Category: Communication Media & Internet

Virtual Marking: Guidance on Doing It Right

Despite the fact that virtual patent marking was introduced nearly a decade ago, jurisprudence addressing virtual marking issues has been quite limited. Recent guidance from U.S. district courts, however, paints a clearer picture of the patent marking statute’s requirements to (a) associate the patented article with the number of the patent; (b) place either “patent” or “pat.” together with a website address on the product; and (c) ensure the marking is “substantially consistent and continuous.”

Since 1952, the patent marking statute (“Marking Statute”) has encouraged patentees to give public notice of a patented article through physical application of the patent number to the article, which assists the public and helps mitigate innocent infringement. 35 U.S.C. § 287; Nike, Inc. v. Wal-Mart Stores, Inc., 138 F.3d 1437, 1443 (Fed. Cir. 1998). Giving effect to this goal, the marking statute provides a financial disincentive for patent owners who do not mark their products (i.e., a patentee is precluded from recovering damages for infringement of unmarked articles prior to notice of infringement). Once marked, a patent owner’s marking must be “substantially consistent and continuous.” Id. at 1446.

Since the AIA’s passage in 2011, however, patentees have been able to inform the public that an article is patented through “virtual marking” (i.e., use of the word “patent” or the abbreviation “pat.” together with the URL of a website address where the actual patent number may be found). 35 U.S.C. § 287. As opposed to physically marking a patent number on a product, virtual marking allows a patent owner to quickly update its patent data website page without the costs of modifying product tooling or packaging (e.g., for newly issued, expired, or invalidated patents). In relevant part, the Marking Statute provides:

“Patentees . . . may give notice to the public that the same is patented . . . by fixing thereon the word ‘patent’ or the abbreviation ‘pat’ together with an address of a posting on the Internet, . . . that associates the patented article with the number of the patent.” 35 U.S.C. § 287(a) (emphasis added).

The Delaware District Court recently clarified what does, and does not, constitute adequate association, concluding that a “website itself must do more than simply list the patentee’s patents.” Mfg. Res. Int’l v. Civiq Smartscapes, LLC, Case No. 17-269, 2019 U.S. Dist. LEXIS 146060, at *3 (D. Del. Aug. 28, 2019)(emphasis added). Citing the statute’s “plain language,” the court reasoned that “[s]imply listing all patents that could possibly apply to a product or all patents owned by the patentee” “merely creates a research project for the public,” as opposed to giving public notice. Id. at *30-31. The court described why this would be the case by pointing to two examples lacking the association necessary “as a matter of law to meet the requirements of virtual marking”:


View larger image

Id.

The Court concluded that Plaintiff’s examples did “nothing to ‘associate’ any specific product it has marked with the patents which cover it.” Id. at 31. The Court was not persuaded by Plaintiff’s arguments that proper association was met in view of (1) Plaintiff’s statement that “[o]ne or more of the above listed MRI patents may be used by LG-MRI products under license from MRI, Inc.”, and (2) Plaintiff’s clarification of “the patent category (LCD Display Patents)”. Id. Accordingly, Plaintiff’s website failed to “provide ‘a ready means of discerning the status of the intellectual property embodied in an article of manufacture or design,” and no damages were awarded for infringement that occurred prior to the notice that was provided by the filing of the suit. Id., citing Bonito Boats, Inc. v. Thunder Craft Boats, Inc., 489 U.S. 141, 162 (1989).

Beyond the association requirement, courts also have found that a website address lacking the words “patent” or “pat.” does not provide constructive notice, A to Z Machining Serv., LLC v. Nat’l Storm Shelter, LLC, 2011 U.S. Dist. LEXIS 149387 (W.D. Okla. 2011), and that evidence supporting consistent marking of substantially all products may include (a) documentary evidence concerning the timeframe in which the website has operated; (b) engineering and assembly drawings or the actual product depicting virtual mark placement; and (c) testamentary evidence concerning the frequency of the virtual mark’s use on products. See Asia Vital Components Co. v. Asetek Danmark A/S, 377 F. Supp. 3d 990, 1024-25 (N.D. Cal. 2019), citing SEB S.A. v. Montgomery Ward & Co., 594 F.3d 1360, 1378 (Fed. Cir. 2010).

