Source: http://cyb3rcrim3.blogspot.co.uk/2016_02_01_archive.html
Timestamp: 2017-08-20 04:13:54
Document Index: 547954118

Matched Legal Cases: ['§ 3', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 1030', '§ 5', '§ 1030', '§ 5']

CYB3RCRIM3: February 2016
This post examines an opinion from the Court of Appeals ofWashington (Division 1): State v. Kohonen, 2016 WL 492651 (2016). The court began by explaining that
J.K. was adjudicated guilty, in juvenile court, of cyberstalking based on two tweets that she sent from her personal Twitter account. She now appeals, contending both that insufficient evidence was adduced to establish that she acted with the intent to `harass, intimidate, torment, or embarrass’ another person and that insufficient evidence was presented that her tweets constituted `true threats.’
Because we agree that insufficient evidence was presented that J.K.'s tweets constituted a true threat, we reverse the conviction and remand for the cause to be dismissed with prejudice.
State v. Kohonen, supra.
brief filed on behalf of J.K. in her appeal outlines the facts that led to her being charged with cyberstalking (from her perspective):
When J.K. was in eighth grade, a classmate, S.G., informed a teacher that a student (not J.K.) was behaving oddly. . . . As a result, J.K. and the other student were suspended from school. . . . The two girls have had no other interaction with each other until this incident. . . .
Two years later, J.K. and S.G. were in the same class as sophomores in high school. . . . One day in November 2013, J.K. saw S.G. in class and was reminded of the incident two years before. . . . She quickly posted two short messages known as tweets via the website Twitter. The first read, `Tbh still want to punch you in the throat even tho it was 2 years ago.’ The second read, `[S.G.]mustdie.’ . . .
J.K. explained that she posts tweets frequently and uses the site almost like a journal, posting her thoughts, reactions, sometimes jokes. . . . She testified she sent the messages quickly and without thinking, as a fleeting expression of her agitation at the memory. . . . Although she is aware the posts are public, and she has around 100 people who follow her, she testified she did not consider the potential impact on S.G. . . .
For nearly a full day after these tweets, there was no reaction. None of J.K.'s Twitter followers mentioned them to her or responded to them in any way. . . . S.G. was unaware of the tweets. The next day, however, another student, I.R., who follows J.K. on Twitter noticed the tweets and showed them to S.G. . . .
I.R. explained that, on the Twitter website, a person can search for J.K.'s page and see anything she has posted that is not specifically blocked. . . .The only reason she became aware of J.K.'s tweets was that she follows J.K. on Twitter, which means that anything J.K. posts automatically appears on I.R.'s Twitter page. . . .
S.G. testified she felt angry and embarrassed because she knew others would see the tweets. . . . She was not frightened; she did not really think J.K. would hurt her. . . . She showed the tweets to the dean of students, who, after consulting with other administrators, called the police. . . .
J.K. immediately admitted she had posted the tweets and explained she never intended to harm S.G. . . . Well before she learned of any criminal charges, she also wrote a letter apologizing to S.G. for the upset that she caused by her thoughtless conduct. . . .
Brief of Appellant, State v. J.K., 2015 WL 5432030 (Washington Court of Appeals – Division 1).
The opinion goes on to explain that J.K. was
taken from class to the administration office, where Lockhart and Brown confronted her with the tweets. J.K. immediately admitted that she had written and posted the tweets but stated that she had not intended for her actions to harm S.G. . . .
J.K. was charged with one count of cyberstalking. After trial, the commissioner adjudicated J.K. guilty as charged, finding J.K. had acted with the intent to embarrass, harass, and torment S.G. and that she was not credible on the question of whether she had considered the effect the tweets could have before posting them. The court also concluded that the tweets constituted a true threat. J.K. was sentenced to six months of probation and 30 hours of community service.
State v. Kohonen, supra. Nicole Lockhart was the Dean of Students at J.K.’s school and George Brown was an officer with the Bellingham Police Department. State v. Kohonen, supra.
As noted above, J.K. appealed the conviction and sentence. The Court of Appeals began its analysis of J.K.’s argument on appeal by explaining that
J.K. contends that insufficient evidence was presented that the tweets in question constituted `true threats,’ as required by the federal and state constitutions. This is so, she asserts, because a reasonable person in her position would not have foreseen that the tweets would be interpreted as serious threats to inflict harm. We agree.
The Court of Appeals began its analysis of the issue in the case by explaining that
[t]he due process clauses of the federal and state constitutions require that the government prove every element of a crime beyond a reasonable doubt. Apprendi v. New Jersey, 530U.S. 466 (2000); U.S. Const. amend. XIV; WASH. CONST. art. I, § 3. `[T]he critical inquiry on review of the sufficiency of the evidence to support a criminal conviction must be . . . to determine whether the record evidence could reasonably support a finding of guilt beyond a reasonable doubt.’ Jacksonv. Virginia, 443 U.S. 307 (1979). `[T]he relevant question is whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could have found the essential elements of the crime beyond a reasonable doubt.’ Jackson v. Virginia, supra.
