I think it would be difficult for Disney to show that this tweet would be sufficient to bind a user that used the hashtag #Maythe4th. In order to be enforceable, the courts in Meyer v. Uber Technologies, Inc. 868 F.3d 66 (2nd Cir. 2017) gave a two prong test (1) reasonable conspicuous notice and (2) manifestation of assent. These are fact intensive factors. First, Disney would have to show there was reasonable conspicuous notice. The tweet does not have that many interactions (1,057 retweets; 9,678 Quote Tweets; 2,735 likes) so this would like weigh against their argument that a user had notice. Additionally, for specific users, you could look to see if they follow the Disney page.

A manifestation of assent can be difficult to show as well unless the user interacted with the tweet. Just because a user uses the hashtag, doesn’t mean they are assenting to the terms. It could just be because it is a popular saying on May 4th for fans of Star Wars.

Based on this tweet alone, it is unlike you could enforce terms of use and be bound by using #Maythe4th.

The Smurfberry Problem

Stewart Griffin is 8 years old and loves the game Smurfs Village (made by Cap-com) which he plays on his mother Lois’s iPad (made by Apple). He asked his mother if he could buy some Smurfberries so he could expand his village. Thinking that this would be a $2 or $5 in-game purchase like some of the other items she’d bought Stewart in the past, Lois told Stewart her iTunes Store password (“stewie123”). But a wagon of smurfberries (the largest amount one can buy at once) costs $100, and in the next twelve days, Stewart bought $2700 worth of Smurfberries. Then Lois’s credit card bill came, and she took away the iPad and changed her password. It is undisputed that when Lois activated her account she tapped “I agree” to the iTunes Store terms and conditions, which include the statement: You are solely responsible for maintaining the confidentiality and security of your Account, and for all activities that occur on or through your Account, and you agree to immediately notify Apple of any security breach of your Account. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. Lois and Stewart have sued Apple and Capcom, seeking to void the Smurfberry sale. What result?

Lois will likely not succeed against Apple and Capcom because she explicitly agreed to the iTunes Store terms and conditions which included the statement that “You are solely responsible for maintaining the confidentiality and security of your Account.” Lois however, did not do this, but instead gave her password to Stewart. Although she may not have thought she was authorizing Stewart to purchase $2700 worth of Smurfberries, she still did by giving him her password. She also never told Stewart how much he was allowed to spend so she would not be able to argue that he exceeded his authority. Not to mention, who gives an 8 year old the ability to purchase anything on their own? Lois accepted the terms and conditions and therefore is bound to those. Additionally included in these terms is that “Apple shall not be responsible for any losses arising out of the unauthorized use of your Account.” Lois also agreed to be bound to this statement.

You are associate general counsel for the FixPoint Corporation, which makes consumer and enterprise networking equipment. You have recently become aware of an issue with your company’s WX11N series of home wireless routers. Once daily, each router connects to a “time server” to reset its internal clock. Each router ships with a list of roughly 100 different time servers. Each time they check what time it is, they pick a random server from the list. The goal is to spread the burden of checking what time it is across a large number of servers, so that none of them bears an excessive burden. Unfortunately, due to a bug in the WX11N’s software, the random-number generator always returns “16” when it picks which time server to consult. That means that the roughly three million WX11Ns in consumers’ homes are all querying the same time server at the University of Helsinki. Worse, due to another bug, they all do it at 2:00AM local time. This leads to a flood of hundreds of thousands of queries to the time server at the University of Helsinki, which has caused it to crash on multiple occasions. The University is threatening to file suit and possibly also to deactivate its time server entirely. Evaluate the legal risk the FixPoint Corporation faces.  You have a meeting scheduled with the engineering team later today. Are there any questions you would want to, either to evaluate the legal risks or to consider possible mitigation strategies?

FixPoint may be liable for Trespass to Chattels. In Intel v. Hamidi, we saw that unwanted electronic communications may constitute a trespass to chattels if the volume and frequency of the communications is sufficient to overly burden the recipients’ email system. Here, we must determine if there was actual harm to the University’s system. It is likely the Courts would find some harms since the University experienced crashes on multiple occasions.

We need to ask the engineering team how soon they can remediate the issue. Can there be a manual override for the query? Can we assign the numbers instead of using a number generator?

National sent a cease-and-desist letter to LineJump stating that National’s terms and conditions prohibited the use of nationalair.com for commercial purposes and that LineJump’s activities breached the Terms. When LineJump’s use did not stop, National filed suit. Its complaint includes claims for breach of contract, trespass to chattels, and violation of the Computer Fraud and Abuse Act. National and Line-Jump have filed cross motions for summary judgment. How should the court rule?

The Court should rule in favor of National for the breach of contract claim and the Computer Fraud and Abuse Act but deny the trespass to chattels claim. The breach of contract claim will likely succeed because the “Terms and Conditions” are hyperlinked on the homepage and the homepage states “use of the National website constitutes acceptance of our Terms and Conditions.” National would argue that this puts users on notice that they are subject to the terms and conditions. these terms include that “third parties may not use the National web sites for the purpose of checking Customers in online or attempting to obtain for them a boarding pass in any certain boarding group.” On the other hand, LineJump could argue that it was not reasonable conspicuous notice because the print was in small black print and at the bottom of the page. However, the Courts will likely find in favor of National.

Next, the CFAA claim will likely find in favor of National because LineJump was circumventing usernames and passwords to gain access to National’s website. They obtained the usernames/passwords of other people, instead of creating their own. In HIQ Labs, Inc. the Courts found that “the wording of the statute, forbidding “access[] … without authorization,” 18 U.S.C. § 1030(a)(2), suggests a baseline in which access is not generally available and so permission is ordinarily required. …Where the default is free access without authorization, in ordinary parlance one would characterize selective denial of access as a ban, not as a lack of “authorization.”” Therefore, “the CFAA’s prohibition on accessing a computer “without authorization” is violated when a person circumvents a computer’s generally applicable rules regarding access permissions, such as username and password requirements, to gain access to a computer. It is likely that when a computer network generally permits public access to its data, a user’s accessing that publicly available data will not constitute access without authorization under the CFAA.”

Lastly, in order to show trespass to chattels, there must be some actual harm which National has not show so the Courts will likely rule in favor of LineJump.

Leaving aside other possible investigative avenues, how should you attempt to turn “eatmyjukt” into an actual name and address? What can you do on your own? What can the FBI do? How likely is this process to succeed? What could go wrong? Your strategy should consider both the technical and legal aspects of the problem. (Hint: The technical part will take more than one step. The legal part is straightforward, if you do things right. Refer back to the Stored Communications Act, supra, as needed.)

Under § 2701 of the Stored Communications Act, whoever “intentionally accesses without authorization… or intentionally exceeds an authorization… obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished.” Here, an unknown actor has gained access, and overwrote a file that contained a prototype design, and replaced it with a pornographic picture. There are exceptions to § 2701 but those would likely not apply here. This is clearly a violation of § 2701.

In order to identify the person responsible, there are a few things that can be done. First, to communicate on the internet, you need at the very least an IP address, which can be used to identify the person responsible. IP addresses are assigned to ISPs in blocks; ISPs generally keep records of which IP addresses they assigned to which subscribers and when. Under § 2703, a governmental entity may require a provider of electronic communication service… to disclose a record or other information pertaining to a subscriber to or customer of such service. However, there are requirements the governmental entity must meet, one of which could be a warrant or in some cases, a court order. This could be an avenue in order for the ISP to disclose information about the IP address associated with the attacker. However, it is possible to forge your IP address when sending messages or can be given to a proxy. We could also check any device communicating on an Ethernet or Wi-Fi network. They would have a unique “media access control” (MAC) address. However, these can also be changed and make it hard to track down. We also need to be careful in case the suspect is underage, especially with the transmission of pornographic images.

You are on the legal staff of SETEC, a non-profit advocacy group whose mission is to “keep the Internet open, free, and safe.” You have just learned about Senator Abbott’s proposal. You are flying to Washington for a meeting with the Senator’s staff tomorrow. Is the bill a good idea? Should you support it, oppose it, or push for modifications? What arguments will you make to the Senator’s staff, and how do you expect them to respond?”

I do not support Senator Abbott’s proposal and will be raising my concerns at my meeting with the Senator’s staff tomorrow in Washington. First, I do not support the proposition that the government will have access to everyone’ s secret keys and can decrypt communications. This opens the doors for abuse by those with the power to do so. Especially since only a court order will be required for law enforcement to gain access. The standard for a court order is usually less than the requirement for a warrant. This raises the question on whether the law would even be constitutional. The Fourth Amendment protects against “unreasonable searches and seizure” and I think there could be an argument that obtaining a key to decrypt all communications just through a court order would be considered unreasonable. The standard for a warrant in the Fourth Amendment is probable cause. At the minimum for this law, that’s what the standard should be in order to decrypt the communications.

As the legal staff of SETEC, our mission is to “keep the internet open, free, and safe.” While the encryption requirement would help keep it safe, it would inhibit the ability to be open and free. All communications instead would have to go through the decryption process making it less efficient.

“The police arrest Bill Maplewood for possession of CSAM. Having read Riley, they plan to obtain a warrant to seize his laptop computer and search it for evidence. The laptop’s hard drive also contains his tax records, his emails, and patient records from his psychiatric practice. Which of these can the police examine? How should they carry out the examination? Can they also look for evidence of tax evasion? How long can they retain the laptop? Which of these limits should be detailed in the warrant itself?”

The Fourth Amendment states: “the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizure, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and that persons or things to be seized.”  (emphasis added). The warrant must specify which particular places are to be searched or which items are to be seized; a search or seizure that goes beyond those limits is invalid. The warrant is likely just to look for CSAM because that is what they have probable cause to issue the warrant for.  Therefore, they would not be allowed to search all files in the computer. Since it is hard to identify which files contain CSAM, they may have to look into the actual content on them. However, once they open the file and identify it’s not CSAM, they can not continue to inspect it to see if there is evidence of tax evasion. They will likely be able to retain the laptop as long as necessary to conduct the investigation.

“2 Fast 2 Warrantless: Dom Toretto was involved in an automobile collision and his badly-damaged car was impounded while he was in the hospital receiving treatment for his injuries. The police suspect that the crash occurred during an illegal high-speed drift-racing competition. They would like to inspect the car’s electronic data recorder, a/k/a “black box,” a small onboard computer which automatically records the car’s speed, engine RPM, steering wheel position, brake status, and other data. Obtaining the data will require inserting a cable into the car’s dashboard and decoding it will require specialized software available only to mechanics certified by the car’s manufacturer. Do the police need a warrant?”

The first question we would want to answer is whether this action would be a search at all? In United States v. Jones a physical invasion is a search. In that case, the police committed a search when they secretly attached a tracking device to the defendant’s car. Here, I would argue that the police are trespassing by inserting a cable into the car’s dashboard and decoding it.  Even if this is not considered a trespass, under Katz, a search can still occur without a trespass when the police violate you reasonable expectation of privacy. Did Dom have a reasonable expectation of privacy in the information on this “black box”? I would argue that he likely does because most people don’t think about someone getting into their dashboard to acquire all this data about the electronic data on the car. Additionally, the cops are using enhanced technology, available only to mechanics certified by the car’s manufacturer. This would likely be similar to Kyllo where the Court held that the use of infrared thermal imaging camera was a search because “The Government use[d] a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion” Although a home is generally given greater protection than a car, I can see where the same principles of enhanced technology would apply here. I would find that there is likely a search here.

The next inquiry would be whether the search would be “reasonable”. The Fourth Amendment prohibits only “unreasonable” searches and seizures. However, a search is automatically reasonable if it is carried out pursuant to a search warrant. There are some exceptions to the rule including, consent being given, plain view rule, and third-party doctrine. In Riley v. California the Court held that an Officer must generally secure a warrant before they are permitted to search digital information on a cell phone incident to an arrest (unless extreme circumstance like a bomb). David Riley was stopped by a police officer for driving with expired registration tags. In the course of the stop, the officer also learned that Riley’s license had been suspended. An officer searched Riley incident to the arrest and found items associated with the “Bloods” street gang. He also seized a cell phone from Riley’s pants pocket. The officer accessed information on the phone and noticed that some words (presumably in text messages or a contacts list) were preceded by the letters “CK”—a label that, he believed, stood for “Crip Killers,” a slang term for members of the Bloods gang. This information was presented at trial to convict Riley. The situation with the “black box” is similar because it also contains electronic data and stores it about the car.

Based on these facts, I would advise that the police obtain a warrant in order to inspect the “black box”.

I think Section 230 bars Mandy Cohen’s suit against Brightside. Section 230 was implemented to provide protections to online platforms for third party content posted. It states “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” Here, Brightside is an interactive computer service.  The one complication is that Federal law makes it a crime to “knowingly provide material support or resources to a foreign terrorist organization.” 18 U.S.C. § 2339B(a)(1). One need not intend to support the organization’s terroristic activities; it is enough to “have knowledge that the organization is a designated terrorist organization” on a list maintained by the Secretary of State. However, the very implication of Section 230 is that they will not be liable

Interestingly, this issue is about to go before the Supreme Court in Gonzalez v. Google. In that case, a family of a deceased victim in an ISIS attack is suing Google due to the way their algorithm recommended ISIS related YouTube videos to the terrorists, which led to them committing the crime.

As a public policy matter, where do you think the line should be drawn with respect to liability for online content? Should Alphabet Inc. (the parent company of Google, YouTube, etc.) be held to a higher standard than, say, the publisher of a newspaper in a small town? Is it appropriate to import standards of liability from tort law that arose in the physical domain—or should we have different standards for online conduct? Higher or lower?

Currently, online platforms such as Alphabet Inc., Meta, and Twitter have very low liability for content posted. Why is this? The primary reason is they hold some statutory immunity, codified in 47 U.S.C. § 230 (“Section 230”). The idea is that the user is responsible for what is posted, not the platform. In Zeran we saw that Congress’ intent with the passage of Section 230 was that tort liability on service providers would limit speech. Interactive computer services such as Alphabet, Inc. and Meta have millions of users. It would be nearly impossible to screen the all posts for problems. Unlike in a local newspaper where the publisher has more control over the content. Platforms of course, use algorithms these days to at least moderate content, using key descriptions to alert posts. Critics however, say that these platforms are moderating content motivated by political reasons.

I think there is an argument that Section 230 is a little too protective over social media sites. Even if a site knows there is a problem or that illegal content is being posted, they still might not be liable. Additionally, the internet reaches far more people than a local newspaper does. However, imposing more liability on these platform would likely lead to them regulating more content to cover themselves.