Hacked casino sues Trustwave over security breach cleanup

A Las Vegas-based casino, Affinity Gaming, hired Chicago-based security firm Trustwave, to investigate a data breach. According to Affinity, Trustwave claimed to have identified the source of the data breach and contained it. Instead, however, further investigation by Mandiant found that Trustwave failed to contain the breach, which continued to occur even while Trustwave was investigating. According to the ZDNet article linked below, Trustwave denied the claims and plans to defend itself in court.

The complaint filed in federal court is available here.

Affinity's claims are:

1) Fraudulent Enducement
2) Fraud
3) Constructive/Equitable Fraud
4) Violations of NRS Chapter 598; Fraud Upon Purchasers; Misrepresentation
5) Gross Negligence
6) Negligent Misrepresentation
7) Breach of Contract
8) Declaratory Judgment under 28 U.S.C. §§ 2201-2202

Here are links to articles from arstechnica, ZDNet, and TheHill.

OMG, Call Yourself A Hacker, Lose Your 4th Amendment Rights!

Update (10/24/13): The Register has now picked up the story and uncritically repeats the same erroneous Fourth Amendment claims.

Update 2 (10/24/13): And just as quickly, the Register contacted me to indicate that the article has been updated to remove the Fourth Amendment references.

Two quick, but equally horrible points about this article:

First: this case has zero, zilch, squat, nothing, to do with the Fourth Amendment (or the Fifth Amendment, given the property issues). This case is about a temporary restraining order between two private parties. The Fourth Amendment's prohibition on unreasonable searches and seizures only applies to “state action." There is simply no state action here. Perhaps the author chose the title as link bait. Nonetheless, the headline is not only misleading, but erroneous, and detracts from the issue at hand.

Second, the decision to grant the TRO is based on the defendant's self-label of hacker (emphasis added):

In addition, the defendants have identified themselves as hackers, as discussed above. A well-known characteristic of hackers is that they cover their tracks...This makes it likely that defendant Thuen will delete material on the hard drive of his computer that could be relevant to this case...The tipping point for the Court comes from evidence that the defendants – in their own words – are hackers. By labeling themselves this way, they have essentially announced that they have the necessary computer skills and intent to simultaneously release the code publicly and conceal their role in that act. And concealment likely involves the destruction of evidence on the hard drive of Thuen’s computer. For these reasons, the Court finds this is one of the very rare cases that justifies seizure and copying of the hard drive.

This is highly disturbing, and has potentially broader implications beyond this immediate case. If simply calling oneself a hacker can be used as evidence that someone may have criminal intent is alarming, troublesome, discouraging and discomforting (thank you, Thesaurus.com). We cannot take this sitting down; we must stand up and fight.

Judge Posner on corporations

Judge Posner

"A corporation is a ganglion of relations with people, most of whom, in the case of a railroad anyway, are not rich--shippers, railroad workers, passengers, employees of suppliers, shippers' customers, and families of the foregoing. Even if all the corporation's shareholders are rich, it is by no means certain that the predominant part of any increase in the corporation's costs that is due to more extensive tort liability will come to rest on them rather than on the persons with whom the corporation is economically entwined. Then too large corporation will on average be a defendant in more suits than will a small one; the total burden on it may be no less..."

Richard A. Posner, Cardozo: A Study in Reputation 47-48 (1990).

Law in Plain English: Case or Controversy

This is one in a series of posts designed to describe the structure, procedures, and legal issues of the federal courts in plain English. For similar posts, click here.

The Case or Controversy Clause, part of Article III of the United States Constitution, reads as follows:

The judicial Power shall extend to all Cases, in Law and Equity, arising under this Constitution, the Laws of the United States, and Treaties made, or which shall be made, under their Authority;--to all Cases affecting Ambassadors, other public ministers and Consuls;--to all Cases of admiralty and maritime Jurisdiction;--to Controversies to which the United States shall be a Party;--to Controversies between two or more States;--between a State and Citizens of another State;--between Citizens of different States;--between Citizens of the same State claiming Lands under Grants of different States, and between a State, or the Citizens thereof, and foreign States, Citizens or Subjects.

In plain English, this means that the courts only have power to hear cases when an actual controversy exists. Federal courts cannot decide issues based on hypothetical scenarios, cannot give advisory opinions, or decide issues  that aren't yet ripe.

To illustrate this concept, let's take a recent decision of the United States Court of Appeals for the Federal Circuit.

