Plaintiff set up a Google Drive so that he could collect photos and other content related to a local school board controversy. He thought it was private, but it was actually configured so that anyone using the URL could access the content. After the local controversy escalated, plaintiff’s son emailed some photos to an opponent, and one of those photos contained the Google Drive’s URL. That photo made its way into the hands of defendant, who, using the URL, allegedly reviewed, downloaded, deleted, added, reorganized, renamed, and publicly disclosed contents of the Google Drive.

So plaintiff sued under the Computer Fraud and Abuse Act, 18 U.S.C. §1030, (the “CFAA”). Defendant moved to dismiss, arguing, among other things, that plaintiff had failed to adequately plead that defendant’s access to the Google Drive was without authorization.

Defendant had argued that her access using the URL could not be considered unauthorized under the CFAA, in accordance with the holding of hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180 (9th Cir. 2022). In that case, the Ninth Circuit reasoned that “the prohibition on unauthorized access is properly understood to apply only to private information – information delineated as private through use of a permission requirement of some sort.” Thus, for a website to fall under CFAA protections, it must have erected “limitations on access.” And if “anyone with a browser” could access the website, it had no limitations on access.

In this case, defendant merely used her web browser and the URL she obtained to access plaintiff’s Google Drive. The portion of the Google Drive was not password protected. And plaintiff had – though inadvertently – enabled the setting that allowed anyone with the URL to access the drive’s contents.

But in the court’s view, the Google Drive nonetheless had limitations that made defendant’s access unauthorized. The court differentiated the situation from one in which just “anyone with a web browser” might access the content, for example, via a web search. One needed to enter a 68-character URL to access the content. And the content was not indexed by any search engines. So the Google Drive was not “per se” public. And defendant’s access – as plaintiff had pled it – was not authorized.

Greenburg v. Wray, 2022 WL 2176499 (D. Ariz., June 16, 2022)

See also:

• Can you violate the CFAA by deleting data on your own computer?

The post Is it unlawful to access someone else’s Google Drive content that is not password protected? appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Plaintiff sued a company and its president for copyright infringement, over some photos that the company published online. The individual defendant moved to dismiss the claim against him, arguing that the complaint (1) did not plead any facts concerning action that he took, (2) did not try to pierce the company’s corporate veil, and (3) contained no facts to establish that the company is the alter ego of the individual defendant. Plaintiff conceded it was neither pursuing an alter-ego theory nor seeking to pierce the corporate veil. Instead, plaintiff argued that the individual defendant was vicariously liable for the company’s infringement. The court denied the motion to dismiss.

The court looked first to Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005), which provides that one infringes vicariously by profiting from direct infringement while declining to exercise a right to stop or limit it. But then it cited to later Tenth Circuit cases (e.g., Diversey v. Schmidly, 738 F.3d 1196 (10th Cir. 2013)) which state the test for vicarious liability a bit differently. Under  Diversey, “[v]icarious liability attaches when the defendant ‘has the right and ability to supervise the infringing activity’ and ‘has a direct financial interest in such activities.” There is no mention of declining to exercise the right to stop or limit the infringement under this test, as there is in Grokster.

The court found that the plaintiff’s claims for vicarious liability against the individual defendant survive because the complaint alleged that defendant was the owner and president of the company, had the ability to supervise and control content on the website, and received a financial benefit from the operation of the website. It rejected the individual defendant’s argument that the claim should fail because there were no allegations that he declined to exercise the right to stop or limit the infringement.

Great Bowery v. Best Little Sites, 2022 WL 2074253 (D. Utah June 9, 2022)

See also:

• Real estate brokerage may be liable for its agent’s copyright infringement
• Photographer’s copyright claim against officer of company over photos on website moves forward

The post Company president may be liable for vicarious copyright infringement appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Under traditional principles of defamation law, one can be liable for repeating a defamatory statement to others. Does the same principle apply, however, on social media such as Twitter, where one can easily repeat the words of others via a retweet?

Hacking, tweet, retweet, lawsuit

A high school student hacked the server hosting the local middle school’s website, and modified plaintiff’s web page to make it appear she was seeking inappropriate relationships. Another student tweeted a picture of the modified web page, and several people retweeted that picture.

The teacher sued the retweeters for defamation and reckless infliction of emotional distress. The court dismissed the case, holding that 47 USC §230 immunized defendants from liability as “users” of an interactive computer service. Plaintiff sought review with the New Hampshire Supreme Court. On appeal, the court affirmed the dismissal.

Who is a “user” under Section 230?

Section 230 provides, in relevant part, that “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider”. Importantly, the statute does not define the word “user”. The lower court held that defendant retweeters fit into the category of “user” under the statute and therefore could not be liable for their retweeting, because to impose such liability would require treating them as the publisher or speaker of information provided by another.

Looking primarily at the plain language of the statute, and guided by the 2006 California case of Barrett v. Rosenthal, the state supreme court found no basis in plaintiff’s arguments that defendants were not “users” under the statute. Plaintiff had argued that “user” should be interpreted to mean libraries, colleges, computer coffee shops and others who, “at the beginning of the internet” were primary access points for people. And she also argued that because Section 230 changed common law defamation, the statute must speak directly to immunizing individual users.