Notably, the burden remains on the patentee to demonstrate that its patent marking practices are effective and appropriate. In view of recent court guidance, consider the following points for creating an effective virtual marking strategy:

  • Include either “pat.” or “patent” together with the website address where the actual patent number may be found.
  • Place the patent owner’s website address on all patented products and clearly correlate each product that is covered by at least one claim of a specific patent on that website address for a patented product.
  • Periodically review the patent website page to ensure that it is current, accurate, and complete (e.g. reflecting new products; updating issued, expired, or invalidated patents).
  • Create and preserve records that demonstrate that the virtual marking was consistent and continuous. This may entail keeping a written log of updates to the patent website address, and preserving evidence that it was continually maintained

© 2019 Brinks Gilson Lione. All Rights Reserved.

No Copyright Case Too Small: Content Creators Rejoice or Casual Infringers Beware?

An office jokester emails a funny meme she copied off Google to a colleague. A tourist snaps a picture of a painting in an art gallery and posts it to his travel blog. A teacher prints copies of a recently published Internet article and distributes to his class. A teen reposts his friend’s Instagram picture on his own social media page. To these casual infringers, no harm has been done and there’s certainly no reason to “make a federal case out of it.” But to the copyright owners, these small acts of infringement mean something. Perhaps not enough to justify the expense and time required for a federal claim, but action may be worth pursuing on a smaller scale.

Enter the pending CASE Act, intended to protect the “creative middle class,” and a potential boon to small businesses and individual content creators, while simultaneously presenting a threat to the “micro-infringements” committed by the ordinary person throughout the day. Last week, the US House of Representatives approved the Copyright Alternative in Small-Claims Enforcement Act of 2019 (CASE Act) by a landslide 410-6 vote. The bill is intended to create a Copyright Claims Board within the US Copyright Office that would hear copyright claims of up to $15,000 per work infringed, with statutory damages capped at a total of $30,000.

If passed by the Senate, the CASE Act is likely to be a welcome avenue for graphic designers, bloggers, photographers, authors, vloggers, and other individual and small business copyright owners to protect their works. Currently, pursuing copyright infringement litigation is limited to filing suit in federal courts, the cost of which can be prohibitive for many small businesses. The proposed Copyright Claims Board provides a more affordable avenue—effectively, a copyright small claims court—to enforce copyright ownership.

Supporters say that small businesses have long needed a more efficient and affordable means to enforce their copyrights. To this point, much of the unauthorized exchange and use of Internet-based works or smaller-scale copyrighted works has been difficult to police. In fact, June Besek, the executive director of the Kernochan Center for Law, Media and the Arts at Columbia Law School, recently told the ABA Journal that many infringers knowingly exploit copyrighted material because they are confident they will never be challenged. (Anyone remember the flagrant use of Napster and LimeWire by teens in the late 1990s and early 2000s to illegally download music—excuse me, “file share”—with little fear of repercussions for their “small-scale” acts of infringement?). A number of organizations, including the American Bar Association, have expressed support for the CASE Act.

But that support, while widespread, is not universal. The American Civil Liberties Union opposes the proposed CASE Act on the grounds that it will stifle free speech and the open sharing of information. Other critics say that by lowering the threshold for infringement claims, lawmakers also are opening the door for “copyright trolls” to file nuisance infringement claims with the Copyright Claims Board. And many are less than keen on the idea that inadvertently unanswered copyright infringement complaints could cost ordinary Americans up to $30,000 in default judgments per proceeding—perhaps a small sum to a business, but potentially life-changing to many individuals—with very limited ability to appeal, under the currently proposed language of the Act.

Notably, as currently written, the small-claims tribunal established under CASE will be entirely voluntary, meaning the complaining party can elect to use the Copyright Claims Board, and the defending party may choose to opt out. But critics point out that the opt-out window is only 60 days long, and easily could be missed by an unwitting defendant.

Next, the Senate will consider the CASE Act, but observers believe it will pass with bipartisan support. The final language of the Act may be somewhat different from its current form, so stay tuned for more updates as the CASE Act makes its way through the legislature.

