Friday, January 31, 2014

The iPhone, Pocket-Dialing and Privacy

James and Bertha Huff sued Carol Spaw, in federal court, claiming she “surreptitiously intercept[ed] their private conversations in violation of Title III of the Omnibus Crime Control and Safe Streets Act of 1968.”  Huff v. Spaw, 2014 WL 273181 (U.S. District Court for the EasternDistrict of Kentucky 2014). As Wikipedia notes, “Title III of the Act set rules for obtaining wiretap orders in the United States.”

The Huffs brought their suit under 18 U.S. Code § 2520(a), which states that

[e]xcept as provided in section 2511(2)(a)(ii), any person whose wire, oral, or electronic communication is intercepted, disclosed, or intentionally used in violation of this chapter may in a civil action recover from the person or entity, other than the United States, which engaged in that violation such relief as may be appropriate.

We will come back to the statutes involved in the suit.  To understand how they do or do not apply, it is necessary to understand what happened to trigger the lawsuit.  According to the opinion, in “late October 2013,” James and Bertha Huff attended a conference in

Bologna, Italy. They were accompanied by Larry Savage, a colleague of Mr. Huff, and Mr. Savage's wife. Mr. Huff and Mr. Savage attended the conference as representatives of the Kenton County Airport Board, which oversees the operations of the Cincinnati/Northern Kentucky International Airport (`CVG’). Mr. Huff serves as Chairman of the Board; Mr. Savage serves as Vice–Chairman.

On the evening of October 23, 2013, Carol Spaw sent Mr. Huff an e-mail inquiring whether he planned to attend a dinner engagement in Italy the following evening. This was a typical task for Spaw, and in fact part of her job duties. Spaw is employed as Senior Executive Assistant to the Chief Executive Officer of CVG, Candace McGraw, as well as liaison to the Kenton County Airport Board. In that role, one of her many tasks is to make travel arrangements for board members.

During a break in the conference the following day, Huff and Savage left the conference room and found a quiet, outdoor balcony so they could discuss Airport personnel matters, including the continued employment of McGraw. However, before diving into their discussion, Huff made sure that nobody was around to overhear what they were saying. He ensured that the door to the balcony was closed, and that no one was standing in the courtyard below. . . .

[T]he two discussed whether they would attend the business event later that evening. Agreeing they would attend, Huff attempted to call Spaw via his iPhone. He was unsuccessful in reaching her . . . apparently because he mis-dialed her number by one digit. Not knowing why the call failed to go through, Huff placed his cell phone in the breast pocket of his suit. Savage then successfully reached Spaw. He had a short conversation with her and confirmed that he and his wife, along with Mr. and Mrs. Huff, planned to attend the dinner engagement later that evening. Savage and Spaw hung up their respective phones at the [end] of their conversation.

Huff v. Spaw, supra.

The opinion says that “[s]hortly thereafter, Huff placed the now infamous `pocket dial’ to Spaw's office phone at the Airport.” Huff v. Spaw, supra. It explains that Spaw answered the

phone and could immediately hear Huff and Savage talking in the background, although she could not make out what they were saying. Spaw said `hello’ at least six times within the first minute of the call but neither Huff or Savage responded.

When neither . . . responded, Spaw placed the call on speaker phone to try to hear what they were saying. She said `hello’ several more times, but again heard no response. Spaw enlisted the help of Nancy Hill, another CVG employee, to help determine what Huff and Savage were discussing. Within the first minute and a half of the phone call, Spaw and Hill determined Huff and Savage were discussing CEO Candace McGraw's employment. Spaw instructed Hill to take down notes of what she heard.

Approximately forty-one minutes into the phone call, Spaw could tell Huff and Savage's conversation had come to an end and they had returned to the conference room. At her deposition, she. . . . [said] she remained on the line because she felt she needed to document what she perceived as inappropriate behavior. . . . [S]he felt Huff and Savage were plotting to take discriminatory action against McGraw, and possibly violate the Board's code of conduct and criminal law. She intended to remain on the line to hear if Huff and Savage made other potentially damning remarks.

Huff v. Spaw, supra.

The opinion says the conference “ended approximately one hour and ten minutes into the call.” Huff v. Spaw, supra. By that time, Spaw had “acquired” a recording device from

the Airport's IT department so she could record any conversations she deemed relevant. Spaw listened in as Huff and Savage left the conference room and walked back to their respective hotel rooms. Along the way, Spaw heard Huff and Savage talk about completely innocuous subjects such as gospel music, taking a nap and meeting in the lobby later in the evening. Spaw . . . remained on the line hoping to hear additional damning conversations.

Approximately one hour and fifteen minutes into the call, Huff returned to his hotel room where . . . Bertha was waiting. . . . Alone in their room, the husband and wife talked about innocent things like all couples do. But Huff also shared with his wife many of the details about his conversation with Savage earlier in the day, including details about Airport personnel matters. Eight-seven minutes into the call, Spaw used the recording device provided by the IT department to record the final four minutes of the Huffs' conversation. . . .