The court held that it was “evident” that Section 230 abrogated the common law of defamation as applied to individual users. “That individual users are immunized from claims of defamation for retweeting content they did not create is evident from the statutory language. ”

Banaian v. Bascom, — A.3d —, 2022 WL 1482521 (N.H. May 11, 2022)

See also:

• Forwarder of defamatory email protected under Section 230

The post Can a person be liable for retweeting a defamatory tweet? appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Defendant listed a domain name for sale using DomainAgents. After a couple rounds of negotiation, plaintiff accepted defendant’s counteroffer to sell the domain name. But when the time came to put the domain name in escrow to enable transfer, defendant backed out of the deal, saying he had changed his mind. Plaintiff sued for breach of contract and sought a temporary restraining order that would prohibit defendant from transferring the domain name.

The court granted the motion. It agreed with plaintiff that it was appropriate to determine the motion ex parte (that is, without giving notice to the defendant) because the defendant could transfer the domain name in the meantime, thereby depriving plaintiff of the ability to procure an irreplaceable asset.

It found plaintiff would likely succeed on the merits of the breach of contract claim, because plaintiff had shown that a valid contract likely exited, that plaintiff was willing to perform its end of the bargain, that defendant had breached by refusing to go through with the transaction, and that plaintiff had been damaged due to the loss of the ability to procure the domain name from defendant.

The court further found a likelihood of irreparable harm to plaintiff, in that defendant’s communicated belief that he was not bound by the purchase agreement indicated he would sell the domain name to another interested party. If that were to happen, plaintiff would have no recourse against that purchaser, who was not in privity of contract with plaintiff.

Moreover, the court found the balance of equities favored plaintiff. The temporary restraining order would only be in place until a further hearing on injunctive relief could be had, and defendant would not otherwise be restricted from using the domain name in the meantime.

Finally, the court held that the public interest favored granting injunctive relief. The public interest strongly favors enforcing contracts.

Jump Operations, LLC v. Merryman, 2022 WL 1082641 (D. Nev., April 8, 2022)

See also:

• When can you use a competitor’s trademark in a domain name?

The post Restraining order issued against domain name seller who refused to transfer appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Back in the 1990s, Congress recognized that stalkers were aided in their crimes by using victims’ driver’s license information, and states were selling driver’s license information to marketers. So Congress passed the Driver’s Privacy Protection Act, 18 U.S.C. § 2721, et seq. (the “DPPA”). This statute makes it unlawful for any person to knowingly disclose personal information from a motor vehicle record for any use other than certain uses that the statute permits.

Defendant had more than 27 million Texas driver’s license records that it stored on an external unencrypted server. In 2020, it announced that a third party had accessed the records without authorization. As expected, the class action lawyers jumped on board and sued under the DPPA.

The lower court dismissed the DPPA claim in response to defendant’s motion to dismiss for failure to state a claim. Plaintiffs sought review with the Fifth Circuit Court of Appeals. On appeal, the court affirmed the dismissal.

It held that plaintiffs failed to plausibly allege that storing the data on an unencrypted server amounted to a “disclosure”. More specifically, although plaintiffs argued that defendants had placed the information on a server that was readily accessible to the public, that assertion was nowhere in the complaint, nor was it supported by the facts alleged in the complaint.

In finding there to be no disclosure, the court observed that the storage of the data, as alleged, did not make it visible to a digital “passer-by”. This made the case different from Senne v. Village of Palatine, Ill.,695 F.3d 597 (7th Cir. 2012), in which a police officer disclosed information by putting a traffic ticket on a windshield, which any passer-by could see. The court also looked to Enslin v. Coca-Cola Co., 136 F. Supp. 3d 654 (E.D. Pa. 2015), in which that court held there to be no disclosure under the DPPA when someone stole an unencrypted laptop containing information protected under the statute.

Allen v. Vertafore, Inc., No. 21-20404 (5th Cir., March 11, 2022)

The post Is storing protected information on an unencrypted server a disclosure of that information? appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Plaintiff sued YouTube after the platform took down one of plaintiff’s videos in response to a DMCA takedown notice. She claimed YouTube failed to follow the procedures in 17 U.S.C. §512 by, for example, not providing her with a physical signature of the copyright owner and otherwise not following the “exact course of the DMCA guidelines.” YouTube moved to dismiss and the court granted the motion.

It held that §512 serves to provide safe harbor protections from copyright infringement liability to platforms. Section 512 does not,  however, give rise to a standalone basis to sue a platform.

When a copyright owner sends a DMCA takedown notice to a platform, it must include substantially the following:

• A physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.
• Identification of the copyrighted work claimed to have been infringed, or, if multiple copyrighted works at a single online site are covered by a single notification, a representative list of such works at that site.
• Identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed or access to which is to be disabled, and information reasonably sufficient to permit the service provider to locate the material.
• Information reasonably sufficient to permit the service provider to contact the complaining party, such as an address, telephone number, and, if available, an electronic mail address at which the complaining party may be contacted.
• A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.
• A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

If the notification does not include substantially these items, then if the platform leaves the content up, the insufficient notification will not be considered to have placed the platform on notice of the alleged infringing activity. So if the copyright holder sues the platform for copyright infringement, it will have to plead other facts showing that the platform is liable for infringement. Relatedly, if the platform acts expeditiously to remove or disable access to allegedly infringing content when it gets knowledge via a valid takedown notice, it will have an affirmative defense to a claim of copyright infringement.