`The purpose of this standard of review is to ensure that the trial court fact finder “rationally appl[ied]” the constitutional standard required by the due process clause of the Fourteenth Amendment, which allows for conviction of a criminal offense only upon proof beyond a reasonable doubt.’ State v. Rattana Keo Phuong, 174 Wash.App. 494, 299 P.3d 37 (Washington Court of Appeals 2013) (quoting Jackson v. Virginia, supra). . . . This standard of review is also designed to ensure that the fact finder at trial reached the `subjective state of near certitude of the guilt of the accused,’ as required by the Fourteenth Amendment's proof beyond a reasonable doubt standard. Jackson v. Virginia, supra.
`A claim of insufficiency admits the truth of the State's evidence and all inferences that reasonably can be drawn therefrom.’ State v. Salinas, 119 Wash.2d 192, 829 P.2d 1068 (Washington Supreme Court 1992). Circumstantial evidence and direct evidence carry equal weight when reviewed by an appellate court. State v. Goodman, 150 Wash.2d 774, 83 P.3d 410 (Washington Supreme Court 2004). Finally, we defer to the fact finder on issues of conflicting testimony, witness credibility, and persuasiveness of the evidence. State v. Rodriquez, 187 Wash.App. 922, 352 P.3d 200, review denied, 184 Wash.2d 1011, 360 P.3d 817 (Washington Supreme Court 2015).
The court then began the process of applying the above standards to the facts in this case, noting, initially, that
J.K. was charged with misdemeanor cyberstalking contrary to [Revised Code of Washington] 9.61.260, which provides, in pertinent part:
(1) A person is guilty of cyberstalking if he or she, with intent to harass, intimidate, torment, or embarrass any other person,. . . makes an electronic communication to such other person or a third party:
It went on to apply the above standards to the issues in this case, noting, initially, that
[t]hus, to convict J.K. of the crime of cyberstalking, the State was required to prove, in pertinent part, each of the following elements beyond a reasonable doubt: (1) that J.K. made an electronic communication to another person, (2) that, at the time J.K. made the electronic communication, she specifically intended to harass, intimidate, torment, or embarrass another person, and (3) that J.K. threatened to inflict injury on the person to whom the electronic communication was made. See 11 WASHINGTON PATTERN JURY INSTRUCTIONS: CRIMINAL 36.82 (3d ed. Supp.2014).
J.K. contends that insufficient evidence was presented to support a finding that her tweets constituted `true threats.’
Where a threat to commit bodily harm is an element of a crime, the State must prove that the alleged threat was a `true threat.’ State v. Kilburn, 151 Wash.2d 36, 84 P.3d 1215 (Washington Supreme Court 2004). This is because of the danger that the criminal statute will be used to criminalize pure speech and impinge on First Amendment rights. True threats are not protected speech because of the `fear of harm aroused in the person threatened and the disruption that may occur as a result of that fear.’ State v. Kilburn, supra.
[t]he test for determining a `true threat' is an objective test that focuses on the speaker. State v. Kilburn, supra. The question is whether a reasonable person in the speaker's position would foresee that the threat would be interpreted as a serious expression of intention to inflict the harm threatened. State v. Allen, 176 Wash.2d 611, 294 P.3d 679 (Washington Supreme Court 2013); accord State v. Kilburn, supra.
A true threat is a serious threat, not one said in jest, idle talk, or political argument. State v. Kilburn, supra (citing U.S. v. Howell, 719 F.2d 1258 (U.S. Court of Appeals for the 5th Circuit 1983)). Stated another way, communications that `bear the wording of threats but which are in fact merely jokes, idle talk, or hyperbole’ are not true threats. State v. Schaler, 169 Wash.2d 274, 236 P.3d 858 (Washington Supreme Court 2010). The nature of a threat `depends on all the facts and circumstances, and it is not proper to limit the inquiry to a literal translation of the words spoken.’ State v. C.G., 150 Wash.2d 604, 611, 80 P.3d 594 (Washington Supreme Court 2003).
Statements may `connote something they do not literally say. . . .’ Planned Parenthood of Columbia/Willamette, Inc, v. Am. Coal, of Life Activists. 290 F.3d 1058 (U.S. Court of Appeals for the 9th Circuit 2002). Consistently with this recognition, our court has held that `[w]hether a statement is a true threat or a joke is determined in light of the entire context’ and `that a person can indirectly threaten to harm or kill another.’ State v. Kilburn, supra. Further, `[t]he speaker of a ‘true threat’ need not actually intend to carry it out. It is enough that a reasonable speaker would foresee that the threat would be considered serious.’ State v. Schaler, 169 Wash.2d 274, 236 P.3d 858 (Washington Supreme Court 2010). . . .
