The matter was remanded by the Federal Circuit to the District Court, and, as we blogged in December, several additional pre-trial rulings again favored the JMRI project, including a ruling on the eligibility of software code that is distributed for free for copyright infringement damages. The settlement was reached with a trial date on the not-too-distant horizon.

With the settlement, the Federal Circuit and District Court rulings will not be subject to direct appeal. Given the rarity of litigation over open source software, it seems unlikely that the reasoning of these two rulings will be questioned judicially in any other open source litigation for some time.

The settlement agreement is here, and the permanent injunction is here.

The explanation of the settlement on the JMRI site indicates that the proprietary software company has agreed, among other things, not to misuse the JMRI software at issue, or to register any domain names incorporating certain terms attributable to the JMRI project, and will make a payment of $100,000. Future disputes will be settled by mediation or arbitration.

Scherillo v. Dun & Bradstreet, Inc., 2010 WL 537805 (E.D.N.Y. Feb. 17, 2010)

I teach my Cyberspace Law students that the most effective online contract formation process is a "mandatory non-leaky clickthrough agreement":

* mandatory = the user cannot proceed to the destination without going through a screen soliciting their consent to the user agreement.
* non-leaky = there are no alternative ways the user can reach the destination. I realize this is redundant with "mandatory," but I remind students that a seemingly mandatory process can have leaks. For example, if customer support representatives will manually set up user accounts occasionally, the mandatory online process has become leaky because now a few users reached the destination without consenting to the agreement.
* clickthrough = the user manifests assent to the contract by clicking, and the user is told that the click signifies assent.

There are other ways to form online contracts (e.g., email exchanges), but if executed properly, the mandatory non-leaky clickthrough process should do very well against contract formation challenges. But even this description leaves open a number of user interaction judgments. Does likelihood of contract formation vary if:

* the agreement terms are presented on the clickthrough page itself or are only available for review by hyperlink?
* the agreement terms are presented in a scrollbox? If a scrollbox is used, must the user be forced to scroll through the scrollbox?
* the user is asked to check an additional box, such as a certification that the user has read the agreement?

In all of these cases, I believe the contract should be properly formed whether the answer to these questions is yes or no. However, I'm now a fan of adding a bonus mandatory checkbox as part of the formation process after reading today's opinion. A user mounts a sophisticated challenge to a mandatory non-leaky clickthrough process, and the bonus mandatory checkbox helps squelch the challenge. I think the court would have enforced it without the checkbox, but it sure put the user in an awkward/untenable position.

Scherillo bought a financial report about a company from Dun & Bradstreet's Small Business Solutions website. Scherillo alleges that the report painted an overly rosy picture of the company, leading him to make bad investment decisions that cost him money when the company tanked. Scherillo wants D&B to cover his investment losses.

Scherillo is almost certain to lose on the merits. Indeed, this case brought to mind one of the earliest cyberlaw cases, Daniel v. Dow Jones, 520 N.Y.S. 2d 334 (N.Y.C. Civ. Ct. Spec. Term 1987). (This case is a fun read--see how the court discusses electronic networked communications almost a quarter-century ago). That case involved Dow Jones' publication of an ambiguous report via a dial-up online service that led the plaintiff to make a bad investment decision. The court said that any tort claim for publishing inaccurate information required the plaintiff to show that it had a "special relationship" (analogous to a fiduciary relationship) with the information vendor, and an ordinary customer-vendor relationship did not qualify as a special relationship.

Interestingly, D&B would rather hear the case in NJ rather than keep it in NY and hope to benefit from substantive NY law that surely would doom Scherillo's case. (Perhaps NJ has a similar law). To move the case to NJ, D&B invoked the venue selection clause in its user agreement. Let's look at the online contract formation process. The court says:

"since 2007, the SBS website has included a page that requires users to register before purchasing a Dun and Bradstreet product ("the registration page"). On the registration page, users input information, including their e-mail address and name. The bottom quarter to third of the page contains a scrollable text box with the title "Terms and Conditions" [which contained a mandatory venue selection clause designating NJ]. Directly below this text box there is more text that reads: "I have read and AGREE to the terms and conditions shown above." Immediately adjacent to this text is a much smaller, empty box ("the terms and conditions check box"). Also at the bottom of the page is another box containing the phrase "Complete Registration" ("the Complete Registration box"). Clicking on this box completes the user's registration. McDonald testified that if a user clicks on the Complete Registration box without checking the terms and conditions check box, the user is unable to complete registration and is returned to the registration page."

Check out the page yourself as I saw it in Google Chrome on Feb. 18 (with cropping). The formation process looks pretty standard to me.

Scherillo attacked the formation process by saying he never consented to the agreement because "it was possible for him to unknowingly and involuntarily 'check' the terms and conditions check box." Not only that, he lined up Sean Chumura, "a cyberwarfare and computer forensics expert" who is also [LINK NSFW] helping Perfect 10 in its lawsuit against Google, to testify that "it was possible for plaintiff, while 'tabbing' through the registration page, to inadvertently hit the space bar and thereby 'check' the terms and conditions box."

[Snarky paragraph alert] First, this may prove the adage that you can find an expert to testify about ANYTHING. Second, Scherillo alleged $75k of investment losses. For a low-value lawsuit like that, he needs a cyberwarfare expert??? Third, I believe Chumura has a MySpace page. Really...? I wonder if he uses an AOL.com email address too. The MySpace page also reveals that its author appeared to attend the Dan Quayle school of spelling.

OK, back to the case. The judge was no more tolerant of this nonsense than I am. He resolves the factual dispute by saying:

even under plaintiff's theory--that, while "tabbing" through the fields on the registration page, he accidentally hit the space bar key and thereby "checked" the terms and conditions box--plaintiff would have seen the check mark appear in the box and then still would have had to hit the "return" key (or clicked the "complete registration" box with the mouse) to complete the registration and advance to the next screen. Plaintiff would have had an opportunity to see that he checked the box inadvertently before he then hit the return key on the "complete registration" box. Thus, to accept plaintiff's theory, the Court would have to find that plaintiff hit two keys accidentally-the space bar and the return key-and that he was then involuntarily and unexpectedly sent to the next screen where he nonetheless proceeded to enter his credit card information and complete the purchase of the report. This alleged chain of events is simply not credible.

Therefore, Scherillo's click on the "Complete Registration" box manifested Scherillo's assent to the terms, even if Scherillo chose not to review them. The court says that the fact that the terms were in a scrollbox is immaterial, and the fact that some sites require the user to scroll through the scrollbox before proceeding doesn't affect the effectiveness of D&B's implementation.

I believe this court would have upheld the formation process even without the bonus checkbox, but you can see how the checkbox defused the withering assault of a cyberwarfare expert. Thus, you might consider implementing the bonus checkbox to discourage similar silly attacks against your contract formation process in the future.

While the saga between TechCrunch and Fusion Garage continues, the latter company is moving forward with the launch of the controversial web tablet, now called JooJoo. While it's not the magical tablet that inspired this blog (In African, the word joujou' means magical device.') Fusion Garage thinks they've got a winner on their hands.

For the same $499 that Apple intends to charge for an entry-level iPad with 140,000 available apps, Fusion Garage will provide you with a browser-based tablet without any capability to run and install local applications. It also lacks a 3G wireless option of any kind, relying solely on WiFi.

But what does the JooJoo have that iPad doesn't?

For starters, a 12.1 inch LCD touch screen in a widescreen aspect ration that we're more accustomed to seeing these days. And you can use all of that screen to render full HD quality video but only from your favorite video sites since the device has only 4 GB of SSD storage not nearly enough to store HD content of any real duration. It has the front-facing camera for videoconferencing that so many people feel is lacking in iPad as well as a USB port, though what one might do with that port is still unknown. As for the software, it's a Linux variant running a Webkit browser that will support both Adobe Flash 10.1 and Java.

So, do they have a winning device?

They may have had one before the iPad announcement, but not now not at that price point and limited functionality, anyway.

You can pre-order the JooJoo now which is expected to ship in 8 to 10 weeks though the site has indicated that time horizon for some time. If you're considering a JooJoo you may want to contact them for an update on a ship date, though the latest word from company executives is late Februrary.

Will you JooJoo?

[JooJoo]

Related articles by Zemanta

• Fusion Garage Files to Dismiss TechCrunch Lawsuit as JooJoo Wars Escalate [Lawsuits] (gizmodo.com)
• Controversial Joojoo Tablet Release Set For Late February (huffingtonpost.com)
• Fusion Garage says JooJoo tablet is on track for Feb. launch (seattlepi.com)
• JooJoo CEO pledges to ship this month, claims deal with leading phone maker (Paul Boutin/VentureBeat) (techmeme.com)
• JooJoo will be manufactured by Malaysia's CSL Group (venturebeat.com)

Will You JooJoo? is a post from: The Magical Tablet

(photo: plastic lemonade)

First, Sen. Richard Shelby put a blanket hold on all executive branch nominees to extort the executive branch into rigging procurement to guarantee that the company he favored won a bid on a defense contract. Oh, and he wanted the FBI to build a crime lab in his state, too.

And now Sen. Lindsey Graham is copycatting, placing a hold on the closing of Gitmo hostage to extort the Department of Justice into not having a civilian trial for Khalid Sheikh Mohammed. And Graham's not being subtle about it. In a well-researched piece for The New Yorker, Jane Mayer breaks some amazing scoops:

Rahm had a good relationship with Graham, and believed Graham when he said that if you don't prosecute these people in military commissions I won't support the closing of Guantnamo. . . Rahm said, If we don't have Graham, we can't close Guantnamo, and it's on Eric!'

[snip]

Graham told [Mayer], It was a nonstarter for me. There's a place for the courts, but not for the mastermind of 9/11. He said, On balance, I think it would be better to close Guantnamo, but it would be better to keep it open than to give these guys civilian trials. Graham, who served as a judge advocate general in the military reserves, vowed that he would do all he could as a legislator to stop the trials.

Okay, Senators Graham and Shelby? This is the U.S. Senate, not middle school. This blackmail thing? Its not like, Oh, the cool kids are wearing Hello Kitty wristwatches and you need to follow the fad.

There is zero logical nexus between whether or not to close Gitmo and whether or not to have civilian trials, so the only reason for making the kind of statement quoted above, is quid pro quo. While I'm not suggesting that this is a Hobbs Act violation (read the link, trust me), it certainly smells just as bad.

Kate Martin, the Center for National Security Studies director, warns, We can't have a situation where political pressure forces the federal government to forgo criminal prosecution. That would mean the system is fundamentally broken.

Message for Rahm, from Marcy Wheeler:

Remind me. Didn't Rove and the Bush White House get in trouble for this kind of tampering with DOJ issues?

Really, the White House needs to BACK OFF and let the Department of Justice and the federal courts do their job. And a bunch of non-lawyers with ZERO expertise in this area should NOT be part of the decision making process, much less driving that process. Hasn't Rahm done enough damage to the President with his mishandling of the healthcare bill? Why do you want him to screw up something he knows even less about?

When Jammie Thomas (now Thomas-Rasset) became the first alleged P2P file-swapper to take her case all the way to trial and verdict, no one suspected that she would actually have three trials and verdicts, but that's the case today, as the RIAA rejected a federal judge's decision to slash Thomas-Rasset's damage award. Instead, we're headed to a truncated third trial on the issue of damages.

