Friday, October 24, 2014

PowerPoint, Advocacy and Prosecutor Misconduct

Geraldo Rivera was charged with, and tried for, “attempting to murder Sean and Michael Burns during a fight that started in a liquor store and ended in the parking lot.”  State v. Rivera, 2014 WL 5042454 (Superior Court of New Jersey – Appellate Division 2014). 
The jury acquitted Rivera of those charges but convicted him of lesser-included offenses: second-degree aggravated assault (Sean) and fourth-degree aggravated assault (Michael).  State v. Rivera, supra.  The trial judge then sentenced him to “eight years' imprisonment for the second-degree assault . . . and to a concurrent fifteen months' imprisonment for fourth-degree assault.”  State v. Rivera, supra.
The propriety of the charges, convictions and/or sentence were not the focus of Rivera’s arguments on appeal nor are they the focus of this post.  On appeal, Rivera claimed the “conduct of the assistant prosecutor who tried the case . . . deprived him of a fair trial.”  State v. Rivera, supra. The Appellate Division began its analysis of his arguments by explaining that the
well-established principles guiding prosecutorial conduct are easily stated and not unique to New Jersey. `[T]he primary duty of a prosecutor is not to obtain convictions but to see that justice is done. “It is as much [a prosecutor's] duty to refrain from improper methods calculated to produce a wrongful conviction as it is to use every legitimate means to bring about a just one.”’ State v. Timmendequas, 161 N.J. 515, 737 A.2d 55 (Supreme Court of New Jersey 1999) (quoting State v. Farrell, 61 N.J. 99, 293 A.2d 176 (Supreme Court of New Jersey 1972) (quoting Berger v. U.S., 295 U.S. 78 (1935))).

This case demonstrates the need to stress what those principles require. Prosecutors must choose their tactics in conformity with their legal duties. Thus, they are not free to employ a prejudicial tactic just because the precise action has not yet been expressly condemned by the Supreme Court. Similarly, when a reviewing court has declared a method improper in a published opinion but concluded it to be harmless error in that case, compliance with the prosecutor's obligation does not permit repetition. A finding of harmless but improper prosecutorial conduct cannot, consistent with a prosecutor's duty, be understood as a license to mimic an improper method. In this case, the cumulative impact of the prosecutor's transgressions requires reversal.
State v. Rivera, supra.
As to the last point, the Appellate Division goes on to note that
[r]eversal of a conviction based on the prosecutor's conduct is appropriate only if that conduct was `”so egregious that it deprived [the] defendant of a fair trial.”’ State v. DiFrisco, 137 N.J. 434, 645 A.2d 734 (New Jersey Supreme Court 1994) (quoting State v. Pennington, 119 N.J. 547, 575 A.2d 816 (New Jersey Supreme Court 1990)). . . .  Stated differently, reversal is warranted when the prosecutor's conduct `substantially prejudice[s] the defendant's fundamental right to have a jury fairly evaluate the merits of his or her defense.’ State v. Harris, 181 N.J. 391, 859 A.2d 364 (New Jersey Supreme Court 2004).
State v. Rivera, supra.
Rivera pointed to a number of actions on the part of the prosecutor which he claimed had combined to deprive him of his right to a fair trial, but this post will only focus on two of them.  State v. Rivera, supra. The Appellate Division began its analysis with the prosecutor’s conduct during his opening statement to the jury.  State v. Rivera, supra.  As Wikipedia explains, the opening statement is
generally the first occasion that the trier of fact (jury or judge) has to hear from a lawyer in a trial. . . . The opening statement is generally constructed to serve as a `road map’ for the fact-finder. This is especially essential, in many jury trials, since jurors (at least theoretically) know nothing at all about the case before the trial, (or if they do, they are strictly instructed by the judge to put preconceived notions aside).

Though such statements may be dramatic and vivid, they must be limited to the evidence reasonably expected to be presented during the trial. Attorneys generally conclude opening statements with a reminder that at the conclusion of evidence, the attorney will return to ask the fact-finder to find in his or her client's favor. . . .
The Appellate Division begins its analysis of this prosecutor’s conduct during his opening statement by noting that a prosecutor’s
opening statement should be limited to what the prosecutor `will prove’ and `not anticipate’  the prosecutor's summation. State v. Ernst, 32 N.J. 567, 161 A.2d 511 (New Jersey Supreme Court 1960). Defendant's core objection to the prosecutor's opening statement is that the prosecutor declared him guilty of the two attempted murders with which he was charged. The prosecutor did that twice -- graphically with the last screen of the PowerPoint presentation accompanying his opening and orally in the final sentence of his opening.
State v. Rivera, supra.
The court then took up the PowerPoint presentation, explaining that its
twenty-first and final screen contains a photograph showing [Rivera’s] face and neck, which is displayed with a bright red border. It also includes text, printed in the same color and density, `Defendant GUILTY OF: ATTEMPTED MURDER.’ The words `Defendant’ and `GUILTY OF: ‘ appear on separate lines to the right of [Rivera’s] photograph, and `ATTEMPTED MURDER’ appears below the photograph in much larger typeface.