State v. Locke, 175 Wash. App. 7779, 790, 307 P.3d 771 (Washington Court of Appeals 2013), review denied, 179 Wn.2d 1021 (2014).
The Court of Appeals then explained that “[a]pplying the foregoing principles of law to the facts herein, the relevant question is whether a reasonable person in J.K.'s position would have foreseen that the tweets would be interpreted as a serious expression of an intent to physically harm S.G.” State v. Kohonen, supra. It then undertook that analysis, noting that
[w]e focus first on the exact language of the tweets. In this regard, a description of the threats at issue in Locke is useful.
Locke concerned a series of Internet threats made against former Governor Christine Gregoire over approximately five minutes. In Locke's first email to the governor, the author identified his city as `Gregoiremustdie’ and stated his desire for her to witness a family member `raped and murdered by a sexual predator. State v. Locke, supra. The e-mail also stated that the governor had `put this state in the toilet’ and requested that she `pull the lever to send us down before you leave Olympia.’ State v. Locke, supra. The court concluded that the various messages in the e-mail did not constitute a true threat because the messages were `more in the nature of hyperbolic political speech, predicting threatening personal consequences from the State's policies.’ State v. Locke, supra.
Locke's second e-mail again identified his city as `Gregoiremustdie.’ In this e-mail, he addressed the governor with an emphatic, gender-specific epithet and expressed his opinion that she should be `burned at the stake like any heretic.’ State v. Locke, supra. While noting that `[the e-mail's] message, expressed twice, [was] that the governor should be killed,’ the court concluded that, because of its `passive and impersonal phrasing,’ this email also did not constitute a true threat. State v. Locke, supra. The author's message, it explained, `[was] that someone should kill the governor, not that he intends to.’ State v. Locke, supra.
Next, the Court of Appeals noted that the
final threat [in Locke] was submitted through the governor's website on a form entitled, `Invite Governor Gregoire to an Event.’ Using this form, the author, who again identified his organization as `Gregoire Must D[i]e,’ requested that an event be held at the Governor's mansion. He stated that the event's subject would be `Gregoire's public execution’ and that the governor's role would be `Honoree.’ State v. Locke, supra. He also noted that the event would last 15 minutes, the media would be invited, and the audience's size would be greater than 150. State v. Locke, supra.
The court concluded that, in this instance, taken in context, the communication constituted a `true threat.’ In the context of the author's threats, there had been a `rapid progression of [his] communications from expressing his displeasure with her to his blunt desire for her death.’ State v. Locke, supra. In particular, the specificity of the final communication `thr[e]w the threat into higher relief and translate[d] it from the realm of the abstract to that of the practical.’ State v. Locke, supra. In the broader context, as Locke was aware, there had recently been a shooting of an elected official in another state. Furthermore, all of the witnesses from the governor's office testified that they took Locke's communications to be serious threats. Finally, Locke himself told police that he understood that his threats would be taken seriously.
The Court of Appeals then returned to the issue of whether the tweets in the Kohonen case were “true threats:”
A comparison of the text of the threats at issue herein with those analyzed in Locke suggest that—in terms of the words alone—the tweets do not constitute true threats. First, the similarity between Locke's `Gregoiremustdie’ statement and J.K .'s `# [S.G.]mustdie’ tweet is striking. Apart from the person named, the difference between the text of J.K.'s tweet and this part of Locke's e-mails is the hashtag. This difference is immaterial. The hashtag does not elevate the tweet to a true threat but, rather, is indicative of the social media context in which it was published. As summarized above, these statements were deemed not to constitute true threats in Locke.
There are also commonalities between J.K.'s second tweet and the threats analyzed in Locke. In particular, similar to the threats regarding violence against the governor or members of her family included in Locke's first two e-mails, J.K.'s second tweet expressed a desire to harm S.G., not an intention to do so. Again, the court in Locke held that the comparable statements—those expressing a desire for, or prediction of, violence—did not constitute true threats.
However, in true threat cases, it is not just the words and phrasing of the alleged threat that matter, but also the larger context in which the words were uttered, including the identity of the speaker, the composition of the audience, the medium used to communicate the alleged threat, and the greater environment in which the alleged threat was made. Herein, the combined high school and social media context in which the alleged threats were made further supports the conclusion that J.K.'s tweets did not constitute true threats.
The author of the alleged threats was J.K., an adolescent high school student. The intended audience was J.K.'s Twitter followers, approximately 100 of her friends and acquaintances—in short, members of her peer group. The alleged threats were disseminated via Twitter, a popular social media platform. Testimony established that J.K. and her peers used Twitter to `tweet their feelings, things that are going on, funny pictures, just pictures in general’ and to `post [their] thoughts, [their] reactions to things, [their] feelings, things that happen to [them] on a daily basis[, and] inside jokes with friends.’
