The Airport, the CBP Agent and the Passwords

This post examines an opinion recently issued in a federal civil case:  Rolando Cruz Lopez sued Customs and Border Protection (CBP) Agent Alejandro Pena, claiming that, “in his individual capacity as a Customs and Border Protection (CBP) agent," Pena "violated the Stored Communications Act (SCA), 18 U.S. Code §§ 2701(a) and 2703, by accessing Cruz Lopez's Yahoo! email account.”  Cruz Lopez v. Pena, 2013 WL 2250127 (U.S. District Court for the Northern District of Texas 2013).

More precisely, Cruz Lopez is suing under 18 U.S. Code § 2707(a)-(c), which creates a civil cause of action for anyone “aggrieved by” a violation of the Stored Communications Act.  Complaint ¶ 89, Cruz Lopez v. Pena, 2012 WL 3307530. The Complaint alleges that Pena violated 18 U.S. Code §§ 2701(a) and 2703, as noted above. Complaint, Cruz Lopez v. Pena, supra, at ¶ 88.  Pena has filed a motion to dismiss the claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure, which lets a defendant argue that the plaintiff’s cause of action is not valid.

As to how the case arose, the Complaint says Cruz Lopez, “who is a citizen of and is domiciled in Mexico”, for years flew to the United States to spend holidays with his long-time friend, James Fox, a U.S. citizen who “is domiciled in Amarillo, Texas.”  Complaint, Cruz Lopez v. Pena, supra, at ¶¶ 3-4, 10-13.  On August 8, 2009, he arrived at the DFW International Airport and presented his Mexican passport, visa and “immigration and customs” documents to a CBP agent. Complaint, Cruz Lopez v. Pena, supra, at ¶ 14. 

Cruz Lopez was told “he would be subject to secondary inspection and was sent to the back offices of the CBP for questioning.  Complaint, Cruz Lopez v. Pena, supra, at ¶ 14.  One officer questioned him in English, after which another officer translated the questions into Spanish. Complaint, Cruz Lopez v. Pena, supra, at ¶ 15.  Cruz Lopez told them that he was here to visit his friend Foxe, he is retired and “was not working in the U.S.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 15.  The officers told him to go sit on a bench in the hallway. Complaint, Cruz Lopez v. Pena, supra, at ¶ 15. 

After a period of time, an officer screamed at Cruz Lopez, telling him to come back into the office. The officers proceeded to take all of [his] possessions; opening his computer case, rifling through his wallet, and throwing his personal possessions and papers on the desk and the floor. Within Cruz Lopez's wallet, in addition to money and personal items, such as pictures, were several Post-It notes.

The Post-It notes had handwritten information including the User ID and password of Cruz Lopez's on-line bank account and personal email accounts. Cruz Lopez was sent in and out of the office on several occasions, forced to leave all of his possessions, including a password protected laptop, camera, cellular phone, wallet and its contents, documents, and all other items with the CBP Officers.

Complaint, Cruz Lopez v. Pena, supra, at ¶ 16. 

The Complaint (and this is Cruz Lopez’s version of these events) says that “[f]or more than 16 hours” he was interrogated by the CBP officers. Complaint, Cruz Lopez v. Pena, supra, at ¶ 17. The Complaint alleges that the officers tried to get Cruz Lopez to admit “that he was working for Foxe”, but he repeatedly told them the two are friends and he “was not working in the U.S.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 18. 

At one point . . . while Cruz Lopez was sitting outside of the office, Pena slammed a piece of paper against an office window for Cruz Lopez to see and gleefully yelled `No, really’ (`No que no’). The piece of paper was later identified as a copy of a deposited check printed off of Cruz Lopez's on-line, U.S. Wells Fargo bank account. Pena told Cruz Lopez the document was proof that [he] was working in the U.S.

Complaint, Cruz Lopez v. Pena, supra, at ¶ 19. 