What the proposed CASE Act could mean for you:

Would-be plaintiffs (or defendants) appearing before the proposed Copyright Claims Board are encouraged to do so with licensed legal representation. Some have suggested that this small claims court format will allow parties to represent themselves without needing to incur the fees of legal representation. However, it is important to remember that, though the monetary stakes may be lower than in federal court, the complex legal nuances of copyright law, not to mention jurisdiction, service, discovery, evidence, joinder of parties, and expert testimony, remain the same and are best addressed by experienced legal counsel.

Owners of large copyright portfolios may find the CASE Act to allow greater leeway in defending their works against smaller-player infringers. Businesses with larger portfolios may wish to take stock of their protected works and develop an enforcement strategy, taking into account this more accessible avenue for enforcement.

Smaller companies or individual content creators, too, may find the proposed CASE Act to provide the freedom to assert their copyrights more aggressively than they have done previously. These companies and individuals also are encouraged to take stock of their copyright portfolios, and consider setting up infringement alerts through their legal representatives or third party vendors in order to take a more offensive stance.

On the opposite side of the court room, copyrighted work users are cautioned to think carefully about their use of protected works. Businesses and schools may want to consider updating policies on use and distribution of protected works, with a more conservative mindset. The relative ease of filing suit with the Copyright Claims Board may give rise to a more litigious “creative middle class.” And while the damages may be smaller-scale, the attendant legal costs may not be, and damages from multiple suits may add up quickly.

 

Copyright © 2019 Womble Bond Dickinson (US) LLP All Rights Reserved.

ARTICLE BY Kristin Lamb of  Womble Bond Dickinson (US) LLP.
For more copyright infringement regulation, see the National Law Review Intellectual Property law page.

Text Messages Inviting Independent Voters to Political Speeches by Former Presidential Hopeful Howard Schultz Were Not “Solicitations” For His Book Tour

The Western District of Washington recently held in Vallianos. v. Schultz, C19-0464-JCC, 2019 WL 4980649 (W.D. Wash. Oct. 8, 2019), that two text messages encouraging recipients to view a livestream of a political speech by the former chairman and CEO of Starbucks Howard Schultz did not amount to “solicitations” under the TCPA. While exploring a run for President, Schultz released a book, “From the Ground Up,” and went on a three-month long cross-country book tour. He also collected from voter records the phone numbers of individuals registered as having “No Party Affiliation” and sent them the text messages at issue. Named plaintiffs Cassandra Vallianos, Stacey Karney, and Mike Barker brought a putative TCPA class action against Schultz alleging that the text messages were sent to them without their consent after they had placed their cell phone numbers on the national Do Not Call Registry.

Specifically, plaintiffs made two claims: first, that Schultz sent the text messages using an auto-dialer and without the plaintiffs’ consent; second, that the calls were solicitations sent in violation of the TCPA’s Do Not Call restrictions. Plaintiffs’ claims were based on two separate text messages Schultz sent Plaintiffs. The first said “Howard Schultz will be speaking in Miami at 12:30! Watch live: https://hs.media.mi-a030[.]” The second said “Howard Schultz will be speaking about his vision for America in Miami at 12:30! Watch live: https://hs.media/mia030[.]” Plaintiffs argued that these text messages were “solicitations” under the TCPA because the text messages were sent with the goal of getting recipients to purchase Schultz’s book. Defendant Schultz moved to dismiss only the Do Not Call claim.

Acknowledging that messages that serve a “dual-purpose” by including both advertising and informational communications are solicitations for purposes of the TCPA, the court looked to the context of the messages to determine whether they constituted “solicitations” under the TCPA. The court reviewed the text messages, the webpage to which the text messages directed recipients, and the speech embedded in the website. The court found that the text messages did not facially discuss Schultz’s book. The court also found that the link in both text messages took Plaintiffs to the homepage of Schultz’s website, which included various video clips, including a livestream of Schultz’s speech and a link to a website where consumers could purchase his book. But the court held that the website was not transformed into a solicitation by the “mere inclusion of a link to a website on which a consumer can purchase a product.” The court found that the speech focused on Schultz’s political views and potential run for president, not his book. The court further found that the website was just a way to facilitate viewing of Schultz’s speech. Thus, the court ultimately determined that the messages did not constitute “telephone solicitations” under the TCPA.

