will not meet. It may return from it elections recess on Monday, November 13, 2006. The adjournment resolution (HConRes 483) provides for returning on Thursday, November 9, at 2:00 PM.
Day two of a two day conference hosted by the Association of American Publishers' (AAP) School Division and the Software & Information Industry Association's (SIIA) Education Division titled "School Technology Summit on K-12 Digital Content: Evolving Models and Markets". See, notice. Prices vary. Location: Renaissance Hotel, 999 Ninth St., NW.
Deadline to submit comments to the National Institute of Standards and Technology's (NIST) Computer Security Division regarding its Draft Special Publication 800-45A [143 PDF], titled "Guidelines on Electronic Mail Security".
10:00 AM. The Supreme Court will hear oral argument in Global Crossing v. Metrophones, Sup. Ct. No. 05-705, a case regarding whether 47 U.S.C. § 201(b) creates a private right of action for a provider of payphone services to sue a long distance carrier for alleged violations of the FCC's regulations concerning compensation for coinless payphone calls.
1:30 - 4:30 PM. The Department of Homeland Security's (DHS) National Infrastructure Advisory Council (NIAC) will hold a meeting. The agenda includes an item titled "Convergence of Physical and Cyber Technologies and Related Security Management Challenges". The speakers will include John Chambers (P/CEO of Cisco Systems), George Conrades (Executive Chairman of Akamai Technologies), and Gregory Peters (former P/CEO of Internap Network Services). The NIAC also accepts written public comments. See, notice in the Federal Register, September 27, 2006, Vol. 71, No. 187, at Pages 56541-56542. Location: National Press Club, 529 14th Street, NW.
Deadline to submit reply comments to the Federal Communications Commission (FCC) in response to its Notice of Proposed Rulemaking [22 pages in PDF] in a new proceeding titled "In the Matter of Amendment of Section 90.20(e)(6) of the Commission's Rules". This is a reaction to Lojack's petition for rulemaking relating to the use of spectrum for stolen vehicle recovery systems (SVRS). The FCC proposes to revise section 90.20(e)(6) of its rules "to permit increased mobile output power, to permit digital emissions in addition to the analog emissions currently authorized by the Rules, and to relax the limitations on duty cycles", among other things. The FCC adopted this item on July 19, 2006, and released it on July 24, 2006. It is FCC 06-107, in WT Docket No. 06-142. See, notice in the Federal Register, August 23, 2006, Vol. 71, No. 163, at Pages 49401-49405.
Deadline to submit initial comments to the Federal Communications Commission's (FCC) Federal-State Joint Board on Universal Service in response to the FCC's public notice [PDF] requesting comments regarding the use of reverse auctions to determine high cost universal service funding to eligible telecommunications carriers. This proceeding is WC Docket No. 05-337 and CC Docket No. 96-45. See, notice in the Federal Register, August 25, 2006, Vol. 71, No. 165, at Pages 50420-50421.
6:00 - 8:00 PM. The Federal Communications Bar Association (FCBA) will host a continuing legal education (CLE) seminar titled "FCC's Media Ownership Rules". Registrations and cancellations are due by 5:00 PM on October 9. The price to attend ranges from $50 to $125. See, registration form [PDF]. Location: Dow Lohnes, Suite 800, 1200 New Hampshire Ave., NW.
10/6. In addition to statutes that provide for federal criminal prosecution, there are a number of federal statutes that provide for civil actions against persons or entities involved in pretexting related activities.
1. § 5 of Federal Trade Commission Act (FTCA). Section 5 of the FTCA, which is codified at 15 U.S.C. § 45(a), provides that "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful."
FTC is clear in its position that pretexting to obtain phone records violates this section. It filed five civil complaints on May 1, 2006 in various U.S. District Courts. It has settled one of these cases, obtaining a permanent injunction.
See, Complaint [7 pages in PDF] filed in the U.S. District Court (EDVa) by the FTC against Integrity Security and Investigation Services (ISIS) on May 3, 2006, and Stipulated Final Order [13 pages in PDF], October 5, 2006.