In overruling defense counsel's objection to the PowerPoint, the judge explained, `There's nothing specifically prejudicial in the presentation. . . . [T]his is, merely in my view, advocacy and the method by which Mr. Herring is presenting his opening statement.’

At the conclusion of the oral portion of his opening, the prosecutor declared [Rivera] guilty of attempted murder a second time. He said, `Defendant is guilty of the attempted murder of a man he stabbed five times and a man [whose] intestines he tore out. Defense counsel did not object, perhaps because his objection to the PowerPoint was overruled.
State v. Rivera, supra.
In a footnote, the Appellate Division points out that
Sean testified that [Rivera] stabbed him five times, but he explained he sustained four wounds and one stab did not penetrate at all. Michael testified that his intestines were `hanging out of [him],’ but he did not testify that his intestines were injured, and . . .  there was no testimony from a medical professional. Michael also testified that none of his `organs were hit,’ but he also said a `slice across [his] stomach’ required surgery.
State v. Rivera, supra.
The court then took up the issue of the prosecutor’s using PowerPoint:
Our courts have not yet addressed the use of PowerPoint presentations during opening statements or summations in criminal trials in a published opinion. Other courts have, however, considered the matter.

The Nevada Supreme Court has concluded that a PowerPoint, `as an advocate's tool, is not inherently good or bad” and that “its propriety depends on content and application.’ Watters v. State, 313 P.3d 243 (2013). The Court further determined that a PowerPoint accompanying an opening is permissible if `the content is consistent with the scope and purpose of opening statements and does not put inadmissible evidence or improper argument before the jury.’  Watters v. State, supra.

We fully agree that the content, not the medium, is important. That view is consistent with the approach our Supreme Court has taken with respect to other technological advances used in connection with trial court proceedings. See, e.g., State v. Miller, 205 N.J. 109, 122 (Supreme Court of New Jersey 2011) (directing that in `responding to a request to review testimony, the trial court's focus should be on the proper controls and limits needed to ensure a fair proceeding, not the medium used to create a record’).
State v. Rivera, supra.
The Appellate Division found that when a court is confronted with a pre-presentation
challenge to use of a PowerPoint in an opening, a court should apply the law governing opening statements. In some respects, use of PowerPoints has potential to advance the interests of fairness in opening statements because the court may direct removal of prejudicial material before a prosecutor displays a slide to the jury. That opportunity should not be lost. . . .

Watters v. State, supra involved the prosecutor's display of a PowerPoint slide in opening quite similar to the final slide in this opening. The Court considered `whether the State's use of a PowerPoint during opening statement that includes a slide of the defendant's booking photo with the word “GUILTY” superimposed across it constitutes improper advocacy and undermines the presumption of innocence essential to a fair trial.’ Watters v. State, supra . The Court concluded that it did and reversed the defendant's conviction. 
State v. Rivera, supra.
The Appellate Division then went on to note that, in Watters, the Nevada Supreme Court
reasoned that the declaration of defendant's guilt displayed by the prosecutor was an impermissible expression of the prosecutor's personal opinion on defendant's guilt at least as, if not more, effective in undermining the presumption of innocence as a prosecutor's oral proclamation of defendant's guilt in opening. . . .

The Court rejected the State's suggestion that declaring the defendant guilty in opening is just a `different way[] of saying’ that the prosecutor will be asking the jury to find defendant guilty. Watters v. State, supra. In the Nevada Supreme Court's view, a declaration of the defendant's guilt, unlike an indication that the State will ask the jurors to find the defendant guilty, expresses the prosecutor's opinion. Watters v. State, supra. 
State v. Rivera, supra.
The Appellate Division found the difference to be “more than semantic.”  State v. Rivera, supra. The court noted that it  
is difficult to conclude that a prosecutor's declaration of the defendant's guilt before the first witness is sworn would not have invaded the province of the jurors. It is quite similar to an investigating officer's giving expert or lay opinion testimony on the ultimate issue. Moreover, such a declaration in opening has the capacity to predispose the jurors to take the prosecutor's view of the evidence `without applying their own independent judgment.’ Thornton, supra, 38 N.J. at 398, 185 A.2d 9. . . .

There is another problem presented by a prosecutor's declaration of a defendant's guilt of the crime charged in the State's opening. Such a declaration delivers a message in conflict with the State's obligation to convince the jury of defendant's guilt by proof of each element of the crime beyond a reasonable doubt. Jackson v. Virginia, 443 U.S. 307 (1979). It does that by suggesting the decision has been made. It is more akin to a directive than advocacy, and it has the capacity to leave the jury with a lessened sense of its weighty responsibility as the sole judge of the facts and credibility. . . .
State v. Rivera, supra.  It held, therefore, that “a display and oral declaration of defendant's guilt in an opening statement is an egregious interference with defendant's right to a fair trial” and is “`highly likely to `substantially prejudice[] the defendant's fundamental right to have a jury fairly evaluate the merits of’ his defense.’” State v. Rivera, supra (quoting State v. Harris, 181 N.J. 391 (New Jersey Supreme Court 2012)).
The Appellate Division found it did not have to decide whether the “opening statement and PowerPoint were, in themselves, sufficiently prejudicial to require a new trial because there was additional conduct inconsistent with the prosecutor's obligation to try the case fairly.”  State v. Rivera, supra.  Its description and analysis of all of the other conduct is too lengthy to outline here, but I will note one other thing the prosecutor did that seems, at the least, unusual.
As the court explains, during
defense counsel's cross-examination of Sean, the prosecutor climbed into the jury box. When the prosecutor engaged in that bizarre behavior, [Rivera] was assisting his attorney by operating a device used to replay segments of the recording of Sean Burns' statement to the police. Defense counsel was using segments of that recording to point out inconsistencies between Sean's testimony and his out-of-court statements. For reasons not clear on this record, the device was on the prosecutor's table. [Rivera], with the judge's prior approval, was seated there.

`For the record,’ the prosecutor said: `Mr. Rivera is actually set up [at] the State's table using [a] laptop computer hooked onto the projector, using the microphone from the witness stand in order to play the sections, and I believe Mr. Rivera is actually doing that.’ With that introduction, he advised the judge, `The State is trying to find somewhere to be. So I think just so it's clear on the record.’

Indicative of the lack of context of a statement about the clarity of the record, the judge asked, `What's clear?’ The prosecutor said, where Sean Burns `was looking.’

The prosecutor apparently found somewhere else to be for some time. He did not get into the jury box until cross and redirect were completed. He did that during defense counsel's re-cross. Defense counsel asked Sean whether he had told an officer that he thought [Rivera] was `a sissy.’ And after that, defense counsel asked his client to set up the video.

The judge addressed the prosecutor as follows: `Mr. Herring, can you please come out of the jury box? I don't want you that close to the jury.’ As [Rivera] attempted to set up the video, the judge called the attorneys to sidebar, but he spoke to them off the record.

Thereafter, [Rivera’s] lawyer told his client that they would play the video later. The prosecutor called his next witness.

The following day defense moved for a mistrial based on the prosecutor's untoward incursion into the jury box. Defense counsel noted that he had not seen the prosecutor get into the jury box but saw him climbing out of it when the judge addressed him. At oral argument in this court, the State confirmed that there is no entrance to the jury box from the area of the courtroom where counsel tables are located.

During his argument on this motion for a mistrial in the trial court, defense counsel acknowledged that he did not know why the prosecutor climbed in but asserted that it was `highly inappropriate.’ 
State v. Rivera, supra. 
The court goes on to explain that there
is no question that the prosecutor invaded the `space’ reserved for the jury. In defense counsel's opinion, the conduct was so unheard of and so improper as to warrant a mistrial. He indicated that it was the `craziest’ thing he had ever seen done.

The prosecutor noted that he was just looking for a place to stand and write. He acknowledged that it was `probably not the best place for [him] to stand.’ He did not, however, offer any other explanation beyond the need for a place to stand and write, which he said he could do inside the jury box.
State v. Rivera, supra. 
For these and many other reasons, the Appellate Division found that
the cumulative impact of the prosecutor's misconduct leaves us with significant doubt that defendant received a fair trial. Accordingly, we reverse his convictions and remand for further proceedings.
State v. Rivera, supra. 
The news story you can find here notes that the prosecutor “has since gone into private practice”. 


Wednesday, October 22, 2014

Defamation, Facebook and the Seventh-Graders

This post examines a recent opinion the Court of Appeals of Georgia issued in a civil case:  Boston v. Athearn, 2014 WL 5068649 (2013).  As the court explains,
Alexandria Boston (`Alex’), a minor, through her parents Amy and Christopher Boston, brought this action in the Superior Court of Cobb County against Dustin Athearn, a minor, his parents, Sandra and Michael Athearn, and other defendants. 
Boston v. Athearn, supra. 
In their suit, the Bostons claimed “Dustin defamed Alex” and that his actions also “constituted intentional infliction of emotional distress.” Boston v. Athearn, supra.  The defendants – “`the Athearns’” – “moved for summary judgment”, the trial judge granted their motion, which effectively ended the lawsuit and the Bostons then appealed that ruling.  Boston v. Athearn, supra. 
The Athearns filed their motion for summary judgment under Georgia Code of Civil Practice § 9-11-56(c).  As Wikipedia explains, a judge can grant a motion for summary judgment only if he/she finds that
there are no disputes of `material’ fact requiring a trial to resolve, and in applying the law to the undisputed facts, one party is clearly entitled to judgment.Summary judgment lets courts dismiss lawsuits when the facts alleged would not, even if proven by a preponderance of the evidence, justify a verdict in the plaintiffs’ behalf.   
The Court of Appeals began its opinion by explaining how that in 

early May 2011, Dustin, who was 13 years old, and his friend, Melissa Snodgrass, agreed to have some fun at a classmate's expense by creating a fake Facebook page for that person. Dustin selected Alex, a fellow seventh-grader, as their target, and Melissa agreed. Melissa, posing as Alex, created a Yahoo e-mail account to use to create a new Facebook account, and gave that information to Dustin.

On May 4, using a computer supplied by his parents for his use and the family Internet account, Dustin posed as Alex to create a new Facebook account, using the Yahoo e-mail address and the password Melissa supplied. For the profile photo, Dustin used a photo that he had taken of Alex at school, after altering it with a `Fat Face’ application.

After Dustin created the account, both Dustin and Melissa added information to the unauthorized profile, which indicated, inter alia, racist viewpoints and a homosexual orientation. Dustin and Melissa also caused the persona to issue invitations to become Facebook `Friends’ to many of Alex's classmates, teachers, and extended family members.

Within a day or two, the account was connected as Facebook `Friends’ to over 70 other Facebook users. Dustin and Melissa continued to add information to the persona's profile and caused the account to post status updates and comments on other users' pages. Some of these postings were graphically sexual, racist or otherwise offensive and some falsely stated that Alex was on a medication regimen for mental health disorders and that she took illegal drugs.

Alex soon suspected that Dustin was involved, because she recognized the profile photo as one he had taken at school. Alex's parents, Amy and Christopher Boston, approached the school's principal, Cathy Wentworth, for help. On May 10, 2011, Wentworth called Dustin and Melissa to her office; they admitted their involvement, and each signed a written statement.  

Wentworth assigned them to in-school suspension for two days for their harassment of Alex. She called their parents and also sent home a `Middle School Administrative Referral Form’ to explain the disciplinary action. The Referral Form included the following `Description of Infraction: [Dustin] created a false Facebook page in another student's name, pretended to be that person, and electronically distributed false, profane, and ethnically offensive information.’

Dustin's mother, Sandra Athearn, reviewed and signed the Referral Form the same day, May 10, 2011, and discussed the incident with her husband, Michael. The Athearns disciplined Dustin by forbidding him for one week from seeing his friends after school. The unauthorized profile and page remained accessible to Facebook users until Facebook officials deactivated the account on April 21, 2012, not long after the Bostons filed their lawsuit on April 3, 2012.

During the 11 months the unauthorized profile and page could be viewed, the Athearns made no attempt to view the unauthorized page, and they took no action to determine the content of the false, profane, and ethnically offensive information that Dustin was charged with electronically distributing. They did not attempt to learn to whom Dustin had distributed the false and offensive information or whether the distribution was ongoing. They did not tell Dustin to delete the page.

Furthermore, they made no attempt to determine whether the false and offensive information Dustin was charged with distributing could be corrected, deleted, or retracted.
Boston v. Athearn, supra. 
The court then took up the issues in the case, that, on appeal, the Bostons “contend there are questions of material fact regarding whether the Athearns were negligent in failing to compel Dustin to remove the Facebook page once they were notified of its existence and, therefore, that the trial court erred in granting the Athearns' motion for summary judgment on Alex's claims.”  Boston v. Athearn, supra.  It also noted that, under Georgia law,
liability for the tort of a minor child is not imputed to the child's parents merely on the basis of the parent-child relationship. Parents may be held directly liable, however, for their own negligence in failing to supervise or control their child with regard to conduct which poses an unreasonable risk of harming others.
Boston v. Athearn, supra. 
The Court of Appeals then took up the issues in the case, explaining, initially, that when
liability is based on parents' alleged failure to supervise or control their child, a key question is the foreseeability of the harm suffered by the plaintiff, that is, whether the parents had knowledge of facts from which they should have reasonably anticipated that harm to another would result unless they controlled their child's conduct. Hill v. Morrison, 160 Ga. App. 151, 286 S.E.2d 467 (Georgia Court of Appeals 1981) (`[T]he true test of parental negligence vel non is whether in the exercise of ordinary care he should have anticipated that harm would result from the unsupervised activities of the child and whether, if so, he exercised the proper degree of care to guard against this result’). . . .

The level of care that is due necessarily depends on the circumstances, which may involve an inherently dangerous instrumentality, a commonly-available object that only becomes dangerous if it is intentionally used to cause harm or is handled in an improper and dangerous manner, or no instrumentality at all.

Whether parents failed to use ordinary care in supervising or controlling their child is generally a question for the jury when the circumstances support an inference that the parents were on notice that, absent their intervention, injury was likely to result from the child's conduct.
Boston v. Athearn, supra. 
The court then applied these standards to the facts in this case, explaining that
it is undisputed that Dustin used a computer and access to an Internet account improperly, in a way likely to cause harm, and with malicious intent. The Athearns contend they had no reason to anticipate that Dustin would engage in that conduct until after he had done so, when they received notice from the school that he had been disciplined for creating the unauthorized Facebook profile. Based on this, they contend they cannot be held liable for negligently supervising Dustin's use of the computer and Internet account.

The Athearns' argument does not take into account that, as Dustin's parents, they continued to be responsible for supervising Dustin's use of the computer and Internet after learning that he had created the unauthorized Facebook profile. While it may be true that Alex was harmed, and the tort of defamation had accrued, when even one person viewed the false and offensive postings, it does not follow that the Athearns' parental duty of reasonable supervision ended with the first publication.

Given the nature of libel, the original tortious conduct may continue to unfold as the false and injurious communication is published to additional readers or the defamatory content persists in a public forum without public correction or retraction. With regard to the instant action, we conclude that a reasonable jury could find that, after learning on May 10, 2011, of Dustin's recent misconduct in the use of the computer and Internet account, the Athearns failed to exercise due care in supervising and controlling such activity going forward.

Given that the false and offensive statements remained on display, and continued to reach readers, for an additional eleven months, we conclude that a jury could find that the Athearns' negligence proximately caused some part of the injury Alex sustained from Dustin's actions (and inactions). Accordingly, the trial court erred in granting the Athearns' motion for summary judgment in part.
Boston v. Athearn, supra (emphasis in the original).
The Court of Appeals went on to note that the Bostons argued that
`[i]n addition to their legal duty as parents, the [Athearns] had a duty as landowners to remove the defamatory content that existed on their property[,]’ citing the dissenting opinion of Presiding Judge Quillian in Southern Bell Telephone & Telegraph v. Coastal Transmission Svc., 167 Ga. App. 611, 307 S.E.2d 83 (Georgia Court of Appeals 1983).

In that case, Presiding Judge Quillian cited with approval Restatement (Second) of Torts § 577(2) (1977, updated June 2014), which provides that `[o]ne who intentionally and unreasonably fails to remove defamatory matter that he knows to be exhibited on land or chattels in his possession or under his control is subject to liability for its continued publication.’ Further, `when, by measures not unduly difficult or onerous, he may easily remove the defamation, he may be found liable if he intentionally fails to remove it.’ Id., Comment p. See Southern Bell Telephone & Telegraph v. Coastal Transmission Svc., supra, Presiding Judge Quillian, dissenting.
The gist of this provision of the Restatement is that
`passing on defamatory matter, i.e., republication, is publication for purposes of liability. Thus, except as to those who only deliver or transmit defamation published by a third person, one who repeats or otherwise republishes defamatory matter is subject to liability as if he had originally published it.’

(Punctuation and footnotes omitted.) Malla Pollack, `Litigating Defamation Claims,’ 128 Am. Jur. Trials 1 (2013, updated May 2014). Georgia defamation law embraces this principle regarding republication. . . .
Boston v. Athearn, supra. 
The Court of Appeals then found that
[s]etting aside the novel and abstract questions the Bostons' argument raises regarding where Internet content is `exhibited,’ the Bostons failed to identify any evidence that, apart from exercising their parental power to control Dustin's conduct, they had the ability to remove the defamation.

The only evidence on the subject in the record is that, when the Bostons contacted Facebook, company officials responded that only the user who signed up for the password-protected account had the authority to remove the page from the forum.

There is no evidence that the Athearns unilaterally had the ability to take down the unauthorized Facebook page by virtue of the fact that it was created on a computer in their home, because it was created using an Internet service they paid for, or otherwise. See Mullinax v. Miller, 242 Ga. App. 811,, 531 S.E.2d 390 (Georgia Court of Appeals 2000) (In the context of our libel laws, `[p]ublication entails the ability to control the libel.’) (citations and punctuation omitted; emphasis in original).

Because there is no evidence supporting this theory of recovery, the trial court did not err in granting the Athearns' motion for summary judgment in part.
Boston v. Athearn, supra (emphasis in the original). 
If you are interested in more information about the case, check out the news stories you can find here, here and here.  The story you can find here says Melissa Snodgrass and her father did not respond to the suit, “and thus were found in default.”  If you are interested, Wikipedia explains what a default judgment is. 