In this case, the court confirmed the notion that the DMCA provides this safe harbor to the platform but does not give the person whose content has been taken down the right to sue the platform. The court does not mention – but it remains relevant – that one whose content has been taken down can seek a remedy under 17 U.S.C. §512(f) against a party who sends a takedown notice while knowingly materially misrepresenting that the content is infringing. But that is not the course plaintiff in this case took – she sued YouTube for not following the requirements that apply to copyright holders. And she lost.

Finley v. YouTube, 2022 WL 704835 (N.D. Cal., March 9, 2022)

See also: Is it defamation to accuse someone of sending a bogus DMCA takedown notice?

The post Can you sue a platform for not following DMCA takedown procedures? appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Plaintiffs filed a class action lawsuit against a facial recognition technology company and related individual defendants, asserting violations of the Illinois Biometric Information Privacy Act (“BIPA”). Plaintiffs alleged that defendants covertly scraped over three billion photographs of facial images from the internet and then used artificial intelligence algorithms to scan the face geometry of each individual depicted to harvest the individuals’ unique biometric identifiers and corresponding biometric information. One of the defendants then created a searchable database containing this biometric information and data that enabled users of its proprietary platform to identify unknown individuals by uploading a photograph to the database. Accordingly, plaintiffs alleged that defendants collected, captured, or otherwise obtained their biometric data without notice and consent, and thereafter, sold or otherwise profited from their biometric information, all in violation of BIPA.

Unconstitutional restriction on public information?

Defendants moved to dismiss the BIPA claim on a number of grounds, including an argument that BIPA violated defendants’ First Amendment rights. More specifically, defendants maintained that the capture and analysis of faceprints from public images was protected speech, and thus, BIPA was unconstitutional because it inhibited the ability to collect and analyze public information. Plaintiffs, however, asserted that the capturing of faceprints and the action of extracting private biometric identifiers from the faceprints was unprotected conduct. The court sided with plaintiffs and rejected defendants’ argument.

The court held that defendants’ argument oversimplified plaintiffs’ allegations. Although defendants captured public photographs from the internet, they then harvested an individual’s unique biometric identifiers and information – which are not public information – without the individual’s consent. Put differently, plaintiffs asserted that the defendants’ business model was not based on the collection of public photographs from the internet, some source code, and republishing information via a search engine, but the additional conduct of harvesting nonpublic, personal biometric data. And, as plaintiffs further alleged, unlike fingerprints, facial biometrics are readily observable and present a grave and immediate danger to privacy, individual autonomy, and liberty.

An intermediate approach to biometric privacy

Accordingly, the court looked at defendants’ conduct as involving both speech and nonspeech elements. Looking to the test set out in the Supreme Court case of United States v. O’Brien, 391 U.S. 367 (1968), the court evaluated how when “elements are combined in the same course of conduct, a sufficiently important governmental interest in regulating the nonspeech element can justify incidental limitations on First Amendment freedoms.” The court applied the intermediate scrutiny standard set out in O’Brien, namely, a regulation does not violate the First Amendment if (1) it is within the power of the government to enact, (2) furthers an important government interest, (3) the governmental interest is unrelated to the suppression of free expression, and (4) any incidental restriction on speech is no greater than is necessary to further the government interest.

The first element was easy to dispense with because the parties did not argue that the Illinois General Assembly lacked the power to enact BIPA. On the second element, the court found that the General Assembly enacted BIPA to protect Illinois residents’ highly sensitive biometric information from unauthorized collection and disclosure. Regarding the third element, the court noted that BIPA, including its exceptions, does not restrict a particular viewpoint, nor does it target public discussion of an entire topic. And on the fourth O’Brien element, the court found BIPA to be narrowly tailored by legitimately protecting Illinois residents’ highly sensitive biometric information and data, yet allowing residents to share their biometric information through its consent provision. And BIPA is not overly-broad because it does not prohibit a substantial amount of protected speech

In re Clearview AI, Inc., Consumer Privacy Litigation, 2022 WL 444135 (N.D. Illinois, February 14, 2022)

The post Biometric privacy statute does not violate First Amendment appeared first on evan.law | Evan Brown | technology and intellectual property attorney.

Defendant asked the court to redact his bitcoin address and transaction information from exhibits used at trial, which ordinarily would become part of the public record. He argued that for each transaction recorded on the blockchain, one could reverse engineer the entire transaction if he or she knows the individual associated with one of a number of pieces of information, including transaction ID and public bitcoin address. “[O]nce a particular individual is associated [with] any of this information, it is essentially akin to providing that individual’s financial account number.”

The court allowed the redaction of the bitcoin address and bitcoin transactions. It found that defendant had demonstrated good cause to support the redactions. The court balanced the public’s right of access to court information against defendant’s interest in keeping the information confidential. It agreed with defendant’s assertion that the bitcoin information he sought to redact is akin to a financial account number or personally identifiable information.

Kleiman v. Wright, 2022 WL 390702 (S.D. Fla., February 9, 2022)

The post Court protects the privacy of bitcoin address and transaction information appeared first on Evan Brown.

NameFind is a GoDaddy company that holds registrations of domain names and seeks to make money off of them by placing pay-per-click ads on parked pages found at the domain names. Global Licensing owns the DEJA VU trademark that is used in connection with strip clubs and other adult-related services. When NameFind used the domain name dejavushowgirls.com to set up a page of pay-per-click ads, Global Licensing sued, raising claims under the federal Anticybersquatting Consumer Protection Act (ACPA), 15 U.S.C. 1125(d).

Arguing that the cybersquatting claim had been insufficiently pled, NameFind moved to dismiss. The court denied the motion.

To establish a “cybersquatting” claim under the ACPA, a plaintiff must establish that: (1) it has a valid trademark entitled to protection; (2) its mark is distinctive or famous; (3) the defendant’s domain name is identical or confusingly similar to, or in the case of famous marks, dilutive of, plaintiff’s mark; and (4) defendant used, registered, or trafficked in the domain name (5) with a bad faith intent to profit. DaimlerChrysler v. The Net Inc., 388 F.3d 201 (6th Cir. 2004) (citing Ford Motor Co. v. Catalanotte, 342 F.3d 543, 546 (6th Cir. 2003)).

Identical or confusingly similar

NameFind first argued that the court should dismiss the ACPA claim because there were no “non-conclusory” allegations explaining how the content on its website could be confusingly similar to plaintiff’s entertainment services. The court found this argument unpersuasive, however, because the content of the website was not important in evaluating this element. Instead, the court was to make a direct comparison between the protected mark and the domain name itself, rather than an assessment of the context in which each is used or the content of the offending website. It found the disputed domain name and plaintiff’s mark to be identical or confusingly similar because the disputed domain name incorporated plaintiff’s mark, and there were no words or letters added to plaintiff’s mark that clearly distinguished it from plaintiff’s usage.

Bad faith intent to profit

The court likewise rejected NameFind’s second argument, which was that plaintiff had not sufficiently pled NameFind’s bad faith intent to profit. The main point of the argument was that most of plaintiff’s allegations were made “on information and belief”. (That phrase is used in lawsuits when the plaintiff does not know for sure whether a fact is true, so it hedges a bit.) The court observed that allegations made on information and belief are not per se insufficient.

In this case, the court stated that the “on information and belief” allegations should not be considered in isolation, but should be considered in the context of the entire Complaint, including the factual allegations that: (1) NameFind had no intellectual property rights in or to the DEJA VU mark; (2) the disputed domain name was essentially identical to plaintiff’s mark and did not contain defendant’s legal name; (3) plaintiff did not authorize or consent to such use; (4) the domain name was configured to display pay-per-click advertisements to visitors, which provided links to adult-related entertainment sites; (5) as such, the disputed domain name was likely to be confused with plaintiff’s legitimate online location and other domain names, and deceive the public; and, (6) defendant’s website harmed plaintiff’s reputation and the goodwill associated with its marks by causing customers to associate plaintiff with the negative qualities of defendant’s website.

Global Licensing, Inc. v. NameFind LLC, 2022 WL 274104 (E.D. Michigan, January 28, 2022)

The post Strip club operator wins motion in domain name dispute against GoDaddy company appeared first on Evan Brown.

Plaintiff is an artist who designs macabre items, including a bat-themed mug. Defendant (Michaels, the well-known retail craft store) started selling a vase that plaintiff claimed infringed its bat mug copyright. So he sued for copyright infringement. Michaels moved to dismiss, arguing there was no substantial similarity between the works. And even if there were substantial similarity, according to Michaels, plaintiff had not sufficiently alleged that Michaels actually copied the work. The court rejected Michaels’ arguments and denied the motion to dismiss.

Actual copying can be shown by indirect evidence. To adequately plead indirect evidence of actual copying, one must allege, among other things, that the accused infringer could reasonably access the plaintiff’s copyrighted work.

In this case, the artist alleged facts sufficient to establish that Michaels could reasonably access the vampire bat mug. Specifically, plaintiff alleged that it advertised its products, including the vampire bat mug, on various social media platforms, such as Facebook, Pinterest, Instagram, and Tumblr. Through these social media accounts, plaintiff had allegedly reached at least 30,000 followers. In addition to its social media presence, plaintiff alleged it advertised the mug on the internet more generally, and sold it through online retailers, including Etsy, eBay, and Amazon. The court credited plaintiff’s allegations that plaintiff’s reach over the internet extended to customers all over the world, in particular customers in China, where designers and advertisers purportedly saw the mug. These allegations were sufficient to show that defendant could have reasonably accessed plaintiff’s work.

Dellamorte, LLC v. The Michaels Companies, 2022 WL 254427 (D. New Jersey, January 27, 2022)

See also:

• Does publication on the web give rise to “access” in copyright infringement analysis?

The post In copyright infringement case, artist’s social media popularity supported claim that retail chain copied artwork appeared first on Evan Brown.

After plaintiff Uber user was denied a ride because of her guide dog, she sued Uber for discrimination under Maine law. Uber sought to have the matter sent to arbitration and the court denied that motion. So Uber sought appeal with the Maine supreme court. That court affirmed the denial of the arbitration motion, finding that Uber’s terms of service were not binding on plaintiff.

First, plaintiff was not placed on reasonable notice that the terms existed. The hyperlink was not underlined and was muted by gray coloring. Its placement on the screen was “relatively inconspicuous.” There was a greater focus on entering payment information.

Second, the court found that even if the registration process had provided reasonable notice that the terms existed, the process was insufficient to place plaintiff on notice that her registration would constitute her assent to those terms. Merely clicking the “DONE” button in the signup process, in the court’s view, could merely have meant that plaintiff thought she was done entering her information, not signing up for an account. And that button appeared on the screen “as far as possible” from the notice and hyperlink to the terms, which were at the bottom of the screen.

Sarchi v. Uber Technologies, Inc., — A.3d —, 2022 WL 244113 (Maine, January 27, 2022)

The post Uber’s signup process did not create enforceable arbitration provision appeared first on Evan Brown.

One could characterize the recent case of Association of American Physicians & Surgeons, Inc. v. Schiff as addressing the issue of vaccine information censorship. The court considered whether letters written by Congressman Adam Schiff to Big Tech platforms, and statements he made in a Congressional hearing, caused the companies to deplatform a medical trade association and otherwise disfavor its content in search results.

The Association of American Physicians and Surgeons (AAPS) publishes online content that it characterizes not as “anti-vaccine,” but rather in favor of “informed consent based on disclosure of all relevant legal, medical, and economic information.” In 2019, California Representative Adam Schiff wrote letters to Google, Facebook, Amazon and Twitter, complaining about what he characterized as inaccurate information on vaccines, and requested answers to questions about what these platforms were doing to combat vaccine misinformation. In a later congressional hearing, he questioned whether Section 230 immunity for these sorts of technology platforms should be changed (a statement that AAPS characterized as a threat to these Big Tech platforms).

Thereafter, Amazon kicked AAPS out of its associates program, and AAPS’s web traffic to its vaccine information pages dropped (which it blames on Google and Facebook disfavoring the content). AAPS sued Schiff, seeking damages, claiming that his statements and actions caused these platforms to treat it disfavorably. The trial court dismissed the case on a motion to dismiss, finding that AAPS lacked standing. AAPS sought review with the District of Columbia Court of Appeals.

On appeal, the court affirmed the lower court’s dismissal for lack of standing. The court affirmed the dismissal primarily for two reasons. First, if found that AAPS had not sufficiently alleged that it suffered any injury in the form of an impairment of its ability to negotiate with Amazon. Secondly, the court found that any injury AAPS suffered from it being deplatformed and its content disfavored, as alleged by AAPS, was not sufficiently traceable to Schiff’s conduct.

Schiff had also argued that he could not be sued (i.e., that the court lacked subject matter jurisdiction) because his actions giving rise to the lawsuit were legislative acts and therefore protected by the Speech or Debate Clause of the Constitution. Because AAPS had not established that it had standing, the court did not need not reach the separate jurisdictional issue of immunity under this constitutional clause.

Association of American Physicians & Surgeons, Inc. v. Schiff, — F.4th —, 2022 WL 211219 (D.C. Cir. January 25, 2022)

The post Vaccine information censorship: Is Congressman Adam Schiff liable for the deplatforming of a medical organization? appeared first on Evan Brown.

In 2019, Indiana joined a number of other states and enacted a statute that makes it a crime for a person to distribute an “intimate image” when he or she knows or reasonably should know that an individual depicted in the image does not consent to the distribution. In March 2020, defendant sent a video of himself receiving oral sex to his ex-girlfriend via Snapchat. After being charged under the statute, defendant moved to dismiss, arguing in part that the statute violates both the Indiana and U.S. constitutions. The trial court agreed and dismissed the case. But the state appealed to the Indiana Supreme Court.

What part of the Indiana constitution applied?

The court’s analysis under the Indiana constitution is particularly interesting. Indiana’s constitutional protection in this area reads quite a bit differently than the language of the First Amendment.

Article 1, Section 9 of the Indiana constitution reads as follows:

No law shall be passed, restraining the free interchange of thought and opinion, or restricting the right to speak, write, or print, freely, on any subject whatever: but for the abuse of that right, every person shall be responsible.

The court first had to evaluate whether videos – and in particular the video at issue – were covered by the applicable Indiana constitutional provision. “Our encounters with Article 1, Section 9 have always involved words, thus invoking the ‘right to speak’ clause.” The court held that the video content was protected under the “free interchange” clause of the state’s constitution. “We understand the free interchange clause to encompass the communication of any thought or opinion, on any topic, through ‘every conceivable mode of expression.’” And the court quickly ascertained that being prosecuted for the distribution of the video was a “direct and substantial burden” on defendant’s right to self-expression.