The FTC also submitted prepared testimony for the hearing of the House Commerce Committee's (HCC) Subcommittee on Oversight and Investigations (SOI) on September 29, 2006. It wrote that "And while there is no specific federal civil law that prohibits pretexting for consumer telephone records, the Commission may bring law enforcement actions against a pretexter of telephone records for deceptive or unfair practices under Section 5 of the FTC Act." (Footnotes omitted.) See, prepared testimony [13 pages in PDF] of Joel Winston of the FTC for the HCC/SOI hearing on September 29, 2006.
The FTC added that "the Attorneys General of California, Texas, Florida, Illinois, and Missouri have sued companies allegedly engaged in pretexting."
The FTC has also brought actions related to pretexting to obtain financial records, under both Gramm Leach Bliley Act (GLBA) and Section 5 of the FTCA.
The FTC also wrote that "Companies that have failed to implement reasonable security and safeguard processes for consumer data face liability under various statutes enforced by the FTC, including the Fair Credit Reporting Act, the Safeguards provisions of the GLBA, and Section 5 of the FTC Act."
Section 13(b), which is codified at 15 U.S.C. § 53(b), provides that the FTC can bring civil actions for violation of Section 5, and obtain injunctive relief and disgorgement of ill gotten profits. However, there is no criminal liability under this section. Nor is there a private right of action. Nor can the FTC recover damages.
These limitations are significant. Consider first the lack of criminal liability. Witnesses from the wireless carriers testified at the September 29 hearing that many of the pretexters and data brokers are bad actors, for whom injunctions, and monetary penalties mean little. If the FTC shuts them down, they may move, form a new business, and carry on.
Second, the FTC's inability to recover damages further limits the impact of its actions.
Third, the disgorgement of ill gotten profits is useless as a deterrent in some cases. For example, while data brokers profit from their pretexting activities, a company like HP mades no profits from pretexting that can be disgorged. If the FTC pursues HP, it will recover no damages or ill gotten profits. The suit might only serve to embarrass HP.
Fourth, the lack of a private right of action means that CNET, its reporters, ordinary phone customers, and class action lawyers cannot use this section.
2. CPNI. The Federal Communications Commission (FCC) has limited civil authority under 47 U.S.C. § 222.
This section provides that "a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information in its provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories."
However, this section only applies to carriers. It cannot be used against HP, data brokers, or pretexters.
Nor can it be used against providers of IP based services, although the FCC has issued a notice of proposed rulemaking (NPRM) that asks whether it can.
The wireless carriers who are being pretexted are not violating the statute as it is currently drafted, and are vigorously opposing any proposed legislation that would impose further duties upon them.
3. § 521 of the GLB Act. 15 U.S.C. § 6821 contains the Gramm Leach Bliley Act's (GLBA) ban on pretexting for financial records. 15 U.S.C. § 6822 provides that "compliance with this subchapter shall be enforced by the Federal Trade Commission".
4. Civil RICO. The federal Racketeer Influenced and Corrupt Organizations (RICO) is codified at 18 U.S.C. §§ 1961-1968.
In addition to the criminal enforcement provisions, there is 18 U.S.C. § 1964(b), which provides for civil enforcement.
10/6. Several federal statutes create private rights of action that may assist persons or entities harmed by Hewlett-Packard (HP), or by others who engage in fraudulent pretexting activities, in obtaining redress.
1. CFAA, 18 U.S.C. § 1030(g). The federal Computer Fraud and Abuse Act (CFAA), which is codified at 18 U.S.C. § 1030, contains broad criminal bans. However, the section that gives rise to a private right of action is limited.
18 U.S.C. § 1030(g) provides that "Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in clause (i), (ii), (iii), (iv), or (v) of subsection (a)(5)(B). Damages for a violation involving only conduct described in subsection (a)(5)(B)(i) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage. No action may be brought under this subsection for the negligent design or manufacture of computer hardware, computer software, or firmware."
2. RICO. The federal Racketeer Influenced and Corrupt Organizations (RICO) Act is codified at 18 U.S.C. §§ 1961-1968.
18 U.S.C. § 1964(c) creates a private cause of action. It provides that "Any person injured in his business or property by reason of a violation of section 1962 of this chapter may sue therefor in any appropriate United States district court and shall recover threefold the damages he sustains and the cost of the suit, including a reasonable attorney’s fee, ..."
3. Stored Communications Act (SCA). The Stored Communications Act (SCA), which is codified at 18 U.S.C. § 2701-2712, is primarily a criminal statute. It is discussed in story in this issue regarding federal crimes.
However, the SCA also contains a private right of action, at 18 U.S.C. § 2707. It provides that "any provider of electronic communication service, subscriber, or other person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind may, in a civil action, recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate".
Several things are notable about this language. First, it broadly gives standing to sue to many persons. The service provider can sue. Its subscribers can sue. But also, any other aggrieved person can sue.
See also, 18 U.S.C. § 2510(11), which provides that an "``aggrieved person´´ means a person who was a party to any intercepted wire, oral, or electronic communication or a person against whom the interception was directed".
Also, this statutory language exempts the federal government from civil liability.
This section allows the plaintiff to recover actual damages, and in some situations, punitive damages.
There is information about the HP scandal that supports the bringing of civil claims under the SCA. For example, Verizon Wireless filed a complaint filed on September 28, 2006, in which it alleged that its "records demonstrate that someone obtained online access to the account by meeting the necessary verification procedures. The user then changed both the user id and the e-mail address associated with the account." See, story titled "Verizon Wireless Files John Doe Complaint Against HP's Pretexters".
There is at least one civil case in which victims of a pretexting scheme prevailed against the pretexter under the SCA's private right of action section. It is Jones v. Global Information Group, in the U.S. District Court (WDKent).
The complaint in that action alleged that Global pretexted to gain access to plaintiff's account information through Verizon Wireless online accounts system.
The complaint stated that "Verizon Wireless has established a website which includes a secure, private area where a subscriber may register for an online account, view and pay bills for their wireless service, activate new telephones and perform other administrative tasks related to a subscriber's account."
It also stated that "In order to register for an online account, a subscriber must furnish three types of personal information, including the mobile phone number, the billing ZIP code for the account associated with the number, and the last four digits of the Social Security Number associated with the account."
The complaint also stated that "Once address and other private account information is obtained, it is possible to penetrate Verizon Wireless's secure website by pretending to be the customer, creating an online account, then viewing or downloading stored transactional records, including information about numbers called by the subscriber, numbers which called the subscriber, times, dates, durations and other private information."
It also stated that "Global gained access to Plaintiffs' confidential account information and CPNI by impersonating Plaintiffs and fraudulently registering for online accounts associated with Plaintiffs' wireless numbers. Defendants employed interstate wire communications in order to access the private area of the Verizon Wireless website and create the unauthorized online accounts."
The complaint alleged that Verizon Wireless's website "is used to provide an electronic communication service" within the meaning of 18 U.S.C. § 2701. It further alleged that Global "knowingly, willfully and intentionally accessed without authorization a Verizon Wireless facility or facilities through which an electronic communication service is provided to Plaintiffs, and obtained access to electronic communications in electronic storage in violation of 18 U.S.C. § 2701((a)(1)."
And hence, the complaint concluded that Global is liable under 18 U.S.C. § 2707(b) and (c). This issue did not go to trial. Rather, the District Court granted plaintiffs' Motion for Entry of Default against Defendant, Global Information Group, Inc. on July 26, 2006.
This case is Charles W. Jones, Sr. and Charles W. Jones, Jr. v. Global Information Group, Inc., North American Security, Inc., and Michael P. Spencer, filed in the U.S. District Court (SDInd), Albany Division, as D.C. No. 4:06-CV-0011-JDT-WGH, and transferred to the U.S. District Court (WDKent) as D.C. No. 3:06-CV-246.
The plaintiffs are represented by Culver Halliday and Douglas Brent of the law firm of Stoll Keenon & Ogden in Louisville, Kentucky.
10/6. 47 U.S.C. § 222 is the section of the Communications Act that provides that consumers' personal information held by carriers is private. However, the statute regulates the activities of carriers. Non-carriers who give out personal customer information do not violate Section 222. Pretexters who fraudulently obtain customer information from carriers do not violate Section 222. Moreover, this is one area where the Federal Communications Commission (FCC) follows its statutory mandate.
Hence, the FCC, which has civil enforcement authority under Section 222, cannot take any action under Section 222 against companies like Hewlett-Packard (HP), or its outside investigators, who fraudulently obtain customer phone records.
HP is not a carrier. It is, however, a radio service licensee. And, the FCC regulates its licensees.