With the seemingly never-ending national campaign season chugging along, we expect to see more such claims filter their way through the courts.

©2019 Drinker Biddle & Reath LLP. All Rights Reserved

For more on TCPA litigation, see the National Law Review Communications, Media & Internet Law page.

ADA Website Litigation Likely to Increase

There has been considerable confusion amongst business owners as to the requirements of the Americans with Disabilities Act (ADA) as it relates to websites. The ADA requires, among other things, that places of “public accommodation” remove barriers to access for people with disabilities. This law has long been understood to apply to brick-and-mortar establishments, such as restaurants, retail stores, and hotels, but recent court decisions have held that the ADA applies to the websites and mobile applications of businesses offering goods and services online.

The Department of Justice (DOJ), which is responsible for establishing regulations pursuant to the ADA, has thus far failed to issue any guidance, regulations, or technical standards for online platforms, resulting in uncertainty for many business owners. Many have looked to the case of Robles v. Domino’s Pizza, LLC   for potential guidance. Robles was filed by a blind man who claimed that he could not access the Domino’s website and mobile app with his screen-reading software. The District Court dismissed the case on the basis that, although the ADA applied to the website and app, the DOJ’s failure to provide guidance as to the ADA’s application to websites violated Domino’s due process rights. The Ninth Circuit reversed this ruling, and on October 7, 2019, the U.S. Supreme Court denied a petition by Domino’s Pizza asking the Court to review the Ninth Circuit’s decision.

The Supreme Court’s refusal to review the Ninth Circuit decision maintains the uncertainty in what will no doubt be an expanding field of litigation. Business owners should expect to see an increase in ADA website litigation, and should take steps to ensure that their websites and mobile apps are accessible to disabled users.

 

© 2010-2019 Allen Matkins Leck Gamble Mallory & Natsis LLP

ARTICLE BY Rachel M. Sanders of Allen Matkins Leck Gamble Mallory & Natsis LLP.
More website regulation on the National Law Review Internet, Communications & Media law page.

CPSC Staff Addresses IoT 2018 Hearing Feedback, IoT Project Plans in New Report

Connected products can make the world a safer place: electronic sensors in the home can detect problems and send smartphone notifications to the homeowner; smart alert devices can notify family members or home help companies that an elderly person has fallen and needs assistance. But with over 64 billion connected products in the marketplace, there is a concern that connected devices could introduce hazards that might lead to a risk of injury due to problems with software updates or customization, faulty connections, and even consumer modifications.

As the body charged with overseeing consumer product safety in the U.S., over the last few years, the Consumer Product Safety Commission (CPSC) has shown an increasing interest in defining its role with regard to connected products. In May 2018, the CPSC held a public hearing on IoT, obtaining feedback from a range of stakeholders on potential risks of connected consumer products and the agency’s role. In late September, CPSC staff submitted to the Commission a status report outlining the CPSC’s work on consumer product IoT issues since the public hearing. The report also outlines how CPSC staff understands the agency’s role, which is safeguarding consumers from potential physical product risks, as well as how its work intersects with the jurisdiction of other agencies as they oversee connected products.

The report notes that this is an ongoing process, stating that CPSC staff is working on “how to define consumer product safety in terms of the IoT, the intersection of, and interdependencies among, consumer product safety, data security and privacy, and how our traditional risk management approaches apply to connected products.” The report acknowledges that privacy and data security are not within CPSC’s jurisdiction, but noted that at least one participant in CPSC’s 2018 hearing warned that “CPSC should pay attention to certain cybersecurity threats that create opportunities for physical harm, a risk not previously considered, and resist creating any prescriptive rules for IoT devices.”

To increase institutional knowledge of IoT benefits and challenges, CPSC has dedicated resources to develop its staff’s expertise. CPSC has also participated in developing voluntary standards, has taken a leadership role in establishing an interagency IoT working group, and has been developing its capability to simulate home networks at its laboratory.