The Complaint says Pena also called Foxe on his cell phone and Foxe told him “Cruz Lopez was not working for him, but indeed is a close family friend and a welcome guest at his home.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 23.  During the course of the secondary inspection, Cruz Lopez was patted down, fingerprinted and “handcuffed and sent to a van to be transported with other individuals to jail.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 20. That seems to have been the result of what happened earlier:

Pena executed an Expedited Removal Order and applied a five year bar of inadmissibility against Cruz Lopez. According to official documentation, `you are being expeditiously removed from the United States for charges 212 (a) (7) (A) (i) (I) of the INA, you will be barred from re - entering the U.S. for a period of no less than 5 years and admissible after this time only with the proper visa and waiver of admissibility to the United States.’

The document further stated, `You are an immigrant not in possession of a valid unexpired immigrant visa, reentry permit, border crossing card, or other valid entry document required by the Immigration and Nationality Act’, and `It is likely that you have engaged or will engage in unauthorized employment in the United States.’

Complaint, Cruz Lopez v. Pena, supra, at ¶ 19. 

Cruz Lopez was held overnight “at the Bedford jail” and was not allowed to take the blood pressure medicine had had taken for over ten years. Complaint, Cruz Lopez v. Pena, supra, at ¶ 24.  The next day he was “paraded in handcuffs through the DFW airport by CBP officers to a departure gate.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 25.  He “asked if his luggage and personal possessions would be returned to him”, and “was given an envelope with papers, boarded onto the plane, where his personal items were finally returned.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 25.

Cruz Lopez hired a lawyer and tried to seed redress from the “wrongfully executed Expedited Removal Order”, apparently to no avail.  Complaint, Cruz Lopez v. Pena, supra, at ¶¶  26-42. So this lawsuit followed.  The opinion notes that “in a January 2012 FOIA disclosure,” Cruz Lopez “claims to have discovered that” while he was detained

Pena had accessed at least six emails from his Yahoo! account: (1) a message sent to Cruz Lopez by an acquaintance on May 8, 2009; (2) and (3) Cruz Lopez's May 15 responses to the May 8 message; (4) the acquaintance's May 18 response to at least one of Cruz Lopez's May 15 responses; (5) Cruz Lopez's June 27 response to the acquaintance's May 18 response; and (6) Cruz Lopez's July 4 response to the acquaintance's May 18 response. Cruz Lopez also alleges that Pena may have accessed other emails, including unopened messages.

Cruz Lopez v. Pena, supra. (FOIA refers to the Freedom of Information Act.) As to the emails, the Complaint alleges that

83. The documents produced in March 2012 by USCIS in response to Cruz Lopez's FOIA request include copies of several e-mail communications between Cruz Lopez and an acquaintance sent through [his] Yahoo e-mail account.

84. According to markings on these documents, the e-mails were printed on August 8, 2009, in the United States.

85. Cruz Lopez had not downloaded those e-mails to his computer, and thus the emails were not stored on his laptop computer when he arrived at the Dallas-Fort Worth Point of Entry prior to his detention by CBP on August 8, 2009.

86. Cruz Lopez did not print copies of the e-mail communications contained in the USCIS disclosure on August 8, 2009, nor did he have the means or access to any device by which he could print those e-mail communications on that date, while he was detained by CBP.

87. Yahoo is an `electronic communications service’ under the Stored Communications Act, as it is a `service which provides to users thereof the ability to send or receive wire or electronic communications.’ See 18 U.S. Code § 2510(15).

88. Pena, without Cruz Lopez's authorization, willfully and intentionally accessed Yahoo's facility or computer system through which electronic communications are provided and obtained Cruz Lopez's electronic communications while those communications were in electronic storage within Yahoo facility or system. In doing so, Pena violated the Stored Communications Act, 18 U.S. Code § 2701(a).

Complaint, Cruz Lopez v. Pena, supra. (USCIS refers to the U.S. Citizenship and Immigration Services.)

The Complaint also alleges that Pena accessed Cruz Lopez’s bank account:

76. In March 2010, [Cruz Lopez] obtained, from Wells Fargo, a log which contains entries showing access into [his] account on August 8, 2009, while Cruz was detained and interrogated by the CBP.

77. The March 2010 Wells Fargo log shows Cruz Lopez's account was accessed on August 8, 2009, by a computer or other device with an assigned IP address of 63.167.255.152, corresponding to IP address `DHS/CBP’ and domain name `DHS.GOV.’

78. Documents later obtained pursuant to a USCIS FOIA request include a copy of a check made by Foxe, drawn on his Wells Fargo account, payable to Cruz Lopez.

79. The same documents show Pena included a copy of the check as support for his erroneous determination that Cruz Lopez was working for Foxe. A copy of the check was attached to Pena's affidavit and report in support of the CBP's Expedited Removal. Cruz Lopez did not carry a copy of the check and deposit record on his person when he arrived at the United States Point of Entry on August 8, 2009. Neither did he print a copy of the check or deposit record from his Wells Fargo account on August 8 or 9, 2009. Thus, Pena accessed Cruz Lopez's account without [his] consent and obtained [his] financial records. . . .

Complaint, Cruz Lopez v. Pena, supra. (The bank records were the basis of another claim, but it was apparently dismissed earlier in the case . . . leaving only the Stored Communications Act claim. Cruz Lopez v. Pena, supra.)

The judge began her analysis of Pena’s motion to dismiss the § 2701(a) claim by noting it would be dismissed unless the Complaint “contains sufficient facts to plausibly show that, by objectively unreasonable conduct, (1) Pena violated a right in § 2701(a) that (2) was clearly established in August 2009 and still is.”  Cruz Lopez v. Pena, supra.  

She also noted that § 2701 creates a cause of action against one who intentionally accesses a facility through which an electronic communication service is provided without being authorized to do so and obtains unauthorized access to an electronic communication while it is in electronic storage. Cruz Lopez v. Pena, supra.  

Under 18 U.S. Code § 2510(17), electronic storage is storage of an electronic communication that is “incidental” to its transmission or is storage an electronic communication services uses “for backup protection”.  Cruz Lopez v. Pena, supra.  Cruz Lopez argued that "some" of the "six emails" Pena

allegedly accessed were in electronic storage incident to transmission. Emails not yet opened by the intended recipient are in such storage. . . . 

But none of the six emails Cruz Lopez accuses Pena of accessing were unopened: Cruz Lopez must have opened the first email because he responded to it; he sent the second and third emails, and it is not clearly established that sent communications are in electronic storage when accessed from the sender's account. . .; he obviously opened the fourth because he responded to it; and the fifth and sixth have the same problem as the second and third. 

None of the emails is adequately alleged to have been in electronic storage on August 8–9, 2009.

Cruz Lopez v. Pena, supra (emphasis in the original).

The judge found Cruz Lopez’s claim that Pena “might have accessed unopened emails” in his Yahoo! or Hotmail accounts was too insubstantial to support a finding that Pena violated § 2701(a). She therefore dismissed that claim. Cruz Lopez v. Pena, supra.

The other claim arose under 18 U.S. Code § 2703, which states that the government can require the provider or remote computing services or electronic communication services if it obtains a search warrant, court order or subpoena.  Cruz Lopez v. Pena, supra. Pena argued that no relevant case law establishes that the government violates § 2703 “by hacking into a user’s online email account,” but the judge noted that § 2703 defines “`the only procedure’” law enforcement can use of obtain the contents of electronic communications.  Cruz Lopez v. Pena, supra (emphasis in the original) (quoting Steve Jackson Games, Inc. v. U.S., 816 F.Supp. 432 (U.S. District Court for the Western District of Texas 1993)).

The judge explained that, in this case, Yahoo!

automatically disclosed the emails when Pena logged on, so Pena is left arguing that § 2703 is inapplicable as it applies only to required disclosure . . . and he did not require Yahoo! to do anything because [it] willingly provided access to the account. It is true that a governmental entity following § 2703 `may require’ a provider to disclose electronic communications. 

But it is not true that an officer can ignore § 2703 procedures, hack into an account, and then claim § 2703 is inapplicable because the provider thought that the officer was the user. 

Cruz Lopez v. Pena, supra (emphasis in the original).

The judge therefore denied the motion to dismiss the Stored Communications Act cause of action, which means this part of the case can go forward. Cruz Lopez v. Pena, supra.

