Tag: CFAA

Nasty Flood of Phone Calls and E-Mails Gives Rise to Computer Fraud Damage Claim – 6th Cir.

In Pulte Homes International Union of North America, 648 F.3d 295 (6th Cir. 2011), the Sixth Circuit addressed the Computer Fraud and Abuse Act (CFAA) in a case where a national labor union launched a barrage of  harassing telephone calls and e-mails against a Michigan home builder that fired a union member.

The plaintiff home sued the union under the CFAA after orchestrated a nation-wide torrent of phone calls and e-mails to plaintiff and its key executives.  The volume of calls – many coming via an auto-dialer – and e-mails basically overburdened and shut down plaintiff’s phone system and computer server.

The 6th Circuit reversed the District Court’s 12(b)(6) dismissal of plaintiff’s CFAA “transmission” claim and reinstated it.  

The “Transmission” Claims 

A CFAA transmission claim requires a plaintiff to show a defendant’s knowing and unauthorized transmission of a program, code, or command that intentionally causes damage to a protected computer.  18 U.S.C. § 1030(a).  

An example of a transmission claim is a hacker or rogue employee who infects a computer system with a virus.  The Pulte Court held that plaintiff’s phone and email systems were “protected computers” under the CFAA and the defendants’ thousands of e-mail and phone blasts constituted “transmissions.”

Under the CFAA, any device that’s not a typewriter or calculator will qualify for protected computer status.

CFAA damage denotes “any impairment to the integrity or availability of data, a program, a system or information.”  18 U.S.C. §1030(e)(8).  The Court noted that the Oxford English Dictionary defined “impairment” as a “deterioration” or “injurious lessening or weakening.” 

The Court held that the Union’s alleged conduct fit squarely into this damage definition.  The Court noted that the volume of calls and e-mails sent by the union prevented plaintiff’s customers from contacting it and so overwhelmed plaintiff’s computer system that it severely stunted plaintiff’s normal business operations. 

On the CFAA intent element, the Court cited plaintiff’s wide-ranging allegations that the union’s conscious objective was to overwhelm and damage plaintiff’s business systems.  The cumulative effect of the allegations against the Union signalled the Union’s intentional conduct.  Since the plaintiff’s allegations demonstrated damage to its computer systems and the Union’s intent, the Court held that the plaintiff successfully pled a CFAA transmission claim.  Id.

The “Access” Claim

A CFAA access claim requires a plaintiff to allege a defendant “intentionally accessed a protected computer without authorization”. 18 U.S.C. § 1030(a)(5)(B), (C).  

Here, the plaintiff failed to demonstrate the Union accessed plaintiff’s phone and computer systems without authorization  under the CFAA since plaintiff allowed all members of the public to call its offices, visit its company web page, and send e-mails to it. 

Take-aways: Pulte provides a good summary of CFAA transmission and access claims and gives content to the CFAA’s damage requirement.  The case also shows how difficult it can be for an employer who has a freely available website, e-mail and phone system (basically, every single company in the U.S.), to meet the without authorization prong of a CFAA access claim. 

Does the Computer Fraud Act Apply to ‘Dumbphones’?

While this Court does not disagree that unwanted text messages, like spam e-mail, are an annoyance, whether receipts of such messages can establish a civil action under the CFAA is, of course, a different question.

Czech v. Wall Street on Demand, Inc. 674 F.Supp. 1102, 1106 (N.D.Minn. 2009).

Anti-spam (e-mail and text) lawsuits and legislation are legion: a flurry of Federal and state laws govern junk e-mails and texts.  This post briefly discusses one case which examined whether sending unwanted texts can subject the texter to Federal Computer Fraud liability. 

In Czech v. Wall Street on Demand, 674 F.Supp. 1102 (N.D. Minn. 2009) a Minnesota plaintiff (representing a proposed class of spam texts recipients) was so fed up with unwanted texts that she literally made a Federal case out of it.  She sued in Minn. District Court under the Computer Fraud and Abuse Act, 18 U.S.C. s. 1030 et seq. (CFAA) after receiving unsolicited texts from an online trading company that mass-texted financial information to phone numbers in its database.  The Court granted the defendant’s 12(b)(6) motion to dismiss the Complaint. 

The basis for the court’s dismissal was that the plaintiff – who owned a cellphone which only made and received calls and texts (colloquially, a “dumbphone”)  – was unable to show (1) that defendant obtained information from plaintiff’s phone; or (2) that defendants intentionally tried to damage plaintiff’s phone; or (3) any statutory “damage” or “loss” due to the unwanted texts.  Id.  As noted in an earlier post, damage and loss are terms of art under the CFAA: damage denotes physical damage to a computer or data; while loss refers to the monetary expense incurred in ameliorating a CFAA violation.  See http://paulporvaznik.com/eagle-i-hijacking-a-linkedin-account-and-the-computer-fraud-act/803 (discussion of CFAA damage and loss under 18 U.S.C. s. 1030(e)).

While the Czech Court ultimately dismissed the plaintiff’s CFAA claims, it also applied the CFAA’s expansive definition of “computer” by acknowledging that the plaintiff’s no-frills cell phone qualified as a “computer” under the CFAA.  674 F.Supp.2d at 1107 (“there is no dispute that [plaintiff’s] cell phone (as well as the various similar wireless devices used by the proposed class members) would constitute…a ‘computer’ as further defined in [the CFAA]).  The CFAA defines a computer as any high-speed data processing device performing logical, arithmetic and storage functions – but that is not a calculator or typewriter.  18 U.S.C. s. 1030(e)(1).  The 8th Circuit Court of Appeals also held that a cell phone that only made calls and texts qualified as a protected computer under the CFAA in a criminal case setting in  U.S. v. Kramer, 631 F.3d 900 (8th Cir. 2011)(defendant used cell phone to entice minor across state lines to engage in criminal sexual conduct).

Declining to extend the Act to unwanted texts, the Czech Court stated succinctly that unwanted texts may be annoying, but they do not give rise to CFAA civil liability: “An annoyance? Quite possibly.  The basis for a civil action under [the CFAA]?  The Court thinks not.”  674 F.Supp.2d at 1105.

Take-away: Czech provides a very detailed analysis of CFAA information (defendant obtained information from a protected computer) transmission (defendant transmitted a virus or worm that damaged plaintiff’s computer), and access (defendant accessed plaintiff’s computer and caused damage or loss to plaintiff)claims.  All three of these claims are predicate acts under CFA sections 1030(a)(2)(C), (a)(5)(A) and (a)(5)(C).  The Court describes the elements and the damage and loss requirements for each of the three claims.  The Court also engages in an intricate and interesting (at least I think so) discussion of the difference between obtaining information from a plaintiff’s website as opposed to a plaintiff’s cell number.  But for this post’s purposes, the case is representative of the CFAA’s expansive definition of a “protected computer” and shows that virtually any mechanical device, wired or not, will qualify for coverage under the statute.

How to Enforce Settlement Agreements In Federal Court

I once represented a plaintiff in a Federal question case (based on the Computer Fraud and Abuse Act) that settled with the defendant making installment payments over time.  In the settlement agreement, I took great pains to emphasize that if the defendant missed a payment, I could immediately move to reinstate the case and accelerate the settlement amount plus fees and costs.  For good measure, I provided that the court retains jurisdiction to enforce the settlement terms if the defendant defaulted.  I thought I was doubly protected.  Defendant’s counsel signed off on all the terms.

We then entered a stipulation to dismiss.  The court dismissed the suit with prejudice.  I remember feeling vaguely uneasy about the “with prejudice” language but quickly reminded myself that (a) dismissals with prejudice AND with the court retaining jurisdiction (seemingly an oxymoron) are entered all the time in State court and (b) the defendant’s counsel requested the with prejudice language as an inducement for getting his client to agree.  After a ton of time and money on this case, both sides were anxious to put this one to bed.

Fast forward about 4 months into an 18-month payment arrangement and the defendant defaulted and my demand letter for compliance went unanswered.  I quickly filed a motion to vacate the dismissal, to reinstate and enter judgment for the full settlement amount – just as the settlement agreement allowed me to.  Imagine my shock when the court denied my motion?!  Apparently, the “with prejudice” language has teeth.

I then filed a motion to vacate the dismissal under FRCP 60 – the rule that governs motions to vacate judgments on the basis of mistake, fraud, inadvertence or other reasons “that justify relief.”  The Court denied this motion too. My only remedy was to now file a breach of contract action in State Court for breach of the settlement agreement (the contract).  While we were able to recover some additional payments from the defendant after we filed in state court (before the defendant filed for bankruptcy protection), I had to consider the question of what I could have done differently?

Key Settlement Enforceability Rules

Federal courts don’t like to babysit settlement agreements (who knew?!).  Seventh Circuit caselaw provides that when a case is dismissed pursuant to a stipulation to dismiss, the court does not automatically acquire jurisdiction over disputes arising out of an agreement that produces the stipulation.  Kokkonen v. Guardian Life Ins. Co. v. Am., 511 U.S. 375, 378 (1994); McCall-Bey v. Franzen, 777 F.2d 1178, 1188 (7th Cir. 1985)(rejecting suggestion that federal judges have inherent power to enforce settlement agreements arising from lawsuits that were previously before them). 

An important rule in the 7th Circuit is that “[a] settlement agreement, unless it is embodied in a consent decree or some other judicial order or unless jurisdiction to enforce the agreement is retained (meaning that the suit has not been dismissed with prejudice), is enforced just like any other contract.”  Lynch, Inc. v. SamataMason, Inc., 279 F.3d 487, 489 (7th Cir. 2002). 

The 7th Circuit holds that a district judge can’t dismiss a suit with prejudice and at the same time retain jurisdiction to enforce the settlement agreement: it’s a contradiction in terms.  A signed stipulation of dismissal does not vest the Court with jurisdiction over an ancillary contract dispute just because the parties included retention of jurisdiction language in the stipulation.   Parties cannot confer federal jurisdiction by agreement.  Lynch, 279 F.3d at 489. 

What About FRCP 60?

I was also surprised that my Rule 60 motion to vacate motion was denied.  But, it turns out the standard for Rule 60 relief is high.  Like life-and-death high.  In Nelson v. Napolitano, 657 F.3d 586, 589 (7th Cir. 2011), the Court held that there may be “some instances” where a Federal court will vacate a voluntary dismissal on plaintiff’s motion, but it would have to be on the order of “a defendant faking his own death with a fraudulent death certificate in order to induce a plaintiff to voluntarily dismiss.”

The take-away:

In dismissing an action in Federal Court (at least in the 7th Circuit), it’s a bad idea to put “with prejudice” language in a dismissal order or stipulation if you want to be able to reopen the case at a later date (such as where a defendant misses an installment payment). 

Even better, try to put the settlement payment terms in the dismissal order.  This will increase your chances of getting the court to enforce a settlement if the defendant defaults. 

If you can’t reinstate a case because of prior “with prejudice” language, then file a new suit for breach of contract (for breach of settlement agreement) in state court.