EFF files amicus brief in Massachusetts cell site data case

The Electronic Frontier Foundation recently filed an amicus brief in a Massachusetts appellate case regarding cell site location data. The trial court in Commonwealth v. Augustine had suppressed two weeks' worth of cell site data, finding that a search warrant was necessary to obtain it. The government then appealed.

According to the EFF release:

In our amicus brief, we urge the SJC to affirm the trial court, arguing that people maintain a reasonable expectation of privacy in their location—even their public movements—since society would deem it unlikely that anything more than small, discrete movements would be observed at a time.... 

Even the SJC itself has been a leader on location privacy. Earlier this year, it ruled in Commonwealth v. Rousseau that a passenger in a car had standing to challenge GPS surveillance because everyone, regardless of whether they are the car's owner or not, has an expectation of privacy in their location.

We hope that the SJC will extend Rousseau, recognize that the third party doctrine does not apply to invasive cell site monitoring, and require police obtain a search warrant to track a person's location through their cell phone.

Read the EFF amicus brief by clicking here.

Read More

Part 1 (The Facts): CFAA case to test the EFF's proposed reform language

In this first post I will outline the relevant facts of the Fidlar case and how the facts present an interesting issue for the proposed CFAA reform language of the EFF (and Rep. Lofgren). At the end of this post, I note EFF Attorney Hanni Fakhoury's initial take on the case. 

In the second post I will offer my own take. I will then propose some changes to the reform language that would clarify the issue. I will conclude by taking a step back and opining on whether the CFAA should even apply to this kind of contractual dispute, and if so, in what circumstances. Spoiler - I will propose a presumption.

A case in the federal District Court for the Central District of Illinois is worth keeping an eye on if you are interested in the evolution of the CFAA from an anti-hacking statute to one used to enforce terms of service agreements, employee disloyalty, and also contractual disputes.

First, as a point of reference, consider the EFF's proposed language to amend the CFAA (emphasis added):

(6) The term “access without authorization” means to circumvent technological access barriers to a computer, file, or data without the express or implied permission of the owner or operator of the computer to access the computer, file, or data, but does not include circumventing a technological measure that does not effectively control access to a computer, file, or data.  

The term “without the express or implied permission” does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or employer.

This language was adopted in some form in Rep. Lofgren's CFAA reform bill. For Orin Kerr's take on these proposals, see here: Aaron’s Law, Drafting the Best Limits of the CFAA, And A Reader Poll on A Few Examples, and here: Drafting Problems With the Second Version of “Aaron’s Law” from Rep. Lofgren.

Back to the case at hand, here is the alleged offense in the complaint from Fidlar Technologies v. LPS Real Estate Data Solutions, Inc., 4:13-cv-4021 (C.D. Ill. Mar. 13, 2013) (emphasis added):

17. In or around 2012, LPS created one or more computer programs, the sole purpose of which were to mimic the interface between Fidlar’s user-interface software and Fidlar’s server software. The mimicked program allowed LPS to fraudulently present itself to Fidlar’s server software as though it had gained access through the Laredo user-interface, but without the attendant user controls. 

18. Fidlar’s server software programs are designed to prevent Fidlar’s customers from accessing those servers by any means other than through Fidlar’s software. 

19. Fidlar does not train, promote, or explicitly publish, nor intend to publish the techniques necessary to access Fidlar’s server software directly and circumvent the Fidlar user-interface software of Laredo or Tapestry. 

20. Specifically, LPS created mimic software that allowed Defendant to fraudulently obtain documents electronically and search at a higher rate and volume than would otherwise be possible. 

21. This mimic software program that LPS created, allowed Defendant to gain fraudulent access to Fidlar’s server software and bypass user controls embedded in the Laredo program. In this manner LPS fraudulently obtained documents that Fidlar server software had retrieved from governmental databases. 

Later in the complaint, Fidlar alleges that LPS's use of this mimicked interface allowed LPS to access documents that they would normally have to pay for; caused a burden on Fidlar's servers that damaged their operations; prevented Fidlar from being able to track LPS's use; and, caused damages in excess of $80,000. Relating to damages, the complaint states: "As a result of Defendant’s unauthorized use of Fidlar’s computers and computer servers, Fidlar has been damaged in excess of $5,000 in the past calendar year. . . . To date, Fidlar has incurred economic damages in excess of $80,000 in attempting to determine the extent of Defendant’s fraudulent invasion of its computers and computer servers, and those damages are ongoing and increasing."