The Court of Appeals went on to explain that, among other things, the “Commissioner” who acted as the fact-finder in the disciplinary proceeding against J.K. heard testimony from several students, including S.G., the alleged victim of J.K’s tweets. State v. Kohonen, supra. It also explained that in her testimony, S.G.
recounted not only her own response, but also the overheard response of another student. According to S.G., she heard another student at school talking about `how funny’ the tweets were. Regarding her own response, S.G. repeatedly recalled feeling `upset,’ `angry,’ and `embarrassed’ upon learning of the tweets. By contrast, S.G. repeatedly denied that she felt scared or afraid as a result of the tweets. Consistent with her stated lack of fear, after leaving the school administration building, S.G. returned directly to class. Thus, even S.G., who did not know J.K. well and who knew that J.K. might resent her because of the incident two years earlier, did not view these tweets as expressing an actual intent to cause physical harm. Indeed, not one of the people in J.K.'s intended audience who testified perceived the tweets to be serious threats.
The Court of Appeals therefore found that
J.K.'s tweets bear the signs of—admittedly mean-spirited—hyperbolic expressions of frustration, and that is precisely how they were received. A reasonable person in J.K.'s position would not have anticipated a different reception. Therefore, insufficient evidence was presented that the tweets constituted true threats. Because Lockhart and Brown were not part of J.K.'s peer group and were unfamiliar with Twitter, their reactions to J.K.'s tweets are a poor measure of the reaction that a reasonable person in J.K.'s position would have anticipated from her peers.
The Court of Appeals therefore reversed her conviction and remanded the case to the trial court “for the cause to be dismissed with prejudice.” State v. Kohonen, supra.
Posted by Susan Brenner at 7:59 AM No comments:
Posted by Susan Brenner at 3:04 PM No comments:
This post examines an opinion the U.S. Court of Appeals for the 7th Circuit issued recently in a civil case: Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 2016 WL 258632 (2016). The Court of Appeals begins the opinion by explaining that
Fidlar Technologies (`Fidlar’) brings this action against LPS Real Estate Data Solutions, Inc. (`LPS’) for violations of the Computer Fraud and Abuse Act (`CFAA’) and the Illinois Computer CrimePrevention Law (`CCPL’). Fidlar claims LPS improperly downloaded county land records provided through Fidlar's services. The district court granted summary judgment in favor of LPS. It held that Fidlar failed to show that LPS acted with intent to defraud under CFAA § 1030(a)(4) or that LPS caused `damage’ under § 1030(a)(5)(A). The court also rejected Fidlar's argument that LPS knew or had reason to know that it might cause loss as required by the CCPL. For the following reasons, we affirm.
Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., supra.
As courts usually do, the Court of Appeals began the substantive part of its opinion by explaining how, and why, the lawsuit arose:
One of Fidlar's software products, Laredo, provides users with remote internet access to county records. The `Laredo system,’ as Fidlar describes it, consists of three components: the county databases, the `Laredo client’ (or just `the client’), and the `middle tier.’ The county databases store county land records and index data. The `Laredo client’ is a user-interface that allows users to remotely access these land records and related data. Finally, the `middle tier’ facilitates the communication between the Laredo client and a specific county database. Fidlar offers its county customers the option of whether to host the county database and middle tier components on the county's own servers or on Fidlar's servers. The client is stored on the user's own computer.
In order to use the client, a user must accept Fidlar's End–User License Agreement (`EULA’). In relevant part, the EULA provides that a user may `use . . . any portion of the software for any purpose,’ but it also provides that a user may `not . . . copy the software covered by this Agreement in any manner.’ Importantly, the EULA specifies that it does not grant access to any county information. The authority to grant access to records remains with the relevant county.
When a user inputs a record search into the Laredo client, the client sends a request to the middle tier via the internet. The middle tier then retrieves the appropriate record from the county database and `streams’ this record to the user through the Laredo client. In other words, the user can view an image of the record in the client, but cannot download or save it for later viewing. However, the client gives the user an option to `print’ an image of the record, either on paper or to a PDF file.
The client communicates with the middle tier through a technology called Simple Object Access Protocol (`SOAP calls’). The Laredo client sends SOAP calls unencrypted over the internet. In order to access a particular record, the client generates the appropriate SOAP call and sends it to the middle tier. After analyzing the SOAP call, the middle tier retrieves the matching record and sends it back to the client for viewing. Each Laredo user has a unique username and password for each county with which it has an agreement. Accordingly, each SOAP call is coded with a corresponding unique identifier.
The opinion followed the general information outlined above with a recitation of the facts and events that led to the litigation:
Fidlar tracks access to county records in order to facilitate billing by the individual counties. Each county develops its own subscription plan for access to its records. All the subscription plans charge a monthly fee set by the county based on time spent accessing records. Some—but not all—counties also charge a separate `print fee’ (or `copy fee’) for each record a user prints using the client. Fidlar also uses SOAP calls to track access and printing. For example, if a user prints a record from the client, the client generates and sends a SOAP call of the print request to the middle tier where it is logged for billing purposes.
In 2011, LPS designed a `web-harvester,’ a computer program to download county records en masse. To create the web-harvester, LPS ran a number of standard record searches and used a `traffic analyzer’ to view the SOAP calls sent from the client to the middle tier. LPS then identified the SOAP calls necessary to retrieve records and developed its own client, the web-harvester, to emulate those SOAP calls and send them to the middle tier. LPS's web-harvester only sent the SOAP calls necessary to retrieve records; it did not send other SOAP calls, such as those that track a user's activity. But every SOAP call did include LPS's unique identifier assigned by each county.
LPS used its web-harvester to obtain a large number of records from the 82 county databases it subscribed to over approximately two years. It downloaded the records in bulk onto its computers and then sent the records to India. There, select data from the records were `keyed,’ or entered, into LPS's database. Throughout this period, LPS continued to pay for unlimited subscriptions in all 82 counties but did not incur (or pay) print fees for all of the records it acquired through its web-harvester. Indeed, essentially none of LPS's activities were tracked during this period. Nonetheless, LPS's web-harvester did not disrupt Fidlar's services to other users or alter any content in the middle tier or county databases.
And that brings us to the suit:
On March 11, 2013, Fidlar filed this action in the Central District of Illinois alleging violations of the Computer Fraud and Abuse Act [CFAA] and the Illinois Computer Crime Prevention Law, as well as trespass to chattels. LPS moved to dismiss, filed a counterclaim, and requested a TRO and preliminary injunction to prevent Fidlar from reporting LPS's activities to the counties and from upgrading Laredo to prevent web-harvesting. The district court denied LPS's motion to dismiss and its requests for injunctive relief. On December 1, 2014, LPS moved for summary judgment on all of Fidlar's claims. On March 5, 2015, the district court granted LPS's motion for summary judgment and dismissed LPS's counterclaim as moot. Fidlar appeals.
[w]e review a district court's grant of summary judgment de novo. Bunn v. Khoury Enters., Inc., 753 F.3d 676 (U.S. Court of Appeals for the 7th Circuit 2014). Summary judgment is appropriate if there is no genuine dispute of material fact and the nonmoving party is entitled to judgment as a matter of law. Id. A `material fact’ is one that affects the outcome of the suit. Id. A `genuine issue’ exists as to any material fact when `the evidence is such that a reasonable jury could return a verdict for the nonmoving party.’ Bunn v. Khoury Enters., Inc., supra. In determining whether a genuine dispute of material fact exists, we view the record in the light most favorable to the nonmoving party, drawing reasonable inferences in the nonmovant's favor. Bunn v. Khoury Enters., Inc., supra.
The Court of Appeals began its analysis of LPS’ motion for summary judgment by explaining that
The CFAA, 18 U.S. Code § 1030, is primarily a criminal anti-hacking statute. However, § 1030(g) provides a civil remedy for any person who suffers damage or loss due to a violation of § 1030. § 1030(g). The district court held that Fidlar failed to demonstrate a violation of § 1030. On appeal, Fidlar argues that LPS violated § 1030(a)(4) and § 1030(a)(5)(A). We review each of these arguments in turn.
The Court of Appeals began its analysis with the issue of intent, noting that
18 U.S. Code § 1030(a)(4) punishes anyone who:
`[K]nowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value. . . .’
Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., supra (emphasis in the original).
The Court of Appeals went on to explain that the District Court held that
no reasonable jury could find that LPS acted with intent to defraud. Fidlar maintains that LPS's use of its web-harvester constituted an intentional scheme to avoid paying print fees, thus defrauding the counties.
Although this Court has not previously examined this element of § 1030, we have explained that in similar statutes `intent to defraud means that the defendant acted willfully and with specific intent to deceive or cheat, usually for the purpose of getting financial gain for himself or causing financial loss to another.’ United States v. Pust, 798 F.3d 597 (7th Cir.2015) (quoting United States v. Paneras, 222 F.3d 406 (7th Circuit 2000)). . . . Because direct evidence of intent is often unavailable, intent to defraud `may be established by circumstantial evidence and by inferences drawn from examining the scheme itself which demonstrate that the scheme was reasonably calculated to deceive persons of ordinary prudence and comprehension.’ United States v. Pust, supra.
Additionally, the legislative history of § 1030(a)(4) indicates that Congress intended for this provision to reach cases of computer theft. S.Rep. No. 99–432, at 9, reprintedin 1986 U.S.C.C.A.N. 2479, 2486–87 (`The new subsection 1030(a)(4) to be created by this bill is designed to penalize thefts of property via computer that occur as part of a scheme to defraud’). The intent to defraud element is meant to distinguish computer theft from mere trespass. Id. at 10 (`[T]here must be a clear distinction between computer theft, punishable as a felony, and computer trespass, punishable in the first instance as a misdemeanor. The element in the new paragraph (a)(4), requiring a showing of an intent to defraud, is meant to preserve that distinction. . . .’).
