Sandi Lazette, a former employee of “Cellco Partnership,
d/b/a Verizon Wireless” sued Verizon and her former supervisor, Chris
Kulmatycki. Lazette v. Kulmatycki, 2013
WL 2455937 (U.S. District Court for the Northern District of Ohio 2013). In the
suit, she asserts several causes of action, all of which arise from the
following facts:
Verizon provided the blackberry for [Lazette’s]
use. She was told she could use the company-issued phone for personal
e-mail. She had an account with g-mail, though she believed she had deleted
that account from the phone before giving it to Kulmatycki in September, 2010.
She understood Verizon would `recycle’ the phone for use by another
employee.
In May, 2012, [Lazette] learned that Kulmatycki,
rather than deleting her g-mail account, had been accessing her [it] for . . .
eighteen months. In addition, Kulmatycki, on information and belief, had
disclosed the contents of the e-mails he accessed. [Lazette] neither consented
to nor authorized [his] surreptitious reading of her personal e-mails. . . . .
Once [Lazette] was aware of
Kulmatycki's actions, she changed her password to prevent further access.
Before she did so, he had accessed 48,000 e-mails in her g-mail account. Among
the contents of the accessed e-mails were communications about [Lazette’s]
family, career, financials, health, and other personal matters.
Lazette v. Kulmatycki,
supra.
In this opinion, the federal district court judge who has
the case is ruling on the defendants’ motion, under Rule 12(b)(6) of the Federal Rules of Civil Procedure, to dismiss all of Lazette’s causes of
action. Lazette v. Kulmatycki, supra. As Wikipedia explains, defendants use a Rule
12(b)(6) motion to ask the judge to dismiss some or all of the plaintiff’s
causes of action because they are legally deficient.
So when a judge rules on such a motion, he/she is only
concerned with whether the plaintiff’s allegations, if proven at trial, would
establish that the plaintiff is entitled to recover for a given cause of
action. So, if for example, John Doe
sues Mary Smith claiming she published a blog post that libeled him, Mary Smith
can file a Rule 12(b)(6) motion to dismiss pointing out (if this is true) that
Doe’s complaint (his statement of his claim) does not plead one of the
essential elements of libel, which is that the statements were false. If the judge finds that is true, given the
facts pled in the complaint he/she will dismiss that cause of action.
The judge began his analysis of the motion to dismiss with
Lazette’s claim under the Stored Communications Act (SCA) or, more precisely, under
18 U.S. Code § 2701(a). Lazette v. Kulmatycki, supra.
He noted that under § 2701(a), one who (i) intentionally “accesses without
authorization a facility through which an electronic communication service is
provided” or (ii) “intentionally exceeds an authorization to access that
facility” and (iii) “thereby obtains”
access to a “wire or electronic communication while it is in electronic storage
in such system shall be punished” as provided in § 2701(b). The statute uses the definition of electronic
storage, i.e.,
(A) any temporary, intermediate storage of a wire or
electronic communication incidental to the electronic transmission thereof; and
(B) any storage of such communication by an electronic communication service
for purposes of backup protection of such communication.
found in 18 U.S. Code § 2510(17), which is part of the
federal Wiretap Act.
Here, the defendants argued that Kulmatycki's opening and
reading Lazette’s e-mails “did not violate the SCA for any or all of the
following reasons:
• The relief [Lazette] seeks is not
available because the legislative history shows that Congress aimed the SCA at
`high-tech’ criminals, such as computer hackers;
• Kulmatycki had authority to access [Lazette’s
e-mails];
• Kulmatycki's access did not
occur via `a facility through which an electronic communication
service is provided’ other than the company owned blackberry;
• The e-mails were not in electronic storage
when Kulmatycki read them.
Lazette v. Kulmatycki,
supra.
The judge found that the SCA applied to the
defendants. Lazette v. Kulmatycki, supra. He reviewed opinions addressing this issue
from other federal courts and noted that at least one specifically held that the SCA “`does not limit liability to “hackers”’”. Lazette
v. Kulmatycki, supra (quoting Thayer Corp. v. Reed, 2011 WL 2682723
(U.S. District Court for the District of Maine). He also cited another opinion in which the
federal judge noted that the SCA applies “`to persons or entities in
general’”. Lazette v. Kulmatycki, supra
(quoting Sherman & Co v. Salton Maxim Housewares, Inc., 94 F. Supp. 2d 817
(U.S. District Court for the Eastern District of Michigan 2000).
He then took up the defendants’ argument that Kulmatycki “had
authority to access” Lazette’s g-mail account because
1) he used a company-owned blackberry;
2) he did not access a `facility,’ as the statute uses that term; and 3) [Lazette]
authorized Kulmatycki's access because she had: a) not expressly told him not
to read her e-mails; and b) implicitly consented to his access by not deleting
her g-mail account.
Lazette v. Kulmatycki,
supra.
The judge found, first, that “the mere fact Kulmatycki used
a company-owned blackberry to access [Lazette’s] e-mails does not mean he acted
with authorization when he did so.” Lazette
v. Kulmatycki, supra. He noted that “among the cases” the
defendants cited as supporting this argument “are ones where one family member
had accessed e-mails sent to another family member on a family computer.” Lazette
v. Kulmatycki, supra (citing White v. White, 781 A.2d 85 (New Jersey
Superior Court 2001)). He pointed out
that these cases were
readily distinguishable, as they
involved joint users of a shared computer. Here, there never was joint use between
[Lazette] and Kulmatycki. Indeed, when Kulmatycki accessed e-mail sent to [Lazette]
she was not able to use the blackberry to do likewise.
Lazette v. Kulmatycki,
supra.
He then took up the defendants’ argument that Kulmatycki “did
not access a `facility,’ as [SCA] uses that term”. Lazette
v. Kulmatycki, supra. More precisely, they claimed
Kulmatycki's conduct was lawful,
because he used the blackberry to open and read [Lazette’s] e-mails. Their
reasoning is that: 1) the blackberry was a `facility’ within the meaning
of § 2701(a)(1); 2) Kulmatycki was (indisputably) an authorized user of
the blackberry; therefore, 3) the SCA permitted him to use such facility to do
what he did. Accordingly, defendants conclude, [Lazette] fails to state a claim
under § 2701.
Lazette v. Kulmatycki,
supra.
The judge noted that neither the Wiretap Act nor the SCA
“defines `facility.’” Lazette v.
Kulmatycki, supra. He therefore relied on cases in which courts
considered whether a personal computer is a “facility” under the SCA in ruling
on the defendants’ argument. Lazette v. Kulmatycki, supra.
He explained that in Crowley v.
CyberSource Corp., 166 F. Supp.2d 1263 (U.S. District Court for the
Northern District of California 2001), that district court judge pointed out
that,
if the computer which is accessed and
the computer through which access occurs are both `facilities,’ it would
certainly `seem odd that the provider of a communication service could grant
access to one's home computer to third parties, but that would be the result of
Crowley's argument.’
Taking this circuitous route, the court observed, `would
equate a user with a provider and, thus, ignore language in §
2701(c) that treats users and providers as different.' Id. at
1270. A user of a service, as Kulmatycki was when he accessed [Lazette’s]
e-mails, is not also the provider of those same e-mails.
Lazette v. Kulmatycki,
supra (quoting Crowley v. Cybersource Corp., supra). This judge therefore found
that the “`electronic communications service’ resided in the g-mail server, not
on the blackberry, and the g-mail server, not the blackberry, was the
`facility.’ Lazette v. Kulmatycki, supra.
He then took up the argument that by not “clos[ing] her
g-mail account” Lazette had authorized access to the emails at issue. Lazette v. Kulmatycki, supra (her “negligence left her e-mail
door open for Kulmatycki to enter and roam around . . . for as long and as much
as he desired”).
The judge noted that consent to access communications can be
implied from conduct but found that “even if” Lazette had been aware “her e-mails
might be monitored, any such implied consent . . . would not be unlimited. Random monitoring is one thing; reading
everything is another.” Lazette
v. Kulmatycki, supra. So he also rejected that argument. Lazette
v. Kulmatycki, supra.
Finally, he addressed the argument that the emails were not
in “electronic storage,” as defined above, when Kulmatycki accessed them Lazette
v. Kulmatycki, supra. The judge agreed with the defendants that
“only emails awaiting opening by the intended recipient are within this
definition), which meant that Lazette
cannot prevail to the extent she seeks
to recover based on a claim that Kulmatycki violated the SCA when he accessed
e-mails which she had opened but not deleted. Such e-mails were not in `backup’
status as § 2510(17)(B) uses that term or `electronic storage’
as § 2701(a) uses that term.
Lazette v. Kulmatycki,
supra.
He then rejected their argument that Lazette’s complaint did
not state a viable cause of action because she did not “specify which of the
48,000 emails” Kulmatycki accessed had not been opened when he did so. Lazette
v. Kulmatycki, supra.
Given the volume of e-mails [Lazette]
alleges Kulmatycki opened, I believe that I can draw a fair and plausible
inference that Kulmatycki opened some of those e-mails before plaintiff did,
and thus, in doing so, violated § 2701(a). [Her] complaint
adequately alleges that Kulmatycki violated § 2701(a) when he opened
e-mails before she did.
Lazette v. Kulmatycki,
supra.
Finally, he addressed the defendants’ motion to dismiss
Lazette’s cause of action for intrusion into seclusion in violation of Ohio
law.
As Wikipedia explains, intrusion
into seclusion occurs when someone “intrudes, physically, electronically, or
otherwise, upon the. . . or seclusion of a person, or the private affairs . . .
of a person, by . . . electronic device or devices to oversee or overhear the
person's private affairs”. To trigger
liability under Ohio law, the intrusion must be “highly offensive to a
reasonable person.” Lazette v. Kulmatycki, supra.
The judge noted that whether Lazette’s expectations “that no
one would intrude into her email account” were reasonable depended on a number
of facts, such as whether she should have expected “total absorption” of the
contents of her g-mail account, exactly what Kulmatycki did, when he did it and
“what were his motives”. Lazette v. Kulmatycki, supra.
He found that her intrusion upon seclusion claim survived the
motion to dismiss because her emails “were highly personal and private” and a
“reasonable jury could find Kulmatycki's reading of tens of thousands of such
private communications, if proven to have occurred, `highly offensive.’” Lazette v. Kulmatycki, supra.
He therefore granted the motion to dismiss “to the extent
she seeks § 2701 recovery for accessing opened, but undeleted e-mail”
but denied it as to the other claims. Lazette v. Kulmatycki, supra.
That does not, of course, mean Lazette has won; it simply means that the
case goes forward, and might eventually go to trial (or to a settlement). Lazette v. Kulmatycki, supra.
No comments:
Post a Comment