[T]he Huffs laid down on their hotel bed and. . . . continued to discuss airport personnel matters and McGraw, and Spaw continued to record what she overheard. While on the bed, Mr. Huff looked at his cell phone and realized it had an open call with Spaw's office phone.

He initially thought the call had been open for a minute and twenty-nine seconds, but later realized [it] had actually lasted one hour and twenty-nine minutes to this point. Mr. Huff testified that he immediately hung up the call. However, cell phone records indicate that the call lasted one hour and thirty-one minutes, suggesting he left the call open for an additional two minutes after first noticing it.

Huff v. Spaw, supra.

After the call ended, Spaw

took the handwritten notes and converted them into a typewritten transcript of the conversation. The . . . transcript is nothing close to a verbatim recitation of the conversations, but more akin to a summary with intermittent quotations.

Spaw also uploaded the audio recording onto her office computer, and later uploaded the recording onto a thumb drive so that it could be transferred to a third-party company to enhance the audio. Both the transcript and audio recording were eventually shared with members of the Board.

Huff v. Spaw, supra.

The opinion notes a few more relevant facts before addressing the legal issues:

[T]he Huffs knew pocket dials are relatively common in the age of smart phones. . . . Mrs. Huff admitted during her deposition that she has pocket dialed people `many times .’ . . . Mr. Huff . . . eventually admitted, `I'm certain I have [pocket dialed people]. . .  and he `believed’ he had placed previous pocket dials. . . .However, Mr. and Mrs. Huff testified that they expect the recipient of a pocket dial call to hang up once they discover they were inadvertently called.

Huff v. Spaw, supra.

The issue before the District Court Judge was the Huff’s motion for a temporary restraining order and preliminary injunction, the nature of which is not described in this opinion.  Huff v. Spaw, supra.  The judge heard oral arguments from the lawyers on each side as to why the motion should or should not granted, and during the arguments they “agreed that if the Court concludes Plaintiffs are not likely to succeed on the merits – and . . . cannot prevail as a matter of law -- then summary judgment pursuant to Rule 56(f), Federal Rules ofCivil Procedure, would be appropriate.”  Huff v. Spaw, supra.  

As Wikipedia explains, in U.S. civil practice a judge can award summary judgment for a party to a civil suit

before trial, effectively holding that no trial will be necessary. Issuance of summary judgment can be based only upon the court's finding that:

  1. there are no disputes of `material’ fact requiring a trial to resolve, and
  2. in applying the law to the undisputed facts, one party is clearly entitled to judgment. . . . 

A `material fact’ is one which, depending upon what the factfinder believes "really happened," could lead to judgment in favor of one party, rather than the other.

Huff v. Spaw, supra.

As noted above, the Huffs sued under 18 U.S. Code § 2520(a), which creates a civil cause of action for those whose communications are the target of activity that violates 18 U.S. Code § 2511.  The judge began his analysis by noting that § 2511(1)(a)((i) makes it a crime to unlawfully and intentionally intercept “any wire, or electronic communications” and § 2511(c) makes it a crime to disclose, “or endeavor to disclose” the contents of such communications knowing they were illegally intercepted.  Huff v. Spaw, supra.

At the oral arguments, the Huffs claimed that (i) the first 87 minutes of their face-to-face communications were “oral” communications but that (ii) once Spaw began recording the call the communications became “oral” and “wire” communications because they were “transmitted over wire to [Spaw’s] office telephone, and then intercepted by a recording device.” Huff v. Spaw, supra.  The judge analyzed whether either or both arguments were valid, starting with the purely “oral” communications.  Huff v. Spaw, supra.

Title III of the Omnibus Crime Control and Safe Streets Act defines “oral communication” as one “`uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation'”.  Huff v. Spaw, supra (quoting 18 U.S. Code § 2510(2)) (emphasis added). The judge noted, therefore, that § 2511 “only protects oral communications to the extent that the participants have both (1) a subjective expectation that their conversation will not be intercepted and (2) that expectation is objectively reasonable” and then analyzed whether the Huffs’ conversations met that standard.  Huff v. Spaw, supra.

The judge then analyzed whether they did, in fact, satisfy that standard:

[The Huffs] unquestionably did not expect that their face-to-face conversations would be intercepted. The very nature of their conversations compels this conclusion. Certainly [Huffs] and Savage would not have openly discussed private Airport personnel matters, including possibly replacing the CEO, knowing others might be listening. Moreover, their actions showed they did not intend others to overhear or intercept their conversations.

A significant portion of the intercepted communications took place in two places: a private balcony and a hotel bedroom. Mr. Huff was alone with Savage on the balcony, and ensured no one was around before discussing personnel issues. Similarly, [he] was alone with his wife in their hotel room when he recounted his previous conversation with Savage. Under these circumstances, [the Huffs] clearly expected that their conversations would remain private and free from interception. . . .

Huff v. Spaw, supra.

He reached a different conclusion as to whether the expectation was reasonable:

Here, the question is whether it was objectively reasonable for [the Huffs] to expect [Spaw] would not answer the inadvertently placed phone call, remain on the line and listen to [their] face-to-face conversations, and record a small portion of the call.

The Court concludes society is not prepared to recognize [their] expectation as reasonable. . . . At their depositions, both [Huffs] agreed they had placed `pocket dial’ calls from their cell phones in the past. . . . Mr. Huff knew he was carrying his cell phone; he had just hung it up and placed it in his pocket when he began the conversations at-issue in this case. Thus, he knew he was carrying a device that was capable of giving a third party audible access to his conversations without him ever knowing. Knowing that, it is unreasonable for him to expect that anything he says while carrying that device will remain free from interception as it was done here. . . .

Society has come to accept the fact that people often place inadvertent calls from their cell phones. This fact has become so well accepted that society has given the technological annoyance a name: the `pocket’ or `butt’ dial. . . . And society recognizes the consequences of a pocket dial. . . ., states that `. . . . the recipient is likely to know the caller, and may overhear conversations that the caller would not want them to hear.’ Pocket Dialing,—dial (last visited Jan. 24, 2014) (emphasis added).

That is exactly what happened here. Because society recognizes that this is a consequence of carrying a cell phone, the Court simply disagrees with [the Huffs] that they had an objectively reasonable expectation that [Spaw] would not listen in to their face-to-face conversations.

But what about the fact that [Spaw] listened for ninety-one minutes and recorded the last four minutes of the call? [The Huffs]. . . . agree there was nothing wrong with [her] answering the pocket dial. But they take issue with the fact that [she] remained on the line for so long even though Mr. Huff never engaged her in conversation. [The Huffs] believe society is willing to recognize that it is reasonable to expect a recipient of a pocket dial to hang up once she discovers that the call was inadvertently placed.

The Court disagrees. While it may be polite for the recipient to hang up once she discovers she has received a pocket dial, it is not reasonable to expect everyone to do so. If an individual wants to keep his conversations private, the onus is on him to do so. He cannot give another person access to his conversation and then put the burden on that individual to determine that she should take no part in it. Therefore, the court finds that [the Huffs’] expectation of non-interception was unreasonable here.

Huff v. Spaw, supra. The judge concluded this part of his analysis by noting that “[i]f If anyone must bear the brunt of the embarrassing consequences of this pocket dial, it must be the caller; not the recipient who had every right to answer the call and remain on the line.”  Huff v. Spaw, supra.

The judge then addressed whether the case involved “wire” communications.  Section 2510(1) of Title18 of the U.S. Code defines “wire communication” as

any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable, or other like connection between the point of origin and the point of reception . . . furnished or operated by any person engaged in providing or operating such facilities for the transmission of interstate or foreign communications or communications affecting interstate or foreign commerce and such term includes and electronic storage of such communication.

Huff v. Spaw, supra. 

The Huffs claimed the case involved wire communications because “there was an aural transfer between themselves and [Spaw], which was transmitted in part by wire to [her] office telephone and then intercepted by [Spaw] via the recording device.” Huff v. Spaw, supra.  The judge did not agree, finding that 18 U.S. Code § 2510(1) required him to

identify the aural transfer's point of origin and point of reception and then determine . . .  whether the transfer was made in whole or in part `by the aid of wire, cable, or other like connection.’ See 18 U.S. Code § 2510(1). [The Huffs] identified [Spaw’s] office telephone as the point of reception, which, if true, would make the aural transfer a `wire communication.’

But [her] office telephone was not the point of reception; Mr. and Mrs. Huff, having a face-to-face conversation, were the point of origination and reception. [Spaw’s] office phone was the `electronic, mechanical, or other device’ used to intercept [the Huffs’] face-to-face conversation. See 18 U.S. Code § 2510(5). The recording device served as an additional device used to enhance the interception of the office phone.

Because there was no `oral, cable, or other like connection between Mr. and Mrs. Huff, their conversation was not a `wire communication’ as that term is defined by § 2510(1).

Huff v. Spaw, supra. 

He therefore held that

[h]aving failed to establish that they were engaged in a type of communication that is protected by the Act, [the Huffs] cannot bring a cause of action against [Spaw] under 18 U.S. Code § 2520(a) for any violation of 18 U.S. Code § 2511. [Spaw is] therefore entitled to judgment as a matter of law on each of Plaintiffs' federal claims.

Huff v. Spaw, supra. 

So, that ends the case unless and until the Huffs can convince the U.S. Court of Appeals for the 6th Circuit to reverse the judge’s ruling.  Huff v. Spaw, supra. 

If you are interested, you can see a photo of Mr. and Mrs. Huff and read more about the case here.  The news story you can find here provides more details about the facts in the case.

Wednesday, January 29, 2014

Cyberimpersonation, the Unique Device Identifier and Harassment

After MaKenna Portuguez obtained a restraining order to prevent Ethan Espiritu, a former friend and high school classmate, from harassing her”, Ethan appealed, claiming “the evidence was insufficient to support the trial court's finding that he had sent certain unwanted text messages to MaKenna.”  Portuguez v. Espiritu, 2014 WL 261327 (California Court of Appeals 2014).  As Wikipedia explains, a restraining order is a
court order that requires a party to do, or to refrain from doing, certain acts. These orders flow from the court's injunction power to grant equitable remedies. A party that refuses to comply with an order faces criminal or civil penalties. . . .
In this case, Portuguez asked the court to issue a restraining order under California Code of Civil Procedure § 527.6 to prevent further incidents of conduct she described at the hearing on her request.  Portuguez v. Espiritu, supra.  According to the opinion, at the hearing the judge held on her motion for the order, Portuguez testified that in 2010

she gave Ethan her e-mail address and password so he could set up a Skype account for her. When Ethan was at her home in December of that year, she gave him the password for her home wireless Internet, and he connected his telephone to her computer. MaKenna testified that whenever she is at home, her telephone automatically connects to the wireless Internet.

According to MaKenna, Ethan started compromising her Internet accounts in mid–2011 and continued to do so for several months. He changed her passwords and enabled a password recovery feature that sent her new passwords to his e-mail account.

MaKenna also testified that in the summer of 2011, various Internet accounts were created in her name. Numerous messages concerning her relationship with Ethan that appeared to be from MaKenna but actually were not were posted to or sent from these accounts. For example:

— Several messages were posted over the course of a week on a Twitter account that included MaKenna's name and a photograph from her Facebook page. Some messages contained abusive and obscene language that expressed anger over the termination of the relationship, while others mentioned a `Cinderella story’ and expressed sadness the relationship had ended. . . .

Portuguez v. Espiritu, supra.  Portuguez also said she “received numerous unwanted communications” from Espiritu “in the summer and fall of 2001”, including these:

— In November, MaKenna received a series of text messages from Ethan while she was riding home from school with her friend Kyle. One . . .  stated: `I knew you were a cheat. You always were. You lying bitch. I hope they [f]* *k you and get you pregnant so you can kill another one.’ Another stated: `Girl[,][I] hate you. I wish[ ] you would disappear. You messed up so don[']t even come around me.’ . . . MaKenna . . . `was upset that [Ethan] would talk to [her] that way.’. . .

Portuguez v. Espiritu, supra. 

Portuguez also testified that from “December 2011 through February 2012, MaKenna testified she received several text messages through a service called Pinger, which allows subscribers to send text messages without paying a fee.”  Portuguez v. Espiritu, supra. They included the following:

— `You left [C]atholic school to go to a public school. Now you left public to go back to a private [C]atholic school? If you think you're escaping the problem, you aren't. I asked people and they wouldn't tell me but I have my ways of finding things out.’ MaKenna found this message `pretty odd and scary.’

— `I don't know why you keep changing your number when all I want to do is talk to you. [S]eeing you Friday made me realize what I've lost. [P]lease answer back. I miss you.’

Portuguez v. Espiritu, supra. 

The opinion explains that records obtained from Pinger

listed an account username that combined a nickname for MaKenna with Ethan's date of birth, contained the e-mail address that was created in MaKenna's name in the summer of 2011, and showed the messages originated from IP addresses for MaKenna's telephone and home wireless Internet. MaKenna denied sending the messages.
MaKenna testified she transferred to a different high school the day after she received the text message from Ethan about flattening her friend Kyle's tires because she `was tired of the harassment from Ethan.’ She also testified she wanted a restraining order because she was `afraid of Ethan’ based on his creation of Internet accounts in her name, impersonation of her, sending her messages, and attempts to find out her mobile telephone number and location.

Portuguez v. Espiritu, supra. 

To support her application, Portuguez called Jeffrey Tutton, a computer security

specialist, to testify . . . on cyberimpersonation. Tutton testified that every device manufactured by Apple Inc. has a unique device identifier (UDID), and every device connected to the Internet (whether manufactured by Apple Inc. or another company) has an Internet protocol (IP) address to and from which electronic information is sent. According to Tutton, the UDID of another person's telephone can be obtained by physically accessing the telephone, or by running readily available UDID detection software on one's own telephone while it is connected to the same wireless network to which the other person's phone is connected or while it is physically connected to a computer on the other person's network.

Tutton also explained that the IP address of a device connected to the Internet can be obtained by physically accessing the device; by obtaining the password for the network to which the device is connected, accessing the network, and running an Internet connection speed test on the network; or by sending an e-mail and getting a response stating that the e-mail was opened and identifying the IP address of the device on which it was opened. Finally, Tutton testified that by obtaining the UDID and the IP address for another person's telephone, entering the UDID into a program on one's own telephone, and remotely accessing the other person's IP address, one can send from his own telephone text messages that appear to have been sent from the other person's telephone. . . .

Portuguez v. Espiritu, supra. 

Espiritu’s testimony at the hearing “differed substantially” from Portuguez’s:

Ethan contradicted MaKenna's testimony about his access to her home Internet and her Internet accounts. Ethan denied he ever connected his device to the wireless Internet at MaKenna's house, but admitted he logged on to her home computer with her and accessed a Web site. Ethan admitted changing some of MaKenna's Internet account passwords because he was angry, but denied ever compromising her Google e-mail account. . . .

Ethan testified he broke up with MaKenna in mid-October 2011 and `didn't want to do anything with her anymore.’ He admitted he sent her the message in November 2011 calling her a `cheat’ and a `lying bitch’ because he was angry she was with Kyle, but denied ever threatening to flatten Kyle's tires. Ethan also denied sending other messages MaKenna claimed she had received from him after the breakup. In fact, Ethan testified, he received several unwanted messages from MaKenna. . . .

Finally, Ethan testified he never had a Pinger account and never sent MaKenna any text messages through Pinger. . . . He testified such accusations `made [him] very jumpy,’ and he found it `nerve-racking that someone [was] using his name and . . . texting other people. . . .[I]t's made [his] life a wreck. It's ruined [his] ... social life at school.’

Portuguez v. Espiritu, supra. 

In his appeal, Espiritu argued that the restraining order “must be reversed because it `is contrary to substantial evidence in the record.’” Portuguez v. Espiritu, supra.  The Court of Appeals began its analysis of his argument by noting that the standard on appeal is

`whether the findings (express and implied) that support the trial court's entry of the restraining order are justified by substantial evidence in the record.’ (R.D. v. P.M. (California Court of Appeals 2011) 202 Cal.App.4th 181). Evidence is substantial if it is reasonable, credible, and of solid value such that a reasonable person might accept it as adequate to support a conclusion. (Braewood Convalescent Hospital v. Workers' Comp. Appeals Bd. (California Supreme Court 1983) 34 Cal.3d 15. . . .). In reviewing a record for substantial evidence, we resolve all factual conflicts and credibility questions in favor of the prevailing party and draw all reasonable inferences in support of the trial court's order. (USS–Posco Industries v. Edwards, (California Court of Appeals 2003) 111 Cal.App.4th 436). . . `If . . . substantial evidence supports the trial court's findings and conclusions, the judgment must be affirmed.’ (Board of Education v. Jack M. (California Supreme Court 1977) 19 Cal.3d 691).

Portuguez v. Espiritu, supra. 

The court then explained that, under California law, harassment is

`[a] knowing and willful course of conduct directed at a specific person that seriously alarms, annoys, or harasses the person, and serves no legitimate purpose. The course of conduct must be such as would cause a reasonable person to suffer substantial emotional distress, and must actually cause substantial emotional distress to the petitioner.’ (California Code of Civil Procedure § 527.6(b)(3)). A `[c]ourse of conduct’ is a pattern of conduct composed of a series of acts over a period of time, however short, evidencing a continuity of purpose, including . . . making harassing telephone calls to an individual, or sending harassing correspondence . . . by any means. . . .’ ’ (California Code of Civil Procedure § 527.6(b)). If . . . the trial court `finds by clear and convincing evidence that unlawful harassment exists, an injunction shall issue prohibiting the harassment.’ ’ (California Code of Civil Procedure § 527.6(i)).  

Portuguez v. Espiritu, supra. 

The Court of Appeals found the evidence Portuguez presented was sufficient to justify

the challenged order. The trial court heard testimony from Ethan that he disrupted MaKenna's Internet accounts by changing the passwords and sent her text messages containing angry and obscene language after the breakup of their relationship. The court also heard testimony from MaKenna that over the course of several months, Ethan sent her numerous unwanted electronic communications, some professing love for her and others hatred. The court could infer from [her] testimony that Ethan had created Internet accounts in her name and posted private information about the status of their relationship and MaKenna's emotional state.

Tutton provided expert testimony from which the court could infer that Ethan cyberimpersonated MaKenna by using the Pinger account to send her threatening text messages and make it appear she had sent them herself. Such a `socially unacceptable course of conduct would have seriously alarmed, annoyed, or harassed a reasonable person, and would have caused a reasonable person to suffer substantial emotional distress.’ (Brekke v. Wills (California Supreme Court 2005) 125 Cal.App.4th 1400.) Indeed, MaKenna testified that Ethan's barrage of unwanted communications disturbed her sleep and made her so upset and fearful that she had to change schools.

Portuguez v. Espiritu, supra. 

Espiritu claimed the order should be reversed because the trial court’s “essential}

`factual finding’ that he sent the text messages that were delivered to MaKenna through Pinger `is contrary to the expert testimony.’ According to Ethan, Tutton testified that `momentary possession’ of MaKenna's telephone was required to obtain the UDID, but it was `uncontroverted that [Ethan] never had possession of the device.’ Ethan further contends reversal is required because `all the evidence shows’ MaKenna `was texting herself out of spite due to being rejected by [Ethan].’