The staff report outlines three ongoing internal projects relating to IoT. The first involves developing a methodology for assessing safety-related implications arising out of software and firmware updates to connected products. This project is at what CPSC views as the intersection of product safety and data security and potential “hazardization” of connected products as a result of data vulnerabilities. CPSC is also looking at connected heating appliances and the risks associated with their remote activation. Finally, CPSC is studying smart toys “in an effort to identify physical safety hazards.” It is surprising that CPSC staff would dedicate resources to toys as opposed to other products, like in-home safety devices, since the physical safety of toys is strictly regulated by the mandatory toy safety standard, ASTM F-963. The likelihood of physical hazardization of toys is far lower than, for example, connected home security devices and sensors. In those categories, connectivity, and thus security breaches that affect the operation of those devices, may be directly related to both safety risks and advantages. Indeed, home safety devices is a category where we have actually seen CPSC recall activity.

The report notes that CSPC is engaging in product safety assessments of connected& shared e-scooters. This is likely in response to reports of e-scooters that were vulnerable to hacking. The emerging hazards of micro-mobility devices such as shared e-scooters are also a focus of CPSC’s Operating Plan for Fiscal Year 2020 and represent another product category that appears to be more vulnerable to hazardization than connected toys.

CPSC staff intended to develop a best practices guide for industry and consumers on connected products, which was an enumerated project in the proposed Operating Plan for Fiscal Year 2020. However, an amendment introduced by Commissioner Feldman focuses CPSC’s resources on IoT intergovernmental work instead. Given the report’s acknowledgment that the agency is still working to develop staff expertise in IoT, attempting to create such a guide appears premature at this juncture.

The sharp increase in the number of connected devices in the market means it is necessary and appropriate for CPSC to continue to build expertise on IoT issues, even though very few examples of actual product safety hazards attributable to some type of connectivity failures exist. It would be useful for CPSC to focus its efforts and resources on product categories that pose a higher potential risk to the physical safety of consumers through hazardization or failure as a result of connectivity, without overstating potential risks. It is encouraging that through the intergovernmental initiatives a variety of federal agencies are working collaboratively to better understand the various consumer protection issues potentially raised by connected products that fit within their respective jurisdictions.

© 2019 Keller and Heckman LLP

For more CSPC regulation, see the National Law Review Consumer Protection law page.

Small and Mid-Sized Businesses Continue to Be Targeted by Cybercriminals

A recent Ponemon Institute study finds that small and mid-sized businesses continue to be targeted by cybercriminals, and are struggling to direct an appropriate amount of resources to combat the attacks.

The Ponemon study finds that 76 percent of the 592 companies surveyed had experienced a cyber-attack in the previous year, up from 70 percent last year. Phishing and social engineering attacks and scams were the most common form of attack reported by 57 percent of the companies,  while 44 percent of those surveyed said the attack came through a malicious website that a user accessed. I attended a meeting of Chief Information Security Officers this week and was shocked at one statistic that was discussed—that a large company filters 97 percent of the email that is directed at its employees every day. That means that only 3 percent of all email that is addressed to users in a company is legitimate business.

A recent Accenture report shows that 43 percent of all cyber-attacks are aimed at small businesses, but only 14 percent of them are prepared to respond. Business insurance company Hiscox estimates that the average cost of a cyber-attack for small companies is $200,000, and that 60 percent of those companies go out of business within six months of the attack.

These statistics confirm what we all know: cyber-attackers are targeting the lowest hanging fruit—small to mid-sized businesses, and municipalities and other governmental entities that are known to have limited resources to invest in cybersecurity defensive tools. Small and mid-sized businesses that cannot devote sufficient resources to protecting their systems and data may wish to consider other ways to limit risk, including prohibiting employees from accessing websites or emails for personal reasons during working hours. This may sound Draconian, but employees are putting companies at risk by surfing the web while at work and clicking on malicious emails that promise free merchandise. Stopping risky digital behavior is no different than prohibiting other forms of risky behavior in the working environment—we’ve just never thought of it this way before.

Up to this point, employers have allowed employees to access their personal phones, emails and websites during working hours. This has contributed to the crisis we now face, with companies often being attacked as a result of their employees’ behavior. No matter how much money is devoted to securing the perimeter, firewalls, spam filters or black listing, employees still cause a large majority of security incidents or breaches because they click on malicious websites or are duped into clicking on a malicious email. We have to figure out how employees can do their jobs while also protecting their employers.

Copyright © 2019 Robinson & Cole LLP. All rights reserved.

For more on cybersecurity, see the National Law Review Communications, Media & Internet law page.

LinkedIn Petitions Circuit Court for En Banc Review of hiQ Scraping Decision

On October 11, 2019, LinkedIn Corp. (“LinkedIn”) filed a petition for rehearing en banc of the Ninth Circuit’s blockbuster decision in hiQ Labs, Inc. v. LinkedIn Corp., No. 17-16783 (9th Cir. Sept. 9, 2019). The crucial question before the original panel concerned the scope of Computer Fraud and Abuse Act (CFAA) liability to unwanted web scraping of publicly available social media profile data and whether once hiQ Labs, Inc. (“hiQ”), a data analytics firm, received LinkedIn’s cease-and-desist letter demanding it stop scraping public profiles, any further scraping of such data was “without authorization” within the meaning of the CFAA. The appeals court affirmed the lower court’s order granting a preliminary injunction barring LinkedIn from blocking hiQ from accessing and scraping publicly available LinkedIn member profiles to create competing business analytic products. Most notably, the Ninth Circuit held that hiQ had shown a likelihood of success on the merits in its claim that when a computer network generally permits public access to its data, a user’s accessing that publicly available data will not constitute access “without authorization” under the CFAA.

In its petition for en banc rehearing, LinkedIn advanced several arguments, including:

  • The hiQ decision conflicts with the Ninth Circuit Power Ventures precedent, where the appeals court held that a commercial entity that accesses a website after permission has been explicitly revoked can, under certain circumstances, be civilly liable under the CFAA. Power Ventures involved Facebook user data protected by password (that users initially allowed a data aggregator permission to access). LinkedIn argued that the hiQ court’s logic in distinguishing Power Ventures was flawed and that the manner in which a user classifies his or her profile data should have no bearing on a website owner’s right to protect its physical servers from trespass.

“Power Ventures thus holds that computer owners can deny authorization to access their physical servers within the meaning of the CFAA, even when users have authorized access to data stored on the owner’s servers. […] Nothing about a data owner’s decision to place her data on a website changes LinkedIn’s independent right to regulate who can access its website servers.”

  • The language of the CFAA should not be read to allow for “authorization” to be assumed (and unable to be revoked) for publicly available website data, either under Ninth Circuit precedent or under the CFAA-related case law of other circuits.

“Nothing in the CFAA’s text or the definition of ‘authorization’ that the panel employed—“[o]fficial permission to do something; sanction or warrant,” suggests that enabling websites to be publicly viewable is not ‘authorization’ that can be revoked.”

  • The privacy interests enunciated by LinkedIn on behalf of its users is “of exceptional importance,” and the court discounted the fact that hiQ is “unaccountable” and has no contractual relationship with LinkedIn users, such that hiQ could conceivably share the scraped data or aggregate it with other data.

“Instead of recognizing that LinkedIn members share their information on LinkedIn with the expectation that it will be viewed by a particular audience (human beings) in a particular way (by visiting their pages)—and that it will be subject to LinkedIn’s sophisticated technical measures designed to block automated requests—the panel assumed that LinkedIn members expect that their data will be ‘accessed by others, including for commercial purposes,’ even purposes antithetical to their privacy setting selections. That conclusion is fundamentally wrong.

Both website operators and open internet advocates will be watching closely to see if the full Ninth Circuit decides to rehear the appeal, given the importance of the CFAA issue and the prevalence of data scraping of publicly available website content. We will keep a close watch on developments.

© 2019 Proskauer Rose LLP.

Whatever Happened to that Big Ringless Voicemail Decision We Were All Expecting? It Was a Nothing Burger—For Now

You’ll recall a few weeks back TCPAWorld.com featured analysis of efforts by VoApps—makers of the DirectDrop ringless voicemail platform—to stem the tide of negative TCPA rulings addressing ringless voicemail technologies. VoApps founder David King even joined the Unprecedented podcast to discuss his submission of a lengthy declaration to the court addressing how the technology works and why it is not covered by the TCPA.

Well, a few days ago the Court issued its ruling on the pending motion—a summary judgment effort by the Plaintiff—and I must say, it was rather anti-climactic. Indeed, the court punted entirely on the key issue.