The Laptop, Malware and Child Pornography

This summary is not available. Please click here to view the post.

The Intern, the Horror Movie and the Email

-->

As I explained in a recent post, the Supreme Court in each state is in charge of disciplining attorneys who violate the relevant rules of professional conduct.  That post dealt with a disciplinary opinion issued by the Supreme Court of Ohio.  This post examines a recent disciplinary opinion issued by the Supreme Court of Indiana.

The opinion is In re Usher, __ N.E.2d __, 2013 WL 2145636 (Indiana Supreme Court 2013), and it involves conduct by Arthur J. Usher IV.  According to the opinion, the events that led to Usher’s facing allegations of attorney misconduct began in the summer of 2006, when he “became acquainted” with Jane Doe, who was a student at the Indiana University McKinney School of Law in Indianapolis.  In re Usher, supra.  A “social relationship developed between them “after she returned to law school for her third year”; by then, Usher had left Bose and  “become a partner at the law firm of Krieg DeVault LLC (`Krieg DeVault’).”  In re Usher, supra. 

The opinion explains that while Usher “expressed an interest in having a romantic relationship with Doe, she consistently declined, telling him she wished to remain only friends.” In re Usher, supra. Their relationship “began to deteriorate” as a result Usher’s “continued pursuit of a romantic relationship.”  In re Usher, supra.  In July of 2008 he

asked the producer of a horror movie in which Doe had appeared to help him obtain a clip from another movie in which [she] also appeared. The producer sent [Usher] a clip . . . that appeared to show Doe in a state of undress. . . After [he] advised Doe of his meeting with the producer, [she] decided to end their friendship. [Usher] then began attempting to humiliate Doe and interfere with her employment prospects.

In August of 2008, [Usher] sent the clip to an attorney at Bose, where Doe had accepted a job offer. [He] attempted to convince the attorney that Doe's appearance in a horror film in a state of undress would have an adverse effect on [Bose’s] ability . . . to retain and/or attract clients. Suspicious of [Usher’s] motives, the attorney did not take [his] suggestion to send the clip to the firm's executive committee. Doe commenced her employment with Bose despite [Usher’s] s efforts to interfere.

On September 17, 2008, [he] sent Doe an email accusing her of lying to and misleading him regarding her affections. Doe responded with an email stating: `Leave me alone. Do not contact me. You have been harassing me for months now. If you do not stop harassing me, I will file for a restraining order.’

In re Usher, supra. 

Usher “decided to publish the clip to a much wider audience” and “drafted a fictitious email thread intended to appear to be an exchange of opinions among lawyers and other fictitious persons”.  In re Usher, supra. The email included the following excerpts:

[Subject line:] Firm slogan becomes `Bose means Snuff Porn Film Business’ w/addition of [Jane Doe]

. . . . I think you are failing to understand how harmful [Doe]'s behavior was to all female professionals, and the incredible stupidity in acting in such a film. A friend happened to wander into a movie theater on the east side . . . and bought a ticket and the DVD for this movie this past summer. . . .The DVD came to me with a note about `When can we expect to see you getting naked in court?’

Having now seen the entire film, what is really troubling from a feminist perspective was that a female lawyer played the central role or otherwise blessed a film project in which the entire plot lines a woman being repeatedly brutalized by a man. . . .

Quite frankly, I can not [sic] believe Bose McKinney employs this woman.

There are legions of plain faced big breasted blondes who are such hacks as actresses that they are gladly shedding their clothes (or doing anything else) to get in front of a camera. It is troubling that someone you would think would know better after making it through law school is such a bundle of insecurities that they would make such a film. Who knows, maybe she is not that bright and took a similar approach to getting hired?

Free speech rights aside, professional women . . . do not need the [Jane Does] of the planet eroding their hard earned respect in the marketplace.

So, given that you told me that your company does about one to one and a half million dollars a year of work with outside counsel, the solution is simple. Refuse to do business with the Bose firms of the world when they employ such people. Moreover, encourage other female in-house counsel to adopt a similar approach.

That firm is free to hire idiots who participate in films demeaning to women. And we female in-house counsel are free to never use the Bose firm when they employ sexists. . . . So I am forwarding this e-mail chain to you to explain the situation and hope you will embrace what is basically my invitation to jot down a note to yourself not to use this firm or similar firms.

In re Usher, supra. The email included “a link to a site where the movie could be purchased on DVD, with the suggestion that copies be sent to in-house counsel.” In re Usher, supra. 

Usher also “recruited his paralegal at Krieg DeVault, `KB,’ to disseminate the email.” In re Usher, supra. Bose had fired KB, who was “very loyal” to Usher. In re Usher, supra.  

 

Usher gave KB “a flash drive containing the email contents and the clip” and “suggested” to her that the “recipients of the email include attorneys at Bose, that it be sent from a location that would avoid it being traced back to them, that [it] appear to have originated from somebody with `clout’ at Bose” and . . . be sent after Usher left” for vacation over “the upcoming Thanksgiving holiday.” In re Usher, supra.  KB would later deny “any knowledge of the contents of the email or acquaintance with Jane Doe” and claimed she thought it was “some sort of prank.”  In re Usher, supra. 

On November 28, 2008, KB took the flash drive to a Kinko's in Indianapolis, “created an email account using the name of the managing partner at Bose” and used it to send the email and clip to fifty-one persons, a large number of whom were from Bose.” In re Usher, supra.  She also sent it to other law firms in Indianapolis. In re Usher, supra. When Respondent returned to his office in December of 2008, he was “confronted with a protective order Jane Doe had obtained against him, to which the email was attached.” In re Usher, supra.  He “complied with Krieg DeVault's demand that he resign” and since 2009 “has practiced as a sole practitioner.”  In re Usher, supra. 

Doe “takes pride in her acting and does not hide the fact she has appeared in a number of films.” In re Usher, supra.  In one of the scenes in the clip, her “character undresses, but a body-double was used in the part showing nudity.” In re Usher, supra.  It says Usher knew that, but did not “disclose this in the email, leaving the impression” that Doe “appeared topless in the movie.”  In re Usher, supra. 

On February 27, 2009, Doe filed a grievance with the Indiana Supreme Court Disciplinary Commission against Usher.  In re Usher, supra. As a result of the grievance and what I am assuming is an investigation, the Disciplinary Commission charged Usher with violating these Indiana Rules of Professional Conduct:

3.3(a)(1): Knowingly making a false statement of fact to a tribunal.

8.1(a): Knowingly making a false statement of material fact to the Disciplinary Commission in connection with a disciplinary matter.

8.1(b): Failure to disclose a fact necessary to correct a misapprehension known by the person to have arisen in a disciplinary matter.

8.4(a): Knowingly assisting another to violate the Rules of Professional Conduct, or violating the rules through the acts of another.

8.4(b): Committing a criminal act (identity deception) that reflects adversely on the lawyer's honesty, trustworthiness, or fitness as a lawyer.

8.4(c): Engaging in conduct involving dishonesty, fraud, deceit or misrepresentation.

8.4(d): Engaging in conduct prejudicial to the administration of justice.

8.4(g): Engaging in conduct that was not legitimate advocacy, in a professional capacity, manifesting bias or prejudice based upon gender.

In re Usher, supra. 

A hearing officer appointed by the Disciplinary Commission held an evidentiary hearing and, on November 14, 2012, filed a report which found that Usher had  “violated all of the above rules except Rule 8.4(b) and 8.4(g).” In re Usher, supra.  Usher then filed a petition with the Indiana Supreme Court, asking it to review (and presumably reverse) the report.  In re Usher, supra. 

The Court found Usher violated Rule 3.3(a)(1) by submitting “false responses” to requests for admissions (RFA) Doe sent him as part of a civil suit she filed against him.  In re Usher, supra.  It noted that in the disciplinary proceeding Usher claimed he was

justified in denying a RFA that he `composed’ the email because he interpreted `composed’ to mean preparing the email that was actually transmitted, that he was justified in denying that he asked or directed another person to send the email because he did not select the recipients or the email account name, and was justified in denying he knew who sent the email because KB might have asked someone else to send it. 

In re Usher, supra. 

It found Usher had violated Rule 8.1(a) because in his answer to the Disciplinary Commission’s complaint he “falsely” denied he “had drafted the subject line of the email”, but when he testified at the hearing he admitted he had drafted it.  In re Usher, supra.  The Court also found he had violated Rule 8.1(b) because in this response to the complaint he “was less than entirely forthcoming about his involvement with the email”, a response which the court said “seems crafted to create misapprehensions rather than to dispel them.”  In re Usher, supra. 

The Court found Usher violated Rule 8.4(a) “by procuring the aid of KB in disseminating the email.”  In re Usher, supra.  As to Rule 8.4(b), which prohibits engaging “in a criminal act that reflects adversely on the lawyer’s honesty, truthworthiness, or fitness as a lawyer”, the Disciplinary Commission charged Usher with violating this rule by “committing identity deception” in violation of Indiana Code § 35-43-5-3.5 “in connection with the email.”  In re Usher, supra.  The hearing officer found the Commission had not met its burden of proof on this charge and so did not find Usher violated it; the Court deferred to the hearing officer’s conclusion.  In re Usher, supra. 

The Court also found that Usher violated Rule 8.4(c), which bars a lawyer from engaging in “conduct involving dishonesty, fraud, deceit or misrepresentation”.  In re Usher, supra.  The Court noted it had already found Usher made misrepresentations in his responses to the RFAs. In re Usher, supra.  It also found he had engaged in misrepresentation and dishonesty in his conduct involving the email, i.e., “by giving it the false appearance of consisting of actual communications between female attorneys and other professionals, by including statements and implications he knew to be false, and by telling KB that the email was just a prank when it was actually a personal and professional attack on Jane Doe.”  In re Usher, supra. 

As to Rule 8.4(d), the Court found Usher violated this rule “which prohibits conduct prejudicial to the administration of justice, by obstructing the civil action and this disciplinary action through knowingly making false statements of fact in those proceedings.”  In re Usher, supra.  And, finally, as to Rule 8.4(g), “which prohibits an attorney from engaging in conduct that is not legitimate advocacy, in a professional capacity, manifesting bias or prejudice based upon gender” the hearing officer found the Commission had not met its burden of proof on this charge and the Court agreed. In re Usher, supra.  It noted that the evidence supported “a finding that the email was motivated by personal anger at Jane Doe in particular rather than by bias or prejudice against women in general.”  In re Usher, supra. 

The Court then took up the issue of discipline.  In re Usher, supra.  It explained that its analysis of the appropriate discipline involved “consideration of the nature of the misconduct, the duties violated by [Usher], any resulting or potential harm, [Usher’s] state of mind, our duty to preserve the integrity of the profession, the risk to the public should we allow [him] to continue in practice, and matters in mitigation and aggravation.”  In re Usher, supra. 

As to the aggravating factors, the hearing officer found that Usher “(1) has not clearly shown that he appreciates the harm he has done to Jane Doe, and he still believes that the email was, in some way, justified; (2) [his] email was the result of a carefully crafted plan; and (3) [he]  used a trusting subordinate to distance himself from the email and shield himself from the consequences.” In re Usher, supra. 

As to factors mitigating the severity of the violation, the hearing officer found that Usher “(1) has no disciplinary history; (2) expressed some remorse, but only about involving KB in his plan to humiliate Jane Doe; and (3) was dealing with news that his sister had been diagnosed with cancer.”  In re Usher, supra. Usher claimed “depression” contributed to “deficiencies in his initial response to the grievance” but the Court noted that depression is relevant is a mitigator when misconduct is due to “neglect or oversight.”  In re Usher, supra. “[Usher’s] misconduct was deliberate and dishonest.”  In re Usher, supra. 

The Court therefore held that Usher “should be suspended for a period of at least three years and any possibility of reinstatement thereafter be available only upon satisfaction of Indiana's rigorous standards for reinstatement, which require clear and convincing evidence of the petitioner's remorse, rehabilitation, and fitness to practice law.”   In re Usher, supra.  It therefore imposed that sanction.  In re Usher, supra. 

If you would like to read a little more about the facts in the case, and see a photo of Usher, check out this news story.