Portuguez v. Espiritu, supra (emphasis in the original).

The Court of Appeals did not agree, noting that Portuguez and Espiritu both denied

sending them, but the court expressly found MaKenna more credible than Ethan. The records obtained from Pinger showed the messages originated from a UDID and IP address belonging to MaKenna, but Tutton testified that a person who had physically accessed MaKenna's telephone or whose device was connected to her wireless Internet network while her telephone was also connected could obtain the UDID and IP address and later use that information to send a text message from some other device and make it appear the message had been sent from MaKenna's telephone.

Although . . . no evidence was presented that Ethan had physical access to MaKenna's telephone, based on Tutton's testimony, Ethan could have obtained MaKenna's UDID by remotely accessing her home wireless Internet network (for which she testified Ethan had the password) at any time her telephone was connected. Thus, while some evidence supported Ethan's theory that MaKenna sent herself the text messages through Pinger, other evidence supported MaKenna's theory that Ethan sent them and made it look like she did.

Portuguez v. Espiritu, supra (emphasis in the original).

The Court of Appeals also pointed out that, as the trial judge recognized, who sent the

messages through Pinger was `not the only fact in the case.’ Even if we disregard the evidence in favor of MaKenna on that issue, other evidence established Ethan's harassment. . . . For example, there was evidence that Ethan (1) disrupted MaKenna's Internet accounts by changing the passwords on multiple occasions; (2) set up false Internet accounts in her name and posted private information about her; (3) disturbed her sleep by sending her nine text messages within 25 minutes; and (4) sent her multiple messages that contained obscene or threatening language and that caused her to switch schools to get away from him.

Portuguez v. Espiritu, supra.  It therefore affirmed the trial judge’s granting the restraining order. Portuguez v. Espiritu, supra. 

Monday, January 27, 2014

Bits, Tangibility and the National Stolen Property Act

After he was charged with “damaging a protected computer in violation of 18 U.S.Code §§ 1030(a)(5)(A) and 1030(c)(4)(A)(i)(I) (`Count I’), and violating the National Stolen Property Act (`NSPA), 18 U.S. Code §2314 (`Count II’)”, Yijia Zhang filed a motion to dismiss Count II.  U.S. v. Yijia Zhang, 2014 WL 199855 (U.S. District Court for the Eastern District of Pennsylvania 2014).  He filed the motion pursuant to Rule 12(b)(3)(B) of the Federal Rules of Criminal Procedure.  U.S. v. Yijia Zhang, supra.

This according to the opinion, is how Zhang came to be prosecuted:

Zhang worked as a computer systems manager for `Company A’ until July 6, 2010. . . . On June 28, 2010, Zhang copied approximately 6,700 of Company A's confidential files from an unspecified location on Company A's internal network to the desktop computer provided to Zhan g by Company A. . . .

Zhang then transferred some or all of these files from his computer to one of Company A's servers (the `Server’). . . . The copied and transferred files contained `sensitive information regarding the operation and development of Company A's computer network.’ . . . Two days later, on June 30, 2010, Zhang gave Company A written notice that his last day with the company would be July 6, 2010. . . .

On Saturday, July 3, 2010, Zhang copied approximately 2,800 more confidential files from Company A's network to his desktop computer. . . . On Sunday, July 4, 2010, Zhang copied roughly 300 more confidential files to his computer. . . . Zhang then transferred some or all of the confidential files that he had accumulated on his desktop computer that weekend to the Server. . . .

Next, Zhang established an Internet connection between the Server and Internet storage sites in Sweden and Germany that Zhang maintained. . . . Zhang then used this connection to transfer an unspecified number of Company A's confidential files to the Internet storage sites. . . . After completing this transfer, Zhang covered his digital tracks by deleting unspecified files from the Server. . . . The deletion of these files eliminated evidence of Zhang's transfers and prevented the Server from functioning as intended. . . .

U.S. v. Yijia Zhang, supra.  If you are interested, you can find the indictment against Zhang here.

The U.S. District Court judge who has the case began his ruling on Zhang’s motion to dismiss by explaining that Rule 7(c)(1) of the Federal Rules of Criminal Procedure

provides that an `indictment . . . must be a plain, concise, and definite written statement of the essential facts constituting the offense charged.’ `A facially sufficient indictment (1) contains the elements of the offense intended to be charged, (2) sufficiently apprises the defendant of what he must be prepared to meet, and (3) allows the defendant to show with accuracy to what extent he may plead a former acquittal or conviction in the event of a subsequent prosecution.’ U.S. v. Stock, 728 F.3d 287 (U.S. Court of Appeals for the 3d Circuit 2013). . . .

`Under Rule 12(b)(3)(B), a defendant may contest the sufficiency of an indictment on the basis that it fails to state an offense . . . [because] the specific facts alleged fall beyond the scope of the relevant criminal statute, as a matter of statutory interpretation.U.S. v. Stock, supra (internal quotation marks omitted). A district court evaluates a challenge under this Rule by `determining whether, assuming all of those facts as true, a jury could find the defendant committed the offense for which he was charged.’ U.S. v. Huet, 665 F.3d 588 (U.S. Court of Appeals for the 3d Circuit 2012).

