Social Media Law: Video Presentation for Social Media Breakfast

The full video of my recent presentation on social media law is now available!

On August 30, 2012, I made a presentation to Social Media Breakfast Dallas titled Social Media Law: It is Real and, Yes, It Can Impact Your Business. The presentation was about social media law and how it relates to businesses using social media. The presentation was professionally videoed by Jason (@jcroftmagic) and the great people at Magic Production Group (@magicprogroup) and they did a fantastic job on the production! The full video presentation is embedded on both Vimeo and YouTube below and you can also access it by clicking on the links for Vimeo and YouTube. As always, please feel free to contact me if you would like to discuss these issues any further! Shawn Tuma: @shawnetuma / stuma@brittontuma.com / 214.726.2808.

<p><a href=”http://vimeo.com/49071894″>Shawn Tuma – Social Media Law</a> from <a href=”http://vimeo.com/magicvideoinc”>Magic Production Group</a> on <a href=”http://vimeo.com”>Vimeo</a&gt;.</p>

Video Preview for Social Media Law: It Is Real and Yes, Can Really Impact Your Business

I will be speaking at Social Media Breakfast Dallas next Thursday, August 30, 2012 from 7:15 am to 9:00 am. My presentation is about social media law and how it relates to businesses using social media. Social Media Breakfast Dallas is an awesome event that takes place on the last Thursday of each month. While it is FREE to attend, you must register because seating is limited and these events usually fill up quickly — so click HERE to register now!

Take a minute and check out Social Media Breakfast Dallas on LinkedIn, Facebook, and Twitter (@SMBdallas and #smbdallas) where you can learn more about the past meetings and help spread the word for this wonderful organization as well as this and other events.

Below is a video preview that was produced by Jason (@jcroftmagic) and the great people at Magic Production Group (@magicprogroup) so please check them out as well — they did a fantastic job and were a pleasure to work with on shooting the promo video. They are also videoing the presentation on the 30th. Thank you for all of your help Jason and Matt! (by the way, check out the pic below and see who else was helping with shooting this video — thanks for taking that Jason!)

I look forward to seeing everyone on the 30th but don’t forget to Register HERE - DO IT NOW!

<p><a href=”http://vimeo.com/47959394″>Social Media Breakfast Dallas – Promo for August 30 meeting</a> from <a href=”http://vimeo.com/magicvideoinc”>Magic Production Group</a> on <a href=”http://vimeo.com”>Vimeo</a&gt;.</p>

Discussion of Problems with Proposed Cybercrime Legislation

There are many proposals floating around Capitol Hill that will purport to beef up our nation’s current cybercrime laws, first and foremost the Computer Fraud and Abuse Act. I have recently read two very good articles that do a nice job of explaining many of the inadequacies of the proposed legislation and is well worth the read:

Obama Cybersecurity Proposal: Flawed, But Fixable

Obama’s Cybercrime Crackdown Already Outdated, Experts Say | Government & Legislation | Law & Justice | SecurityNewsDaily.

As for me, the first thing I want Congress to do is make it clear what is really an improper access under the Computer Fraud and Abuse Act and tell us to whom it is really intended to apply (yeah, I know, different Congress = different intent … but hey, if I’m a wishin’ I’m a gonna wish good!).

Beyond that pipe-dream, I am wondering if the most effective thing Congress could do isn’t to simply amend the Computer Fraud and Abuse Act to provide that (1) a “loss” required for a civil claim includes having one’s personally identifiable private information compromised, and (2) the person who’s information was compromised has a civil claim against both the hacker of the information and the person or entity from which the information was hacked.

Make this happen and some very enterprising plaintiff’s lawyers will take care of the rest.

As I asked in my post last week: Who’s Gonna Get It? Mark my words, at some point, somebody will. My hunch is that if Congress made these couple of amendments we’d find out the answer to that question a whole lot easier and quicker!

3 Recent Computer Fraud and Abuse Act Cases Worth Noting

Three recent Computer Fraud and Abuse Act cases decided over the last couple of months are worth looking at because they show the following points, respectively: (1) the CFAA in its current form does not give consumers an adequate remedy for privacy related data breach issues; (2) the CFAA’s focus on “access” is more akin to trespassing on a computer system than using a computer to commit a traditional “fraud”; and (3) the way a judge “walks through” the evidence vis-a-vis the elements of a basic civil claim under the Computer Fraud and Abuse Act.

Why the Computer Fraud and Abuse Act in its current form does not give consumers an adequate remedy to address privacy related data breach issues?

This is demonstrated by La Court v. Specific Media, Inc., 2011 WL 2473399 (C.D. Cal. Apr. 28, 2011) in which the court granted the defendant’s Motion to Dismiss because the plaintiffs in a class-action case, even in the aggregate, could not demonstrate the requisite $5000 “loss” required to maintain a civil claim for violation of the CFAA where the only “loss” they sustained was the value of personal data.

The case arose from the alleged use of Adobe Flash cookies that tracked the plaintiffs’ use of the Internet without their knowledge or consent. The plaintiffs brought a claim for violating the CFAA, among other things, alleging “that they sought to maintain the secrecy and confidentiality of the information obtained by Defendant through use of the” flash cookies and that their personal information has discernible value of which they were deprived but defendants use of it for their own economic benefit. The court dismissed the CFAA claim finding that the plaintiffs personal information, in essence, had no value– or at least not enough value to collectively meet the $5000 threshold.

You will recall that I blogged about this impediment when Apple was sued in the iTracking cases. If not, take a look at these posts where I delve a little deeper into this “loss” issue:

Apple iTracking Case: will Apple be WINNING on Computer Fraud and Abuse Act claim?

Apple Should Win the Computer Fraud and Abuse Act Claims …

iTracking II: Apple Sued Again for Violating Computer Fraud and Abuse Act

From what I can tell, nothing has changed.

Now, there is talk around the “data privacy” neighborhood that things could be changing a bit and courts may be starting to ascribe some value to people’s own personal data but I’ve not yet seen anything that has confirmed this is going to happen.

First, apparently two cases related to the La Court case involving Adobe Flash cookies have been settled for a $2.4 million settlement. The cases are Valdez v. Quantcast Corp. and White v. Clearspring Technologies and the article I read indicating the settlement value can be found HERE. I do not know the details of the settlement but, if any of you happen to know, I would be interested in learning more about it.

Second, just yesterday I read an article by Andrew Clearwater on the International Association of Privacy Professionals newsletter entitled New theory of harm in data breach cases that argued that people have a property right in personal information. I found this argument to be persuasive and, according to Clearwater, it is currently being tested in the case Alan Claridge v. RockYou Inc. (2011 WL 1361588 (N.D. Cal. Apr. 11, 2011) where the court has allowed the case to proceed a partially denying the defendant’s motion to dismiss. As Clearwater says, it will be interesting to see how this develops.

If it is treated like a trespass, why is the Computer Fraud and Abuse Act not called the Computer Trespass and Abuse Act?

Now that is a good question, and one that I do not know the answer to! I do suspect, however, that it was probably an easier “sell” to use the word fraud instead of trespass so I will leave it at that. In Xcedex, Inc. v. Vmware, Inc., 2011 WL 2600688 (D. Mass. June 8, 2011), however, the court stated “[t]he conduct prohibited by the CFAA is ‘analogous to that of “breaking and entering” rather than using a computer … in committing the offense.’” This is an important principle to remember about the CFAA and, I believe, helpful to understanding the various arguments circulating around about what is and “access” under the CFAA.

What kind of evidence does a judge look for when analyzing a civil claim under the Computer Fraud and Abuse Act?

The cynics among us will probably look at this next case and say, “he sure was struggling to find a comment-worthy point in this case” and they just may be right. But let me tell you why I wanted to bring this case to your attention.

Not too long ago I was drafting a motion for summary judgment for a plaintiff on a CFAA claim. As we all know, a movant on summary judgment has a better chance of winning when they can present a clear and concise argument that is supported by clear and concise evidence — with brevity being of paramount importance! One of the questions I asked myself during the drafting process was “what evidence should I use that will be most persuasive to the court and give me the maximum bang for the buck?” Within a couple of weeks of that, I read the opinion in Barnstormers, Inc. v. Wing Walkers, LLC, 2011 WL 1671641 (W.D. Tex. May 3, 2011). I found nothing earth shattering about the CFAA issues presented in this default judgment but did appreciate the way the court walked through the elements and discussed the evidence supporting each element that it found persuasive enough to include in its opinion. To me, that was enough to make it worth mentioning.