Plagiarism, Copyright and Computer Crime

This post is about a decision from the U.S. Court of Appeals for the Fourth Circuit that was issued in the civil case of A.V. ex rel. Vanderhye v. iParadigms, LLC, 562 F.3d 630 (2009) [A.V. v. iParadigms].

Before we get to the facts of the case, I want to note the causes of action that were at issue in it. The plaintiffs brought a copyright infringement action against iParadigms “based on its use of essays and other papers written by plaintiffs for submission to their high school teachers through an online plagiarism detection service operated by iParadigms.” A.V. v. iParadigms, supra.

iParadigms responded by filing counterclaims (more on those in a minute) against one of the plaintiffs -- A.V. – claiming that he “gained unauthorized access to iParadigms' online service in violation of the Computer Fraud and Abuse Act, [18 U.S. Code § 1030(a)(5)(A)(iii)] and the Virginia Computer Crimes Act,. [Va. Code §§ 18.2-152.1-18.s-152.16]. A.V. v. iParadigms, supra.

Counterclaims obviously don’t come up in criminal cases, but this is, as I noted a civil lawsuit. A plaintiff starts a civil law suit by filing a “complaint” against the defendant(s); the complaint alleges the facts at issue in the suit and asserts one or more causes of action against the defendant(s). A defendant can respond by filing a counterclaim. As Wikipedia explains, a counterclaim is filed by a defendant in a civil suit “against the plaintiff or against the plaintiff and other people. This claim may be an attempt to offset or reduce the amount/implications of the plaintiff's original claim against the defendant, or it may be a different claim.”

Defendants often use counterclaims as a way of raising the stakes for the plaintiff: If the plaintiff sues the defendant and wins, he comes out ahead; if he sues the defendant and loses, he’s lost his attorney’s fees (usually) and maybe court costs, etc. If a defendant files a counterclaim, a plaintiff can sue and win on his claim but lose because the defendant wins on his counterclaims and recovers more than he had to pay the plaintiff. (The same downside can occur obviously occur if the plaintiff loses on his claim and the defendant wins on his counterclaim(s).) The stakes in this case were pretty high: As this news story notes, the plaintiffs were seeking $900,000 in damages.

So here (i) the plaintiffs sue the defendant for copyright infringement and (ii) the defendant responses with counterclaims under two computer crime statutes, one state and one federal (The lawsuit was brought in federal court, so it’s a federal case; the federal district court has jurisdiction to hear both the federal and state claims.) That brings us to the factual basis of the copyright and computer crime claims:

iParadigms owns and operates `Turnitin Plagiarism Detection Service,’ an online technology system designed to `evaluate[ ] the originality of written works in order to prevent plagiarism.’ . . . Turnitin offers high school and college educators an automated means of verifying that written works submitted by students . . . not the products of plagiarism. When a school subscribes to iParadigms' service, it typically requires its students to submit their written assignments `via a web-based system available at www.turnitin.com or via an integration between Turnitin and a school's course management system.’ In order to submit papers online, students `must be enrolled in an active class’ and must `enter the class ID number and class enrollment password’ supplied by the assigning professor.’

After a student submits a writing assignment, Turnitin performs a digital comparison of the student's work with content available on the Internet, including `student papers previously submitted to Turnitin, and commercial databases of journal articles and periodicals.’ For each work submitted, Turnitin creates an `Originality Report’ suggesting a percentage of the work, if any, that appears not to be original. The assigning professor may, based on the results of the Originality Report, further explore any potential issues.

The Turnitin system gives participating schools the option of `archiving’ student works. When this option is selected, Turnitin digitally stores the written works . . . `so that the work becomes part of the database used by Turnitin to evaluate the originality of other student's works in the future.’ The archived student works are stored as digital code, and employees of iParadigms do not read or review the archived works.

To submit a paper to Turnitin, a student must create a user profile on the web site, [which] requires the student to click on `I Agree’ under the . . . `Clickwrap Agreement.’ The Clickwrap Agreement provided . . . that the services offered by Turnitin are `conditioned on [the user's] acceptance without modification of the terms, conditions, and notices contained herein,` and that `[i]n no event shall iParadigms . . . be liable for any . . . damages arising out of or in any way connected with the use of this web site.’ . . .

Plaintiffs A.V. and K.W. attended McLean High School in Fairfax County, Virginia, which began using Turnitin in 2006 and opted to have student papers archived in the Turnitin data base. Plaintiffs E.N. and M.N. attended Desert Vista High School in Tucson, . . . which also subscribed to the Turnitin service and elected the archiving option. . . . [B]oth schools required students to submit their written assignments via Turnitin.com to receive credit; failure to do so would result in a grade of `zero’ for the assignment . . . .

Plaintiffs K.W., E.N. and M.N. allege that their teachers adhered to school policy and required them to submit their written assignments to Turnitin. Using the passwords provided by the schools, K.W., E.N. and M.N. submitted their papers, each of which included a `disclaimer’ objecting to the archiving of their works. As requested by the two high schools, however, each of these submissions was archived. A.V., the fourth plaintiff, did not submit his paper for credit in a high school course; instead, he submitted his work to Turnitin using a password designated for students enrolled in a college course at the University of California, San Diego (`UCSD’). The password was provided to A.V. by plaintiffs' counsel who obtained it by conducting an internet search.

A.V. v. iParadigms, supra. The plaintiffs (who obtained a copyright registration for each of their papers) claimed iParadigm infringed their copyright interests in their papers by archiving them. A.V. v. iParadigms, supra. The district court judge dismissed that claim because it found that when the students clicked “I Agree” for the Clickwrap Agreement, they entered into an agreement that shielded iParadigms from liability arising out the plaintiffs’ use of the Turnitin site. A.V. v. iParadigms, supra. The district court judge also found that iParadigms’ use of the plaintiffs’ papers qualified as “fair use” under 17 U.S. Code § 107 and therefore didn’t constitute copyright infringement. The Court of Appeals for the Fourth Circuit held the district court correctly found that iParadigms’ use of the papers constituted fair use and so didn’t address the first issue. A.V. v. iParadigms, supra.

That brings us to the counterclaims. As I’ve noted, 18 U.S. Code § 1030 is the basic federal computer crime statute, but it also creates a civil cause of action for someone injured by conduct that violates its criminal provisions. In its counterclaim iParadigms alleged that “by gaining unauthorized access to Turnitin through a password assigned to UCSD students, plaintiff A.V. violated § 1030(a)(5)(A)(iii, which prohibited any person from `intentionally access[ing] a protected computer without authorization, and as a result of such conduct, caus[ing] damage’. A.V. v. iParadigms, supra.

iParadigms offered evidence that when it learned that A.V. was able to register and submit papers as a student of a university in which he was not enrolled and had never attended, it feared the possibility of a technical glitch in the Turnitin system and concluded an investigation was necessary. Unaware that A.V. had simply obtained a password posted on the Internet, iParadigms assigned several employees to determine what happened. According to iParadigms, over the course of about one week, numerous man-hours were spent responding to A.V.'s use of the UCSD password.

A.V. v. iParadigms, supra. The district court judge dismissed this counterclaim because § 1030(g) limited damages for the kind of violation iParadigms was alleging to “economic damages” and it found iParadigms did not “`produce any evidence of actual or economic damages,’ and `only presented evidence of consequential damages resulting from the steps taken by iParadigms in response to A.V.'s submissions.’” A.V. v. iParadigms, supra. The Court of Appeals held that the district court erred because (i) § 1030(g) says that to have a cause of action, one must have suffered “damage or loss” as the result of a violation of §1030(a); and (ii) § 1030(e)(11) defines “loss” as encompassing “consequential damages of the type sought by iParadigms-costs incurred as part of the response to a CFAA violation, including the investigation of an offense.” A.V. v. iParadigms, supra. So it remanded that claim back to the district court.

This brings us to iParadigm’s second counterclaim against plaintiff A.V. It was brought under the Virginia Computer Crimes Act [VCCA],

which provides that `[a]ny person who uses a computer or computer network, without authority and . . . [o]btains property or services by false pretenses . . . is guilty of the crime of computer fraud.’ Va. Code Ann. § 18.2-152.3. Moreover, `[a]ny person who willfully obtains computer services without authority is guilty of the crime of theft of computer services’ Va. Code Ann. § 18.2-152.6. Va. Code Ann. § 18.2-152.12 provides that `any person whose property or person is injured by reason of a violation of [the VCCA] . . . may sue therefore and recover for any damages sustained and the costs of suit.’ The factual basis for this counterclaim was essentially the same as that for the [§ 1030(g)] counterclaim -- that A.V., a Virginia resident, obtained access to the Turnitin service by using passwords and enrollment codes A.V. did not have authorization to use.

A.V. v. iParadigms, supra. The district court judge dismissed this claim for the same reason it dismissed the § 1030(g) claim, i.e., “its conclusion that iParadigms failed to present evidence of actual or economic damages caused by A.V.'s submission of papers as a UCSD student.” A.V. v. iParadigms, supra. The Court of Appeals held that the district court judge also erred in dismissing this counterclaim:

iParadigms contends that because the district court rejected the [§1030] and the VCCA counterclaims for the same reasons, the district court was necessarily construing the phrase `any damages’ under the VCCA to exclude consequential damages. iParadigms suggests that there is no indication in the statute that the Virginia General Assembly intended to so limit the meaning of `any damages.’ Finding nothing in the statute to suggest that consequential damages are not available under § 18.2-152.12, we agree that it was error to dismiss the VCCA claim solely on this basis. Moreover, we decline A.V.'s invitation to affirm on other grounds, such as the lack of evidence to establish a causal link between the submission of A.V.'s paper and any damages, consequential or otherwise.

A.V. v. iParadigms, supra. So iParadigms succeeded in (i) having the plaintiff’s cause of action dismissed and (ii) having its counterclaims against A.V. reinstated. Essentially, A.V. found himself in the position of having gone from plaintiff to defendant. As I said, counterclaims can be a useful way of raising the stakes for plaintiffs.