The recording industry also made it clear this week that both Thomas-Rasset and Joel Tenenbaum (the second P2P defendant to go to trial and verdict) are, in its view, quite terrible people: lying, deceiving, irresponsible, and unreasonable. And the industry can't understand why they're both fighting on.

Credit card usage is slowing. Revolving credit largely made up of credit card debt fell by nearly 20% in November, the largest drop on record, according to the Federal Reserve, reflecting less borrowing by consumers and banks' tighter lending standards. Through October, the number of new credit card accounts was down 46% from the same period in 2008, according to Equifax.

But abandoning credit cards is a much more radical step than using them less. Consumers who don't own a credit card often have a hard time renting a car. Some hotels won't book rooms to travelers who want to pay with a debit card or cash. Those that accept debit cards may place a hold on several hundred dollars in the customer's bank account, which could cause checks to bounce. And many consumer experts say that responsible use of credit cards is one of the most effective ways to build a good credit record.

It will be interesting to see what the long term implications of this will be, because I sense a lot of people now run with the baseline perception that banks and credit card companies exist only to screw their customers.

With that in mind, I decided to filter the barrage of iPad coverage through a publishing lens. What follows are intriguing ideas culled from all sorts of sources. Most revolve around content applications the iPad may provide.

There's no way I'll catch all the good stuff -- there's just too much out there -- so please use the comments area to post links and commentary that grab your attention, publishing-related and otherwise.

Ebook pricing could get interesting

The iPad's release portends a price-point battle between Apple and Amazon. That's ebook pricing, not hardware.

The Wall Street Journal says Apple is pushing book publishers to set two ebook price points, $12.99 and $14.99, with Apple taking its customary 30 percent cut from any sales. They key word in all this is "set." The big kahuna of ebooks, Amazon, controls its pricing. Most bestsellers are parked at $9.99, which is below what Amazon pays a publisher for a title. Amazon is subsidizing its low price point.

But that's the present. The future is a different matter. The thought is that Amazon is taking a short-term loss on ebooks so it can solidify its position as the dominant channel. Once it owns the ebook market, Amazon can ditch the subsidy and force publishers to renegotiate pricing.

That's the fear, and Apple appears to be playing to it by giving publishers an option: get a measure of pricing control through Apple, or make more with Amazon but pray they don't rewrite the rules later. (Apple could always rewrite rules, too ...)

What's really interesting about this -- and kind of bizarre -- is that the binary Apple-or-Amazon thinking obscures an important point: mobile devices already offer publishers plenty of pricing options.

What about e-reader applications?

Steve Jobs famously quipped a couple of years ago that "people don't read anymore." Well, I guess Apple changed its stance on that one. The new iBooks app -- and accompanying store -- is a big ol' cannonball in the ebook pool.

Early discussion on a back-channel publishing list I follow has focused on how Apple will treat its new ebook competitors. Will established applications, like Stanza and the Kindle app, be removed? Kirk Biglione, co-founder of Medialoper, thinks competitors will remain in Apple's universe. Just don't count on sharing titles across apps:

Look for books to be added as a new media type in the device media library. The other reading apps may be able to co-exist as long as they don't access books stored in that library. So, for example, you probably won't be able to use Stanza to read iBooks. [Note: Kirk gave me permission to post his comments.]

One thing to consider here: Past inquiries from the Federal Communications Commission may soften Apple's competitive instincts. At least for a while.

Of course, FCC heat doesn't preclude Apple from a little friendly rivalry. Digital Trends picked up on the backhanded compliment Jobs gave Amazon during the iPad presentation:

... [Jobs] basically told the online retailer that we'll take it from here.

The reading/viewing experience

Apple has already shown what it's capable of on the music and video front, so I'm curious to see how it handles the book experience. Early word is positive from folks who've had a chance to demo the iPad. Here's Gizmodo's take:

It's an optical illusion, but just seeing the depth of pages makes the iBook app feel more like a book than a Kindle ever did for me. The text is sharp, and while the screen is bright, it doesn't seem to strains the eyesbut time will tell on that.

The iPad is backwards compatible with existing iPhone applications. That seems useful on first blush, but Joshua Topolsky of Engadget called out a big issue with "old" apps:

It's kind of silly looking. A lone app in the center of a black screen.

More to come

I'll be adding to this post in the coming days as more analysis bubbles up. Again, please use the comments to point out interesting or informative links you come across as well.

A federal lawsuit alleging collusion among the major music labels over digital download pricing can proceed, a three judge Appeals Court panel ruled today.

As lawsuits go, this one's a humdinger, charging that the labels engaged in a price-fixing conspiracy to ensure that they each made about 70 cents per track sold online, and that no one received a better deal than anyone else. The case had earlier been tossed for a "failure to state a claim," but the Second Circuit Court of Appeals has reinstated it and ordered the trial judge to proceed with the case.

I will do a more comprehensive year in review for Cyberlaw generally, but I thought it would be fun to take a close look at how 47 USC 230 fared in 2009. This is the first full calendar year following the Ninth Circuit's en banc Roommates.com opinion, and many of us initially feared that the case would create a huge hole in 230's otherwise solid immunity. As it turns out, those concerns have not come to pass. If anything, 2009 shows us just how strong the immunity remains.

I blogged on a total of 22 cases issued in 2009 that discussed the statute. (I blog on every case I see that substantively discusses 47 USC 230). I blogged on other cases in 2009 that were decided before 2009, such as the Woodhull v. Meinel case from October 2008 and DC v. Harvard-Westlake, a 2007 arbitrator's dismissal that came to light in 2009.

Of the 22 calendar year 2009 cases, I would classify 14 of them (63%) as easy defense wins, frequently on a 12(b)(6) motion to dismiss or state law equivalent. Even many of the remaining 8 cases contained good news for defendants. For example, in Shiamili, the defense inexplicably lost at the district court level but got an easy reversal on appeal. The Stayart court granted Yahoo an easy defense win, although co-defendant Various didn't get the 230 ruling. Similarly, the Barnes case granted the defense an easy 230 win on one theory (negligent undertaking) but denied 230 for a different one (promissory estoppel). The Certain Approval Process case said 230 did not prevent the plaintiff from amending the complaint to add a cause of action, but once added, the court instantly zapped the claim on other grounds.

This leaves four unambiguous 230 defense losses in 2009. The leading 230 defense loss was the Tenth Circuit FTC v. Accusearch case, which held a retailer liable for reselling illicit phone records. The other major 230 defense loss was the NPS v. StubHub case, which held that 230 may not apply to a lawsuit over the alleged illegal ticket scalping by StubHub's sellers. Both of these cases involve the retailing of illegal items, suggesting that 230's boundaries may not reach that far.

The other two defense losses are less consequential. The Project Playlist held that 230 does not preempt state IP law claims, a conclusion that deserves note only because the Ninth Circuit held otherwise in the 2007 ccBill case. I believe that no other courts will follow the Ninth Circuit's rule that 230 preempts state IP laws, making the Project Playlist ruling unsurprising.

In People v. Gourlay, a web host was denied a 230 defense to a criminal prosecution for child molestation- and child pornography-related claims. This case turns mostly on the web host's active role creating the child pornography (as well as the host's molestation of the child actor); with that context, this case may have little influence on other cases. Indeed, the court made clear that web hosts providing standard web hosting services could fully qualify for 230 protection against a state criminal prosecution of child pornography dissemination.

In reverse chronological order, a brief overview of the 230 cases from 2009:

Nemet Chevrolet v. ConsumerAffairs.com (4th Cir. Dec. 29, 2009). One of three federal appellate court 230(c)(1) rulings in 2009 (Barnes and Accusearch are the others). A solid defense win for a consumer review website. The plaintiff's claims that the website contributed to the reviews' development and fabricated reviews were tossed on a 12(b)(6) motion to dismiss.

Shiamili v. Real Estate Group (N.Y. App. Div. Dec. 17, 2009). In an unpublicized January 2009 decision, the trial court denied a website's 230 dismissal request for claims based on user-supplied comments. In December, this error was fixed on appeal despite allegations that the website chooses and administers the user content.

Dart v. Craigslist (N.D. Ill. Oct. 20, 2009). Craigslist got a big win in its ongoing battles with various government agencies over prostitution ads on Craigslist when the court held it wasn't liable for those ads.

Riggs v. MySpace (C.D. Cal. Sept. 17, 2009). A goofy case. The court holds that MySpace's deletion of Riggs' account was protected by 230(c)(1) on the apparent theory that Riggs (the plaintiff) was the third party supplier of the deleted content. This case would make more sense as a 230(c)(2) case.

Finkel v. Facebook (N.Y. Sup. Ct. Sept. 15, 2009). Facebook wasn't liable for the contents of a user's private group even though Facebook placed a copyright notice on the page.

Intellect Art v. Milewski (N.Y. Sup. Ct. Sept. 15, 2009). Ripoff Report wins again.

Stayart v. Yahoo (E.D. Wis. Aug. 28, 2009). An convoluted, and possibly confused, ruling that Yahoo wasn't liable for search results snippets. However, Various was denied 230 because it may have originated the content in question.

Cornelius v. DeLuca (E.D. Mo. Aug. 18, 2009). An online retailer wasn't liable for user-supplied comments despite a conspiracy allegation.

Goddard v. Google (N.D. Cal. July 30, 2009). This is a follow-on ruling to an important December 2008 ruling in this case, which dismissed the plaintiff's complaints but gave the plaintiffs another chance. The December 2008 ruling is one of the most interesting and important decisions interpreting Roommates.com. In the July ruling, the judge again found that 230 insulates Google from liability due to allegedly fraudulent ads run through its network and granted a final dismissal.

Doe II v. MySpace (Cal. App. Ct. June 30, 2009). MySpace isn't liable for users' sexual assaults on other users.

FTC v. Accusearch (10th Cir. June 29, 2009). The second of three federal appellate court rulings on 230(c)(1). The defendant was an online retailer of illegal phone records. The retailer claimed that the phone records came from third party suppliers and therefore 230 immunized the retailer from liability associated with the records. The court echoed the Ninth Circuit's Roommates.com decision, effectively extending that case to the Tenth Circuit, and said that the retailer was responsible for selling the illicit phone records despite 230.

Zango v. Kaspersky (9th Cir. June 25, 2009). This is the only 2009 ruling addressing 47 USC 230(c)(2), the overshadowed and frequently overlooked sibling of 230(c)(1). Despite the rarity of 230(c)(2) cases, this case could be fairly influential. The Ninth Circuit held that 230(c)(2) protected an anti-spyware software vendor's decision to classify software as a threat. If you missed it, you might want to take a look at my presentation slides on 230(c)(2), which distill my deep look at 230(c)(2) this summer.

Gibson v. Craigslist (S.D.N.Y. June 15, 2009). Craigslist isn't liable for physical injury caused by a gun purchased via a Craigslist ad.

Doe IX v. MySpace (E.D. Tex. May 22, 2009). MySpace isn't liable for users' sexual assaults on other users.

Barnes v. Yahoo (9th Cir. May 7, 2009; amended opinion June 22, 2009). The third of three federal appellate court opinions on 230(c)(1). The Ninth Circuit held that 230 preempted a claim against a service provider for negligently delaying the removal of user content (essentially, Zeran redux), but 230 did not preempt a promissory estoppel claim based on promises the service provider made to the person requesting takedown. The initial Ninth Circuit opinion had two other unfortunate digressions: (1) it said that 230 was an affirmative defense that did not support a 12(b)(6) motion to dismiss, and (2) the opinion had ambiguous language implying that 230 preempted only state claims, not federal claims. The amended opinion helpfully eliminated both digressions.

Atlantic Records v. Project Playlist (S.D.N.Y. March 25, 2009). 230 does not preempt a state IP claimin this case, a violation of state copyright law for pre-1972 sound recordings.

Joyner v. Lazzareschi (Cal. App. Ct. March 18, 2009). A message board operator wasn't liable for user posts.

Raggi v. Las Vegas Police (D. Nev. March 10, 2009). A union wasn't liable for messages that union members posted on the union-operated message board.

Certain Approval Programs v. Xcentric Ventures (D. Ariz. March 9, 2009). 230 did not bar amending a complaint to add a new cause of action when the plaintiff also adequately alleged that the Ripoff Report contributed to the creation and development of the content at issue.

People v. Gourlay (Mich. App. Ct. March 3, 2009). This case involves the prosecution of a pornographic web host who also molested the child actor. The web host asserted a 230 defense in trying to overturn the conviction for the charges related to pornography dissemination. Although 230 can preempt state criminal prosecutions, and web hosts are protected by 230 for their ordinary web hosting activities, this web host actively participated in the site's development and therefore lost 230's protection.

NPS v. StubHub (Mass. Super. Ct. Jan. 26, 2009). In a long-running battle between the New England Patriots and season ticketholders who want to resell their tickets via StubHub, StubHub was denied summary judgment on 230 grounds. The court cites Roommates.com in saying that StubHub may have contributed to illegal ticket scalping sufficient to potentially disqualify it for 230 protection.

GW Equity v. Xcentric Ventures (N.D. Tex. Jan. 9, 2009). Ripoff Report is protected by 230 even though it offers pull-down menus and manipulates user-submitted reports.

Electronic Frontier Foundation (EFF), a non-profit group dedicated to defending the freedoms of individuals in the digital age, thinks the U.S. government may be violating the privacy of individuals who post content to Facebook and Twitter.

The organization has filed suit in San Francisco's U.S. District Court, Northern District, against the Department of Defense, the CIA, the Department of Homeland Security, the Department of Justice, the Department of the Treasury and the Office of the Director of National Intelligence in order to get information concerning the government's use of social-networking websites for investigative and data gathering purposes to help inform Congress and the public about the effect of such uses and purposes on citizens' privacy rights and associated legal protections.

According to the complaint, EFF is aware that the government is using content posted to social media sites in their investigations. After their initial requests for more information and documentation on the specific policies around these activities went unanswered, the EFF began seeking a court order to force the government's hand in full disclosure.

One of the incidents cited in the complaint was the widely publicized FBI search of an activist's home, which came after the man in question used radio scanners to post the movements of police on Twitter during the G-20 Summit.

From the complaint:

Although the Federal Government clearly uses social-networking websites to collect information, often for laudable reasons, it has not clarified the scope of its use of social-networking websites or disclosed what restrictions and oversight is in place to prevent abuse.

While it should come as no surprise that the government would be monitoring social media sites for information (earlier in the year the White House sought to hire a social media archivist, while the CIA invested in a social media monitoring firm), it does seem that the EFF has a valid complaint, and that the public should know the scope of the government's monitoring activities.

The full 8-page complaint is embedded below. We're curious to see how this all plays out, so we'll keep you posted on new developments.

[via Bloomberg]

Tags: EFF, lawsuit, social media monitoring, trending, Trending Stories, US Government

Dart v. Craigslist, Inc., 09 C 1385 (N.D. Ill. Oct. 20, 2009)

Yesterday, Judge John F. Grady of the Northern District of Illinois federal court dismissed Cook County Sheriff Dart's lawsuit against Craigslist for user-posted advertisements in Craigslist's erotic services/adult services category on 47 USC 230 grounds. This is hardly surprising, as I wrote in March that "this lawsuit is almost certainly preempted by 47 USC 230." However, it was nice to see such a clean and decisive opinion--and a little ironic, as our law enforcement officials, who are supposed to enforce the laws rather than bypass them, got schooled in the limits of their legal authority.

With respect to the 230 analysis, the court characterizes Sheriff Dart's claims as alleging that Craigslist negligently published the user-supplied ads. The court says that the Seventh Circuit implicitly said that 230 preempted such claims in the 2008 CLC v. Craigslist case. To get around this, Sheriff Dart tried a Roommates.com styled attack, arguing that Craigslist induced the users' advertisements by creating an erotic/adult services category and letting users do keyword searches. These arguments go nowhere (making this yet another case where Roommates.com is cited for the defense). An adult services category can legitimately contain postings for legal services, and the keyword search functionality was agnostic about the illegality of the search and therefore a "neutral tool" (whatever that meant from Roommates.com).

Two other interesting doctrinal notes from the opinion:

* In FN 6, the court reiterates that 230 preempts a civil action to enforce a federal criminal statute. See Doe v. Bates.

* the court rejects arguments that Craigslist "arranges" meetings for prostitution, "directs" people to prostitution or "provides" contact info for prostitutes because, in all three cases, the user-supplied ad (if anything) satisfies those verbs. Similarly, Craigslist's role in "facilitating," "assisting" or "aiding and abetting" these user activities is governed by 230. I believe this is consistent with my view that 230 should preempt any claim that one party "endorses" third party online content.

Given some ambiguous language floating in Seventh Circuit 230 jurisprudence from the CLC v. Craigslist case and the old Doe v. GTE case, it wouldn't surprise me if Sheriff Dart tried an appeal. However, this opinion was solidly reasoned and completely consistent with that jurisprudence, so I wouldn't expect a different result on appeal.

The question of what effect an employee's disloyalty has on authorization to access an employer's computer has arisen in numerous cases in which employers have added civil claims under the CFAA in actions brought against employees alleged to have misappropriated of trade secrets. A typical scenario in which such a claim would be made is where, before departing for a new job, the employee is alleged to have copied or transmitted an employer's computer files for the benefit of a new employer.

Often, what is at stake in such cases is the employer's ability to maintain an action in federal court. A dispute over misappropriation of trade secrets is likely to involve only state law issues, and unless there is diversity of the parties, there is no basis for jurisdiction in a federal court. But, of course, federal courts have jurisdiction over a CFAA claim, and the trade secret misappropriation claims are then swept into federal court along with the CFAA claim as pendent state law claims.

The Seventh Circuit opinion in International Airport Centers v. Citrin is the ruling that is cited by employers seeking to press CFAA claims in such cases. In that case the circuit, in an opinion written by Judge Posner, ruled that under common law agency principles, an employee who breaches the duty of loyalty to an employer thereby becomes unauthorized to access the employer's computer, at least for the purpose of furthering an act of disloyalty to the employer. In LVRC Holdings, LLC v Brekka, the Ninth Circuit ruled to the contrary, finding that under the plain meaning of the language of the CFAA, acts of disloyalty on the part of an employee do not render the employee's access to the employer's computer unauthorized within the meaning of the statute.

In LVRC, the Ninth Circuit panel concluded that under the ordinary, contemporary, common meaning of the statutory terms, an employer gives an employee 'authorization' to access a computer when the employer gives the employee permission to use it. The court found that there is no statutory language to support the contention that authorization terminates when an employee determines to act contrary to the interest of an employer. The court looked to the term "exceeds authorized access," and concluded that the definition of that term made it clear that Congress had no intent to include in the statute any implicit, rather than explicit, limitation on the term authorization. It is an employer's act of allowing or terminating an employer's authorization to access a computer that determines whether the employee's access is authorized within the meaning of the statute, not the employee's disloyal act. The court reasoned:

Section 1030(e)(6) provides: the term exceeds authorized access' means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter. 18 U.S.C. 1030(e)(6). As this definition makes clear, an individual who is authorized to use a computer for certain purposes but goes beyond those limitations is considered by the CFAA as someone who has exceed[ed] authorized access. On the other hand, a person who uses a computer without authorization has no rights, limited or otherwise, to access the computer in question. In other words, for purposes of the CFAA, when an employer authorizes an employee to use a company computer subject to certain limitations, the employee remains authorized to use the computer even if the employee violates those limitations. It is the employer's decision to allow or to terminate an employee's authorization to access a computer that determines whether the employee is with or without authorization.

The Ninth Circuit rejected the Seventh Circuit's reasoning in International Airport Centers, LLC v. Citrin, concluding that relying on whether an employee's mental state changed from loyal employee to disloyal competitor to determine whether the statute had been violated would be problematic in the criminal law context. The statute should be interpreted consistently in civil and criminal contexts, the court reasoned. Relying on the employee's mental state with respect to disloyalty to determine whether the statute had been violated would run afoul of the proscription against interpreting criminal statutes in surprising and novel ways that impose unexpected burdens on defendants.

In this respect, the ruling echoes (but does not cite) the recent district court opinion in United States v. Drew, No. CR 08-0582-GW (C.D. Cal. Aug. 28, 2009) (the MySpace "cyberbullying" criminal prosecution). There, the court dismissed a misdemeanor charge of violating the CFAA that was predicated on a user's alleged violation of the MySpace Terms of Service, finding that it would run afoul of the void for vagueness doctrine because individuals of 'common intelligence' arguably would not be on notice that a breach of the terms of a service contract could become a crime under the CFAA.

And conversely, the Ninth Circuit ruling appears to contradict the recent opinion in United States v. Nosal, 2009 U.S. Dist. LEXIS 31423 (N.D. Cal. Apr. 13, 2009), in which the district court declined to dismiss an indictment charging a violation of 18 U.S.C. 1030(a)(4). The indictment alleged that the statute was violated when a former employee accessed an employer''s computer network to copy proprietary information for use in a competitive enterprise. The court found that the statutory element of intent to defraud in subsection 1030(a)(4) could be found in the employee''s knowing access of electronic records for uses outside their intended purpose. The court in Nosal also rejected the defendant''s argument that because subsection 1030(a)(4) had never been addressed in the criminal context the indictment should be dismissed under the rule of lenity. Citing International Airport Centers, LLC v. Citrin and a number of opinions following it, the court found that there was ample authority in civil cases construing this section to conclude that the CFAA was violated by the 'access to the employer's confidential and proprietary information to advance his own competitive enterprise.

No doubt more will be heard on this issue in the Ninth Circuit, and other courts as well. And eventually, perhaps, the U.S. Supreme Court.

EU Opposition of Google's Settlement

Many voices in the EU complained at a hearing that the proposed settlement would give Google more power to exclusive rights to sell million of out-of-print works even though the copyrights are still valid. Not much of a surprise that Microsoft is backing the anti-Google settlement groups in the EU. Many groups in the EU feel that since they did not participate in the settlement that they were discriminated against.

What's Next in the Lawsuit?

Federal District Judge Denny Chin must now sort through the filings to try to determine if the proposed settlement properly protects the authors, or else the case may continue on to trial. Among other issues for Judge Chin to consider are antitrust concerns that Google's control over these works would give Google too much market power. There are many antitrust issues on the horizon for Google it seems with many opponents, not just with books but more broadly in the entire space known as eCommerce. Stay tuned as we see Google and eCommerce evolve.