Monday, October 20, 2014

The Federal Reserve, the Virtual Private Network and the Zeus Trojan

This post examines an opinion a U.S. District Court Judge who sits in the U.S. District of Minnesota recently issued in a civil suit:  State Bank of Bellingham v. BancInsure, Inc., 2014 WL 4829184 (2014) (“State Bank v. BancInsure”).  She begins the opinion by explaining that the bank is a Minnesota
`state bank with five employees and one location in Bellingham, Minnesota.’ . . . [BancInsure] is an insurance company . . . incorporated in Oklahoma. . . . In October 2010, [BancInsure] issued Financial Institution Bond No. FIB0011607 (the `Bond’) to Bellingham Corporation, with coverage effective from October 17, 2010, to October 17, 2013. . . [State Bank] is a named insured on the Bond. . . . Under the Bond, [BancInsure] agrees to indemnify [State Bank] in various circumstances, collectively referred to as `Insuring Agreements,’ including-relevant to this case-in the case of `computer systems fraud.’
State Bank v. BancInsure, supra.  Essentially, the Bond covered “[l]oss resulting directly from a fraudulent . . . entry of Electronic Data or Computer Program into, or . . . change of Electronic Data or Computer Program within any Computer System operated by the insured, whether owned or leased”.  State Bank v. BancInsure, supra. 
The lawsuit involves a “loss” that resulted from “a fraudulent wire transfer.”  State Bank v. BancInsure, supra.  At the time the loss occurred, State Bank made wire transfers
through the Federal Reserve's FedLine Advantage Plus system (`FedLine’). . . . State Bank used a desktop computer that was connected to a Virtual Private Network device . . . provided by the Federal Reserve. . . . The VPN was both a modem and an encryptor. . .  It encrypted the information entered on the computer and transmitted it over the internet to the Federal Reserve, where the information was then decrypted. . . . [T]o complete a wire transfer on FedLine, a user had to enter an authorized user name and three passwords. . . . One of the passwords was provided by a security token issued by FedLine that had to be inserted into a USB port on the computer. . . . The other two passwords were typed in by the user. . . . And, although it was not required by FedLine, wire instructions had to be verified by entry of a second user name and set of passwords. . . .

On October 27, 2011, one of [State Bank’s] employees, Sharon Kirchberg, accessed FedLine . . . to complete a wire transfer. . . . Kirchberg's token, password, and pass phrase, as well as the token, password, and pass phrase of another employee, were used to complete the transfer. . . . When Kirchberg left the Bank for the day, she left both tokens in the computer and left the computer running. . . .

On October 28, Kirchberg arrived at work and accessed Fedline's Account Information Management application, which shows [State Bank’s] account balance with the Federal Reserve. . . . At approximately 8:12 a.m. CST, she noticed that $940,000 had been transferred out of the bank using Fedwire Funds, which is part of FedLine. . . . She began investigating the entry and discovered someone had attempted to initiate two wire transfers from a Demand Deposit Account at the bank to two different banks in Poland. . . . The first transfer, to a Citibank account in Warsaw, was in the amount of $485,000 and was initiated at 7:12 a.m. CST. . . . That transfer was completed at 7:25 a.m. CST using the user name and passwords of Kirchberg and one other employee. . . .

However, neither of those employees authorized or verified the transfer or had access to FedLine at the time of the transfer. . . . The second transfer, to an ING Bank account in Katowice, was in the amount of $455,000 and was initiated at 7:21 a.m. CST and completed at 7:25 a.m. CST. . . . The same user names and passwords were used, but, again, neither employee even had access to FedLine at the time of the transfer. . . . Both transferee accounts were in the name of Markus Vorreas. . . .

Kirchberg immediately attempted to reverse the wire transfers using FedLine. . . . However, shortly after 8:00 a.m., [State Bank’s] internet service provider experienced a distributed denial-of-service attack (`DDoS’), which disabled internet service near [State Bank]. . . .  Accordingly,. Kirchberg was unable to electronically request reversal of the transfers. . . .  She then called the Federal Reserve and requested the reversals, but her request was denied. . . .

On October 31, the Federal Reserve notified the two intermediary institutions for the transfers that the transfers were fraudulent. . . . While the intermediary institution for the second transfer was able to revert the transferred funds to [State Bank], the $485,000 that was transferred to the Citibank account in Warsaw has never been credited or reverted. . . .
State Bank v. BancInsure, supra. 
State Bank notified BancInsure of the loss on October 28 . . . by faxing a copy of the transaction details of the two transfers. State Bank v. BancInsure, supra.  On November 3, BancInsure acknowledged receipt of the notice and advised State Bank that the claim had been assigned to Karbal Cohen Economou Silk Dunne (`KCESD’) for investigation. State Bank v. BancInsure, supra.  In a November 9 letter, KCESD reminded State Bank of its obligation to provide BancInsure with “`proof of loss . . . with full particulars’“ within six months of discovering the loss. State Bank v. BancInsure, supra. 
BancInsure received State Bank’s Proof of Loss on December 27, 2011. . . .  State Bank v. BancInsure, supra.  In the `Details of Loss’ section of the form, State Bank stated that “`an unknown individual or individuals gained unauthorized access to the FedLine Advantage Plus service on the State Bank of Bellingham's computer systems and fraudulently authorized two wire transfers.’” State Bank v. BancInsure, supra.  It went on to describe Kirchberg's discovery and attempted reversal of the transfers, and said that, “in addition to the Federal Reserve, it had notified various law enforcement agencies and the FBI had examined” State Bank’s computers but it “was not aware of the status of any investigations.” State Bank v. BancInsure, supra. 
With regard to its security measures, State Bank said that, internally, it followed
standard security procedures with respect to user names and passwords for its systems in accordance with the Federal Reserve Banks' Password Practice Statement. All systems on the internal network have Symantec Small Business Endpoint Protection 12.5, with not only antivirus and antispyware features but a desktop firewall and intrusion detection/protection. This security suite is centrally managed by the network server for definitions and threat management and updates automatically. Additionally, the native Windows firewall is activated on computers on the internal network and the computers are configured to limit the software that can be installed on the device.

As for external threats, the Bank uses a Sonic WALL NSA 240 firewall. The firewall has Gateway Antivirus and Gateway Anti–Spyware inspecting all traffic before passing through the gateway and uses Gateway Intrusion Protection. This security suite likewise is updated automatically on a daily basis, meaning no user accesses or modifies the firewall or the settings of the software overall.
State Bank v. BancInsure, supra. 
On May 15, BancInsure’s counsel told State Bank “that it had retained forensic computer specialist Mark Lanterman of Computer Forensic Services, Inc.” (CFS) to work on investigating the crime.  State Bank v. BancInsure, supra.  On June 20, State Bank told BancInsure’s lawyer it had the “hard drive in the condition it was in at the time of the loss” and agreed to “provide the hard drive to Lanterman for examination under certain conditions”.   State Bank v. BancInsure, supra.  Lanterman “received the hard drive on August 8, and issued his report on October 10.” State Bank v. BancInsure, supra.  His report said the analysis
identified an email message, sent to the address `bellinghambank’, which contained a hyperlink to a malicious webserver. CFS further determined that this email had been read and the embedded link clicked on. . . .

The user's action of clicking on the hyperlink ultimately lead to the download of multiple files associated with the Zeus virus.
State Bank v. BancInsure, supra. 
The CFS report also explained that the analysis showed the Zeus virus was detected
on October 13, 2011. Given [Symantec's] settings, it is more likely than not that Symantec notified the user of the infection. The analysis revealed [Zeus] was quarantined on October 18, 2011 but the infection was never completely removed by Symantec Antivirus. Given [its] settings, it is more likely than not that Symantec notified the user of the quarantine. . . . Once [Zeus] executed, it remained resident, ultimately downloading a rash of subsequent infections that resulted in the unauthorized ACH transactions. The continued use of the computer after receiving multiple virus warnings is contrary to generally accepted computer security practices.

Three additional malicious executable files, downloaded automatically by [Zeus], still reside on the system. There is no evidence these files were detected by Symantec. [One] resulted in the download of . . . a virus. [It] . . . was downloaded and launched on October 26, 2011 [and] is considered directly responsible for the unauthorized wire transfers. . . .

Further, Symantec `Proactive Threat Protection’ was disabled due to the fact that it was last updated July 30, 2008. This left the system vulnerable to viruses created after 2008. . . .  Generally accepted security practices would include daily virus scans and ensuring the virus definitions are current. . . .

[T]he system was previously compromised on August 8, 2011. Symantec Antivirus . . . successfully removed that infection. This demonstrates the computer has a history of vulnerabilities due to user activity. The user(s) was also aware of this compromise after receiving Symantec's alert. . . .

CFS reviewed email activity on the system and was able to identify the specific message containing the malicious hyperlink. Other messages within the Outlook Express inbox also suggest that the email application was being used for purposes other than FedLink. For instance, the email account was used to order and track company purchases. This is contrary to generally accepted security practices. The use of email on a computer that's purpose is to initiate FedLink transactions resulted in that system's compromise.

Additionally, CFS determined that messages in the spam folder had been opened or read. Spam is a typical vehicle for malware.

CFS recovered and analyzed nearly one million URLs from Internet browser histories on the system. . . . Much of the history was found to relate to activity other than banking. For example, the user `FedLine’ multiple times, with and without private browsing activated, before and after the initial infection. . . .This is contrary to generally accepted computer security practices.

CFS also determined that the administrator user accounts, `Administrator’ and `FedLine’, were not password protected. This would have allowed the virus to execute itself as an administrator without the need of a password. This is contrary to generally accepted computer security practices.
State Bank v. BancInsure, supra. 
As a result of this investigation and other factors, BancInsure denied coverage and State Bank then filed suit against BancInsure, “asserting a claim for breach of contract.”  State Bank v. BancInsure, supra.  BancInsure responded by asserting three counterclaims, one of which asserted that it “owe[d] no duty” to provider coverage for the bank’s losses and another of which asserted a cause of action for breach of contract based on State Bank’s “alleged failure to provide a complete and accurate Proof of Loss and its alleged failure to cooperate with” BancInsure.  State Bank v. BancInsure, supra. 
Both sides eventually filed motions for summary judgment on their respective behalves. As Wikipedia explains, in U.S. law, a court can award summary judgment before
trial, effectively holding that no trial will be necessary. Issuance of summary judgment can be based only upon the court's finding that:
  1. there are no disputes of `material’ fact requiring a trial to resolve, and
  2. in applying the law to the undisputed facts, one party is clearly entitled to judgment. . . .
A `material fact’ is one which . . . could lead to judgment in favor of one party, rather than the other.
The District Court Judge began her analysis of BancInsure’s argument, in its summary judgment motion, BancInsure argued, in part, that the policy’s exclusions for a loss
`caused by an Employee’ . . ., `. . .  resulting directly or indirectly from theft of confidential information’ . . . and `. . . resulting directly or indirectly from mechanical failure . . . [or] gradual deterioration” of a computer system . . . preclude coverage of [State Bank’s] claim. As for the employee exclusion, [BancInsure] argues that `Bank employees caused the loss by intentionally disregarding Bank policies, Federal Reserve policies, and good banking practices.’ . . . [It] points to the employees' downloading of the Zeus virus through spam email, [their] continued use of the computer after it detected a virus, the employees' failure to enable and update antivirus software, the employees' failure to password-protect the FedLine user accounts, Ms. Kirchberg's use of another employee's password and token to complete a transfer on the day preceding the loss, and Ms. Kirchberg's failure to remove the tokens from the computer or shut down the computer on the day preceding the loss. . . .

According to [BancInsure], `[t]hese actions caused the loss by opening the door for cyber thefts.’ . . . As for the theft of confidential information exclusion, [it] argues that the employees' passwords and pass phrases were confidential, that those passwords and pass phrases were used to make the transfers, and, therefore, that `[t]he theft of [the] passwords and pass phrases caused the loss.’ . . .

Finally, as for the mechanical failure or gradual deterioration exclusion, [BancInsure] asserts that, because Proactive Threat Protection was disabled and its definitions not updated, the computer's antivirus software gradually deteriorated and allowed malware to be downloaded, which led to the unauthorized transfers. . . .

[State Bank] argues that none of these exclusions were triggered by the circumstances of the loss, but that even if they had been, [BancInsure] cannot satisfy its burden under Minnesota's concurrent causation doctrine of establishing that an excluded cause was the `overriding’ cause of the loss. . . .  
State Bank v. BancInsure, supra. 
The judge agreed with” State Bank.  State Bank v. BancInsure, supra.  She noted that
[w]hen there are multiple causes of an insured's loss, one of which is a `covered peril’ and the other of which is an `excluded peril,’ Minnesota's concurrent causation doctrine provides that the availability of coverage or the applicability of the exclusion depends on which peril was the `”overriding cause” ‘ of the loss. Friedberg v. Chubb & Son, Inc., 691 F.3d 948 (U.S. Court of Appeals for the 8th Circuit 2012) (quoting Henning Nelson Constr. Co. v. Fireman's Fund Am. Life Ins. Co., 383 N.W.2d 645 (Minnesota Supreme Court 1986)).
State Bank v. BancInsure, supra.  (This case was in federal court not because it involved any issues of federal law, but because the parties are “diverse,” i.e., are from different states.  As Wikipedia explains, the Constitution gives federal courts jurisdiction to hear such cases.  And as Wikipedia also explains, the U.S. Supreme Court has held that in diversity jurisdiction cases, the federal court applies the law of the relevant state.)        
Here, the District Court Judge applied Minnesota law and found that the computer systems
fraud was the efficient and proximate cause of [State Bank’s] loss. But for the hacker's fraudulent conduct, the $485,000 would not have been transferred. Conversely, neither the employees' violations of policies and practices (no matter how numerous), the taking of confidential passwords, nor the failure to update the computer's antivirus software was the efficient and proximate cause of [its] loss.

Assuming all of these circumstances existed as [BancInsure] argues, it was not then a `foreseeable and natural consequence’ that a hacker would make a fraudulent wire transfer. Thus, even if those circumstances `played an essential role’ in the loss, they were not `independent and efficient causes’ of the loss. In other words, without the fraudster's actions, there would have been no loss even if all of the other circumstances [State Bank’s] loss.
State Bank v. BancInsure, supra.  
She therefore held that because BancInsure presented
no set of facts from which a reasonable jury could find that one of the excluded perils -- and not the computer systems fraud -- was the overriding cause of [State Bank’s] loss, [it] is entitled to summary judgment on its claim for breach of contract and on [BancInsure’s] claim for a declaratory judgment that it is not liable for coverage. Accordingly, [BancInsure] owes [State Bank] $480,000 under the Bond, which is the amount of the loss less the $5,000 deductible.
State Bank v. BancInsure, supra.  More precisely, the judge held that State Bank was “awarded the principal amount of $480,000 under the Bond, with prejudgment interest of $140,187.36, for a total of $620,187.36.”  State Bank v. BancInsure, supra. 

The judge’s opinion also addresses the legal issues raised by BancInsure’s motion for summary judgment, which she denied, but I am not addressing them, or the detailed analysis the judge conducted of State Bank’s motion for two reasons:  This post would be very long if I did that and the summary above, I think, explains why she ultimately found in favor of State Bank.  You can, if you are interested, find the full opinion here.