A group of farmers, many of who grew organic crops, did not want to have their crops contaminated by genetically-modified Monsanto seeds. They were concerned that the widespread proliferation of Monsanto's seeds would contaminate their organic crops, and afraid that Monsanto would then sue them for patent infringement (in some cases like this recent Supreme Court case, Monsanto has sued farmers for such infringement). So, the farmers asked the United States District Court for the Southern District of New York to declare (essentially, make a legally-binding judgment) that Monsanto's patents were invalid, unenforceable, and not infringed.

After filing the suit, the farmers asked Monsanto for a covenant not to sue (something we saw in this Supreme Court case earlier this term), which is exactly what it sounds like: a legally binding agreement not to sue. Monsanto declined to issue the covenant, but instead declared (via their website) that "[i]t has never been, nor will it be Monsanto policy to exercise its patent rights where trace amounts of our patented seeds or traits are present in farmer’s fields as a result of inadvertent means." Additionally Monsanto advised the farmers that

Monsanto is unaware of any circumstances that would give rise to any claim for patent infringement or any lawsuit against your clients. Monsanto therefore does not assert and has no intention of asserting patent-infringement claims against your clients. You represent that “none of your clients intend to possess, use or sell any transgenic seed, including any transgenic seed potentially covered by Monsanto’s patents.” Taking your representation as true, any fear of suit or other action is unreasonable, and any decision not to grow certain crops unjustified.

The District Court concluded that, given these facts, there was no controversy. As a result, it is important to note that the court could not hear the substance of the farmers' claims. On appeal, the Federal Circuit agreed.

Given our understanding of the Case or Controversy Clause, it's not difficult to understand why the courts decided as they did. The farmers were asking the court to rule on something that might happen. Given's Monsanto's stated policy and their assurances that they were unaware of any circumstances that would give rise to any claim for patent infringement or any lawsuit, the court concluded that the farmers had not been injured in any way:

In sum, Monsanto’s binding representations remove any risk of suit against the appellants as users or sellers of trace amounts (less than one percent) of modified seed. The appellants have alleged no concrete plans or activities to use or sell greater than trace amounts of modified seed, and accordingly fail to show any risk of suit on that basis. The appellants therefore lack an essential element of standing. The district court correctly concluded that it lacks Declaratory Judgment Act jurisdiction.

And now you know!

Is it illegal to put the names of competitor's businesses in meta tags to draw more traffic to a website?

On Friday night, I was chatting with Bill Mihan on Facebook. He mentioned to me that he had noticed a local plumber's website that had 'roto rooter' and many other business names in his meta tags. This prompted the question: is it illegal to put the names of competitor's businesses in meta tags to draw more traffic to a website?

You know I can't avoid not knowing the answer to such interesting legal questions. :-)

A few courts have squarely considered the issue. Consider the case of N. Am. Med. Corp. v. Axiom Worldwide, Inc., 522 F.3d 1211 (11th Cir. 2008):

NAM designs and manufacturers physiotherapeutic spinal devices, commonly known as traction devices, which are used, for example, to treat lower back pain. Adagen is an authorized distributor of NAM's devices. Axiom, a competitor of NAM's, manufacturers a physiotherapeutic device known generally as the DRX 9000. Gibson and Exharhos are, respectively, the president and vice president of Axiom. In the present lawsuit, NAM and Adagen allege that Axiom engaged in unfair competition by infringing NAM's trademarks and by issuing false advertising regarding the DRX 9000.

The trademark infringement claims stem from Axiom's use of two of NAM's registered trademarks: the terms “Accu–Spina” and “IDD Therapy.” Axiom included these terms on its website within meta tags. Although Axiom's website never displayed NAM's trademarked terms to visitors and never mentioned NAM or NAM's products, Axiom nonetheless included the terms within its meta tags to influence Internet search engines. For instance, evidence in this case indicated that, before Axiom removed these meta tags from its website, if a computer user  entered the trademarked terms into Google's Internet search engine, Google listed Axiom's website as the second most relevant search result. In addition, Google provided the searcher with a brief description of Axiom's website, and the description included these terms and highlighted them.

After analying the use of Axiom's use of NAM's trademarks, the court concluded that

...the plain meaning of the statutory language [of the Lanham Act] clearly indicates that Axiom's use of NAM's trademarks as meta tags constitutes a “use in commerce ... in connection with the sale ... or advertising of any goods” under the facts of this case.

...

Because Axiom's use of NAM's trademarks as meta tags caused the Google search to suggest that Axiom's products and NAM's products had the same source, or that Axiom sold both lines, or that there was some other relationship between Axiom and NAM, Axiom's use of the meta tags caused a likelihood of actual source confusion.

However, in a different case (Standard Process, Inc. v. Banks, 554 F.Supp.2d 866 (E.D. Wisc. 2008)), a court came to a different conclusion:

Standard Process also alleges that Dr. Banks is liable for trademark infringement because of “initial interest confusion.” “Initial interest confusion” occurs when a customer is lured to a product by the similarity of the mark, even if the customer realizes the true source of the goods before the sale is consummated. For example, in Promatek, the plaintiff used a direct competitor's trademark in its metatags. A metatag is HTML (Hyper Text Markup Language) code that describes the content of a website, and search engines used to use them to identifying the content of a website. The Seventh Circuit found that the use of the competitor's trademark in the plaintiff's metatags diverted customers to the plaintiff's website and likely caused customer confusion.

Like the plaintiff in Promatek, Dr. Banks used Standard Process trademarks in the metatags of his website. However, today “modern search engines make little if any use of metatags.” As more and more webmasters “manipulated their keyword metatags to provide suboptimal keyword associations, search engines progressively realized that keyword metatags were a poor indicator of relevancy.”Accordingly, search engines today primarily use algorithms that rank a website by the number of other sites that link or point to it. 

In any event, even if search engines still made significant use of metatags, this case is different than Promatek. Consumers who enter “Standard Process” in a search engine may be diverted to Dr. Banks's website where, unlike the plaintiff's site in Promatek, it actually provides an opportunity to purchase the trademark holder's goods. Dr. Banks is not a direct competitor to Standard Process. Consumers will still be able to purchase unaltered SP Products on his site, so the likelihood of consumer confusion is not present here. (citations omitted)

So what sort of rule can we develop from these cases? There are two parts to this test, with a series of subparts. First, the plaintiff must demonstrate use in commerce in connection with the sale or advertising of any goods, consistent with the Lanham Act. In doing so, the plaintiff must show (1) they possessed a valid mark, (2) that the defendant used the mark, (3) that the defendant's use of the mark occurred “in commerce,” and (4) that the defendant used the mark “in connection with the sale ... or advertising of any goods.” Second, the plaintiff must demonstrate the likelihood of confusion. Seven factors are relevant when determining whether a likelihood of confusion exists: (1) the strength of the plaintiff's mark; (2) the similarity between the plaintiff's mark and the allegedly infringing mark; (3) the similarity between the products and services offered by the plaintiff and defendant; (4) the similarity of the sales methods; (5) the similarity of advertising methods; (6) the defendant's intent, e.g., does the defendant hope to gain competitive advantage by associating his product with the plaintiff's established mark; and (7) actual confusion.

As you can tell, the answer to Bill's question is not straightforward. With as little information as we have, the best answer is maybe, or it depends (don't you hate when that happens?). But what we do know now, is that it is certainly possible.

Edited to add (4/13/13): As has been suggested, many companies buy their competitor's names as Google AdWords. These decisions suggest that, at least in some circumstances, that it might be a trademark violation. However, here's an article that suggests plaintiffs rarely win trademark infringement claims involving Google AdWords. Additionally, the financial stakes don't make much sense.

Can Adria Richards sue (and win) for retaliation?

In the wake of Adria Richards's termination, there have been some suggestions that she sue her former employer SendGrid for retaliation (well, of course she can sue; but can she win?). The common-law legal term for this would be "retaliatory discharge."

As I see it, there are a few problems with this theory.

First, Colorado (like 48 other states, with the exception of Montana) is an "at-will" employment state. That means an employee can be fired for any reason, or for no reason (subject to a handful of statutory exceptions, like civil rights, age discrimination, disability discrimination). So the presumption is already against  her.

Second, retaliatory discharge typically presumes that the retaliation was done in response to some illegal action of the employer, or fellow employers. In this case, there is no evidence to that SendGrid did anything illegal. The allegedly harassing comments were made by someone else not associated with SendGrid. So it's difficult for me to see how SendGrid retaliated against her.

Third, it's not clear that Adria actually engaged in a protected activity.

Fourth, there has been a suggestion that her employer owes her a duty of care to protect her. Generally, this would only be the case if the harm was foreseeable, or if the employer knew of a danger yet failed to warn the employee. Again, there are no facts in the public view that SendGrid somehow knew of any such danger or failed to warn Adria.

Lastly, her case becomes even more difficult if the employer can show they have a legitimate, non-discriminatory reason for firing the employee. SendGrid appears to have already alleged this.

There may be other facts unknown to us that permit Adria to sue under some different claim. However, I suspect that a claim of retaliatory discharge would fail.

Of course, this doesn't mean that she won't sue--I just don't think she would win. Other smart people may very well disagree with me. You're free to post such comments below.

*I am not a lawyer. This is not legal advice. It is my opinion based upon the publicly available facts and some general legal research.

WMATA, sovereign immunity, and AEDs

Reminder: I am not a lawyer (yet), and this is not legal advice.

Under what conditions might a lawsuit against the Washington Metropolitan Area Transit Authority (WMATA) succeed in overcoming WMATA's sovereign immunity, for failing to properly maintain an installed automated external defibrillator (AED)?

To understand this, we need to review the concept of sovereign immunity and how it applies to WMATA; and more importantly, the associated waivers of sovereign immunity. Essentially, sovereign immunity is a principle that states are immune from being sued without their consent (or, by their own waiver).

See the following from Morris v. WMATA (781 F.2d 218), which is a nice summation of the history of WMATA's sovereign immunity:

On November 6, 1966, Congress consented to, and enacted for the District of Columbia, a compact whose signatories were Maryland, Virginia, and the District of Columbia....The Compact created WMATA to operate a mass transit system for the District of Columbia and the surrounding suburban areas of Maryland and Virginia.

...

WMATA's sovereign immunity exists because the signatories have successfully conferred their respective sovereign immunities upon it. Congress has power to legislate for the District of Columbia and to create an instrumentality that is immune from suit....

The relevant portion of the WMATA Compact is Section 80. The section in bold below is important because this identifies WMATA's partial waiver of immunity:

80. Liability for Contracts and Torts

The Authority shall be liable for its contracts and for its torts and those of its Directors, officers, employees and agent committed in the conduct of any proprietary function, in accordance with the law of the applicable Signatory (including rules on conflict of laws), but shall not be liable for any torts occurring in the performance of a governmental function. The exclusive remedy for such breach of contracts and torts for which the Authority shall be liable, as herein provided, shall be by suit against the Authority. Nothing contained in this Title shall be construed as a waiver by the District of Columbia, Maryland, Virginia and the counties and cities within the Zone of any immunity from suit.

So the distinction here is a matter of function: WMATA cannot be sued for "governmental" functions but it can be sued for "proprietary" functions. So, what is the difference? Let the courts answer (all citations omitted for clarity):

Federal courts...interpreting the WMATA Compact have adopted certain tests

to aid in their determination of which functions are “governmental” and thus immune from suit.

Activities that are “quintessentially governmental” fall within the scope of § 80's grant of

immunity. Such functions have been defined as those activities exclusively within the purview of the government by way of its legal and authoritative nature. The oftcited prototypical governmental function as pertains to WMATA is the act of maintaining a police force.

So, immunity applies to governmental functions but not proprietary ones. If a function is proprietary, a second test must be applied:

If it is not discretionary, as where a “statute, regulation, or policy specifically prescribes a course of action for an employee to follow,”  the activity is “ministerial” and not protected by governmental immunity. If, on the other hand, the activity is “discretionary,” the court must decide whether it falls within what the Supreme Court has termed the “exception for discretionary governmental functions,” commonly referred to, by the federal appellate courts, as the “discretionary function exception.” If the discretionary function exception applies to the challenged activity, then that activity, like activity falling within a quintessential governmental function, “constitute[s] [a] ‘governmental’ activit[y] within the meaning of the ‘governmental/proprietary’ test” of section 80 of the WMATA Compact, and is thus shielded from tort liability.

Got it? Good (yeah, it's a little confusing to say the least!).

Essentially, the function must be both proprietary and also ministerial or WMATA's sovereign immunity applies.

Here's an example. In this case, "WMATA failed to maintain, repair, inspect, or operate the escalators at the Anacostia station such that they became wet and icy, and second, that WMATA failed to warn the public of the wet and icy escalators...WMATA concedes that its actions were not 'quintessentially governmental activities.'" So the first part of the test is conceded; the function of maintaining, repairing, inspecting and operating of escalators is not a governmental function, but a proprietary one. However, the court found that "discretion exercised over the maintenance, repair, inspection, and operation of the escalators is 'subject to policy analysis' and thus discretionary." So escalator maintenance fails the second test because it is discretionary and not ministerial. Thus, WMATA's sovereign immunity applies.

Can we assume that AEDs are similar to escalators in that the function of maintaining, repairing, and inspecting of AEDs is not a governmental function, but a proprietary one? I don't see any reason why not. Absent a strong argument otherwise, the first test appears to be met.

WMATA has much less of an argument if they want to suggest that function of maintaining, repairing, and inspecting AEDs is subject to discretion. There may be differing methods of dealing with escalators in cold and wet weather, but the maintenance of AEDs seems pretty straight forward. In fact, to have AEDs installed without a specific maintenance procedure seems negligent, no?