Fidlar’s complaint does not allege what specific section of 18 U.S.C. § 1030 LPS violated, but the language in the complaint reiterates the phrase "without authorization" (i.e. "Defendant has engaged in a pattern of unauthorized access of Fidlar’s computers and computer servers, in order to intentionally obtain information from Fidlar’s computers"); thus "without authorization" will be the focus of the analysis in my next post.

After reading the complaint, the next logical question is whether any language in the license agreement directly applies; it can be found here: Exhibit A - Fidlar Technologies Laredo End User Agreement. In my opinion it doesn't say much that is helpful to this dispute. The bulk of the agreement relates to Fidlar's protection of its intellectual property; I do not see any limiting language on how a customer may access the database. Feel free to correct me.

Unsurprisingly, LPS's side of the story is quite different. Its Motion to Dismiss for Failure to State a Claim (filed Apr. 8, 2013) (emphasis added & internal cites omitted, except where relevant) states:

Fidlar’s CFAA claim fails for two reasons: 1) LPS was authorized to access Fidlar’s computers, and 2) Fidlar does not allege that it suffered “damage” or “loss” as those terms are defined by the CFAA.

a. LPS was authorized to access Fidlar’s computers. 

Fidlar’s complaint explicitly concedes that LPS has been a customer of Fidlar “since at least 2009 using the Laredo program and has installed the Laredo program on its own computers.” The complaint further admits, “LPS has purchased Laredo licenses in 76 counties where Fidlar has provides [sic] access to documents.” In other words, LPS had paid for and was granted authorization to access the data on Fidlar’s servers relating to those counties.

Even though LPS was authorized to access Fidlar’s servers, Fidlar complains that LPS went about it the wrong way. Specifically, LPS did not employ an individual to manually review the documents one at a time. Instead, LPS employed a computer program that allegedly circumvented controls that Fidlar claims were in place to “prevent customers from electronically capturing and downloading documents” instead of paying for copies. 

As a matter of law, these allegations do not constitute “intentionally access[ing] a computer without authorization.” The term “without authorization” means “without any permission at all.” AtPac, Inc., 730 F. Supp. 2d at 1179 (citing LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1133 (9th Cir.2009)). On this issue, the decision in State Analysis, Inc. v. American Financial Services Assoc., 621 F. Supp. 2d 309 (E.D. Va. 2009) is particularly instructive. There were two defendants in State Analysis: the first was alleged to have accessed the plaintiff’s website using usernames and passwords that did not belong to it and to which it had never been given lawful access, while the second was alleged to have misused the passwords with which it had been entrusted. The court allowed the CFAA claim to proceed against the first defendant, but granted the second defendant’s motion to dimiss, explicitly holding that while use of an unauthorized password to access password- protected content may constitute a CFAA violation, a mere allegation that a defendant “used the information [which it had been given lawful authority to access] in an inappropriate way” did not state a claim for relief. 

Fidlar wrongly contends that authorized access becomes unauthorized if the user violates contractual or embedded limitations on the use of the data (i.e., saves the images rather than printing them out). This is not the law. . . .

The logic here is simple. By its terms, the CFAA only addresses access to electronically stored data as opposed to the use of that data. . . . [FN1]

[FN1] - The only Seventh Circuit decision LPS could find that touches on the definition of “authorized access” is International Airport Centers, LLC v. Citrin, 440 F.3d 418 (7th Cir.2006), but it is inapposite. In that case, the Court held that an employee’s authority to access his employer’s computers ceases when he decides to leave his job, go into competition against his employer, and abandon his duty of loyalty.

In short, LPS had authority to access Fidlar’s database of public records and Fidlar’s claim to the contrary is not plausible. LPS did not violate the CFAA merely by saving images of those public records instead of printing them. In fact, this conduct is not even a breach of Fidlar’s user agreement that a Laredo user must accept before accessing a county’s records through Laredo. A true and correct copy of a Fidlar user agreement is attached as Exhibit A, and the Court may consider it on a Rule 12(b)(6) motion because it is referenced in the complaint and Fidlar’s user agreement is central to Fidlar’s claim. . . . Nothing in the User Agreement prohibits any of the conduct alleged in the complaint. Thus, even if Fidlar attempted to rely on the User Agreement to argue that LPS lacked authorization to access the data in the manner that did, it would still not violate the CFAA. 

b. Fidlar does not allege damage or loss under the CFAA.

... 

Fidlar’s complaint does not even attempt to allege it suffered “damage.” Fidlar’s complaint only alleges that it became “aware of a strange usage pattern” related to LPS’s licenses, and as a result, “audited several LPS accounts to determine account activity.” Notably, Fidlar alleges that LPS’s conduct only “continues to threaten to overload those servers” and “continues to be able to disrupt Fidlar’s operations.” There is no allegation that LPS’s conduct actually caused Fidlar’s servers to crash, overload, or otherwise malfunction. Indeed, it is the lack of activity recorded on Fidlar’s servers that underlies its complaint. 

Thus, Fidlar may only maintain a civil action for CFAA violations if it suffered a “loss.” As the statutory definition makes clear, its claim for unpaid printing charges is not recoverable. Lost revenue and consequential damages are only losses if they were caused by an interruption in service. 18 U.S.C. §1030(e)(11).

The only allegations in Fidlar’s complaint that even approach the definition of loss relate to its investigation into LPS’s access. This investigation, however, was not into an interruption in service, destruction of data, or impairment of a program. Instead, it was an investigation into unpaid printing charges and unmonitored usage. The cost of this type of investigation does not meet the statutory definition of loss. 

The court has not yet ruled on LPS's motion to dismiss. There have been counterclaims, motions for temporary restraining orders, and issues related to discovery. If the MTD is denied (which seems likely), or granted before I get the next post up, I will pass that on immediately.

As stated above, I mentioned this case to Hanni Fakhoury, Staff Attorney at the Electronic Frontier Foundation. Here are his comments (emphasis added):

I read the complaint and the MTD portions re: the CFAA claim . . . sounds very much to me like Nosal (re: use v. access) and Facebook v. Power Ventures (https://www.eff.org/cases/facebook-v-power-ventures). 

I think the issue comes down to whether LPS violated a code-based restriction on access to that data or a contractual restriction, and the complaint and MTD don't really shed much light on that point (other than to claim it wasn't a violation of the contractual terms of service). Interesting case and a good find. It also provides an opportunity for the court to decide whether Citrin applies beyond the employment context.

Assuming that the End User Agreement (Exhibit A) is the only document governing the relationship between Fidlar and LPS, I can't see how this comes down to a contractual dispute in isolation (or if that guides the court's decision much, except to say that the contract is void of informative language). Therefore, I see this as being forced under the CFAA and hence why the case should be interesting to watch.

Last note (if you didn't read the complaint in its entirety) - The other causes of action in the complaint are a violation of the Illinois Computer Tampering Statute and common law trespass to chattels.

Read More

Question on appeal: "Is a cell phone really a pair of trousers?"

In a Texas appellate case, the Electronic Frontier Foundation is arguing that a warrant is required before police search a cell phone being held in a jail's property room. A teenager was arrested at school for a "disturbance" and taken to jail. His cell phone was taken from him and searched, revealing evidence of an unrelated felony (he was arrested for a misdemeanor). The trial court and lower appellate court found that the evidence should be suppressed.

The lower appellate court had framed the issue this way:

Is a cell phone really a pair of trousers? The State argues as much here, at least when both come from someone who has been arrested. We disagree and affirm the trial court's decision to suppress evidence discovered during a warrantless search of an impounded cell phone.

On appeal again before the Texas high court, the EFF and others argue:

The Court’s ruling in this case thus has the potential to affect every Texan who possesses a cell phone and who might someday be arrested and jailed, even briefly, for a misdemeanor offense. Cell phones and smart phones with immense digital memories containing their users’ most private information are now in the pockets of millions of Americans each day. The state contends that a pretrial detainee being held in jail has “no legitimate expectation of privacy” in his inventoried personal effects, including the data stored in personal electronic devices. If the state’s argument in this case were to be accepted, any law officer, even a stranger to the arrest, would be able to enter a jail property room with no warrant, probable cause or exigency
whatsoever, power up any detainee’s stored and inventoried cell phone, and freely rummage through the device, either for mere curiosity or a personal vendetta, or searching for incriminating photographs, emails, texts or other data related to any potential criminal offense. This is not the law, nor should it be. 

In sum, no exception to the warrant requirement applies on these facts, and the appellate court’s decision below, suppressing the evidence obtained from the warrantless search of Anthony Granville’s cell phone, should be affirmed.... 

A cell phone is not a pair of pants.

Read More

Case Prep (all briefs & materials): US v. Katzin - GPS case before Third Circuit on Tuesday 3/19/13

Tomorrow (3/19/13), the Third Circuit is set to hear oral arguments in US v. Katzin, No. 12-2548,  a GPS tracking case the government appealed after a federal district court ruled (post-Jones) that the good faith exception did not apply to the conduct in this case because, inter alia, there was no Third Circuit precedent allowing warrantless GPS tracking to begin with but merely a disagreement between other circuits.

First, for some background, Jeffrey has mentioned this case more than once. His relevant posts can be found here:

Government appeals GPS case to Third Circuit; groups file amicus arguing that warrant is required (about Katzin itself)

District court okays warrantless pre-Jones GPS use, holds that good faith rule doesn't require binding precedent (about United States v. Baez, another GPS tracking case where evidence was not suppressed; it includes a discussion of the Davis good faith rule as well as a paragraph on Katzin)

Second, here are some write-ups on the case itself from the media & amici:

From Wired (posted today, 3/18/13): Feds: No Warrant Needed to Track Your Car With a GPS Device
From the ACLU: ACLU in Federal Appeals Court Tuesday Arguing Against Warrantless GPS Tracking
From the EFF (authored by Hanni Fakhoury & Marcia Hoffman): Jones Meant What it Said: EFF Urges Court to Stop Warrantless GPS Tracking

Finally, here are all of the documents related to the case (for those who like to review all of the materials) in chronological order. This includes an updated version of the government's brief:

5/09/12 - E.D. PA Memorandum Granting Suppression of the GPS Evidence
10/25/12 - Brief for Appellee Harry Katzin
11/05/12 - Brief of Appellee Mark Katzin
11/13/12 - Amicus Brief from EFF, ACLU, ACLU PA Chapter, and Nat'l Assoc. of Criminal Defense Lawyers
12/03/12 - Reply Brief for Appellant United States of America

Read More

Government appeals GPS case to Third Circuit; groups file amicus arguing that warrant is required

As frequent readers of this blog have become well-aware, an interesting fight occurring throughout American courtrooms concerns the interpretation of the Supreme Court's Jones decision and the application of the good faith doctrine to that opinion. Some patterns have appeared, but there are many exceptions to each of them.

One decision, United States v. Katzin, followed a pattern. Typically, if the jurisdiction of the search did not have binding precedent, the good faith exception does not save the search, and the evidence is suppressed. In Katzin (No. 11-226 (E.D. Pa. 2012)), the district court found that the warrantless use of a GPS tracking device violated the Fourth Amendment and cannot be excused under the good faith doctrine. The jurisdiction had no binding authority on the issue and as the installation occurred four months after Maynard, there was a circuit split.

The government has appealed the case, suggesting to the Third Circuit that no search warrant was needed because the Supreme Court did not specifically decide if a warrant is needed to monitor a person's movements via GPS. Further, they suggest that good faith saves the evidence.

The Electronic Frontier Foundation (EFF), American Civil Liberties Union (ACLU), and the National Association of Criminal Defense Lawyers (NACDL) have filed an amicus brief, arguing that Jones requires a warrant for installation of and monitoring with a GPS device and that the good faith doctrine only saves evidence when binding precedent existed at the time of the installation.

Read More

EFF files amicus in D.C. Circuit Court against use of CSLI in remanded Jones case

Back in April, Jeffrey wrote that Antoine Jones wasn't off the hook for his crimes because of the ruling in United States v. Jones, 132 S. Ct. 945 (2012). Rather, instead of using the GPS tracking data they had collected (illegally), the police decided to use Cell Site Location Information (CSLI). Jeffrey's previous article can be found here - Jones II: This time, the government seeks to use cell site location information.  If you're looking to read more on the subject, we have additional content that can be found, here.

On Monday, the Electronic Frontier Foundation filed an amicus brief in favor of Antoine Jones, arguing that six months worth of CSLI should not be obtainable without a warrant. The EFF drew parallels between this situation and the GPS tracking that occurred in the original instance. Additionally, the EFF forwards an argument in the brief that could not be used in the context of GPS tracking - that CSLI could actually provide information about occurrences inside the home. This is important because courts have tended to give the most Fourth Amendment protection to the confines of a private home - see, for example, Karo or Kyllo.

The EFF's brief also addresses third-party doctrine, the Stored Communications Act, and even CALEA.

The brief can be found here: BRIEF AMICI CURIAE OF THE ELECTRONIC FRONTIER FOUNDATION AND CENTER FOR DEMOCRACY & TECHNOLOGY IN SUPPORT OF DEFENDANT ANTOINE JONES’ MOTION TO SUPPRESS CELL SITE DATA


The EFF also has a story, here: Government Faces New Warrantless Surveillance Battle After Losing Landmark GPS Tracking Case

Read More

Cybercrime Review will be onsite at Defcon 20, Blackhat, and BSides LV

I will be out in Las Vegas next week for the trifecta of Defcon, Blackhat, and BSides. I hope to do some reporting from there if any of the presentations have a good legal or criminal flavor. Feel free to send messages to myself at @cybercrimerev while I am there.

For a look at the respective conferences, see:

Defcon 20

Blackhat USA 2012

BSides Las Vegas 2012

Read More