Abuse of rights?

But defendant’s expressive activity in this case – though within his right to free interchange as expressed in the constitution – was an abuse of that right. Looking through the lens of the natural rights philosophy that informed the drafting of the Indiana constitution, the court cited to previous authority (Whittington v. State, 669 N.E.2d 1363 (Ind. 1996)) that explained how “individuals possess ‘inalienable’ freedom to do as they will, but they have collectively delegated to government a quantum of that freedom in order to advance everyone’s ‘peace, safety, and well-being.'” Thus, the court observed that the purpose of state power is “to foster an atmosphere in which individuals can fully enjoy that measure of freedom they have not delegated to government.”

Citing to State v. Gerhardt, 145 Ind. 439 (Ind. 1896), the court evaluated how “[t]he State may exercise its police power to promote the health, safety, comfort, morals, and welfare of the public.” And citing to other authority, the court noted that “courts defer to legislative decisions about when to exercise the police power and typically require only that they be rational.” So the question became whether – approached from the standpoint of rationality – the statute’s restriction on the right to self-expression was appropriate to promote the health, safety, comfort, morals and welfare of the public.

Rationality favored public protection

“Under our rationality inquiry, we have no trouble concluding the impingement created by the statute is vastly outweighed by the public health, welfare, and safety served.” In reaching this conclusion, the court examined, among other things, the tremendous harms of revenge porn – including its connection to domestic violence and psychological injury. Accordingly, the court found the statute did not violate the Indiana constitution.

The court also found that the statute did not violate the First Amendment of the U.S. Constitution. It held that the statute is content-based and therefore subject to strict scrutiny. Even under this standard, the court found that it served a compelling government interest, and was narrowly tailored to achieve that compelling interest.

State v. Katz, 2022 WL 152487 (Ind., January 18, 2022)

See also:

• Should revenge porn victims be allowed to proceed anonymously in court?
• Hunter Moore arrest reveals a certain inconsistency about the Computer Fraud and Abuse Act

The post Is Indiana’s revenge porn law constitutional? appeared first on Evan Brown.

The parties in the case of H.I.S.C., Inc. v. Franmar are competitors, each making garden broom products. In earlier litigation, the defendant filed a counterclaim against plaintiff for trade dress infringement, and successfully obtained an injunction against plaintiff, prohibiting plaintiff from advertising brooms designed in a certain way. Defendant asked the court to find plaintiff in contempt for, among other reasons, certain social media posts that plaintiff posted before the injunction, but that still remained after the injunction was entered. The court agreed that the continuing existence of such posts was improper and found plaintiff in contempt for having violated the injunction.

The court noted that the injunction prohibited “[a]dvertising, soliciting, marketing, selling, offering for sale or otherwise using in the United States the [applicable product trade dress] in connection with any garden broom products.” It observed that “[o]n the Internet and in social media, a post from days, weeks, months, or even years ago can still serve to advertise a product today.” The court cited to Ariix, LLC v. NutriSearch Corp., 985 F.3d 1107, 1116 n.5, in which that court noted that one prominent influencer receives $300,000 to $500,000 for a single Instagram post endorsing a company’s product – a sum surely including both the post itself and an agreement to continue allowing the post to be visible to consumers for a substantial duration of time. Interestingly, the court found that the nature of a social media post may be different from a television or radio advertisement that has a fixed air date and time. Accordingly, the court found that it was inappropriate for social media posts published before the injunction to stay online.

H.I.S.C., Inc. v. Franmar Int’l Importers, Ltd., 2022 WL 104730 (S.D. Cal. January 11, 2022)

See also:

• Police not required to publicly disclose how they monitor social media accounts in investigations
• Court allows class action plaintiffs to set up social media accounts to draw in other plaintiffs

The post Old social media posts violated trade dress infringement injunction appeared first on Evan Brown.

The Stored Communications Act (18 USC 2701 et seq.) is among the most powerful tools relating to email privacy. It is a federal statute that prohibits, in certain circumstances, one from intentionally accessing without authorization, or exceeding authorized access to, a facility through which an electronic communication service is provided. The statute provides criminal penalties and an aggrieved party can bring a civil suit for damages in certain cases.

The statute contains a provision that addresses the amount of money damages a successful plaintiff can recover. Section 2707(c) provides the following:

Damages. The court may assess as damages in a civil action under this section the sum of the actual damages suffered by the plaintiff and any profits made by the violator as a result of the violation, but in no case shall a person entitled to recover receive less than the sum of $1,000. If the violation is willful or intentional, the court may assess punitive damages. In the case of a successful action to enforce liability under this section, the court may assess the costs of the action, together with reasonable attorney fees determined by the court.

Note the phrase “but in no case shall a person entitled to recover receive less than the sum of $1,000.” Does that mean every plaintiff that successfully proves the defendant’s liability is entitled to at least $1,000, regardless of whether there was any actual damage that occurred? The Fifth Circuit Court of Appeals recently addressed that question in the case of Domain Protection, L.L.C. v. Sea Wasp, L.L.C. It held that one must show at least some actual damages before being entitled to the minimum of $1,000.

The court looked to the Supreme Court’s approach in addressing nearly identical language in another statute, wherein SCOTUS concluded that “person entitled to recover” refers back to the party that suffers “actual damages.” Doe v. Chao, 540 U.S. 614, 620, 124 S.Ct. 1204, 157 L.Ed.2d 1122 (2004). And it noted that two other circuits have held that this reasoning should apply to the same terms in the Stored Communications Act: Vista Mktg., LLC v. Burkett, 812 F.3d 954, 964–75 (11th Cir. 2016) and Van Alstyne v. Elec. Scriptorium, Ltd., 560 F.3d 199, 204–208 (4th Cir. 2009). The court “endorse[d] the reasoning of those opinions and [saw] no need to repeat it.”

Domain Protection, L.L.C. v. Sea Wasp, L.L.C., — F.4th —, 2022 WL 123408 (5th Cir. January 13, 2022)

The post Can a party recover statutory damages under the Stored Communications Act without proving actual damages? appeared first on Evan Brown.

Omegle is a notorious website where you can be randomly placed in a chat room (using video, audio and text) with strangers on the internet. Back in March 2020, 11-year-old C.H. was using Omegle and got paired with a pedophile who intimidated her into disrobing on camera while he captured video. When C.H.’s parents found out, they sued Omegle alleging a number of theories:

• possession of child pornography in violation of 18 U.S.C. § 2252A;
• violation of the Federal Trafficking Victims Protection Act, 18 U.S.C. §§ 1591 and 1595;
• violation of the Video Privacy Protection Act, 18 U.S.C. § 2710;
• intrusion upon seclusion;
• negligence;
• intentional infliction of emotional distress;
• ratification/vicarious liability; and
• public nuisance

The court granted Omegle’s motion to dismiss all eight claims, holding that each of the claims was barred by the immunity provided under 47 U.S.C. § 230. Citing to Doe v. Reddit, Inc., 2021 WL 5860904 (C.D. Cal. Oct. 7, 2021) and Roca Labs, Inc. v. Consumer Op. Corp., 140 F. Supp. 3d 1311 (M.D. Fla. 2015), the court observed that a defendant seeking to enjoy the immunity provided by Section 230 must establish that: (1) defendant is a service provider or user of an interactive computer service; (2) the causes of action treat defendant as a publisher or speaker of information; and (3) a different information content provider provided the information.

Omegle met Section 230’s definition of “interactive computer service”

The court found Omegle to be an interactive computer service provider because there were no factual allegations suggesting that Omegle authored, published or generated its own information to warrant classifying it as an information content provider. Nor were there any factual allegations that Omegle materially contributed to the unlawfulness of the content at issue by developing or augmenting it. Omegle users were not required to provide or verify user information before being placed in a chatroom with another user. And some users, such as hackers and “cappers”, could circumvent other users’ anonymity using the data they themselves collected from those other users.

Plaintiffs’ claims sought to treat Omegle as a publisher or speaker of information

The court found that each of the claims for possession of child pornography, sex trafficking, violation of the Video Privacy Protection Act, intrusion upon seclusion and intentional infliction of emotional distress sought redress for damages caused by the unknown pedophile’s conduct. Specifically, in the court’s view, no well-pleaded facts suggested that Omegle had actual knowledge of the sex trafficking venture involving C.H. or that Omegle had an active participation in the venture. As for the claims of intentional infliction of emotional distress, ratification/vicarious liability and public nuisance, the court similarly concluded that plaintiffs’ theories of liability were rooted in Omegle’s creation and maintenance of the site. The court observed that plaintiffs’ claims recognized the distinction between Omegle as an interactive computer service provider and its users, but nonetheless treated Omegle as the publisher responsible for the conduct at issue. The court found this was corroborated by the “ratification/vicarious liability” claim, in which plaintiffs maintained that child sex trafficking was so pervasive on and known to Omegle that it should have been vicariously liable for the damages caused by such criminal activity. And, in the court’s view, through the negligence and public nuisance claims, plaintiffs alleged that Omegle knew or should have known about the dangers that the platform posed to minor children, and that Omegle failed to ensure that minor children did not fall prey to child predators that may use the website.

The information at issue was provided by a third party

On this third element, the court found that Omegle merely provided the forum where harmful conduct took place. The content giving rise to the harm – the video and the intimidation – were undertaken by the unknown pedophile, not Omegle.

Special note: Section 230 and the sex trafficking claim

Section 230 (e)(5) limits an interactive computer service provider’s immunity in certain circumstances involving claims of sex trafficking. In this case, however, like the court did in the case of Doe v. Kik Interactive, Inc., 482 F. Supp. 3d 1242 (S.D. Fla. 2020), the court held that Omegle’s Section 230 immunity remained intact, because the plaintiffs’ allegations were premised upon general, constructive knowledge of past sex trafficking incidents. The complaint failed to sufficiently allege Omegle’s actual knowledge or overt participation in the underlying incidents between C.H. and the unknown pedophile.

M.H. and J.H. v. Omegle.com, LLC, 2022 WL 93575 (M.D. Fla. January 10, 2022)

The post Omegle protected by Section 230 against claims for child pornography, sex trafficking and related claims appeared first on Evan Brown.

Federal law has a statute that prohibits abusive domain name registration. The Anticybersquatting Consumer Protection Act, 15 U.S.C. 1125(d) (ACPA) provides, among other things, that one is prohibited from registering, trafficking in or using, with a bad faith intent to profit, a domain name that is confusingly similar to another’s trademark that was distinctive when the domain name was registered.

In the recent case of Instructure, Inc. v. Canvas Technologies, the court considered whether the ACPA requires the mark to have been distinctive when the domain name was first registered, or whether it can still be protected by being distinctive when the domain name was re-registered. It held that the statute applies to distinctiveness at re-registration.

In this case, the disputed domain name was first registered in 1997, several years before plaintiff obtained trademark rights in its CANVAS mark. Defendant moved to dismiss plaintiff’s cybersquatting claim, arguing that the plaintiff did not have rights to a distinctive mark when the domain name was first registered, and that therefore the statute’s requirement was not met. Plaintiff showed, however, that the ownership of the domain name changed sometime in 2021 (i.e., it was re-registered).

Looking to the statute’s plain language, Congressional intent, public policy, and the trending weight of authority in other federal circuits, the court held that re-registration, or “registration again” is contemplated under the ACPA’s language. It denied defendant’s motion to dismiss the ACPA claim.

Instructure, Inc. v. Canvas Technologies, Inc., 2022 WL 43829 (D.Utah, January 5, 2022)

The post ACPA claim survives because mark was distinctive when domain name was re-registered appeared first on Evan Brown.

In a recent case under the Uniform Dispute Resolution Policy (UDRP), the administrative panel determined that a party who had owned the disputed domain name for more than 20 years was not entitled to recover it from another party who bought the domain name at auction. The complainant alleged that it let the domain name registration lapse because it could not communicate with the domain name registrar, which apparently recently had been acquired by another registrar. After purchasing the domain name at auction, the respondent redirected it to his travel-related website. (The parties disputed whether that redirection continued – in a supplemental filing, the complainant characterized the respondent’s redirecting of the disputed domain name to pay-per-click ads as “thumbing his nose” at the tribunal and the complainant.

The panel found the use of the generic words “simple” and “plan” in the domain name, in relation to a travel-related website operating in the way described by the respondent, was legitimate. The panel therefore found that, before any notice to the respondent of the dispute, the respondent had used the domain name in connection with a bona fide offering of travel-related services.

As for the question of the respondent’s registration and use of the domain name in bad faith, the panel found there was insufficient evidence to demonstrate that the respondent had any hand in preventing the complainant’s renewal of the domain name or that he should have known of the complainant’s mark at the time when he purchased the domain name at auction. Further, the complainant did not submit any evidence of its reputation in the countries where the respondent lives or conducts business. Thus, the panel concluded that the complainant had not shown, by a preponderance of the evidence, that the was targeting the complainant’s mark.

Simple Plan Inc. v. Michel Rog, FORUM Claim Number FA2111001973743 (January 4, 2022)

The post UDRP loss results from lack of communication with domain registrar appeared first on Evan Brown.

Plaintiff manufacturer of medical equipment sued a company that services such equipment for hospitals and clinics. Plaintiff claimed, among other things, that defendant violated the Computer Fraud and Abuse Act and the anticircumvention provisions of the Digital Millennium Copyright Act by using fake accounts to access proprietary documents, information and software that plaintiff had protected with digital rights management (DRM) technology.

The court denied plaintiff’s motion for preliminary injunction – which sought to bar defendant from accessing the computer systems or circumventing the DRM. It held that plaintiff had not met an essential element required for injunctive relief, namely, that plaintiff would suffer irreparable harm if the injunction was not granted.

There were two main reasons for the court’s decision. First, the court found that the assertions of irreparable harm were mere conclusions not supported by concrete facts. Second, the court found that the obligations on the defendant imposed by the contracts it had with its hospital and clinic customers would constrain defendant from engaging in the harmful activity that plaintiff sought to stop. For example, plaintiff claimed that defendant would access patient data without authorization. But the court noted that defendant was bound by confidentiality agreements and the obligation to abide by applicable data protection law. And plaintiff was worried that continued unauthorized access would increase the chances that defendant would modify the equipment. But again, the court looked to the contracts between defendant and its customers, which obligated defendant to properly maintain the equipment (thus removing any incentive to do what plaintiff was seeking to prevent).

Philips North America LLC v. Advanced Imaging Services, Inc., 2021 WL 6052285 (E.D. Cal., December 21, 2021)

The post Court refuses to enjoin use of fake accounts to access DRM-protected information appeared first on Evan Brown.

Empty intangibility?

Ain’t she a beauty?

There’s something about Mona Lisa

Love at the molecular level

Being intentional

The post How do we attribute value to an NFT? appeared first on Evan Brown.