The Airport, the CBP Agent and the Passwords

This post examines an opinion recently issued in a federal civil case:  Rolando Cruz Lopez sued Customs and Border Protection (CBP) Agent Alejandro Pena, claiming that, “in his individual capacity as a Customs and Border Protection (CBP) agent," Pena "violated the Stored Communications Act (SCA), 18 U.S. Code §§ 2701(a) and 2703, by accessing Cruz Lopez's Yahoo! email account.”  Cruz Lopez v. Pena, 2013 WL 2250127 (U.S. District Court for the Northern District of Texas 2013).

More precisely, Cruz Lopez is suing under 18 U.S. Code § 2707(a)-(c), which creates a civil cause of action for anyone “aggrieved by” a violation of the Stored Communications Act.  Complaint ¶ 89, Cruz Lopez v. Pena, 2012 WL 3307530. The Complaint alleges that Pena violated 18 U.S. Code §§ 2701(a) and 2703, as noted above. Complaint, Cruz Lopez v. Pena, supra, at ¶ 88.  Pena has filed a motion to dismiss the claims under Rule 12(b)(6) of the Federal Rules of Civil Procedure, which lets a defendant argue that the plaintiff’s cause of action is not valid.

As to how the case arose, the Complaint says Cruz Lopez, “who is a citizen of and is domiciled in Mexico”, for years flew to the United States to spend holidays with his long-time friend, James Fox, a U.S. citizen who “is domiciled in Amarillo, Texas.”  Complaint, Cruz Lopez v. Pena, supra, at ¶¶ 3-4, 10-13.  On August 8, 2009, he arrived at the DFW International Airport and presented his Mexican passport, visa and “immigration and customs” documents to a CBP agent. Complaint, Cruz Lopez v. Pena, supra, at ¶ 14. 

Cruz Lopez was told “he would be subject to secondary inspection and was sent to the back offices of the CBP for questioning.  Complaint, Cruz Lopez v. Pena, supra, at ¶ 14.  One officer questioned him in English, after which another officer translated the questions into Spanish. Complaint, Cruz Lopez v. Pena, supra, at ¶ 15.  Cruz Lopez told them that he was here to visit his friend Foxe, he is retired and “was not working in the U.S.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 15.  The officers told him to go sit on a bench in the hallway. Complaint, Cruz Lopez v. Pena, supra, at ¶ 15. 

After a period of time, an officer screamed at Cruz Lopez, telling him to come back into the office. The officers proceeded to take all of [his] possessions; opening his computer case, rifling through his wallet, and throwing his personal possessions and papers on the desk and the floor. Within Cruz Lopez's wallet, in addition to money and personal items, such as pictures, were several Post-It notes.

The Post-It notes had handwritten information including the User ID and password of Cruz Lopez's on-line bank account and personal email accounts. Cruz Lopez was sent in and out of the office on several occasions, forced to leave all of his possessions, including a password protected laptop, camera, cellular phone, wallet and its contents, documents, and all other items with the CBP Officers.

Complaint, Cruz Lopez v. Pena, supra, at ¶ 16. 

The Complaint (and this is Cruz Lopez’s version of these events) says that “[f]or more than 16 hours” he was interrogated by the CBP officers. Complaint, Cruz Lopez v. Pena, supra, at ¶ 17. The Complaint alleges that the officers tried to get Cruz Lopez to admit “that he was working for Foxe”, but he repeatedly told them the two are friends and he “was not working in the U.S.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 18. 

At one point . . . while Cruz Lopez was sitting outside of the office, Pena slammed a piece of paper against an office window for Cruz Lopez to see and gleefully yelled `No, really’ (`No que no’). The piece of paper was later identified as a copy of a deposited check printed off of Cruz Lopez's on-line, U.S. Wells Fargo bank account. Pena told Cruz Lopez the document was proof that [he] was working in the U.S.

Complaint, Cruz Lopez v. Pena, supra, at ¶ 19. 