The Court of Appeals then began its analysis of the intent issue, noting, initially, that
this is not a case of theft. It is undisputed that LPS had authority to access the county records as a general matter, the question is whether the way in which it did so violated the statute.
Nonetheless, appealing to the broad nature of § 1030(a)(4)'s language, Fidlar argues that LPS's conduct supports an inference of an intent to defraud. By using its web-harvester, LPS obtained county records at no additional cost. Moreover, LPS knew that printing records through the client resulted in an additional fee in some counties. And LPS received invoices that did not reflect any downloads it made using its web-harvester, suggesting that LPS was aware that Fidlar and the counties were not tracking its activities. Assuming that LPS otherwise would have paid a print fee for the records it downloaded, LPS's web-harvester allowed it to avoid paying these fees. Therefore, Fidlar contends that LPS's `scheme’ appears consistent with an intent to defraud.
By contrast, LPS argues that its conduct is consistent with a legitimate, non-fraudulent intent. By using its web-harvester, LPS rapidly acquired records en masse, something it could not do with the Laredo client, even if it paid print fees. In other words, LPS could have been driven by a need to access documents more quickly, and not by an intent to defraud the counties by avoiding print fees. Indeed, if LPS just wanted to avoid print fees, it could have done so through simpler means such as copying the salient data by hand, taking pictures of the records on its computer screens with a digital camera, or simply keying the data directly from the Laredo client. Hence, LPS contends that its intent was to engage in efficient and legitimate business practices, not to `deceive or cheat’ the counties. United States v. Pust, supra.
Examining the `scheme’ itself, we conclude that no reasonable juror could infer that LPS had an intent to defraud. In other words, LPS's conduct was not `reasonably calculated to deceive persons of ordinary prudence and comprehension.’ United States v. Pust, supra. First, LPS used its web-harvester even in those counties that did not charge a print fee. If LPS's intent was to evade print fees, it would have only used its web-harvester in counties that did charge print fees. The fact that LPS used its web-harvester in all counties suggests that its goal was to accelerate its data acquisition efforts. Second, LPS continued to pay for unlimited subscriptions in all 82 counties, even though it was not logging any time by using its web-harvester. If LPS intended to defraud the counties, it could have selected a limited subscription for less money. Third, LPS did not conceal its use of a web-harvester. In fact, each of LPS's SOAP requests contained its unique identifier. As a result, no reasonable jury could conclude that LPS had the requisite intent to defraud based only on the scheme itself.
Moreover, Fidlar failed to present sufficient circumstantial evidence from which a reasonable jury could conclude that LPS intended to commit fraud, or even that LPS knew its actions were fraudulent. LPS maintains that it honestly believed that its conduct was permissible under the county agreements. Fidlar cannot demonstrate that LPS intended to commit fraud without evidence that LPS knew that its conduct was fraudulent. See United States v. Pust, supra (considering whether the defendant knew `the fraudulent nature of the scheme’ in assessing intent to defraud).
None of the circumstantial evidence, including the testimony of LPS employees, the agreements governing LPS's access to county records, and the Laredo technology itself, undermines LPS's claim that it believed it could permissibly download records through its web-harvester without paying print fees. First, LPS presented testimony from its employees indicating that they believed that although printing a record resulted in a fee, downloading a record did not. For example, LPS's former Senior Vice President Erick Marroquin stated that he believed that LPS was `entitled to download images from the Laredo program without incurring a print charge.’ LPS also offered evidence that it did not use a web-harvester to avoid print fees. The employee who oversaw development of the web-harvester, John McCabe, testified that in designing the web-harvester, `no part of [the process] was to avoid a print fee’ and that the purpose was `[e]fficiency, speed.’
Fidlar's own conduct, moreover, bolsters LPS's testimony on this point. LPS presented evidence that Fidlar knew that at least two of LPS's competitors used third party programs to acquire record data via Laredo. In particular, CoreLogic used a `screen-scraper’ to collect data from county records. Similarly, the First American Title Company used its own web-harvester to acquire records. Fidlar was aware of this conduct yet did not do anything to stop it. Indeed, in an internal e-mail, a Fidlar employee stated that Fidlar could make screen-scraping or web-harvesting illegal with a `simple disclaimer that states the information can't be scraped from the image.’ Taken together, this evidence suggests that even Fidlar itself did not believe that web-harvesting was impermissible.
[s]econd, the agreements between LPS and the counties did not prohibit LPS from using a web-harvester or require LPS to access the records through the Laredo client. Cf. EF Cultural Travel BV v. Zefer Corp., 318 F.3d 58 (U.S. Court of Appeals for the1st Circuit 2003) (`[T]he public website provider can easily spell out explicitly what is forbidden. . . . If [the plaintiff] wants to ban [certain conduct], let it say so on the webpage or a link clearly marked as containing restrictions’). These agreements also did not prohibit LPS from downloading records or require LPS to pay a print fee for any records it downloaded. Yet, LPS derived its authority to access records entirely from these agreements. The agreement between LPS and Fidlar, the Laredo client EULA, stated that it does not grant access to any county information. So the EULA, by its own terms, did not limit—or even affect—LPS's access to county records.
Third, the Laredo client's technological limitations do not support an inference that LPS knew it could not download records. Fidlar contends that because the client was designed to prevent downloading records, LPS should have known that it was not authorized to do so. But the client's technological limitations only show that LPS knew that it could not download records through the Laredo client. We see no reason why LPS should have inferred that it could not download records through a completely different program that it designed. LPS's access to records was tied to the individual agreements with each county—agreements that did not require LPS to use the Laredo client and that Fidlar was not even party to. Further, the EULA, which was the only agreement between Fidlar and LPS, expressly provided that it did not grant access to records and that access could only be granted by the relevant county. In other words, if LPS believed that the county agreements granted it the authority to access records through its own software, the limitations on the Laredo client would seem to have no bearing on the permissible uses of that software.
The Court of Appeals then took up another, related issue, explaining that Fidlar
attempts to cast doubt on LPS's claim that it did not intend to defraud the counties. First, Fidlar argues that the county invoices, which did not indicate any of LPS's web-harvester activity, support an inference that LPS intended to defraud the counties. Even assuming that LPS knew its activities were not being tracked as a result of these invoices, the invoices do not undermine LPS's contention that it believed its conduct was permissible. LPS's access was governed by the county agreements and the invoices did not give LPS cause to change its understanding of these agreements. The fact that LPS was not being billed for downloading records would only reinforce LPS's belief that its conduct was permissible under its unlimited subscriptions. Similarly, the fact that the counties continued to accept LPS's unlimited subscription fees (and that Fidlar continued to provide LPS access) without any inquiry into the company's minimal activity might have further reinforced LPS's understanding of its arrangement. As a result, the invoices do not make an intent to defraud any more likely.
Second, Fidlar cites the testimony of Lynda Taylor. Taylor was a Senior Vice President at LPS until June 2010, prior to LPS's creation and use of its web-harvester. Taylor explained that during her tenure at LPS, her plan was to `pay selectively,’ `on an as-needed basis . . . because Laredo charged for time to be on the system and to look at the document images online, and then you paid extra if you wanted to actually get a copy of an image.’ She also stated that Laredo did not allow a user to `take control of the digital image’ of a record. Fidlar argues that this testimony shows that LPS knew it could either view a record in the client or pay to print a record from the client, but could not download or `take control’ of a record.
The court, though, found that
Fidlar misreads Taylor's testimony. Taylor was only referring to the limitations of the Laredo client. She did not testify that LPS was prohibited from downloading records using a web-harvester or through other means. In fact, Taylor's tenure predates LPS's creation and use of the web-harvester. And individuals employed at LPS at that time consistently testified that they believed LPS's conduct to be permissible.
Third, Fidlar points to testimony from Michael Hall, LPS's Director of Data Acquisition, who stated that a hypothetical fee of $0.50 or more per page to print a record would have been `cost prohibitive' for LPS. This hypothetical fee is the same as the actual print fee charged by some of the 82 counties. Accordingly, Fidlar argues that Hall's testimony supports an inference that LPS was defrauding the counties of this fee.
The Court of Appeals then took up Fidlar’s argument that
LPS violated § 1030(a)(5)(A), which punishes anyone who:
`[K]nowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer. . . .’
Under the CFAA, `damage’ is defined as `any impairment to the integrity or availability of data, a program, a system, or information. . . .’ § 1030(e)(8). Hence, `causes damage’ encompasses clearly destructive behavior such as using a virus or worm or deleting data. See, e.g., Int'l Airport Ctrs., L.L.C. v. Citrin, 440 F.3d 418 (U.S. Court of Appeals for the 7th Circuit 2006). But it may also include less obviously invasive conduct, such as flooding an email account. See, e.g., Pulte Homes, Inc. v. Laborers' Int'l Union, 648 F.3d 295 (U.S.Court of Appeals for the 6th Circuit 2011).
Fidlar claims LPS caused damage to a protected computer—the middle tier servers—by `stopp[ing] the flow of information, causing a diminution in the completeness or availability of data.’ However, Fidlar admits LPS did not alter any data or disrupt Fidlar's services in any way. LPS just avoided Fidlar's method of tracking user activity by not sending the necessary SOAP calls.
This interruption is not `damage’ as defined by the statute. LPS's web-harvester did not impair the integrity or availability of Fidlar's data or systems; it simply downloaded the data requested without leaving a trace. Put another way, the middle tier servers, including the logs, were unaltered after LPS used its web-harvester.
Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., supra. (For the CFAA's definition of "damage", see 18 U.S. Code 1030(e)(8).)
Fidlar attempts to liken this case to United States v. Mitra, 405 F.3d 492 (U.S. Court of Appeals for the 7th Circuit 2005), but the two are readily distinguishable. In Mitra, this Court held that a defendant caused damage by blocking emergency radio communications. United States v. Mitra, supra. Unlike in this case, the defendant in Mitra actually impaired the availability and integrity of a protected computer. His conduct prevented others from communicating through the public communication system. See United States v. Mitra, supra (noting that the defendant's conduct `prevented the computer from receiving, on the control channel, data essential to parcel traffic among the other 19 channels’ and that `[w]hen disturbances erupted, public safety departments were unable to coordinate their activities because the radio system was down’). By contrast, LPS did not prevent anyone from using the middle tier and county database servers nor did it alter any of the content on the servers.
Fidlar tries to sidestep this distinction by arguing that LPS caused damage to the entire `Laredo system’ because it prevented the tracking component from functioning as Fidlar intended. But the statute only protects against damage `to a protected computer,’ including to systems on such a computer. §§ 1030(a)(5)(A); 1030(e)(8). The Laredo system is not a `computer,’ but rather a description of Fidlar's multi-tier architecture. See § 1030(e)(1)(defining `computer’ as `an electronic, magnetic, optical, electrochemical, or other high speed data processing device’). Hence, LPS cannot be liable for damaging the entire `Laredo system’ under this statute.
In reality, Fidlar's claim is trespassory in nature. LPS accessed the middle tier servers without following Fidlar's `rules’ (i.e., logging its activity or using the Laredo client). But by using the word `damage,’ and in light of the statutory definition, Congress intended this provision reach actual disruptions in service, not mere access, even if trespassory. See International Airport Centers, L.L.C. v. Citrin, 440 F.3d 418 (U.S. Court of Appeals for the 7th Circuit 2006) (`Congress was concerned with both . . . attacks by virus and worm writers, . . . and attacks by disgruntled programmers who decide to trash the employer's data system on the way out. . . .’); cf.§ 1030(a)(2) (prohibiting unauthorized access to obtain information from a protected computer without requiring damage). Therefore, the district court was correct that no reasonable jury could conclude that LPS caused any damage within the meaning of the statute.
The Court of Appeals then took up, and dismissed, Fidlar’s claim that LPS violated the Illinois Computer Crime Prevention Law:
Like the CFAA, the Illinois CCPL is a criminal statute with a civil suit provision. Section720 ILCS § 5/17–51(c) provides that `[w]hoever suffers loss by reason of a violation of subdivision (a)(4) of this Section may, in a civil action against the violator, obtain appropriate relief.’ Fidlar claims that LPS violated subdivision (a)(4)(C), which provides that:
(a) A person commits computer tampering when he or she knowingly and without the authorization of a computer's owner or in excess of the authority granted to him or her: ... (4) Inserts or attempts to insert a program into a computer or computer program knowing or having reason to know that such program contains information or commands that will or may:... (C) cause loss to the users of that computer or the users of a computer which accesses or which is accessed by such program....
The Court of Appeals went on to explain that the District Court Judge held that LPS
had no reason to know that its use of a web-harvester would or might cause loss under the statute. The court reasoned that LPS never believed that the counties were entitled to print fees for its use of a web-harvester, and thus there was no loss to the counties that LPS knew or should have known it was causing.
In support of its position that LPS violated the CCPL, Fidlar incorporates the same argument it made under CFAA § 1030(a)(4): LPS intentionally defrauded, and consequently intended to cause loss to, the counties. Indeed, under Illinois law, Fidlar can establish knowledge by demonstrating that LPS acted intentionally. See 720 ILCS § 5/4–5 (`When the law provides that acting knowingly suffices to establish an element of an offense, that element also is established if a person acts intentionally’).
But as discussed above, Fidlar cannot show that LPS intended to defraud the counties. LPS demonstrated that its intent was to efficiently acquire records in a way it believed to be permissible under the governing agreements. Its intent was not to avoid print fees. Accordingly, LPS did not intend to cause loss to the counties.
For the same reason, Fidlar cannot show LPS knew or had reason to know that it might cause loss to the counties. LPS was aware that some counties imposed print fees and that the counties obtained revenue from these fees. But given that LPS believed that it was entitled to download records without incurring a fee, it follows that LPS did not know or have reason to know that it was causing a loss. The fact that LPS could have paid print fees but chose not to does not establish a loss to the counties because LPS was not printing records.
At a minimum, Fidlar must demonstrate that LPS had reason to know that the counties were entitled to the print fees they allegedly lost. However, from LPS's perspective, the counties were not entitled to anything beyond the unlimited subscription fees LPS was already paying. Therefore, we agree with the district court that no reasonable jury could conclude that LPS knew or had reason to know that it would or might cause a loss.
The Court of Appeals therefore affirmed the judgment of the District Court Judge. Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., supra.
Fidlar Fid
Posted by Susan Brenner at 5:42 PM No comments: