Friday, August 09, 2013

The Stored Communications Act, the Emails and Seclusion

Sandi Lazette, a former employee of “Cellco Partnership, d/b/a Verizon Wireless” sued Verizon and her former supervisor, Chris Kulmatycki. Lazette v. Kulmatycki, 2013 WL 2455937 (U.S. District Court for the Northern District of Ohio 2013). In the suit, she asserts several causes of action, all of which arise from the following facts:

Verizon provided the blackberry for [Lazette’s] use. She was told she could use the company-issued phone for personal e-mail. She had an account with g-mail, though she believed she had deleted that account from the phone before giving it to Kulmatycki in September, 2010. She understood Verizon would `recycle’ the phone for use by another employee.

In May, 2012, [Lazette] learned that Kulmatycki, rather than deleting her g-mail account, had been accessing her [it] for . . . eighteen months. In addition, Kulmatycki, on information and belief, had disclosed the contents of the e-mails he accessed. [Lazette] neither consented to nor authorized [his] surreptitious reading of her personal e-mails. . . . .

Once [Lazette] was aware of Kulmatycki's actions, she changed her password to prevent further access. Before she did so, he had accessed 48,000 e-mails in her g-mail account. Among the contents of the accessed e-mails were communications about [Lazette’s] family, career, financials, health, and other personal matters.

Lazette v. Kulmatycki, supra.

In this opinion, the federal district court judge who has the case is ruling on the defendants’ motion, under Rule 12(b)(6) of the Federal Rules of Civil Procedure, to dismiss all of Lazette’s causes of action.  Lazette v. Kulmatycki, supra.  As Wikipedia explains, defendants use a Rule 12(b)(6) motion to ask the judge to dismiss some or all of the plaintiff’s causes of action because they are legally deficient. 

So when a judge rules on such a motion, he/she is only concerned with whether the plaintiff’s allegations, if proven at trial, would establish that the plaintiff is entitled to recover for a given cause of action.  So, if for example, John Doe sues Mary Smith claiming she published a blog post that libeled him, Mary Smith can file a Rule 12(b)(6) motion to dismiss pointing out (if this is true) that Doe’s complaint (his statement of his claim) does not plead one of the essential elements of libel, which is that the statements were false.  If the judge finds that is true, given the facts pled in the complaint he/she will dismiss that cause of action.

The judge began his analysis of the motion to dismiss with Lazette’s claim under the Stored Communications Act (SCA) or, more precisely, under 18 U.S. Code § 2701(a).  Lazette v. Kulmatycki, supra.  He noted that under § 2701(a), one who (i) intentionally “accesses without authorization a facility through which an electronic communication service is provided” or (ii) “intentionally exceeds an authorization to access that facility” and (iii) “thereby obtains” access to a “wire or electronic communication while it is in electronic storage in such system shall be punished” as provided in § 2701(b).  The statute uses the definition of electronic storage, i.e.,

(A) any temporary, intermediate storage of a wire or electronic communication incidental to the electronic transmission thereof; and (B) any storage of such communication by an electronic communication service for purposes of backup protection of such communication.

found in 18 U.S. Code § 2510(17), which is part of the federal Wiretap Act.

Here, the defendants argued that Kulmatycki's opening and reading Lazette’s e-mails “did not violate the SCA for any or all of the following reasons:

• The relief [Lazette] seeks is not available because the legislative history shows that Congress aimed the SCA at `high-tech’ criminals, such as computer hackers;

• Kulmatycki had authority to access [Lazette’s e-mails];

• Kulmatycki's access did not occur via `a facility through which an electronic communication service is provided’ other than the company owned blackberry;

• The e-mails were not in electronic storage when Kulmatycki read them.

Lazette v. Kulmatycki, supra. 

The judge found that the SCA applied to the defendants.  Lazette v. Kulmatycki, supra.  He reviewed opinions addressing this issue from other federal courts and noted that at least one specifically held that the SCA “`does not limit liability to “hackers”’”.  Lazette v. Kulmatycki, supra (quoting Thayer Corp. v. Reed, 2011 WL 2682723 (U.S. District Court for the District of Maine).  He also cited another opinion in which the federal judge noted that the SCA applies “`to persons or entities in general’”.  Lazette v. Kulmatycki, supra (quoting Sherman & Co v. Salton Maxim Housewares, Inc., 94 F. Supp. 2d 817 (U.S. District Court for the Eastern District of Michigan 2000).

He then took up the defendants’ argument that Kulmatycki “had authority to access” Lazette’s g-mail account because

1) he used a company-owned blackberry; 2) he did not access a `facility,’ as the statute uses that term; and 3) [Lazette] authorized Kulmatycki's access because she had: a) not expressly told him not to read her e-mails; and b) implicitly consented to his access by not deleting her g-mail account.

Lazette v. Kulmatycki, supra. 

The judge found, first, that “the mere fact Kulmatycki used a company-owned blackberry to access [Lazette’s] e-mails does not mean he acted with authorization when he did so.” Lazette v. Kulmatycki, supra.  He noted that “among the cases” the defendants cited as supporting this argument “are ones where one family member had accessed e-mails sent to another family member on a family computer.”  Lazette v. Kulmatycki, supra (citing White v. White, 781 A.2d 85 (New Jersey Superior Court 2001)).  He pointed out that these cases were

readily distinguishable, as they involved joint users of a shared computer. Here, there never was joint use between [Lazette] and Kulmatycki. Indeed, when Kulmatycki accessed e-mail sent to [Lazette] she was not able to use the blackberry to do likewise.

Lazette v. Kulmatycki, supra. 

He then took up the defendants’ argument that Kulmatycki “did not access a `facility,’ as [SCA] uses that term”.  Lazette v. Kulmatycki, supra.  More precisely, they claimed

Kulmatycki's conduct was lawful, because he used the blackberry to open and read [Lazette’s] e-mails. Their reasoning is that: 1) the blackberry was a `facility’ within the meaning of § 2701(a)(1); 2) Kulmatycki was (indisputably) an authorized user of the blackberry; therefore, 3) the SCA permitted him to use such facility to do what he did. Accordingly, defendants conclude, [Lazette] fails to state a claim under § 2701.

Lazette v. Kulmatycki, supra. 

The judge noted that neither the Wiretap Act nor the SCA “defines `facility.’” Lazette v. Kulmatycki, supra.  He therefore relied on cases in which courts considered whether a personal computer is a “facility” under the SCA in ruling on the defendants’ argument.  Lazette v. Kulmatycki, supra.  He explained that in Crowley v. CyberSource Corp., 166 F. Supp.2d 1263 (U.S. District Court for the Northern District of California 2001), that district court judge pointed out that,

if the computer which is accessed and the computer through which access occurs are both `facilities,’ it would certainly `seem odd that the provider of a communication service could grant access to one's home computer to third parties, but that would be the result of Crowley's argument.’ 

Taking this circuitous route, the court observed, `would equate a user with a provider and, thus, ignore language in § 2701(c) that treats users and providers as different.' Id. at 1270. A user of a service, as Kulmatycki was when he accessed [Lazette’s] e-mails, is not also the provider of those same e-mails.

Lazette v. Kulmatycki, supra (quoting Crowley v. Cybersource Corp., supra). This judge therefore found that the “`electronic communications service’ resided in the g-mail server, not on the blackberry, and the g-mail server, not the blackberry, was the `facility.’ Lazette v. Kulmatycki, supra. 

He then took up the argument that by not “clos[ing] her g-mail account” Lazette had authorized access to the emails at issue. Lazette v. Kulmatycki, supra (her “negligence left her e-mail door open for Kulmatycki to enter and roam around . . . for as long and as much as he desired”). 

The judge noted that consent to access communications can be implied from conduct but found that “even if” Lazette had been aware “her e-mails might be monitored, any such implied consent . . . would not be unlimited.  Random monitoring is one thing; reading everything is another.”   Lazette v. Kulmatycki, supra.  So he also rejected that argument.  Lazette v. Kulmatycki, supra. 

Finally, he addressed the argument that the emails were not in “electronic storage,” as defined above, when Kulmatycki accessed them  Lazette v. Kulmatycki, supra.  The judge agreed with the defendants that “only emails awaiting opening by the intended recipient are within this definition), which meant that Lazette

cannot prevail to the extent she seeks to recover based on a claim that Kulmatycki violated the SCA when he accessed e-mails which she had opened but not deleted. Such e-mails were not in `backup’ status as § 2510(17)(B) uses that term or `electronic storage’ as § 2701(a) uses that term.

Lazette v. Kulmatycki, supra. 

He then rejected their argument that Lazette’s complaint did not state a viable cause of action because she did not “specify which of the 48,000 emails” Kulmatycki accessed had not been opened when he did so.  Lazette v. Kulmatycki, supra. 

Given the volume of e-mails [Lazette] alleges Kulmatycki opened, I believe that I can draw a fair and plausible inference that Kulmatycki opened some of those e-mails before plaintiff did, and thus, in doing so, violated § 2701(a). [Her] complaint adequately alleges that Kulmatycki violated § 2701(a) when he opened e-mails before she did.

Lazette v. Kulmatycki, supra. 

Finally, he addressed the defendants’ motion to dismiss Lazette’s cause of action for intrusion into seclusion in violation of Ohio law.  

 As Wikipedia explains, intrusion into seclusion occurs when someone “intrudes, physically, electronically, or otherwise, upon the. . . or seclusion of a person, or the private affairs . . . of a person, by . . . electronic device or devices to oversee or overhear the person's private affairs”.  To trigger liability under Ohio law, the intrusion must be “highly offensive to a reasonable person.”  Lazette v. Kulmatycki, supra. 

The judge noted that whether Lazette’s expectations “that no one would intrude into her email account” were reasonable depended on a number of facts, such as whether she should have expected “total absorption” of the contents of her g-mail account, exactly what Kulmatycki did, when he did it and “what were his motives”.  Lazette v. Kulmatycki, supra.  He found that her intrusion upon seclusion claim survived the motion to dismiss because her emails “were highly personal and private” and a “reasonable jury could find Kulmatycki's reading of tens of thousands of such private communications, if proven to have occurred, `highly offensive.’” Lazette v. Kulmatycki, supra. 

He therefore granted the motion to dismiss “to the extent she seeks § 2701 recovery for accessing opened, but undeleted e-mail” but denied it as to the other claims.  Lazette v. Kulmatycki, supra.  That does not, of course, mean Lazette has won; it simply means that the case goes forward, and might eventually go to trial (or to a settlement). Lazette v. Kulmatycki, supra. 

No comments: