Widespread Use of GOOGLE Trademark as a Verb Does Not Render the Mark Generic

On May 16, 2017, the United States Court of Appeals for the Ninth Circuit held that widespread use of the word “google” as a verb for “searching the internet” – as opposed to use as an adjective for a brand of internet search engine – was insufficient to establish that GOOGLE ceased to function as a trademark. Elliott v. Google, Inc., No 15-15809, slip op. (9th Cir. May 16, 2017). As a result, the Ninth Circuit affirmed the district court’s granting of summary judgment in favor of defendant Google, Inc. on the plaintiffs’ Lanham Act claim seeking cancellation of the GOOGLE trademark on the ground that it had become generic.

Generic terms are words that are the commonly accepted identification of a type of goods or services. By way of example, “automobile” and “chair” are generic terms when used in connection with their dictionary meanings. Under federal law, generic terms are not protectable as trademarks. Trademarks can become generic over time if they are used as the name for a category of goods or services instead of as a brand name or source identifier. This is commonly known in trademark law as “genericide.” Examples of terms that have lost federal trademark protection due to genericide include “aspirin,” “escalator,” and “thermos,” each of which was once a protectable trademark. A registered trademark may be cancelled if it loses its source-identifying significance by becoming the generic name of a particular type of good or service. 15 U.S.C. §1064(3); Elliott, slip op. at 6.

The question before the Ninth Circuit was “whether the primary significance of the word ‘google’ to the relevant public is as a generic name for internet search engines or as a mark identifying the GOOGLE search engine in particular.” Elliott, slip op. at 12. The plaintiffs argued that the word “google” is primarily understood as “a generic term universally used to describe the act of internet searching.” In support, the plaintiffs presented consumer survey evidence showing that a majority of consumers used the term “google” as a verb for the act of searching the internet.

The Ninth Circuit rejected plaintiffs’ claim as a matter of law for two reasons. First, the court clarified that “a claim of genericide or genericness must be made with regard to a particular type of good or service.” Elliott, slip op. at 8 (emphasis added). Thus, surviving summary judgment would have required plaintiffs to present evidence that the term “google” is generic specifically with regard to internet search engines. Second, the court concluded that “verb use does not automatically constitute generic use,” thus rejecting plaintiffs’ grammatical argument that a word can only be protectable as a trademark when used as an adjective. Elliott, slip op. at 10. The court noted that the part of speech is not dispositive of the genericide issue, as it is well-established that “a speaker might use a trademark as a noun and still use the term in a source-identifying trademark sense.” Elliott, slip op. at 10-11. For example, a restaurant customer might order “a coke,” using the mark as a noun, while still having a particular source of cola beverages – the Coca-Cola Company – in mind. Id. at 11. As a result, plaintiffs’ consumer survey evidence that the public uses the term “google” as a verb was insufficient as a matter of law, because such evidence did not reveal consumers’ thoughts regarding use of the term with respect to internet search engines. Without more evidence, it was not possible to ascertain whether the survey respondents were using the verb “google” in an indiscriminate sense, with no particular internet search engine in mind; or in a discriminate sense, with the Google search engine in mind.

In light of Elliott, a party claiming that a mark has become generic would be wise to present consumer surveys in which respondents indicate whether they believe a term is a brand name or a common name for a particular good or service, regardless of grammatical function. Any consumer survey submitted should be conducted by qualified experts according to accepted principles. As an example, in Elliott, Google offered a survey in support of its position that the GOOGLE mark is not generic, which began by providing a brief overview of the difference between brand names and common names, then asked respondents to classify various words – such as “Coke,” “Jello,” “Amazon,” “Refrigerator,” “Browser,” and “Website” – as either brand names or common names. Id. at 16. Approximately 93% of respondents described “Google” as a brand name. Unlike plaintiffs’ survey, the Ninth Circuit viewed the results of Google’s survey as evidencing consumers’ primary understanding of the word “google” as it related to search engines.

This case contravenes the conventional guidance to always use trademarks as adjectives that modify a descriptive or generic term. Although the Elliott court acknowledged that using a trademark as an adjective makes it easier to prove the source-identifying function of the mark, this holding makes clear that widespread use of trademarks as nouns and verbs does not make them generic, absent significant evidence of indiscriminate consumer use of the mark to refer to any brand of a particular good or service.

This post was written byThomas A. Agnello and Luke W. DeMarte of Michael Best & Friedrich LLP.

Fourth Circuit Ruling Continues Star-Crossed Fate of Trump Administration Travel Ban

On May 25, 2017 the U.S. Court of Appeals for the Fourth Circuit upheld a lower court’s nationwide injunction against the Trump administration’s executive order (EO) suspending entry into the United States of foreign nationals from six designated countries: Iran, Libya, Somalia, Sudan, Syria, and Yemen. This ruling maintains the current status quo under which key provisions of the travel ban have been blocked. As a result, employees from the designated countries remain free to travel to and request admission into the United States.

The EO at issue in the case, “Protecting the Nation from Foreign Terrorist Entry into the United States,” is a revised version of the original executive order that had also encountered legal obstacles. Under the revised version of the executive order, the Trump administration had attempted to address some of the early objections to the original executive order by excluding certain foreign nationals from its scope, such as those who already had visas, or who were green card holders or dual nationals traveling on a passport from a non-designated country. Despite those changes, the revised EO, issued on March 6, 2017, met with challenges and legal objections similar to the original. Section 2(c) of the revised EO, “Temporary Suspension of Entry for Nationals of Countries of Particular Concern During Review Period,” was the central focus in this case.

While the court was not directly evaluating the constitutionality of the travel ban, the judges took a close look at the strength of the plaintiff’s Establishment Clause claim against the EO. The Establishment Clause prohibits the government from making any law respecting an establishment of religion. In defense of the EO, the administration has asserted a need to accord deference to the president’s actions taken to protect the nation’s security. The court, however, noted that the president’s authority cannot go unchecked, and included an examination of past statements made by President Donald Trump in its analysis.

Stating that the Trump administration’s travel ban was rooted more in the intent to bar Muslims from the country rather than in the government’s asserted national security interest, the court found that the public interest argued in favor of upholding the district court’s preliminary injunction.

Attorney General Jeff Sessions issued a statement confirming that the government intends to appeal the Fourth Circuit’s decision to the Supreme Court of the United States. A separate nationwide injunction against the EO is currently under appeal in the Ninth Circuit. Oral arguments were heard in that case on May 15, 2017, and a decision is pending. Because the case is still ongoing, this latest decision should not be considered a final determination of the EO’s fate.

This post was written by Jordan C. Mendez and Lowell Sachs of  Ogletree, Deakins, Nash, Smoak & Stewart, P.C.

CBO Greenlights Telehealth Provisions in Senate’s CHRONIC Care Act

Last week, the Congressional Budget Office (CBO) concluded that a key piece of telehealth legislation, the CHRONIC Care Act of 2017, would not, overall, increase or decrease Medicare spending. This score is significant as it marks the first time that CBO has concluded that providing enhanced Medicare coverage for telehealth services would be budget neutral and clears the path for Congress to pass the legislation in a tough political climate.

american health care actThe CHRONIC Care Act was developed by the Senate Finance Committee’s Bipartisan Chronic Care Working Group. If enacted, the bill would expand Medicare coverage of telehealth services in four ways:

  • Nationwide Coverage for Telestroke – Currently, Medicare will pay a physician for consulting on a patient experiencing acute stroke symptoms via telehealth only if the hospital where the patient is located is in a rural Health Professional Shortage Area (HPSA) or a county outside a Metropolitan Statistical Area (MSA). Under the CHRONIC Care Act, beginning in 2019, the geographic restriction would be eliminated and physicians would receive payment for telestroke consultations regardless of the hospital location.
  • Home Remote Patient Monitoring for Dialysis Therapy – Medicare requires that beneficiaries receiving home dialysis treatments have a monthly clinical assessment from their health care provider. Under current law, beneficiaries can only use telehealth to satisfy the clinical assessment requirement if the patient is at an authorized originating site (e.g., a physician office) located in a rural HPSA or a county outside an MSA. Beginning in 2019, beneficiaries could receive the required monthly clinical assessment from a freestanding dialysis facility or the patient’s home without geographic restriction.
  • Enhanced Telehealth Coverage for ACOs – The CHRONIC Care Act would apply the Next Generation ACO telehealth waiver criterion to the Medicare Shared Savings Program (MSSP) Track II, MSSP Track III, and the Pioneer ACO program. Specifically, the legislation would (i) eliminate the geographic component of the originating site requirement, and (ii) allow beneficiaries assigned to the approved MSSP and ACO programs to receive telehealth services in the home.
  • Increased Flexibility for Telehealth Coverage under Medicare Advantage Plans – Under current law, a Medicare Advantage (MA) plan may provide telehealth benefits beyond those that are currently reimbursed by Medicare. However, these enhanced telehealth services are not separately paid for by Medicare and MA plans must use their rebate dollars to pay for those services as a supplemental benefit. The CHRONIC Care Act would allow an MA plan to offer additional, clinically appropriate, telehealth benefits in its annual bid amount beginning in 2020.

The CHRONIC Care Act has been widely heralded by health care providers as a first step in removing barriers to providing telehealth services to Medicare beneficiaries. In a recent Senate Finance Committee hearing, health care providers voiced their support for greater coverage of telemedicine services. The Senate Finance Committee is in the process of marking up the bill.

This post was written by Carrie Roll of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

State Department Makes Predictions about EB Cut-Off Date Movement

Notably, the State Department stated with certainty that the EB-2 Rest of the World category likely will retrogress in the coming months.

At a recent American Immigration Lawyers Association meeting, the US Department of State made comments about Employment-Based (EB) cut-off date movement in the final third of the fiscal year. This Immigration Alert summarizes the comments made by the State Department and what they could mean for EB cut-off date movement in the upcoming months.

EB-1: China and India

US Citizenship and Immigration Services announced that the “final action date” of January 1, 2012 will control for the China and India EB-1 categories. These have apparently exhausted close to 50% of the entire EB-1 limit for the 2017 fiscal year. This cut-off date is expected to be maintained until the end of September, when the fiscal year ends. The final action cut-off date for the China and India EB-1 categories may once again become current at the start of the new fiscal year on October 1, 2017, but there is no guarantee that this will happen.

EB-1: Rest of the World

The EB-1 Rest of the World category (i.e., countries other than China, India, Mexico, the Philippines, El Salvador, Guatemala, and Honduras) should remain current for the foreseeable future.

EB-2: India

A slight advancement in the EB-2 India category will occur in June, but it is unlikely that this category will once again reach the most advanced final action cut-off date that was reached last year. The State Department stated that it may maintain the existing final action date through the end of September, but there is no guarantee that this will occur.

EB-2: China

EB-2 China will advance by less than one month to March 1, 2013 in June. The State Department noted that the EB-2 China category should continue to advance slowly and will probably exhaust its per-country limit before the end of the year.

EB-3: China

EB-3 China’s final action date of October 1, 2014 will continue to apply in June. As a result of a significant EB-3 downgrade volume, retrogression in this category is possible in the final months of the fiscal year.

EB-2: Worldwide

The State Department noted that the EB-2 category has experienced significant usage, and stated with certainty that a final action cut-off date will be imposed for the EB-2 Rest of the World category in August—or even as early as JulyThis cut-off date, once imposed, should remain unchanged through the end of September, with a small advancement possible in September and a return to currency in October.

EB-3: Rest of the World

The EB-3 Rest of the World category will move forward by one month in June to April 15, 2017. The State Department expects further forward movement in this category for the rest of the fiscal year.

EB-3: India

The State Department noted that the EB-3 India category will advance in June from March 25, 2005 to May 15, 2005. Continued forward movement is expected in July and August. The State Department predicts that the July cut-off date for the EB-3 India category will advance to October 15, 2005.

How This Affects You

It is highly likely that the cut-off date movement predicted by the State Department will occur. Persons seeking permanent residence through the EB process should take note of this predicted movement and plan accordingly. In particular, persons in the EB-2 Rest of the World category may wish to consider filing adjustment of status applications before the anticipated retrogression in this category occurs in July or August. Once this retrogression occurs, only persons with priority dates before the new cut-off date will be able to file such applications.

This post was written by A. James Vázquez-Azpiri of Morgan, Lewis & Bockius LLP.

Practicing Telemedicine Across State Borders: New Expedited Licenses Permit Physicians to Expand Practice

In a watershed moment for the expansion of telemedicine, the Interstate Medical Licensure Compact Commission is now processing applications to allow physicians to practice telemedicine across state lines with greater ease. Nineteen states have passed legislation to adopt the Interstate Medical Licensure Compact, which allows physicians to obtain a license to practice medicine in any Compact state through a simplified application process.  Under the new system, participating state medical boards retain their licensing and disciplinary authority, but agree to share information essential to licensing, creating a streamlined process.

The Federation of State Medical Boards’ President and CEO, Humayun Chaudhry, DO, MACP, called the Compact a “milestone” for medical regulation in the United States.  “The launch of the Compact will empower interested and eligible physicians to deliver high-quality care across state lines to reach more patients in rural and underserved communities. This is a major win for patient safety and an achievement that will lessen the burden being felt nationwide as a result of our country’s physician shortage.”

States currently participating in the Compact are Idaho, Montana, Wyoming, Nevada, Arizona, Utah, Colorado, South Dakota, Kansas, Minnesota, Iowa, Wisconsin, Illinois, Mississippi, Alabama, West Virginia, Pennsylvania, New Hampshire, and Nebraska.  Seven additional states have proposed legislation to adopt the Compact, including Washington, D.C.

Most states require a physician to obtain a license to practice medicine in each state where the patient is located at the time of the physician-patient encounter.  Prior to adoption of the Compact, obtaining licensure in a given state was an oppressive task, requiring the physician to complete lengthy applications, submit required documentation, pay fees, and pass examinations.  This proved to be a burdensome restriction for physicians practicing telemedicine, where patients may be located in any state at the time of the physician-patient encounter.  Licensing requirements were identified as a significant barrier to the expansion of telemedicine, prompting introduction of the Compact.

Physicians are eligible to apply for the Compact license if they possess a full and unrestricted license to practice medicine in a Compact state and have not been disciplined by any state medical board, among other requirements.  To apply, the physician must designate a Compact state as the “state of principal licensure” and select the other Compact states in which they would like to become licensed.  The state of principal licensure will verify the physician’s eligibility and provide credential information to the Interstate Commission.  The Interstate Commission then collects applicable fees and transmits the physician’s information to the additional states, where the licenses will then be granted.

Participation in the Compact creates another pathway for licensure, but does not otherwise change a state’s existing Medical Practice Act.  Physicians located in a state that has not adopted the Compact may still obtain licensure in other states through the ordinary licensure process.

This post was written by Marki Stewart at Dickinson Wright PLLC.

Weapons in the Cyber Defense Arsenal

In May 2017, the world experienced an unprecedented global cyberattack that targeted the public and private sectors, including an auto factory in France, dozens of hospitals and health care facilities in the United Kingdom, gas stations in China and banks in Russia. This is just the tip of the iceberg and more attacks are certain to follow. As this experience shows, companies of all sizes, across all industries, in every country are vulnerable to cyberattacks that can have devastating consequences for their businesses and operations.

The Malware Families

Exploiting vulnerabilities in Microsoft® software, hackers launched a widespread ransomware attack targeting hundreds of thousands of companies worldwide. The vector, “WannaCry” malware, encrypts electronic files and locks them until released by the hacker after a ransom is paid in untraceable Bitcoin. The malware also has the ability to spread to all other computer systems on a network. On the heels of WannaCry, a new attack called “Adylkuzz” is crippling computers by diverting their processing power.

The most prevalent types of ransomware found in 2016 were Cerber and Locky. Microsoft detected Cerber, used in spam campaigns, in more than 600,000 computers and observed that it was one of the most profitable of 2016. Spread via malicious spam emails that have an executable virus file, Cerber has gained increasing popularity due to its Ransomware-as-a-Service (RaaS) business model, which enables less sophisticated hackers to lease the malware.

data security privacy FCC cybersecurityCheck Point Software indicated that Locky was the second most prevalent piece of malware worldwide in November 2016.  Microsoft detected Locky in more than 500,000 computers in 2016. First discovered in February 2016, Locky is typically delivered via an email attachment (including Microsoft Office documents and compressed attachments) in phishing campaigns designed to entice unsuspecting individuals to click on the attachment. Of course, as the most recent global attacks demonstrate, hackers are devising and deploying new variants of ransomware with different capabilities all the time.

The Rise of Ransomware Attacks

The rise in ransomware attacks is directly related to the ease with which it is deployed and the quick return for the attackers. The U.S. Department of Justice has reported that there was an average of more than 4,000 ransomware attacks daily in 2016, a 300 percent increase over the prior year. Some experts believe that ransomware may be one of the most profitable cybercrime tactics in history, earning approximately $1 billion in 2016. Worse yet, even with the ransom paid, some data already may have been compromised or may never be recovered.

The risk is even greater if your ransom-encrypted data contains protected health information (PHI). In July 2016, the U.S. Department of Health and Human Services, Office of Civil Rights (HHS/OCR) advised that the encryption or permanent loss of PHI would trigger HIPAA’s Breach Notification Rule for the affected population, unless a low probability that the recovered PHI had been compromised could be demonstrated. This means a mandated investigation to confirm the likelihood that the PHI was not accessed or otherwise compromised.

Ransomware Statistics

According to security products and solutions provider Symantec Corporation, ransomware was the most dangerous cybercrime threat facing consumers and businesses in 2016:

  • The majority of 2016 ransomware infections happened in consumer computers, at 69 percent, with enterprises at 31 percent.

  • The average ransom demanded in 2016 rose to $1,077, up from $294 in 2015.

  • There was a 36 percent increase in ransomware infections from 340,665 in 2015 to 463,841 in 2016.

  • The number of ransomware “families” found totaled 101 in 2016, triple the 30 found in 2015.

  • The biggest event of 2016 was the beginning of RaaS, or the development of malware packages that can be sold to attackers in return for a percentage of the profits.

  • Since January 1, 2016, more than 4,000 ransomware attacks have occurred − a 300 percent increase over the 1,000 daily attacks seen in 2015.

  • In the second half of 2016, the percentage of recognized ransomware attacks from all malware attacks globally doubled from 5.5 percent to 10.5 percent.

The Best Defense Is a Good Offense

While no perfectly secure computer system exists, companies can take precautionary measures to increase their preparedness and reduce their exposure to potentially crippling cyberattacks. While Microsoft no longer supports Windows XP operating systems, which were hit the hardest by WannaCry, Microsoft has made an emergency patch available to protect against WannaCry. However, those still using Windows XP should upgrade all devices to a more current operating system that is still fully supported by Microsoft to ensure protection against emerging threats. Currently, that means upgrading to Windows 7, Windows 8 or Windows 10.

Even current, supported software needs to be updated when prompted by the computer. Those who delay installing updates may find themselves at risk. Microsoft issued a patch for supported operating systems in March 2017 to protect against the vulnerability that WannaCry exploited. Needless to say, many companies did not bother to patch their systems in a timely manner.

Ransomware creates even greater business disruption when a company does not have secure backups of files that are critical to key business functions and operations. It also is important for companies to back up files frequently, because a stale backup that is several months old or older may not be particularly useful. Companies also should make certain that their antivirus and anti-malware software is current to protect against emerging threats.

In addition, companies need to train their employees on detecting and mitigating potential cyber threats. Employees are frequently a company’s first line of defense against many forms of routine cyberattacks that originate from seemingly innocuous emails, attachments and links from unknown sources. Indeed, many cyberattacks can be avoided if employees are simply trained not to click on suspicious links or attachments that could surreptitiously install malware.

Last but not least, companies should consider purchasing cyber liability insurance coverage, which is readily available. While cyber policies are still evolving and there are no standardized policy forms, coverage can be purchased at varying price points with different levels of coverage. Some of the more comprehensive forms of coverage provide additional “bells and whistles” such as immediate access to preapproved professionals that can guide companies through the legal and technical web of cybersecurity events and incident response.

Other cyber policies afford bundled coverages that may include:

  • The costs of a forensics investigation to identify the source and scope of an incident

  • Notification to affected individuals

  • Remediation in the form of credit monitoring and identity theft restoration services

  • Costs to restore lost, stolen or corrupted data and computer equipment

  • Defense of third-party claims and regulatory investigations arising out of a cyberattack.

 

This post was written by Anjali C. Das, Kevin M. Scott and John Busch of Wilson Elser Moskowitz Edelman & Dicker LLP.data security privacy FCC cybersecurity

Health Care Task Force Pre-Releases Report on Cybersecurity Days Before Ransomware Attack

Last week, the Health Care Industry Cybersecurity (HCIC) Task Force (the “Task Force”) published a pre-release copy of its report on improving cybersecurity in the health care industry.  The Task Force was established by Congress under the Cybersecurity Act of 2015.  The Task Force is charged with addressing challenges in the health care industry “when securing and protecting itself against cybersecurity incidents, whether intentional or unintentional.”

The Task Force released its report mere days before the first worldwide ransomware attack, commonly referred to as “WannaCry,” which occurred on May 12.  The malware is thought to have infected more than 300,000 computers in 150 jurisdictions to date.  In the aftermath of the attack, the U.S. Department of Health and Human Services (HHS) sent a series of emails to the health care sector, including a statement that government officials had “received anecdotal notices of medical device ransomware infection.”  HHS warned that the health care sector should particularly focus on devices that connect to the Internet, run on Windows XP, or have not been recently patched.  As in-house counsels understand, the ransomware attack raises a host of legal issues.

Timely, the HCIC report calls cybersecurity a “key public health concern that needs immediate and aggressive attention.”  The Task Force identifies six high-level imperatives, and for each imperative, offers several recommendations.

The imperatives are as follows:

  1. Define and streamline leadership, governance, and expectations for health care industry cybersecurity.

  2. Increase the security and resilience of medical devices and health IT.

  3. Develop the health care workforce capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities.

  4. Increase health care industry readiness through improved cybersecurity awareness and education.

  5. Identify mechanisms to protect research and development efforts and intellectual property from attacks or exposure.

  6. Improve information sharing of industry threats, weaknesses, and mitigations.

With respect to medical devices (imperative #2), the Task Force specifically advocates for greater transparency regarding third party software components.  The report encourages manufacturers and developers to create a “bill of materials” that describes its components, as well as known risks to those components, to enable health care delivery organizations to move quickly to determine if their medical devices are vulnerable.  Furthermore, the Task Force writes that product vendors should be transparent about their ability to provide IT support during the lifecycle of a medical device product.  The Task Force also recommends that health care organizations ensure that their systems, policies, and processes account for the implementation of available updates and IT support for medical devices, such as providing patches for discovered vulnerabilities.  The report suggests that government and industry “develop incentive recommendations to phase-out legacy and insecure health care technologies.”

The Task Force also encourages medical device manufacturers to implement “security by design,” including by making greater security risk management a priority throughout the product lifecycle, such as through adding greater testing or certification. In addition, the report encourages both developers and users to take actions that improve security access to information stored on devices, such as through multi-factor authentication.  The Task Force recommends that government agencies, such as the U.S. Food and Drug Administration (FDA) and the Office of the National Coordinator for Health Information Technology (ONC) at HHS, consider using existing authorities to “catalyze and reinforce activities and action items” associated with this recommendation.  This includes leveraging existing government guidance and industry standards, like FDA’s premarket and postmarket cybersecurity guidance documents.  Published in 2014 and 2016, these documents recommend that “manufacturers should monitor, identify, and address cybersecurity vulnerabilities and exploits as part of the [secure development lifecycle].”  We have previously discussed these guidance documents here and here.

Finally, the Task Force recommends that the health care industry take a “long-range approach” to considering “viability, effectiveness, security, and maintainability of” medical devices. The Task Force states that each product should have a defined strategy and design that supports cybersecurity during each stage of the product’s lifecycle.  In particular, the Task Force encourages HHS to evaluate existing authorities to conduct cybersecurity surveillance of medical devices.

This post was written by Dena Feldman and Christopher Hanson of Covington & Burling LLP.

San Mateo Gardens Teaches College District a Lesson on Picking Thorny Subsequent Review Procedure

The California Supreme Court recently addressed an important California Environmental Quality Act (CEQA) issue: Who decides whether CEQA’s subsequent review provisions are applicable when there are changes to an adopted project? Subsequent review provisions include a subsequent Environmental Impact Report (EIR) or Negative Declaration (ND), a supplemental EIR, or an addendum to an EIR or ND.  When a project that has been reviewed and finalized under CEQA is altered, what type of review process under CEQA is required, if any?  As we said before on Friends of the College of San Mateo Gardens v. San Mateo County Community College District et al., (2016) 1 Cal.5th 937 (Friends of the College), the Court determined that the lead agency makes this determination.  The question that the lead agency should be analyzing is whether the original document “retains some informational value” – if it does, then CEQA’s subsequent review procedures apply.  Should the lead agency’s decision be challenged, then the Court must decide whether “substantial evidence” supports the lead agency’s conclusion.

The First District Court of Appeal thus took up applying this standard on remand. In Friends of the College of San Mateo Gardens v. San Mateo County Community College District et al., (2017 WL *1829176) (San Mateo Gardens), the Court of Appeal upheld the San Mateo County Community College District’s determination that it could proceed under CEQA’s subsequent review provisions.  The District had previously analyzed its project, including the demolition or renovation of some buildings on a San Mateo college campus, through a mitigated negative declaration (MND).  After a failure to obtain funding for renovations to the “Building 20 complex,” the District altered the project to include demolition of Building 20 and its associated gardens (the centerpiece of the dispute) and to renovate two other buildings that were previously slated for demolition.  The District determined that these changes would “not result in a new or substantially more severe impact than disclosed” in the original MND, and thus proceeded to adopt the alteration through a subsequent review procedure document called an addendum.

The Court of Appeal held that the District’s decisions to proceed by CEQA’s subsequent review procedures was supported by substantial evidence. The relevant changes only altered the treatment of three buildings while leaving alone plans to demolish 14 others with attendant mitigation measures.

That the District could proceed by CEQA’s subsequent review procedures, however, only answers the first question. The subsidiary, and more “critical” issue, is “to determine whether the agency has properly determined how to comply with its obligations under those provisions.” Friends of the College, 1 Cal.5th at 953.  In other words, which subsequent review procedure is correct to use.  The Court of Appeal held that a more rigorous standard of review is applicable at this second step when a project is originally accompanied by a negative declaration than when an approved project is originally analyzed through an EIR.  This more rigorous standard looks to whether the negative declaration will require a “major revision.”  A major revision is required when “there is ‘substantial evidence that the changes to a project for which a negative declaration was previously approved might have a significant environmental impact not previously considered in connection with the project as originally approved.’ ” San Mateo Gardens, 2017 WL *1829176 (quoting Friends of the College, 1 Cal.5th at 959).  If the project was previously analyzed through an EIR, however, the agency may proceed without a subsequent EIR so long as substantial evidence supports the agency’s conclusion that no major revisions to the original document are necessary.

It is at this critical second step that the District failed. The Court of Appeal determined that there was substantial evidence that the altered project might have a significant “aesthetic impact”, which is a cognizable environmental impact under CEQA.  The “Building 20 complex” demolition would include removal of gardens which were of particular value to the college community for aesthetic purposes.  The Court of Appeal therefore concluded that the District violated CEQA in analyzing the altered project through an addendum when a subsequent EIR or MND was necessary.

The takeaway from this case is that lead agencies will have to be especially keen on determining the impact of project changes when the original project is adopted by a negative declaration. While the original document may retain some residual “informational value,” and thus allow CEQA’s subsequent review procedures, it may be difficult to show that project changes do not require some type of further environmental review. It is the lead agencyiess responsibility to determine the need for and type of further review, but that decision must be based upon substantial evidence.

This article was written by David H. McCray and Jacob P. Duginski of Beveridge & Diamond P.C.

Trump Administration Notifies Congress of Intent to Renegotiate NAFTA

The White House formally notified Congress on Thursday of the Trump administration’s intent to renegotiate the North American Free Trade Agreement (NAFTA). The notification letter from U.S. Trade Representative Robert Lighthizer marked the start of a 90-day window to consult with members of Congress on developing negotiation priorities before beginning formal negotiations with Canada and Mexico as early as August 16, 2017.NAFTA, USA, Mexico, Canada

Currently, there is no indication that renegotiations will impact NAFTA-related immigration programs. However, under the Bipartisan Congressional Trade Priorities and Accountability Act of 2015, the administration’s negotiation objectives are required to be made public 30 days before formal negotiations begin. While the letter to Congressional leadership did not discuss any specific changes to NAFTA, the administration indicated that it would aim to modernize outdated chapters of the agreement and address challenges faced by U.S. consumers, businesses, and workers.

NAFTA Immigration Programs

Among other economic and trade relationships established under NAFTA, the agreement created the TN nonimmigrant classification, which allows certain citizens of Canada and Mexico to work temporarily in the United States in a professional capacity. The agreement also provides an expanded range of permissible business activities for Canadian and Mexican citizens in B-1 visitor status and permits Canadian citizens to submit L-1 intracompany transferee petitions directly at U.S. ports of entry and pre-flight inspection stations for adjudication by U.S. Customs and Border Protection.

Whether the Trump administration intends to alter existing immigration programs under NAFTA is not yet known.

This post was written by Kara Kelly of Ogletree, Deakins, Nash, Smoak & Stewart, P.C.

Yesterday, #WannaCry. Today, #DocuSignPhish

Another day, another data incident.  If you use DocuSign, you’ll want to pay attention.

The provider of e-signature technology has acknowledged a data breach incident in which an unauthorized third party gained access to the email addresses of DocuSign users.   Those email addresses have now been used to launch a massive spam campaign.   By using the stolen email address database and sending “official” looking emails, cyber criminals are hoping that recipients will be more likely to click on and open the malicious links and attachments.

DocuSign’s alert to users says in part:

[A]s part of our ongoing investigation, today we confirmed that a malicious third party had gained temporary access to a separate, non-core system that allows us to communicate service-related announcements to users via email. A complete forensic analysis has confirmed that only email addresses were accessed; no names, physical addresses, passwords, social security numbers, credit card data or other information was accessed. No content or any customer documents sent through DocuSign’s eSignature system was accessed; and DocuSign’s core eSignature service, envelopes and customer documents and data remain secure.

A portion of the phish in the malicious campaign looks like this:

Two phishing campaigns already detected and more likely

The DocuSign Trust Center has posted alerts notifying users of two large phishing campaigns launched on May 9 and again on May 15.

The company is now advising customers NOT TO OPEN emails with the following subject lines, used in the two spam campaigns.

  • Completed: [domain name]  – Wire transfer for recipient-name Document Ready for Signature

  • Completed [domain name/email address] – Accounting Invoice [Number] Document Ready for Signature

We recommend that you change your DocuSign password in light of this incident as an extra measure of caution.  Also, DocuSign (and other similar services) offer two-factor authentication, and we strongly recommend that you take advantage of this extra security measure.

As always, think before you click.