Beverly Stayart searched her own name and didn't like the results. She got links to pornographic websites, online pharmacies promoting sexual dysfunction drugs, and an adult-oriented online dating service. She sued Yahoo! and other defendants, including the operator of AdultFriendFinder, for false endorsement under the Lanham Act and state-law privacy violations. The court dismissed the Lanham Act claim and surrendered jurisdiction over the state law claims.

Stayart lives in Wisconsin and was previously employed by several major financial institutions in Chicago, attaining the position of Vice President. She's involved in animal protection and genealogy research throughout the world. This includes an internet presence; her periodic posts on one genealogical website have generated almost 17,000 hits during the past three years. (Okay, I'm sorry, but: on the internet as a whole, that's tiny. My stats look more impressive than thatif you've never seen any others.) And two of her poems appear on two Danish websites (they support the preservation of baby seals).

Stayart alleged that she was the only Beverly/Bev Stayart on the internet, and that she had never engaged in a promiscuous lifestyle, or other overt sexual activities, which are repugnant to her and her community. She alleged that her name had commercial value because of her humanitarian endeavors, positive and wholesome image, and the popularity of her scholarly posts on the Internet. The search engine defendants, she alleged, knowingly used her name on false snippets in results by (1) repeatedly linking Plaintiff to the advertising of Cialis by an online pharmacy; (2) repeatedly linking Plaintiff to six separate websites playing pornographic videos containing computer spy ware; and (3) repeatedly linking Plaintiff to a website captioned Free Streaming Porn--HOTTEST DAILY PORN' displaying 27 hardcore pornographic photos. She asked Yahoo! to stop linking her name to these search results. Yahoo! replied: We do not aim to judge web content for appropriateness or censor materials that we find offensive or inappropriate. Instead, we present information as it is reflected on the Web, allowing you to draw your own informed conclusions about what you see.

Stayart also alleged that Various (which operates AdultFriendFinder) used her name on a website advertising its service. She typed her name into altavista.com and got, among the results, jewellery-makin-doorway.orge.pl/bev-stayart.html. This went to an Under Construction site that stated Meet AdultFriendFinder members near Janesville [Wisconsin]-- Over 20 Million Members and displayed five graphic images of fully or partially nude women, accompanied by the age, nickname and city of residence of the women.

Under Iqbal, though a court must accept all well-pleaded facts as true, the claim must still have facial plausibility. And a plaintiff can plead herself out of court, which was what the court determined had occurred here.

False endorsement means that consumers are likely to be misled about a person's sponsorship or approval of a product or service.

In order to have prudential standing under the Lanham Act, Stayart needed to allege at least an existing intent to commercialize her identity. This she didn't do. Though she alleged that her name has commercial value, her complaint is really about distasteful associations. That emotional desire to prevent others from using her name doesn't create Lanham Act standing. Her correspondence with Yahoo!, attached to the complaint, further indicates that her concerns are with privacy and reputation, defamation and demeaning associations. But the Lanham Act does not create a false light tort claim, absent commercialization.

Stayart relied on Doe v. Friendfinder, which refused to dismiss a false endorsement claim against AdultFriendFinder. But Doe didn't address prudential standing in its decision.

The court went on to reach an independent ground for dismissal, lack of likely confusion as a matter of law. [A] commonsense reading of the complaint demonstrates that there could be no likelihood of confusion. The complaint explicitly disavows any association with pornographic materials, sexual dysfunction drugs, or sexually-oriented dating services. This contravenes likelihood of confusion, so Stayart pleaded herself out of court. (Query: before 1999, would Bob Dole have had a claim? He'd never previously been associated with sexual dysfunction drugs, so wouldn't it have been just as implausible that he'd be a pitchman for them?) No one who accessed these links could reasonably conclude that Bev Stayart endorsed the products at issue.

Stayart argued initial interest confusion against AdultFriendFinder. But on the internet, initial interest confusion depends on relatedness of goods and a consumer's level of care. Given that Stayart's identity is completely unrelated to AdultFriendFinder's services, initial confusion won't facilitate free riding on another mark's goodwill. Without a meaningful effect on the market, confusion is of little or no consequence under the Lanham Act. The type of person looking for information about Bev Stayart would not be fooled into using an online adult-oriented dating website. (I'd add in to find her at the end of that; the court might be surprised to find outjust as Stayart might bethe non-Stayart-related interests of the type of people looking for information about Stayart. I'd be willing to bet that even genealogists and animal rescuers sometimes like to meet adult friends!)

Next, a puzzling CDA discussion. The court commented that if Stayart successfully stated a false endorsement claim under the Lanham Act, it would probably fall under the CDA's intellectual property exclusion. But, it continued, one of the fatal flaws of that claim is that Yahoo! didn't use Stayart's name in connection with its own goods or services. It just included snippets from third-party websites and didn't create the content of which Stayart complained. So the proper analysis is vicarious liability/contributory infringement under the Lanham Act.

Under settled doctrine, Yahoo! can't be held liable for failing to remove the search results even after Stayart complained. It didn't control the third-party websites, which fact defeated both contributory and vicarious liability. (That's a shortcut on contributory liability analysis, but not particularly troubling under the circumstances.) The only way Yahoo! could control the results would be to change its algorithm, which goes to the heart of Yahoo!'s role as an interactive computer service. Because ordinary search engines play no part in developing any unlawful searches, Yahoo! should be entitled to immunity because it acted as an interactive computer service, even though Stayart's claims are nominal intellectual property claims. Immunizing Yahoo! doesn't contravene the CDA's IP exclusion because Stayart doesn't have a valid IP claim.

Comment: oh, my. Look, I like CDA immunity generally. But what's weird here is not the court's willingness to use CDA reasoning on an IP claim despite the IP exclusion; what's weird is the court's failure to notice that IP secondary liability doctrine itself incorporates the tech-promoting rationales underlying the CDA. Well, trademark does much more than copyright, these daysbut it's trademark doctrine that's at issue here! There's no need to bring in the CDA! And that last bitthis analysis only applies because Stayart doesn't have a valid IP claimmakes this whole excursion even more obviously useless.

The court then said that matters were less clear with respect to AdultFriendFinder. The site is in some ways interactive, but Stayart's complaint relates to the banner ad associated with the bev-stayart.html URL. AdultFriendFinder's role in the creation of the banner ad content was unclear, so the court couldn't grant it immunity at this stage.

The only claims that remained were state-law claims. Given that the dismissal was on the pleadings, ordinarily a federal court should relinquish jurisdiction, unless it is so obvious how the claims should be decided that the plaintiff should be put out of her misery rather than involving state-court resources. Defendants argued that Wisconsin requires a name to have commercial value in order to maintain a right of publicity claim. But some variations of the appropriation tort, which Wisconsin may recognize, require only commercial use plus bruised feelings. (Doesn't Yahoo! get out of this even if AdultFriendFinder has to proceed in state court? Under what theory is Yahoo!'s use commercial? If it's using snippets from other sites, how can it possibly be distinguished from the New York Times using Stayart's name in a story?)

The distinction between appropriation and the right to publicity (based on commercial damage) is also relevant to CDA immunity. The latter is an IP claim. (Implicit holding: to the extent Stayart is bringing an appropriation claim, Yahoo! is immune.) Plus there's the Perfect 10 versus Friendfinder split over whether state IP claims are preempted by the CDA. Since this is an unsettled issue of federal law, the court couldn't conclude that there was an obvious resolution of the state law claims. Even though the Court already held that Yahoo! was entitled to CDA immunity, the Court cannot say with certainty that a potential right to publicity claim under Wisconsin law is without merit, meaning that the intellectual property exception could save Stayart's claims. Also, AdultFriendFinder's CDA status is unclear, leaving it potentially vulnerable under either a misappropriation or right of publicity claim.

Judge Der-Yeghiayan granted defendants' Fed. R. Civ. P. 12(b)(1) motion to dismiss for lack of subject matter jurisdiction even though plaintiff brought a federal Lanham Act trademark infringement claim. While Lanham Act claims are generally considered federal questions creating subject matter jurisdiction, plaintiffs claims were in essence breach of contract claims. Plaintiff was a franchisor of Mindy's Restaurants. Defendants were franchisees, until they allegedly stopped making required franchise payments and plaintiff terminated the franchise agreement. While plaintiff's claims were for use of plaintiff's trademarks when defendants allegedly continued operating their restaurant after the franchise agreement was canceled. As a result, the Court held that the parties dispute and plaintiff's claims sounded in contract, not the Lanham Act. The reason the trademarks were allegedly infringed was the termination of the franchise agreement.

When the Ninth Circuit decided Fair Housing Council of San Fernando Valley v. Roommates.com, 521 F.3d 1157 (9th Cir. 2008), we opined that the opinion wasn't "all that earth-shattering. It's crafted to be narrowly applicable to the particular case decided and should not alter the Section 230 analysis in most future cases." Now, more than a year later, about half a dozen federal courts have espoused the same view.

In Goodard v. Google, Inc., 2009 WL 2365866 (N.D. Cal. July 30, 2009), the United States District Court for the Northern District of California held that Roommates "carved out only a narrow exception" to the rule set out in Carafano v. Metrosplash, 339 F.3d 1119 (9th Cir. 2003), that a website consisting of user-generated content "could never be liable [under Section 230 of the Communications Decency Act] because 'no [user] profile has any content until a user actively creates it,'" Roommates, 521 F.3d at 1171 (quoting Carafano, 339 F.3d at 1124) (emphasis added). The court also pointed out two recent district court opinions which reached similar conclusions:

• In Doe v. MySpace, Inc., ___ F.Supp.2d ___, 2009 WL 1457170 (E.D. Tex. 2009), the United States District Court for the Eastern District of Texas found that Roommates was "not applicable" to an action against social networking site MySpace.com because the decision was was only relevant to websites, unlike MySpace, which require their users to provide illicit content.

• In Atlantic Recording Corp. v. Project Playlist, Inc., 603 F.Supp.23d 690 (S.D.N.T. 2009), the United States District Court for the Southern District of New York found that the Roommates decision "was based solely on the fact that . . . Roommates.com . . ., in violation of federal and California state housing law, required potential subscribers to identify their sex, sexual orientation, and family status, and to indicate their preferred sex, sexual orientation, and family status in a roommate."

A couple of other district courts have issued opinions which take the same position: the Roommates decision is narrowly applicable to the facts of that particular case and does not alter the broad immunity afforded by Section 230 in the vast majority of cases. See Lee Baker, Another One Bites the Dust: Roommates as a Hail Mary for Frivolous Lawsuits, Citizen Media Law Project (Aug. 5, 2009); Thomas O'Toole, Five Post-Roommates.com Decisions Confine Immunity Exception to Narrow Circumstances, TechLaw (May 28, 2009).

Daniel Boyd and half-dozen of his alleged recruits in the Raleigh, N.C. area were charged with providing material support to terrorism.

The Justice Department in Washington said Boyd, who is a U.S. citizen, trained in Afghanistan and fought there between 1989 and 1992 before returning to the United States.

Boyd and the other defendants were scheduled to appear in federal court in Raleigh.

A newly unsealed indictment charged that Boyd, also known as 'Saifullah,' encouraged others to engage in jihad.

Boyd allegedly traveled to Israel in 2007 with several of the defendants, hoping to engage in "violent jihad," according to the indictment. The attempt was unsuccessful, though, and the men returned home, officials said.

Boyd was also accused of trying to raise money last year to fund others' travel overseas to fight.

One of the men, Hysen Sharifi, allegedly went to Kosovo to engage in violent jihad, according to the indictment, but it's unclear if he did any actual fighting.

Several of the defendants, including Boyd, were also charged with practicing military tactics on a private property in Caswell, County, N.C. in June and July of this year.

We're not only losing journalists, we may be losing journalism, according to Copps.

Some blame the Internet and bloggers, and that's certainly a part of the story. All that consolidation and mindless deregulation, rather than reviving the news business, condemned us to less real news, less serious political coverage, less diversity of opinion, less minority and female ownership, less investigative journalism and fewer jobs for journalists.

The decline of traditional print and broadcast outlets is the primary focus of the report. The report also loks at possible ideas for addressing these issues.

How about journalism? asked Copps. Will anyone figure out a business model to support in-depth, investigative journalism or must we develop something completely new, perhaps based on philanthropy, non-profit models or public media?

Chris Soghoian observed in CNET that

Google's terms of service, thick with legalese, state that:

You may not use Google's products, software, services and web sites and may not accept the Terms if you are not of legal age to form a binding contract with Google.

Of course if you're in the US that means that anyone under 18 is accessing Google's computer system in violation of its terms of service. And this applies to all Google services, YouTube, Gmail, and Image Search.

Ignoring Legal Risks Leads to Selective Prosecution
Federal prosecutors recently used the Computer Fraud and Abuse Act to selectively prosecute Lori Drew as a hacker for violating MySpace's terms of service. She lied about her identity, and harassed a troubled minor who was also using the system under a false identity. After the child committed suicide, a media and political frenzy resulted in federal prosecutors turning a breach of the site's terms, which might not have even been civilly enforcable, in to a federal criminal case.

Ignoring the Disconnect Between Terms and Practice May Partly Void the Agreement
Obviously, online services retain the right to modify their own terms of use. You may begin a user experience with a minimal grant of rights and a maximum of restrictions when reflexively accepting terms. However, when site staff clearly operate to the contrary to those terms, and in some instances assure users that terms in the TOS won't be enforced, isn't the contract being modified within the user experience?

Smoking Gun: Google for Kids
Google in fact provides safe-search resources just for kids. There's no easily accessible link to terms of service, so arriving new users aren't even exposed to them.

Question 1: By creating this site and its other practices, doesn't Google by their own practice modify their terms?

Question 2: Could any reasonable person believe that a new visitor to the Google Directory for Kids and Teens should be bound by these unseen terms, which even Google seems to disregard?

Question 3: What risk is created by the gap between the lawyers who wrote the TOU, site management who follows their own drummer, and visitors who ignore the terms are entirely disconnected.

Are such TOU's unenforcable sharades posing as contracts?

The agents -- already there for more than six months -- say the chore is so daunting, they need to stay in the Manhattan skyscraper at least another year.

And by the way: They intend to hang on to the copy machine.

The former headquarters of Bernard Madoff are a home away from home for the FBI and, as of July 1, a leasing opportunity for any potential tenant who can stomach its status as ground zero of the largest securities swindle in history.

"Some people may see a stigma associated with it," building manager Russell Freeman said on a recent tour of the piece of the three-floor firm that's been put on the market. "But he's out of there. His bad karma has gone with him. ... Space is space."

Space once used by Madoff himself -- a fishbowl corner office with partial views of the East River -- has been emptied of most furniture and paperwork, like the rest of the 19th floor. Only a pair of built-in cabinets and a wall-mounted television, easily 10 years old, remain.

Across the room is a matching corner office where Madoff's brother Peter worked. Two smaller glass offices were for Madoff sons Andrew and Mark. Two filing cabinet drawers still bear stickers with the name "Andy Madoff."

The three men, whose names remain on an automated directory in the building lobby, oversaw a trading floor for Bernard L. Madoff Investment Securities that's now a ghost town, dead silent except for the hiss of an air conditioner.

The color theme throughout -- from the refrigerator in a galley kitchen to the trading floor desks to the many conference rooms -- is the minimalist black and ash gray favored by the 71-year-old former Nasdaq chairman, one of the original tenants when the building opened in the mid-1980s.

Floors 17 through 19 became part of a crime scene later last year when the once-prominent money manager confessed that his secretive investment advisory group actually was a massive Ponzi scheme that wiped out thousands of investors. He was sentenced to 150 years in prison last month and on Thursday decided not to appeal the sentence.

The disgraced financier has claimed he alone conned clients by recycling their money to create phantom wealth. But investigators have said they suspect members of Madoff insiders were involved and have been camped out on the 17th floor searching for evidence of a wider conspiracy.

Many of the records were paper or on microfilm and date back decades. Authorities say the firm relied on an old IBM computer to churn out statements that were fictitious.

When the scandal broke, news crews and burned investors flocked to the 34-story skyscraper -- shaped like an open lipstick tube -- to measure the financial wreckage. They didn't get far: Madoff's firm had been sealed off from the public by an army of FBI agents, federal regulators and a trustee appointed to liquidate the business assets.

Since then, the trustee has sold one of Madoff's legitimate trading operations to a new broker-dealer firm that took over the 18th floor. A staircase connecting the 18th and 19th floors will be removed, Freeman said.

As for the 17th floor, trustee Irving Picard wrote in court papers that the FBI "has advised me that they will require access to the space until, at least, approximately July of 2010." It also wanted to continue using a leased Xerox copying machine there. The cost will be covered by an industry group that compensates victims of securities fraud.

Sharing the 17th floor in separate office space is a discount brokerage headed by Wall Street veteran Muriel Siebert, the first woman to buy a seat on the New York Stock Exchange in 1967 and the only tenant allowed a dog. Siebert had a sublet with Madoff and is now paying rent to the trustee.

What remains is the 16,182-square-foot 19th floor. A bankruptcy judge recently authorized the trustee to cancel the Madoff lease there through 2012 with landlord Metropolitan Real Estate Investors, creating the vacancy in a sagging commerical real estate market.

Freeman wouldn't say what Madoff paid in rent, adding that no price has been set for the floor. There have been some feelers, but no firm offers.

Any takers who don't remodel, he said, "will certainly have to like dark colors."

LOS ANGELES A federal judge on Thursday overturned guilty verdicts against Lori Drew, and issued a directed acquittal on the three misdemeanor charges.

U.S. District Judge George Wu granted a defense motion to overturn the jury verdict in the case after reviewing transcripts from last year's trial, in which 50-year-old Drew was convicted of three misdemeanor charges of unauthorized computer access.

Drew had faced a maximum sentence of three years and a $300,000 fine. Although prosecutors sought the maximum, probation authorities, in a pre-sentencing report sent to the court, had recommended probation and a $5,000 fine.

Drew was accused of participating in a cyberbullying scheme against a 13-year-old girl who later committed suicide. The case against Drew hinged on the government's novel argument that violating MySpace's terms of service for the purpose of harming another was the legal equivalent of computer hacking.

In September 2006, prosecutors said, Drew conspired to create a fake MySpace account for Josh Evans with her then 13-year-old daughter, Sarah, and a then-18-year-old employee and family friend named Ashley Grills.

Prosecutors alleged that Drew and the two others used the profile to lure Megan Meier, a 13-year-old neighbor, into an online relationship with Josh to find out what Megan was saying about Drew's daughter online. But in October, one of the group, writing as Josh, turned against Megan, and told her that the world would be a better place without her. Shortly afterward, Megan hanged herself in her bedroom.

MySpace's user agreement requires registrants, among other things, to provide factual information about themselves and to refrain from soliciting personal information from minors or using information obtained from MySpace services to harass or harm other people. By allegedly violating that click-to-agree contract, Drew committed the same crime as any hacker, prosecutors claimed.

But testimony in the case offered by prosecution witness Ashley Grills under a grant of immunity showed that nobody involved in the hoax actually read the terms of service. Grills also said that the hoax was her idea, not Drew's, and that it was Grills who created the Josh Evans profile, and later sent the cruel message that tipped the emotionally vulnerable 13-year-old girl into her final, tragic act.

Drew was cleared of the felony computer-hacking charges by a jury, but convicted of three misdemeanors for unauthorized computer access. The jury deadlocked on the felony charge of conspiracy.

More details to come.

Photo: AP

See also:

• Judge Postpones Lori Drew Sentencing; Weighs Dismissal
• Can Lori Drew Verdict Survive the 9th Circuit Court?
• Prosecutors Seek 3 Years in Prison for Lori Drew
• Lori Drew Not Guilty of Felonies in Landmark Cyberbullying Trial
• Prosecution: Lori Drew Schemed to Humiliate Teen Girl
• Government's Star Witness Stumbles: MySpace Hoax Was Her Idea, Not Drew's
• Experts Say MySpace Suicide Indictment Sets Scary' Legal Precedent
• Blog Readers Out Anonymous Adults that Newspaper Refused to Identify

Max Ray Butler, 36, faces up to 60 years in prison for the two felonies under law, but his actual sentence will be influenced by a number of factors, not least a plea agreement with federal prosecutors that was filed under seal Monday.

Wearing an ill-fitting orange jail uniform and round glasses, his hair cut short and neat, the six-foot-plus Butler towered over the burly deputy marshals that brought him into the court room. Once he settled into his seat, he spoke softly and evenly as he answered questions from the judge, frequently drawing admonishments to speak up for the benefit of the court reporter.

I actually did the actions that are relevant in the indictment, and I am guilty, Butler said, at one point.

Butler identified himself in court as Max Vision, the name he gave himself in the 1990s when he became a superstar in the computer security community. At that time Butler was billing himself out as a $100-an-hour computer security consultant, and he earned the respect of his peers for creating and curating an open source library of attack signatures used to detect computer intrusions.

But it turned out Butler was staging recreational hacks on the side, and in 2001 he was sent to federal prison for 18 months for launching a scripted attack that closed security holes on thousands on Pentagon systems, and left backdoors behind for his own use.

While in prison, Butler met more serious criminals, and he was befriended by a professional swindler named Jeffrey Norminton. After his release, Norminton introduced him to an Orange County, California entrepreneur and former bank robber named Chris Aragon.

Butler admitted Monday that he began hacking banks, merchants and other hackers to steal credit card numbers, then sold them to Aragon. Aragon, who's pending trial on related state charges in southern California, turned that stolen data into near-perfect counterfeit cards, complete with holograms, and recruited a crew of shoppers who used the cards to snap up designer merchandise for resale on eBay. Aragon earned at least $1 million in the business, police say.

Butler became a priority to federal law enforcement officials in 2006, when, under the handle Iceman, he staged a brazen takeover of the online carder forums where hackers and fraudsters buy and sell stolen data, fake IDs and specialized underground services.

He hacked into the forums, wiped out their databases, and absorbed their content and membership into his own site, called CardersMarket.

On one of the sites he hacked, called DarkMarket, Butler later discovered that an administrator named Master Splyntr was logging in from an FBI office in Pittsburgh. Butler partnered with a Canadian hacker to try and expose Master Splyntr as a fed, but his claim was largely dismissed in the underground as inter-forum rivalry. DarkMarket went on to become a full-blown undercover FBI operation, and the FBI and Secret Service began an investigation into Iceman.

(I wrote about Butler in the January issue of Wired. I'm now working on a book about him and the carder forums for Crown publishing).

Using informants and some genuine electronic gumshoe work, the feds identified Iceman as Butler about a year later, and arrested him in September 2007 at a corporate apartment he used as a hacking safe house.

When the feds seized Butler's hard drive, they found five terabytes of encrypted data on his harddrive, the government said Monday. They later cracked Butler's crypto, and discovered 1.8 million stolen credit card numbers belonging to 1,000 different banks. The banks tallied the fraudulent charges on the cards at $86.4 million.

But Butler's defense attorney told U.S. District Judge Maurice B. Cohill Jr. Monday that Butler and his associates weren't' responsible for all of the fraudulent charges.

Butler, noted federal public defender, Michael Novara, frequently cracked the computers of other members of the underground, and stole their stuff. Some of the credit card numbers found on Butler's hard drive had been in the hands of cyber thieves before Butler began his hacking spree.

Max is kind of a hacker's hacker, said Novara. There was a lot of stuff on his computer that he was not responsible for, and did not intend to use.

I don't think I ever heard the expression, a hacker's hacker' before, said Judge Cohill, with a smile.

Sources say Butler's plea deal will also wrap up a separate federal case in Virginia, in which Butler is charged with staging the first documented spear phishing attack against employees of a financial institution, gaining access to the corporate network of Capitol One bank.

Butler was calm and attentive at Monday's proceeding, which opened with federal prosecutor Luke Dembosky crossing to the defense table to shake hands with the hacker, who smiled and nodded.

Through his attorney, Butler released a two-paragraph statement following his plea.

Max Vision, known in this case as Max Butler, pled guilty today as a first step toward getting this sad chapter of his life behind him. It is unfortunate that his life circumstances in 2005 led him to participate in this criminal conduct, and he very much regrets doing so, he wrote.

Max has always preferred using his extraordinary computer skills his computer vision for the good of society and the cyber world, and he hopes that he will be given the opportunity in the future to once again don the white hat.

Asked afterward what kind of sentence the government expects for Butler, Dembosky was vague with reporters. Suffice to say, it won't be probation.

See Also:

• Notorious Crime Forum DarkMarket Goes Dark
• Cybercrime Supersite DarkMarket' Was FBI Sting, Documents Confirm
• 56 Arrested in DarkMarket Sting, Says FBI
• One Hacker's Audacious Plan to Rule the Black Market in Stolen Credit Cards
• A White Hat' Goes to Jail

So Cassetica sued in federal court, alleging a number of causes of action, including violations of the Computer Fraud and Abuse Act, 18 USC 1030 et seq. (CFAA). CSC moved to dismiss pursuant to FRCP 12(b)(6) for failure to state a claim. The court granted the motion, finding that Cassetica did not plead either damage or loss as required by the CFAA.

What the CFAA requires

Interpreting the CFAA differently that at least one other judge in the Northern District of Illinois has (cf. Garelli Wong & Assoc. v. Nichols, 551 F.Supp.2d 704 (N.D.Ill. 2008)), Judge Kendall held that Cassetica was required to plead either damage or loss as such terms are defined in the CFAA. (In Garelli Wong, the court held that both damage and loss must be pled.)

Under the CFAA, damage is defined as any impairment to the integrity or availability of data, a program, a system, or information. Loss is defined as any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.

Insufficient damage allegations

The bare allegations of damage in the complaint were not enough. The court found that Cassetica did not allege any facts that would plausibly suggest that the software downloads authorized or not caused a diminution in the computers or usability of [Cassetica's] computerized data. The court went on to observe that [c]ritically absent from the Complaint are allegations that CSC's downloads resulted in lost data, the inability to offer downloads to its customers, or that the downloads affected the availability of the software.

Insufficient loss allegations

Cassetica's complaint also failed to plead loss. The allegations primarily dealt with the lost fees Cassetica would have received had the alleged unauthorized downloading not taken place. Because Cassetica did not allege that it lost revenues as a result of an interruption in service caused by CSC, its claim for lost revenue fell outside the CFAA's definition of loss.

Download picture courtesy Flickr user soren_nb under this Creative Commons license.

Computer Sciences Corp., the IT service organization, today laid out its strategy for the cloud. Unsurprisingly, CSC's cloud products will focus on being reliable and secure enough for enterprises and the federal government. CSC will continue providing its managed hosting business, but later this year will launch an infrastructure-as-a-service product that will provide secure cloud computing and storage that takes into account geographical location and differing regulatory environments. It will also build out a platform and offer software that will help companies connect other clouds to their secure CSC clouds or to the CSC platform. Pricing and further services built on top of CSC's clouds and other clouds will be announced in the next few months.

Most interesting to me was that Brian Boruff, vice president of CSC's Cloud Computing business, said the company was leaning toward building its cloud infrastructure with Cisco's new unified computing system. Given the competition CSC has with the IT services offered by HP and IBM, it is also evaluating Dell hardware. However, CSC did participate in the launch of Cisco's new unified computing systems, and Boruff said, We're talking to Dell, but right now the most advanced discussions are with Cisco.

CSC's cloud computing offerings would compete with those from Rackspace and Amazon at the infrastructure-as-a-service level. Because of the high levels of reliability and customer service emphasized by CSC, I imagine it will draw business from folks who are considering Rackspace's CloudServer product. Those folks may need a better service level agreement or exact knowledge about where their data is being stored than what Amazon currently offers. The announcement also leaves me wondering when IBM and HP are going to announce their own big cloud computing plays, rather than webinars and research projects. I think this summer, we're going to see some big players launch real products to take on various layers of the cloud.

If anything sucks more than being the target of an ambitious but delusional gubernatorial candidate who has suddenly developed a bit of a fetish for prostitution, it's being ignored by that candidate. As far as Village Voice sees the world, Craigslist just got a bunch of free press. And they want their share.

When Craigslist management was facing a criminal investigation for listings on the site they did the smart thing. They talked about the law, and they pointed out that the real smut was on other sites that were being ignored by the South Carolina Attorney General. If you really want hard core porn and prostitution, Craigslist CEO Jim Buckmaster pointed out, check out Village Voice's BackPage.com.

That's all body fluids under the bridge now, of course, since a federal judge smacked down McMaster and forbid him from stalking Craigslist management.

But Village Voice is still smarting from those Buckmaster links in that blog post. Yesterday they issued a very official press release titled Village Voice Media to Craigslist CEO Buckmaster: Calm Down, Back Off; There is Nothing Wrong With a Little Competition.

In an email, Village Voice's PR firm accuses Buckmaster of leveraging the legal bind he's in to damage Craigslist's competition.

The real reason for the press release and press outreach, of course, is to get a little bit of the spotlight pointed to backpages, too. Because their official story doesn't make sense.

Backpages has adult ads, lots and lots of them, and they're proud of it: We will continue to exercise our right to accept legal adult postings, they say. All Buckmaster did was link to a whole bunch of them. And since backpages desperately needs the traffic, what they really should be doing is thanking Craigslist, not attacking them.

What we learned today: If you really want to pay for sex, backpages is the place to go.

Full press release is below:

Village Voice Media to Craigslist CEO Buckmaster: Calm Down, Back Off; There is Nothing Wrong With a Little Competition

PHOENIX, May 29 /PRNewswire/ Last Friday, Jim Buckmaster, CEO of Craigslist, fired a deliberate, unnecessary and wholly inaccurate shot across the bow of Village Voice Media and backpage.com, our online classified advertising property. Given the serious nature of what Buckmaster inferred in his post about Village Voice Media newspapers and backpage.com, we can't sit on our hands and be silent.

In the original blog post, which was later submarine edited to reword and soften some of the attacks towards Village Voice Media, Buckmaster complained that politicians are attacking Craigslist but not Village Voice Media and other media outlets because they have a need for positive stories and campaign endorsements from those very same newspapers.

Is it possible that writing stories critical of Craigslist's (relatively tame) adult service' section is more career-friendly than attacking their own employer (or journalistic media brethren) for operating a (far more graphic) adult service' section of their own?

Buckmaster and Craigslist are in a tough, and in many ways, frightening situation - they have a number of moralistic state Attorneys General threatening them over their adult ads, and a raft of bad press following the terrible tragedy in Boston that the company is admittedly in no way responsible for. But, the manner in which Buckmaster is responding to this pressure - by disingenuously lashing out at competitors and caving to political pressure - is inexcusable, and displays a remarkable lack of sound judgment.

In 2002, Village Voice Media recognized the forces that were changing the classified advertising market and created backpage.com to answer that challenge. We've put a lot of work into making it the No. 2 free classifieds site in U.S. We're fine with being No. 2, proud in fact. Buckmaster, apparently, is not. Instead of working with his competitors to find a way to solve, or at least mitigate issues surrounding adult ads - the shortcomings of automatic content filters is something we are all trying to fix - Buckmaster simply attempted to take the competition down with him. And, his methods leave much to be desired.

First off, our newspapers don't endorse politicians and rarely have anything nice to say about them, so to say that politicians aren't going after Village Voice Media because they need our endorsement isn't viable. Secondly, Buckmaster is only complaining because a competitor is challenging his economic advantage in the free classified arena - which he built in part on adult ads - and has made him a very wealthy man. His talk of building community and serving his users rings hollow. It now appears that, as is so often the case with New Age entrepreneurs, it's all about the money.

We will continue to exercise our right to accept legal adult postings from our users and concentrate on growing backpage.com. We are aggressively building additional technical solutions as well as increasing our manual site inspections to improve efficiency of removing content that is illegal or otherwise violates our Terms of Use.

About Village Voice Media

Village Voice Media is a collection of 15 weekly newspapers and daily Web sites, including New York's Village Voice, the LA Weekly, Denver's Westword and the Phoenix New Times. Online, in print, and on mobile devices, VVM's products combine music, food and events coverage with gritty, hard-hitting journalism to create the most powerful city guides in each market. While the focus of the brand is local, its free classifieds site backpage.com, partnership with social recommendation engine LikeMe.net and national sales force, Voice Media Group, extend its reach on a national level.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

An Ohio appellate court has upheld the felony hacking conviction of a man who was found guilty of unauthorized access for misusing his computer at work.

Richard Wolf acknowledged that his behavior was inappropriate when he used his work computer to upload nude photos of himself to an adult web site and view other photos on porn sites, but he didn't think he should be convicted of hacking for doing so.

A jury disagreed and felt he exceeded his authorization on the computer, which the appellate court recently upheld (.pdf).

Mark Rasch, a former federal prosecutor of computer crimes, called the conviction a misuse of the computer hacking law.

This goes to the whole concept . . . that violation of an internal policy on the use of a computer can be piggybacked to make a crime, said Rasch, who now works as a consultant for Secure IT Experts. His uploading of nude pictures is certainly inappropriate and something he could be terminated for, but it was perfectly legal. When you use the heavy hand of the criminal law to prosecute inappropriate behavior, it's just an abuse of the criminal statutes.

Wolf was also convicted of soliciting a dominatrix online for sexual services, a misdemeanor. Rasch says using the computer evidence for proof of this crime is appropriate, but charging him separately for felony hacking goes too far.

Rasch said the problem stems from an amendment that was made to the federal Computer Fraud and Abuse Act the federal anti-hacking law that states have added to their own statutes.

The early statute only talked about unauthorized access which is breaking into computer, he said. But then they amended it to say or exceeding the scope of authorization to access a computer'.

The amendment was intended to target employees who have access to a computer but abuse that access to obtain data they shouldn't have or go into parts of their employer's network they shouldn't enter.

The amendment arose from the case of an IRS employee who was caught looking up tax returns on an assistant district attorney who was prosecuting his father, among others. Authorities tried to prosecute him on hacking charges but ran into difficulty since he was authorized to use the computer system.

Unfortunately, Rasch says, the amendment created an opportunity for prosecutors to interpret the law too broadly.

That term exceeding authorization' is very loose and ambiguous, he says.

The case began when Larry Wise, the Superintendent of the Shelby City Wastewater Treatment Plant, where Wolf was employed, was deleting old files from a work computer and found a nude photograph of Wolf.

When police interviewed him, Wolf admitted that in January 2006 he joined a web site called Adult Friend Finder to meet women and that, in violation of established work practices, he uploaded nude photos of himself from his work computer after women he met online requested pictures. He also admitted accessing various porn sites and spending more than 100 hours doing personal business on his work computer.

Forensic analysis of the computer's temporary internet files uncovered 703 pornographic photos as well as several sexually explicit e-mails Wolf exchanged with a dominatrix named Mistress Patrice, soliciting her services.

Wolf was convicted on state charges for three counts: unauthorized access to a computer, a felony; theft of services in office (essentially for depriving the city of his paid services while he conducted the unauthorized activities on a city computer on city time), which is also a felony; and solicitation of prostitution, a misdemeanor.

He was sentenced to 15 months and a $5,000 fine for the two felony convictions and ordered to pay the city about $2,400 in restitution for personal business on city time. On the misdemeanor solicitation charge, he was sentenced to 60 days (to run concurrently with his other sentence) and a fine of $500. His sentence was later reduced to two and a half years in community control.

Wolf argued for appeal on grounds that there was insufficient evidence for any of the convictions and that the convictions for unauthorized use of computer and theft of service in particular are contrary to public policy and create such a manifest miscarriage of justice that such convictions must be reversed.

The Ohio hacking statute reads in part that No person, in any manner and by any means, including, but not limited to, computer hacking, shall knowingly gain access to, attempt to gain access to, or cause access to be gained to any computer, . . . without the consent of, or beyond the scope of the express or implied consent of, the owner of the computer, . . . or other person authorized to give consent.

The appellate court wrote that Wolf's conduct was beyond the scope of the express or implied consent and the charge of unauthorized use of a computer was based upon sufficient evidence.

The appellate court vacated the theft-of-service conviction, however.

Judge John Wise wrote that while the State presented evidence Appellant spent approximately 100 hours over a five month-period utilizing internet websites that were not related to his job, there was no evidence presented that his job performance suffered or that he failed to perform his job duties.

Furthermore, even if it could be shown that Appellant failed to perform
such job duties, while it could certainly serve as a basis for termination from his
employment, such could not be the basis of a criminal theft in office charge.

One of the judges wrote a dissenting opinion on this point, saying the state had proven that the city experienced a measurable loss for the time Wolf wasted on the computer.

The county assistant prosecutor said her office will appeal the ruling to the state supreme court.

UPDATE: David Carto, the attorney who handled Wolf's appeal, told Threat Level that Wolf was prosecuted because authorities disapproved of the material he viewed online.

The reason he was prosecuted was clearly because of the content of what he was looking at, he said. If somebody else had been on an internet site studying horticulture, I don't think he would have been prosecuted. It was not obscene. It was just something that was not approved of by certain elements of the city government and by the court in which he was tried. The prosecutor and the judge both treated this basically as a sex offense.

Carto said the photos Wolf viewed were profile pictures from the adult dating site he visited. Some of the profile photos of women on the site showed nudity but not sexual acts.

He said his client was a good worker and had even been promoted after his supervisors found the pictures. Initially he was suspended while police investigated the case, but was promoted after he returned to work. He lost his job, however, when he was convicted of the charges.

He added that the city had never actually disseminated a policy regarding internet usage to tell workers what was inappropriate.

They had crafted one but they hadn't published it, he said. So there was in effect no policy and no protections on the computer no password protection or filtering of any kind so basically anybody could access anything on the internet through the city's computer.

Photo showing a random computer: chunter01/Flickr

The essence of the dispute is that Power Ventures, instead of developing its interface through the Facebook Connect developer program, created a Facebook user account and accessed Facebook content through that account. Facebook alleged that the creation and use of that account was in violation of the Facebook Terms of Use. Facebook Complaint 24, 41. The complaint also alleges that Power Ventures used the interface that it created to induce Facebook users to share their usernames and passwords, and then utilized that information to access Facebook servers via its interface in a manner that violated the Facebook ToU.

The complaint alleges that the ToU prohibits a variety of activities, including, among other things, solicitation of passwords or personally identifying information for commercial or unlawful purposes; using or attempting to use the account of another user or creating a false identity; using automated scripts; impersonating another person or entity; sending junk mail or spam; harvesting e-mail addresses; registering for more than one account; and using Facebook's website for commercial use without the express permission of Facebook. The ToU also provides that the limited license granted to access and use the site terminates when the site is used other than as specifically authorized herein.

The copyright claim alleges that in violation of the ToU, Power Ventures used its account to access and copy the Facebook Web site, including the Facebook home page for which Facebook has obtained a copyright registration. Complaint 31, 70. Judge Fogel concluded that the allegations of the complaint made out a sufficient claim of copyright infringement because Power Ventures need only access and copy one page to commit copyright infringement. The court also found that the ToU prohibited downloading, scraping or distributing content from the Facebook Web site content except that belonging to the user, and that in any event, using automated methods, i.e., data mining, robots, scraping, or similar data gathering or extraction methods to access any content were also prohibited by the ToU. Thus, the court found that the allegation that Power Ventures accessed Facebook via automated means constituted made out a claim of direct copyright infringement, while the allegation that Facebook users utilized the Power.com interface to access their own profile pages made out claim of secondary copyright infringement.

Judge Fogel also declined to dismiss Facebook's claim that the use of automated scripts to access Facebook copyrighted content bypassed specific technical measures designed to block such access and thus violated the DMCA. The trademark infringement claims were sustained based upon the inclusion in the complaint of a screenshot illustrating the use of the Facebook mark on an e-mail sent by Power Ventures to Facebook users. The court did order Facebook to file a short statement clarifying the basis for its California unfair competition claim.

The complaint also alleges a federal CAN-SPAM claim stemming from the transmission of e-mails to other Facebook users encouraging them to use the Power.com interface. According to the opinion, Power Ventures abandoned its challenge to the sufficiency of the CAN-SPAM claim, as well as its challenge to the sufficiency of the complaint under the CFAA. The CFAA claim also is grounded on the allegation that Power Ventures's access to Facebook's computers was unauthorized because it was in violation of the Facebook ToU.

The court's refusal to dismiss Facebook's claims demonstrates that careful drafting of a Web site terms of use is essential to obtaining legal redress for unauthorized access, particularly unauthorized access by competitors and others for commercial purposes. Access that violates the clear proscriptions of a ToU can form the basis for a multiplicity of legal claims, thereby maximizing the chances of a successful challenge to unwanted access.

The Scranton Times, LP v. Wilkes-Barre Publishing Co., 3:08-cv-02135-ARC (M.D. Pa. March 6, 2009)

Oh man, how bad is it in the newspaper business? Rather than investing in building new and sustainable business models and relationships with their subscribers, newspapers are like dinosaurs trying to eat each other while the temperature rises. However, instead of eating each other, the dinosaurs are suing each other, squandering their valuable capital on low-merit newspaper v. newspaper lawsuits, such as the GateHouse v. NYT lawsuit over the republication of headlines.

Today's lawsuit is even more scoffable. The Scranton Times is suing the Wilkes-Barre newspaper for republishing obituary notices in its Scranton edition that were initially published in the Scranton Times. But the Scranton Times has a problem--funeral homes typically write and submit the obituary notices, so the Scranton Times has no copyright interest in the notices. Undeterred, the Scranton Times sued the Wilkes-Barre paper for a bunch of junky unfair competition-style claims in Pennsylvania state court.

This ruling deals with the Wilkes-Barre defendant trying to remove the case to federal court by showing that there is a federal question of whether the junky claims are preempted by federal copyright law.

The most interesting discussion relates to the hot news misappropriation doctrine. I just discussed the doctrine last month in the AP v. All Headlines News case, where the SDNY said that the AP's hot news claim against an online aggregator/syndicator survived a motion to dismiss. I've seen some breathy law firm announcements that this ruling revitalized the hot news doctrine, but not so fast, guys. Here, the court says that the obituary notices fail to qualify as hot news, and therefore the misappropriation claim is preempted by copyright law.

In particular, the court says that obituary notices can qualify as time-sensitive information, such as timing of memorial services. Further, even though the newspaper doesn't write the obituary notices, the court says that the newspaper bore all of the costs of collecting and distributing the notices, and the rival paper free-rode on those investments. However, the court said that the Scranton Times had failed to show that the free-riding would threaten the Scranton Times' publication of obituary notices. Thus, the hot news claim failed.

The court looks at the copyright preemption of other junky unfair competition claims, holding that the unfair competition claim was really a reverse passing off claim, which was preempted, as was the tortious interference and unjust enrichment claims. Oddly, the court said that the conversion claim wasn't preempted by copyright law, even though the only "converted" assets would be copyrighted intangible material (the obituary notices).

So a few of the junky claims survive the copyright preemption analysis, but there isn't much hope for this lawsuit. Then again, unless the Scranton Times realizes that fighting a rear-guard action against its competition does nothing to improve its future business prospects in a market disintegrating around it, there isn't much hope for the paper either.

HT: Tom O'Toole

The Los Angeles authorities said John Schiefer, 27, was the nation's first defendant to plead guilty to wiretapping charges (.pdf) in connection to using botnets.

Schiefer, who went by the online handle "acidstorm," faced as many as 60 years in prison and acknowledged using a botnet to remotely control computers across the United States. Once in control of the computers, the authorities said, (.pdf) his spybot malware allowed him to intercept computer communications. He mined usernames and passwords on accounts such as PayPal and made purchases totaling thousands of dollars without consent.

The authorities said he worked by day as an information security consultant with 3G Communications. After his guilty plea, Schiefer was hired at Mahalo, the so-called "human powered search engine." Its founder, Jason Calacanis wrote that the company failed to realize that the Los Angeles company had hired a man who had pleaded guilty to being a hacker.

Calacanis point out that Mahalo users' data was not breached by Schiefer.

Note to Mahalo Users: John's work is well-supervised. Mahalo follows strict security policies and we don't store any sensitive data anyway. (Even if one of our employees did go off the deep end, the most they would have access to would be your questions and answers on Mahalo Answersnot much damage can be done there since they're all public anyway).

The defendant was among eight individuals indicted or successfully prosecuted in a crack down on black hat hackers who use armies of zombie computers to commit financial fraud, attack web sites with floods of traffic and send spam. The crimes at issue involved more than $20 million in losses, according to the FBI.

The FBI dubbed the eight cases "Operation Bot Roast II" -- the second round of its investigations against botnets, one of the most dangerous threats online today. The first FBI crackdown on botnets was announced in June, 2007.

See Also:

• Weak Password Brings 'Happiness' to Twitter Hacker
• Miley Cyrus Hacker Raided by FBI
• Pop Superstar Sting Supports Pentagon Hacker, Condemns U.S. ...
• Palin E-Mail Hacker Says It Was Easy
• Israeli Hacker Says He Contemplated Suicide
• Miley Cyrus Hacker Used Celebrity MySpace Accounts for Spamming ...
• Guilty Plea: Blind Hacker Admits Harassment, Eavesdropping, Fraud ...
• Hardware Hacker Charged With Selling Cable Modems That Get Free ...
• Security Report: Most PCs Run Outdated, Hacker-Friendly Software ...
• Hacker Reportedly Kidnaps and Tortures Informant, Posts Picture as ...
• Valve Tried to Trick Half Life 2 Hacker Into Fake Job Interview ...
• Hacker Launches Botnet Attack via P2P Software

Sen. Joe Lieberman (I-Connecticut), who helms the Senate's government affairs committee, is annoyed enough that he bypassed the administrators of the system and sent a letter Friday straight to the Judicial Conference of the United States.

He's asking Judge Lee H. Rosenthal to explain why in the age of Google the Public Access to Court Electronic Records, or PACER, system isn't free for citizens. He'd also like to know why federal courts still aren't blacking out sensitive information in court documents as required in the 2002 E-Government Act (a piece of legislation dear to Lieberman).

He writes:

Seven years after the passage of the E-Government Act, it appears that little has been done to make these records freely available with PACER charging a higher rate than 2002. Furthermore, the funds generated by these fees are still well higher than the cost of dissemination ...

If the complaints sound familiar, perhaps you know of public.resource.org's Carl Malamud who's been running a virtual one-man campaign against the clunky and costly PACER system. It's just part of his campaign to "open-source the nation's operating system."

He's also been vigilantly searching through court documents and using automated tools and has found that some judicial districts routinely fail to redact information that would be very handy for identity thieves to have. He's also found just plainly embarrassing and invasive information like medical records of patients not even involved in litigation.

Malamud is running a campaign to become the nation's public printer, and from the looks of this letter, he's already got one senator's attention.

See Also:

• Online Rebel Publishes Millions of Dollars in U.S. Court Records ...
• Rogue Archivist Campaigns to Be Obama's Printer
• Contrarian Libertarian
• Death to Sleepy Stock Data

John McCain says he was a puppet for the Republican National Committee and therefore should not be held accountable for a presidential campaign commercial that used the popular song "Running on Empty" by Jackson Browne without permission.

But the Los Angeles federal judge presiding over the copyright-infringement case was not buying it. The judge refused late Friday to remove the Arizona senator from the lawsuit in which he and the Republican National Committee are accused of violating the rights to Browne's 1977 hit.

Here's what McCain told the judge (.pdf)handling the case:

I was not involved at all in any way in the writing, creation, production, distribution or dissemination of the video, nor do I have any knowledge whatsoever of how this video was written, created, produced or disseminated or who was involved in any aspect of the writing, creation, production, distribution or dissemination of the video. I was completely unaware that this video even existed until I was informed of it after this lawsuit was filed.

Despite McCain's claims of being a hapless dupe for his party, U.S. District Judge R. Gary Klausner said (.pdf) the RNC and McCain's relationship were so intertwined what the judge called an "agency relationship" that McCain stays in the case. The judge wrote that, even if McCain's statement were true, "once an agency relationship is established, the principal is liable for the acts of her agent, even if the principal does not expressly authorize or instruct her agent to take any action."

The judge also did not agree with the Republicans and McCain that Browne's lawsuit was bogus. Among other things, the judge kept the lawsuit alive to give the defendants a chance to demonstrate how using about 20 seconds of the song in the commercial was a fair use.

The August commercial was broadcast on YouTube and cable television. It played Browne's music in a McCain commercial criticizing Barack Obama's energy policy. The song was purchased on iTunes.

Browne claims that the commercial falsely suggested he endorsed McCain and the Republican Party. "Nothing could be further from the truth," Browne said.

The judge scheduled an April 20 hearing to determine how to proceed with Browne's lawsuit. The ad initially ran in Ohio, but the Ohio Republican Party was removed from the case.

See Also:

• Stifled by Copyright, McCain Asks YouTube to Consider Fair Use ...
• McCain Campaign Yanks 'Obama Love' Web Video
• YouTube to McCain: You Made Your DMCA Bed, Lie in It
• McCain Uses Walter Reed Middle School, Not Army Hospital, as ...
• McCain's Disputed Fox Debate Clip a Viral Hit Online
• Meet the Latest Copyright Scofflaw -- Meet the GOP
• Parody of News Team Deliberations Over Alleged McCain Outburst ...
• John McCain Campaign Takes a +3 Vorpal Blade to Dungeons & Dragons ...

Bridal Expo produces the Bridal Extravaganza Show in Houston, one of the largest bridal shows in the US. Hundreds of exhibitors and thousands of prospective brides attend; the show has been in business for 25 years and keeps databases of attendees and potential clients. Defendant Wedding Showcase scheduled the Houston Wedding Showcase for Feb. 2009, a few weeks after the Bridal Extravaganza at the same location. The individual defendants van Florestein and Moore, were key to creating the Wedding Showcase and are former Bridal Expo employeesshow manager and assistant. They left Bridal Expo in July 2008, but not before Moore downloaded Bridal Expo's databases and other information.

Defendants used Bridal Expo's database to mail ads to vendors for Wedding Showcase's November 2008 seminar. They used Google to advertise the Wedding Showcase as Houston's #1 Bridal Show, and mailed a brochure to vendors using quotations attributed to our vendors and our brides that actually came from other bridal shows on the East Coast, produced by another company.

In an earlier state court suit, Bridal Expo brought claims for trade secret misappropriation, unfair competition, and related torts. The judge denied a TRO and after a hearing also denied a temporary injunction. Bridal Expo nonsuited the state case and sued in federal court, using the same claims along with a Lanham Act false advertising claim and a Computer Fraud and Abuse Act claim.

On the state claims, the district court refused to disturb the state court's ruling on the temporary injunction. All the elements of collateral estoppel were present, though this of course only affected the availability of temporary relief, not a final adjudication on the merits. Given that only a month had passed since the state court denial, and that plaintiffs had held a successful bridal show in the interim (thus suggesting lack of harm), the court found no reason to revisit the state court's decision.

On the false advertising claim, plaintiffs argued that Houston's #1 Bridal Show was literally false, since Bridal Extravaganza is, in fact, the largest bridal show in Houston by any number of measures, and that the statement wasn't puffery because it was unambiguous and needed no additional context to give it meaning. Also, they argued that the brochures were literally false because defendants have yet to produce a bridal show in Houston.

Defendants called the Google ads puffery, and argued that the use of our in the brochures referred to the principals of Wedding Showcase, who have produced many shows. Moreover, the brochures mentioned several times that the Houston Wedding Showcase is a new show.

The court held, based on Pizza Hut, that the Google ads were too ambiguous to be actionable, and were the kind of bald assertion or general statement of superiority on which no reasonable consumer would rely. See also In re Century 21-RE/MAX Real Estate Advertising Claims Litigation, 882 F .Supp. 915, 923 (C.D.Cal.1994) (holding that # 1 was too vague to be actionable and declared ... # 1 in the United States and the World" was puffery, because it was opinion and made no reference to what was #1). Anyway, defendants stopped running the ad.

As for the brochure, plaintiffs argued that the our statements were literally false, and also that the brochure made literally false claims that van Florestein and another defenant had a combined 25 years of experience. Moreover, they argued that, by scheduling their show shortly after Bridal Extravaganza at the same location, defendants were trying to confuse customers into thinking their show was the Bridal Extravaganza.

On this record, the court found no literal falsity. Our could readily, in context, refer to the show's owners, one of whom ran the shows on the East Coast from which the our statements came. The brochure explained that the Houston Wedding Showcase would be a new show with a long history. Likewise, more than 25 years of combined experience could refer to the sum of the two principals' individual experience, not 25 years each. The court concluded that it was unlikely that a sophisticated vendor audience, familiar with the Houston wedding market, would be misled into thinking that the quoted brides and vendors were from Houston.

The evidence of confusion between the shows was that one of plaintiff's employees heard from one vendor at the Bridal Extravaganza that he was confused about who was running the Wedding Showcase, but there was no evidence of any connection to the brochure, and this was insufficient to claim confusion overall, though this might be an issue for a jury.

The CFAA claim was based on 18 U.S.C. 1030(a)(4), creating liability for a person who knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value . For a civil claim, there are extra requirements; here, the key was loss to 1 or more persons during any 1-year period ... aggregating at least $5,000 in value. Loss includes costs of responding to an offense and conducting a damage assessment. Here, the claimed loss was the confidential trade secrets.

Defendants argued that their access wasn't without authorization and didn't exceed their authorization. Van Florestein and Moore accessed their work computers and took files to which they were allowed access as employees. They argued that there's a difference between access to computers and use or disclosure of information obtained through that access.

There's a split over the meaning of authorization. Some courts say that using files to harm the employer violates the CFAA even if the employee technically has authorization to access the files in the scope of her duties. Contrary to that, other courts have noted that, when Congress wanted to prohibit things like communication and delivery, it listed them. If Congress wanted to reach all wrongdoers who access information they then use to the detriment of their employers, it could have omitted the statute's words of limitation altogether. Despite the conclusions of other courts, the district court determined that, given those statutory construction arguments and the rule of lenity (since the CFAA is also a criminal statute), authorization is not exceeded just because the employee breaches her duty of loyalty to an employer.

Here, the files were copied/downloaded on the defendants' last day of employment. They hadn't signed a confidentiality agreement or any other agreement restricting access to the files they'd been working on at Bridal Expo. It was within the nature of their relationship to use their computers and access the files at issue. Indeed, a key Bridal Expo employee saw them using the computer on their final day and didn't complain, even though it was after they'd turned in their keys.

Thus, the court found plaintiffs were unlikely to succeed on the merits. Moreover, even had there been a likelihood of success, a preliminary injunction would have been unwarranted, based on the Fifth Circuit's hesitance to grant injunctive relief against the use of information obtained through a past violation of the CFAA, where there was no potential for ongoing access.

The court stated, somewhat confusingly, that it would be willing to revisit the issue if defendants were continuing to use the vendor email list to advertiseeven if there's no likelihood of success on the merits? And then the court said that even if it had found likely success on the merits, it wouldn't have entered an injunction, because plaintiffs hadn't shown irreparable harmthat successful show they'd conducted since defendants entered the marketand defendants would suffer great harm if they couldn't produce their show: they'd have to cancel contracts, unwind arrangements on short notice, and pay cancellation fees. About that email list: It's unusual in a written opinion for a court to signal so overtly that, though it thinks there's no legal basis for some behavior, it nonetheless expects a party to engage in that behavior, but that seems to be what happened here.