In Saunders v. Dyck O’Neal, Case No. 1:17-CV-335, 2019 U.S. Dist. LEXIS 177606 (W.D. Mich. Oct. 4, 2019) the court issued its highly-anticipated ruling on the Plaintiff’s bid to earn judgment following the Court’s earlier ruling that a ringless voicemail is a call under the TCPA. It was in response to this motion that VoApps submitted a mountain of evidence that although a ringless voicemail may be a “call” it is not a call to a number assigned to a cellular service—and so such calls are not actionable under the TCPA’s infamous section 227(b).

Rather than answer the question directly the Court made mincemeat of the Federal Rules of Civil Procedure and treated the summary judgment motion as if it were some sort of motion to confirm the Court’s earlier ruling. This is weird because: i) no it wasn’t; and ii) there’s no such thing. As the Court put it: “Admittedly, Saunders moved for summary judgment, but her motion is in fact limited to a request for clarification of the impact of the Court’s prior ruling: Was the Court’s prior ruling that DONI’s messaging technology falls within the purview of the TCPA a ruling as a matter of law that binds the parties going forward? The answer is clearly yes.”

Great. So we now know what we already all knew—the Saunders court holds that a ringless voicemail is a call. Got it. As to the key issue of whether the calls were made to a landline to a cell phone, however, the Court finds: “These issues were unnecessary to Saunders’s motion, as she has not [actually] moved for summary judgment on her claim.”

So there you go. Plaintiff’s motion for summary judgment was not actually a motion for summary judgment after all. So all that work by VoApps was for nothing. But not really. Obviously this fight is not yet over. The Court declined to enter judgment in favor of the Plaintiff meaning that further work—and perhaps a trial—lies ahead for the good folks over at VoApps. We’ll keep you posted.

 

© Copyright 2019 Squire Patton Boggs (US) LLP

For more on voicemail & phone regulation, see the National Law Review Communications, Media & Internet law page.

Resist the Urge to Access: the Impact of the Stored Communications Act on Employer Self-Help Tactics

As an employer or manager, have you ever collected a resigning employee’s employer-owned laptop or cellphone and discovered that the employee left a personal email account automatically logged in? Did you have the urge to look at what the employee was doing and who the employee was talking to right before resigning? Perhaps to see if he or she was talking to your competitors or customers? If so, you should resist that urge.

The federal Stored Communications Act, 18 U.S.C. § 2701, et seq., is a criminal statute that makes it an offense to “intentionally access[ ]without authorization a facility through which an electronic communication service is provided[ ]and thereby obtain[ ] . . . access to a[n] . . . electronic communication while it is in electronic storage  . . . .” It also creates a civil cause of action for victims of such offenses, remedied by (i) actual damages of at least $1,000; (ii) attorneys’ fees and court costs; and, potentially, (iii) punitive damages if the access was willful or intentional.

So how does this criminal statute apply in a situation in which an employee uses a personal email account on an employer-owned electronic device—especially if an employment policy confirms there is no expectation of privacy on the employer’s computer systems and networks? The answer is in the technology itself.

Many courts find that the “facility” referenced in the statute is the server on which the email account resides—not the company’s computer or other electronic device. In one 2013 federal case, a former employee left her personal Gmail account automatically logged in when she returned her company-owned smartphone. Her former supervisor allegedly used that smartphone to access over 48,000 emails on the former employee’s personal Gmail account. The former employee later sued her former supervisor and her former employer under the Stored Communications Act. The defendants moved to dismiss the claim, arguing, among other things, that a smartphone was not a “facility” under the statute.

While agreeing with that argument in principle, the court concluded that it was, in fact, Gmail’s server that was the “facility” for purposes of Stored Communications Act claims. The court also rejected the defendants’ arguments (i) that because it was a company-owned smartphone, the employee had in fact authorized the review, and (ii) that the former employee was responsible for any alleged loss of privacy, because she left the door open to the employer reviewing the Gmail account.

Similarly, in a 2017 federal case, a former employee sued her ex-employer for allegedly using her returned cell phone to access her Gmail account on at least 40 occasions. To assist in the prosecution of a restrictive covenant claim against the former employee, the former employer allegedly arranged to forward several of those emails to the employer’s counsel, including certain allegedly privileged emails between the former employee and her lawyer. The court denied the former employer’s motion to dismiss the claim based on those allegations.

Interestingly, some courts, including both in the above-referenced cases, draw a line on liability under the Stored Communication Act based on whether the emails that were accessed were already opened at the time of access. This line of reasoning is premised on a finding that opened-but-undeleted emails are not in “storage for backup purposes” under the Stored Communications Act. But this distinction is not universal.

In another 2013 federal case, for example, an individual sued his business partner under the Stored Communications Act after the defendant logged on to the other’s Yahoo account using his password. A jury trial resulted in a verdict for the plaintiff on that claim, and the defendant filed a motion for judgment as a matter of law. The defendant argued that she only read emails that had already been opened and that they were therefore not in “electronic storage” for “purposes of backup protection.” The court disagreed, stating that “regardless of the number of times plaintiff or defendant viewed plaintiff’s email (including by downloading it onto a web browser), the Yahoo server continued to store copies of those same emails that previously had been transmitted to plaintiff’s web browser and again to defendant’s web browser.” So again, the court read the Stored Communications Act broadly, stating that “the clear intent of the SCA was to protect a form of communication in which the citizenry clearly has a strong reasonable expectation of privacy.”

Based on the broad reading of the Stored Communications Act in which many courts across the country engage, employers and managers are well advised to exercise caution before reviewing an employee’s personal communications that may be accessible on a company electronic device. Even policies informing employees not to expect privacy on company computer systems and networks may not save the employer or manager from liability under the statute. So seek legal counsel if this opportunity presents itself upon an employee’s separation from the company. And resist the urge to access before doing so.

© 2019 Foley & Lardner LLP
For more on the Stored Communications Act, see the National Law Review Communications, Media & Internet law page.

Head Hacking: New Devices Gather Brainspray

For more than a decade I have been warning about the vulnerability of brainspray – the brain signals that can be captured from outside your head. In 2008, this article by Jeffery Goldberg demonstrated that an fMRI machine could easily interpret how a person felt about stimuli provided – which could be a boon to totalitarian governments testing for people’s true feelings about the government or its Dear Leader. Of course in 2008 the fMRI costs two million dollars and you must lie still inside it for a useful reading to emerge.

While fMRI mind reading and lie detection is not yet ready for the courtroom, its interpretations are improving all the time and mobile units are under consideration. And its wearable cousins, like iWatches and computerized head gear are reading changes from within your body, such as electrocardiogram, heart rate, blood pressure, respiration rate, blood oxygen saturation, blood glucose, skin perspiration, capnography, body temperature, motion evaluation, cardiac implantable devices and ambient parameters. Certain head gear is calibrated just for brain waves.

Some of this is gaming equipment and some helps you meditate.  Biofeedback headsets measure your brain waves, using EEG. They’re small bands that sit easily on your head and measure activity through sensors. Several companies like MindWave, NeuroSky, Thync, and Versus all make such equipment available to the general public.

Of course, if you really want to frighten yourself about how far this technology has advances, check in on DARPA and the rest of the US Military. DARPA has been testing brainwave filtering binoculars , human brainwave driven targeting for killer robots,  and soldier brain-machine interfaces for military vehicles. And these are just the things they are currently willing to dicuss in public.

I wrote six years ago about how big companies like Honda were exploring brainspray capture, and have spoken about how Google, Facebook and other Silicon Valley giants have sunk billions of dollars into creating brain-machine interfaces and reading brainspray for practical purposes.

I will write more on this later, but be aware that hacking of this equipment is always possible, which could give the wrong people access to your brain waves and pick up if you are thinking of your bank account PIN or other sensitive matter. Your thoughts of any sort should be protected from view.  Thought-crime has always been on the other side of the line.

Now that it is possible to read your brainspray with greater certainty, we should be considering how to regulate this activity.  I don’t mind giving the search engine my information in exchange of efficient immediate searches.  But I don’t want to open my head to companies or government.

Copyright © 2019 Womble Bond Dickinson (US) LLP All Rights Reserved.

For more in device hacking, see the Communications, Media & Internet law page on the National Law Review.