The Complaint says Pena also called Foxe on his cell phone and Foxe told him “Cruz Lopez was not working for him, but indeed is a close family friend and a welcome guest at his home.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 23.  During the course of the secondary inspection, Cruz Lopez was patted down, fingerprinted and “handcuffed and sent to a van to be transported with other individuals to jail.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 20. That seems to have been the result of what happened earlier:

Pena executed an Expedited Removal Order and applied a five year bar of inadmissibility against Cruz Lopez. According to official documentation, `you are being expeditiously removed from the United States for charges 212 (a) (7) (A) (i) (I) of the INA, you will be barred from re - entering the U.S. for a period of no less than 5 years and admissible after this time only with the proper visa and waiver of admissibility to the United States.’

The document further stated, `You are an immigrant not in possession of a valid unexpired immigrant visa, reentry permit, border crossing card, or other valid entry document required by the Immigration and Nationality Act’, and `It is likely that you have engaged or will engage in unauthorized employment in the United States.’

Complaint, Cruz Lopez v. Pena, supra, at ¶ 19. 

Cruz Lopez was held overnight “at the Bedford jail” and was not allowed to take the blood pressure medicine had had taken for over ten years. Complaint, Cruz Lopez v. Pena, supra, at ¶ 24.  The next day he was “paraded in handcuffs through the DFW airport by CBP officers to a departure gate.”  Complaint, Cruz Lopez v. Pena, supra, at ¶ 25.  He “asked if his luggage and personal possessions would be returned to him”, and “was given an envelope with papers, boarded onto the plane, where his personal items were finally returned.” Complaint, Cruz Lopez v. Pena, supra, at ¶ 25.

Cruz Lopez hired a lawyer and tried to seed redress from the “wrongfully executed Expedited Removal Order”, apparently to no avail.  Complaint, Cruz Lopez v. Pena, supra, at ¶¶  26-42. So this lawsuit followed.  The opinion notes that “in a January 2012 FOIA disclosure,” Cruz Lopez “claims to have discovered that” while he was detained

Pena had accessed at least six emails from his Yahoo! account: (1) a message sent to Cruz Lopez by an acquaintance on May 8, 2009; (2) and (3) Cruz Lopez's May 15 responses to the May 8 message; (4) the acquaintance's May 18 response to at least one of Cruz Lopez's May 15 responses; (5) Cruz Lopez's June 27 response to the acquaintance's May 18 response; and (6) Cruz Lopez's July 4 response to the acquaintance's May 18 response. Cruz Lopez also alleges that Pena may have accessed other emails, including unopened messages.

Cruz Lopez v. Pena, supra. (FOIA refers to the Freedom of Information Act.) As to the emails, the Complaint alleges that

83. The documents produced in March 2012 by USCIS in response to Cruz Lopez's FOIA request include copies of several e-mail communications between Cruz Lopez and an acquaintance sent through [his] Yahoo e-mail account.

84. According to markings on these documents, the e-mails were printed on August 8, 2009, in the United States.

85. Cruz Lopez had not downloaded those e-mails to his computer, and thus the emails were not stored on his laptop computer when he arrived at the Dallas-Fort Worth Point of Entry prior to his detention by CBP on August 8, 2009.

86. Cruz Lopez did not print copies of the e-mail communications contained in the USCIS disclosure on August 8, 2009, nor did he have the means or access to any device by which he could print those e-mail communications on that date, while he was detained by CBP.

87. Yahoo is an `electronic communications service’ under the Stored Communications Act, as it is a `service which provides to users thereof the ability to send or receive wire or electronic communications.’ See 18 U.S. Code § 2510(15).

88. Pena, without Cruz Lopez's authorization, willfully and intentionally accessed Yahoo's facility or computer system through which electronic communications are provided and obtained Cruz Lopez's electronic communications while those communications were in electronic storage within Yahoo facility or system. In doing so, Pena violated the Stored Communications Act, 18 U.S. Code § 2701(a).

Complaint, Cruz Lopez v. Pena, supra. (USCIS refers to the U.S. Citizenship and Immigration Services.)

The Complaint also alleges that Pena accessed Cruz Lopez’s bank account:

76. In March 2010, [Cruz Lopez] obtained, from Wells Fargo, a log which contains entries showing access into [his] account on August 8, 2009, while Cruz was detained and interrogated by the CBP.

77. The March 2010 Wells Fargo log shows Cruz Lopez's account was accessed on August 8, 2009, by a computer or other device with an assigned IP address of 63.167.255.152, corresponding to IP address `DHS/CBP’ and domain name `DHS.GOV.’

78. Documents later obtained pursuant to a USCIS FOIA request include a copy of a check made by Foxe, drawn on his Wells Fargo account, payable to Cruz Lopez.

79. The same documents show Pena included a copy of the check as support for his erroneous determination that Cruz Lopez was working for Foxe. A copy of the check was attached to Pena's affidavit and report in support of the CBP's Expedited Removal. Cruz Lopez did not carry a copy of the check and deposit record on his person when he arrived at the United States Point of Entry on August 8, 2009. Neither did he print a copy of the check or deposit record from his Wells Fargo account on August 8 or 9, 2009. Thus, Pena accessed Cruz Lopez's account without [his] consent and obtained [his] financial records. . . .

Complaint, Cruz Lopez v. Pena, supra. (The bank records were the basis of another claim, but it was apparently dismissed earlier in the case . . . leaving only the Stored Communications Act claim. Cruz Lopez v. Pena, supra.)

The judge began her analysis of Pena’s motion to dismiss the § 2701(a) claim by noting it would be dismissed unless the Complaint “contains sufficient facts to plausibly show that, by objectively unreasonable conduct, (1) Pena violated a right in § 2701(a) that (2) was clearly established in August 2009 and still is.”  Cruz Lopez v. Pena, supra.  

She also noted that § 2701 creates a cause of action against one who intentionally accesses a facility through which an electronic communication service is provided without being authorized to do so and obtains unauthorized access to an electronic communication while it is in electronic storage. Cruz Lopez v. Pena, supra.  

Under 18 U.S. Code § 2510(17), electronic storage is storage of an electronic communication that is “incidental” to its transmission or is storage an electronic communication services uses “for backup protection”.  Cruz Lopez v. Pena, supra.  Cruz Lopez argued that "some" of the "six emails" Pena

allegedly accessed were in electronic storage incident to transmission. Emails not yet opened by the intended recipient are in such storage. . . . 

But none of the six emails Cruz Lopez accuses Pena of accessing were unopened: Cruz Lopez must have opened the first email because he responded to it; he sent the second and third emails, and it is not clearly established that sent communications are in electronic storage when accessed from the sender's account. . .; he obviously opened the fourth because he responded to it; and the fifth and sixth have the same problem as the second and third. 

None of the emails is adequately alleged to have been in electronic storage on August 8–9, 2009.

Cruz Lopez v. Pena, supra (emphasis in the original).

The judge found Cruz Lopez’s claim that Pena “might have accessed unopened emails” in his Yahoo! or Hotmail accounts was too insubstantial to support a finding that Pena violated § 2701(a). She therefore dismissed that claim. Cruz Lopez v. Pena, supra.

The other claim arose under 18 U.S. Code § 2703, which states that the government can require the provider or remote computing services or electronic communication services if it obtains a search warrant, court order or subpoena.  Cruz Lopez v. Pena, supra. Pena argued that no relevant case law establishes that the government violates § 2703 “by hacking into a user’s online email account,” but the judge noted that § 2703 defines “`the only procedure’” law enforcement can use of obtain the contents of electronic communications.  Cruz Lopez v. Pena, supra (emphasis in the original) (quoting Steve Jackson Games, Inc. v. U.S., 816 F.Supp. 432 (U.S. District Court for the Western District of Texas 1993)).

The judge explained that, in this case, Yahoo!

automatically disclosed the emails when Pena logged on, so Pena is left arguing that § 2703 is inapplicable as it applies only to required disclosure . . . and he did not require Yahoo! to do anything because [it] willingly provided access to the account. It is true that a governmental entity following § 2703 `may require’ a provider to disclose electronic communications. 

But it is not true that an officer can ignore § 2703 procedures, hack into an account, and then claim § 2703 is inapplicable because the provider thought that the officer was the user. 

Cruz Lopez v. Pena, supra (emphasis in the original).

The judge therefore denied the motion to dismiss the Stored Communications Act cause of action, which means this part of the case can go forward. Cruz Lopez v. Pena, supra.