HP holds numerous FCC IG and YI radio service licenses, in Palo Alto, California, Cupertino, California, Corvallis, Oregon, Fort Collins, Colorado, Boise, Idaho, and Arecibo, Puerto Rico.
HP, like other licensees, must seek periodic renewal of these licenses. Also, if HP acquires a company with FCC licenses, or goes through a merger, and in such transactions licenses are transferred, the FCC must approve or reject the license transfers. Finally, the FCC has authority to revoke licenses. The FCC currently has an open FM license revocation proceeding for a troublesome FM radio station licensee in a remote corner of the state of Texas.
The FCC also has a history of injecting its political and policy objectives into its decisions, and in the conditions that it imposes, in license transfer proceedings.
Hence, hypothetically, the FCC could use it licensing authority to punish or reward large companies that hold FCC licenses, according to whether or not they respect the privacy of consumers' phone records. Whether the FCC would do this is another matter.
WorldCom perpetrated fraud that resulted in tremendous harm to shareholders, employees, and the telecommunications industry. Yet, the FCC did not revoke its licenses.
Moreover, the FCC has recently demonstrated little concern for the privacy of communications, or the security of consumers' or business's confidential records, in its implementation of the CPNI statute, in its expansion of its CALEA mandates, and in its inaction regarding recently reported NSA activities.
The FCC has a statutory mandate to promote the "public convenience, interest, or necessity".
FCC also has "authority to suspend the license of any operator" if the licensee "has violated, or caused, aided, or abetted the violation of, any provision of any Act, treaty, or convention binding on the United States, which the Commission is authorized to administer, or any regulation made by the Commission under any such Act, treaty, or convention" or "has knowingly transmitted ... false or deceptive signals or communications". See, 47 U.S.C. § 303.
The FCC's current license revocation proceeding, concerning Terry Hammond, in Shamrock, Texas, shows that the FCC does upon occasion assert its license revocation authority.
Hammond is a bad character, as are some current and former HP persons. Hammond is in jail in Texas on a felony conviction. The FCC announced on September 15, 2006, that it plans to revoke his FCC license, arguing in part that a convicted felon should not be an FCC licensee.
There are some similarities between Hammond's wrongs, and HP's. Both lied. Although arguably, HP's are more severe, and thus, present a stronger case for license revocations.
An FCC order states that his conviction "involved Hammond altering checks written to the station and depositing them into an account that he controlled" and that this was "for theft of more than $1,500 but less than $20,000". See, document [PDF] titled "Order to Show Cause, Notice of Opportunity for Hearing, and Hearing Designation Order", released on September 15, 2006. This is FCC 06-124 in EB Docket No. 06-163. See also, notice in the Federal Register, October 4, 2006, Vol. 71, No. 192, at Pages 58607-58609.
The FCC's interest in Hammond and Shamrock, Texas, cannot be significant. Shamrock is a tiny town in a sparsely populated region of the northwestern panhandle of Texas. Shamrock is a spot on Interstate 40 where people traveling between Amarillo, Texas, and Oklahoma City, Oklahoma stop for gas and to go to the bathroom. Hammond holds the only FM radio license in Shamrock.
In contrast, HP's pretexting to fraudulently obtain consumer phone records has caused considerable damage to consumer confidence in the integrity of the wireless phone industry.
Nevertheless, it is probably unlikely that the FCC would take any license related action with respect to HP.

References: § 1030
 § 1343
 § 1341
 § 1028
 § 1029
 § 521
 § 6821
 § 223
 § 1519
 § 1512
 § 5
 § 45
 § 222
 § 521
 § 6821
 § 1964
 § 1030
 § 1964
 § 1707
 § 1030
 § 1030
 § 1030
 § 1343
 § 222
 § 1349
 § 1341
 § 1342
 § 1028
 § 1029
 § 2510

§ 2510
 § 2510
 § 521
 § 6821
 § 6823
 § 1962
 § 1963
 § 223
 § 223
 § 1519
 § 1512
 v. 
 v. 
 v. 
 § 201
 § 5
 § 45
 § 53
 § 222
 § 521
 § 6821
 § 6822
 § 1964
 § 1030
 § 1030
 § 1030
 § 1964
 § 2701
 § 2707
 § 2510
 v. 
 § 2701
 § 2701
 § 2707
 v. 
 § 222
 § 303