To establish that the function of  maintaining, repairing, and inspecting of AEDs as a ministerial function rather than a discretionary one, an argument would be bolstered by specific instructions, or policies, to check AEDs on a regular basis. A further example would be the District of Columbia's AED law which states in part that:

The defibrillator is maintained and tested according to the manufacturer’s operational guidelines, and written records of the maintenance and testing are maintained...

(For the record, I know the action took place in the Pentagon Metro Station in Virginia, I am simply citing the DC law as an example of a positive duty to maintain the AED device. I haven't found related laws in Virginia or Maryland yet).

This DC law (whether or not it is truly applicable to WMATA remains to be seen) seems to suggest a positive duty to maintain the AED device; such would make it (in my opinion) a ministerial function. Even absent specific laws in MD or VA, some cases suggest that certain organizations may have a duty to maintain.

In such a case, the function of maintaining AEDs would be both proprietary and ministerial and thus not subject to WMATA's sovereign immunity; as such, WMATA could be sued for failing to maintain the AED (this post does not elaborate on whether or not such failure contributed to the death of the passenger, although common sense suggests it is probable).

I am curious to hear your thoughts and opinions.

Would you confuse these products?

Would you confuse these products?  Coca-Cola thinks you might.  They filed a trademark and patent infringement lawsuit against Pepsi.  "Simply Orange" is a Coke product that has been around for several years; Trop50 is a fairly new product from Pepsi.  

Los Angeles Times is wrong about the Wal-Mart class-action lawsuit

The Los Angeles Times editorializes about the Wal-Mart class-action lawsuit today, and to no surprise, they've read the issue entirely wrong:

There is currently no limit on the size of a class, nor should there be...In other words, Wal-Mart's size shouldn't immunize it to a lawsuit that otherwise meets legal standards.

But this case isn't simply about the size of the class.  Experts acknowledge that a class this large could conceivably go forward if Wal-Mart had a nationwide policy that equally affected all of the women in the class.  But as Ted Frank wrote in the Washington Examiner:

...the theory of the Dukes lawsuit is exactly the opposite: the plaintiffs claimed that Wal-Mart's central office did not exercise enough authority over each of its 3,400 stores; each of the individual managers' discretionary employment or promotion decisions--whether made by male or female managers--was, on average, discriminatory; and thus Wal-Mart was responsible for a policy that "fosters or facilitates" discrimination.

...

One can quickly see why this does not work as a class action. In the words of Professor Richard Epstein, the procedural tail is wagging the substantive dog.

The discrimination laws permit Wal-Mart to defend itself by demonstrating that the challenged job decision was made for a reason other than gender. For example, looking at Betty Dukes, the named plaintiff, alone, we learn that she had a female manager and that she was repeatedly disciplined for returning late from lunch breaks.

Yet if a court ties together claims that are not alike, it will have trouble trying the case as a single class action--unless it pretends that the parts that are not alike are not part of the lawsuit. Wal-Mart is stripped of its defense because the individualized defense would be inconvenient to trying the case as a class action.

But that is precisely backwards. If there are too many individualized issues to permit a defendant to defend itself adequately in a class action, that means the correct ruling is not to have a class action.

Emphasis is mine.  The case isn't about the size of the class, per se.  The size of the case is only relevant because it brings together claims that are not alike, and therefore prevents Wal-Mart from defending itself from disparate, individualized claims.

Class action lawsuits and common sense

Let's say I purchase a product which turns out to be defective and causes some sort of injury to me.  I can file a lawsuit against the manufacturer to recover damages.  Now presume that 10,000 people also purchased the same product and were similarly injured.  The courts would be overwhelmed with 10,000 lawsuits that alleged the same general facts about how the product was defective.  The answer is the class action lawsuit, which brings together many claims into one.  This improves the efficiency of the court because there is no need to repeat the same general facts over and over and over again.

A problem with a class action lawsuit when the circumstances surrounding the injury are different in each case.  This is precisely the problem with Dukes v. Wal-Mart, which will be heard by the Supreme Court this term.  This case is the largest class-action lawsuit ever, and involves alleged discrimination against women in promotion decisions at Wal-Mart.  The legal issue is not about whether the discrimination occurred, but whether or not it should be a class-action case in the first place.  The Ninth Circuit (en banc) affirmed the class certification of the District Court (6-5) in a decision that is almost certain to be overturned.

At the Supreme Court level, the decision will be about the intricateness of Rule 23 of the Federal Rules of Civil Procedure (the rule concerning Class Actions).  From a common-sense perspective, class action lawsuits make sense when they provide efficiency to the courts, but not at the expense of the rights of the parties involved.

For a similar perspective, see the article Manhattan Moment: Courts shouldn't ignore due process to create class actions in the Washington Examiner.