U.S. v. Yijia Zhang, supra. 

He also explained that federal crimes are

`solely creatures of statute.’ Dixon v. U.S., 548 U.S. 1 (2006). `Statutory construction must begin with the language employed by Congress and the assumption that the ordinary meaning of that language accurately expresses the legislative purpose.' Gross v. F B L Fin. Servs., Inc., 557 U.S. 167 (2009) (quotation marks omitted).

The Supreme Court instructs that `ambiguity concerning the ambit of criminal statutes should be resolved in favor of lenity.’ Jones v. U.S., 529 U.S. 848 (2000). Accordingly, `when choice has to be made between two readings of what conduct Congress has made a crime, it is appropriate, before [the Court] choose[s] the harsher alternative, to require that Congress should have spoken in language that is clear and definite.’ Jones v. U.S., supra.

U.S. v. Yijia Zhang, supra. 

The judge then noted that the National Stolen Property Act (NSPA) makes it a crime for

a person to `transport[ ], transmit[ ], or transfer[ ] in interstate or foreign commerce any goods, wares, merchandise, securities or money, of the value of $5,000 or more, knowing the same to have been stolen, converted or taken by fraud.’ 18 U.S. Code § 2314. The digital files at issue in this case are neither securities nor money. . . . 

Thus, to survive Zhang's motion to dismiss, the indictment must allege: (1) that Zhang transported, transmitted, or transferred goods, wares, or merchandise in interstate or foreign commerce; (2) that those goods, wares, or merchandise had a value of $5,000 or more; and (3) that Zhang knew `the same’ to have been stolen, converted, or taken by fraud. . . .

U.S. v. Yijia Zhang, supra. 

In his motion to dismiss, Zhang argued that the indictment failed to state an offense

for two reasons. First, Zhang argues that t he Indictment fails to allege that `the stolen item was in some tangible or physical form’ when it was stolen. . . . Second, Zhang argues that the Indictment fails to allege the existence of a market for the confidential information stolen by Zhang. . . .

U.S. v. Yijia Zhang, supra. 

The judge therefore found that Zhang’s arguments required him to “determine whether the NSPA requires the government to make these allegations, and, if it does so require, whether the government makes these allegations in the Indictment.” U.S. v. Yijia Zhang, supra.  He began with the first issue:  whether “the NSPA includes a tangibility requirement”.  U.S. v. Yijia Zhang, supra. 

In 1985, in Dowling v. U.S., 473 U.S. 207, the Supreme Court addressed whether the

NSPA criminalizes the `interstate shipments of bootleg and pirated sound recordings and motion pictures whose unauthorized distribution infringed valid copyrights.’ Dowling v. U.S., supra. The indictment. . . . alleged that the `unauthorized use of the musical compositions rendered the phonorecords “stolen, converted or taken by fraud” within the meaning of the [NSPA].’  Dowling v. U.S., supra. Thus, the Supreme Court decided whether the NSPA criminalizes the interstate shipment of bootleg records where nothing tangible was stolen, converted, or taken by fraud.

The Supreme Court began . . . by noting that the text of the NSPA does not plainly cover the interstate shipment of bootleg records for two reasons. First, copyrighted works are not obviously goods, wares, or merchandise. The Court explained that the NSPA `seems clearly to contemplate a physical identity between the items unlawfully obtained and those eventually transported’ by `requiring that the “goods, wares, [or] merchandise” be “the same” as those “stolen, converted or taken by fraud”.’ Dowling v. U.S., supra (quoting 18 U.S. Code § 2314). . . . Second, the Court noted that `interference with copyright does not easily equate with theft, conversion, or fraud.’ Dowling v. U.S., supra. . . . `[I]nfringement plainly implicates a more complex set of property interests than . . . theft, conversion, or fraud.’ Dowling v. U.S., supra

. . . The Court found Congress's purpose in enacting the NSPA was to `assist the States' efforts to foil the “roving criminal,” whose movement across state lines. [It] reasoned that `the need to fill with federal action an enforcement chasm created by limited state jurisdiction . . . simply does not apply to’ interstate shipment of `merchandise whose contraband character derives from copyright infringement’ because `Congress has the unquestioned authority to penalize directly the distribution of goods that infringe copyright, whether or not those goods affect interstate commerce.’ Dowling v. U.S., supra.  

The Court concluded that the NSPA does not `plainly and unmistakably’ apply to the interstate shipment of bootleg records. Dowling v. U.S., supra. [It therefore] reversed the defendant's conviction under the `time-honored interpretive guideline that ambiguity concerning the ambit of criminal statutes should be resolved in favor of lenity.’ Dowling v. U.S., supra

U.S. v. Yijia Zhang, supra.  The judge noted that the U.S. Circuit Courts of Appeals “for the 1st, 2nd, 7th, and 10th Circuits have concluded that only tangible property can constitute goods, wares, or merchandise” under the NSPA. U.S. v. Yijia Zhang, supra. 

He explained that the prosecution “urges us to decide that the NSPA includes no tangibility requirement” and that “Dowling does not compel a contrary conclusion for two reasons.”  U.S. v. Yijia Zhang, supra. 

First, the government argues Dowling did not hold that the NSPA requires `a physical identity between the items unlawfully obtained and those eventually transported, and hence some prior physical taking of the subject goods’ . . . because that language is dictum. . . .

The government explains that Dowling merely `held that what the defendant transported across state lines -- the physical records -- was not the “the same” as the thing that he had taken-the copyright holder's statutory right to limit and license copying.’ . . . We agree. But, dictum or otherwise, the Supreme Court noted that the `common-sense meaning of the statutory language’ limits application of the NSPA to `physical “goods, wares, [or] merchandise” that have themselves been ‘stolen, converted or taken by fraud.’ Dowling v. U.S., supra (quoting 18 U.S. Code § 2314). We find this analysis to be highly persuasive. . . .

Second, the government argues that any `tangibility requirement was removed when Congress amended the [NSPA] in 1988.’ . . . That year, Congress amended the NSPA by `striking “transports” and inserting “transports, transmits, or transfers.”’ Anti–Drug Abuse Act of 1988, Pub.L. No. 100–690, 102 Stat. 4181 (1988). 

It is unclear whether this change removed any tangibility requirement. On the one hand, the new verbs -- transmits and transfers -- might apply only to the nouns `securities’ and `money,’ which are readily transmitted and transferred in digital form.  On the other hand, the addition of these verbs might signal that the NSPA now criminalizes the theft of goods, wares, or merchandise that can be transmitted or transferred in digital form.

U.S. v. Yijia Zhang, supra. 

Ultimately, the judge found that the NSPA is “ambiguous” as to whether stolen

`goods, wares, and merchandise’ must take a physical form. The 3rd Circuit directs that the ordinary meaning of goods, wares, and merchandise is `personal property or chattels’ that are `ordinarily a subject of commerce.’ U.S. v. Seagraves, 265 F.2d 879 (1959).  Based on this precedent, we think the most natural reading of `goods, wares, and merchandise’ is personal property or chattels that `have some sort of tangible existence.’ U.S. v. Smith, 686 F.2d 234 (U.S Courtof Appeals for the 5th Circuit 1982). . . . 

This interpretation fits best with the statutory requirement that the goods, wares, or merchandise transported in interstate or foreign commerce be the same as the goods, wares, or merchandise stolen, converted, or taken by fraud; and is consistent with the approaches taken by every Court of Appeals to consider the issue.

The government's contrary position is not unreasonable. In this digital era, we think that intangible products could reasonably be understood to constitute personal property that is ordinarily the subject of commerce. . . . However, the government's position merely demonstrates that there is some ambiguity surrounding the NSPA's reach.

U.S. v. Yijia Zhang, supra. 

The judge therefore held that to state an offense under the NSPA, the indictment must

allege that Zhang transported, transmitted, or transferred something that had been stolen, converted, or taken by fraud while in a tangible form. The value of that object may derive from intangible information contained within the item; but without a physical manifestation, the stolen property is not goods, wares, or merchandise within the meaning of the NSPA.

U.S. v. Yijia Zhang, supra. 

The judge then took up the other issue:  whether the indictment alleged the information Zhang stole “`ever took physical form.’”  U.S. v. Yijia Zhang, supra.  Zhang pointed out that, “`the Government alleges that Mr. Zhang transferred electronic files over the internet from a network to a server.’” U.S. v. Yijia Zhang, supra. 

The government responds that `storage of information in digital format on a server, a computer hard drive, or a disk is just as physical as the storage on a piece of paper.’ . . . The government [claims] the Indictment satisfies any tangibility requirement because `the material had a physical embodiment on the servers of Company A’ and on Zhang's `storage space in Europe.’

U.S. v. Yijia Zhang, supra. 

The judge then explained that he agreed with the prosecution that information stored

in computer hardware has a physical manifestation. . . . If the government had accused Zhang of stealing some part of Computer A's server that stored propriety information, we would have had little difficulty concluding that the tangibility requirement were satisfied. . . . But . . . the government accuses Zhang of stealing information by transmitting that information over the Internet. This transmission was . . . the act that rendered the digital files stolen, and the act that the government argues violated the NSPA.

The government has not alleged, as it must, that the digital files transmitted by Zhang had been stolen, converted, or taken by fraud while in a tangible form. Bits transmitted over the Internet are intangible information falling outside the NSPA's ambit. Accordingly, the government has failed to state an offense under the NSPA.

U.S. v. Yijia Zhang, supra. 

He therefore granted Zhang’s motion to dismiss Count II of the indictment.  U.S. v. Yijia Zhang, supra.