LIGATT Security, a controversial Georgia-based computer security firm, is embroiled in an ongoing flame war with its online detractors, who question the firm's legitimacy and stock prospects. Earlier this month, LIGATT upped the ante by filing suit in a Georgia court, threatening about 25 anonymous commenters on Yahoo! Message Boards and demanding a $5 million judgment and a court order prohibiting criticism. LIGATT CEO warned that he hoped the lawsuit would "set a trend" for other OTC companies facing online critics.
We hope not. EFF is frequently called upon to help protect the rights of anonymous speakers in similar suits, and the world does not need more facially deficient lawsuits targeting online critics. As we explain below, this complaint is a prime example of a case that should be dismissed. And, if LIGATT attempts to use this complaint to subpoena Yahoo! for the identities of its critics, the subpoenas might not only fail, but LIGATT may be forced to pay its critics' attorneys' fees.
It is not surprising that LIGATT has attracted controversy and commentary. The publicly traded company is headed by Gregory Evans, a self-described "media personality" who calls himself the "World's #1 Hacker." Evans' books include "Memoirs of a Hi-Tech Hustler," an account of the exploits that landed him in federal prison, and "How to Become the World's No. 1 Hacker," an allegedly plagiarized introduction to computer security. LIGATT has published provocative online videos advertising its services. And this is not the first time LIGATT has been criticized over its litigation.
The important legal question at this point, however, is not whether LIGATT's critics are right or wrong, but whether the complaint sets forth a valid claim. It does not. LIGATT and Evans' complaint asserts three primary claims: defamation, commercial disparagement, and "tortuous interference with contractual relations," which is a way of accusing the defendants of hurting its business relationships. The company also seeks an injunction against the defendants from posting any further defamatory comments against LIGATT Security, its subsidiary SPOOFEM.COM, or its CEO Evans, and demands $5 million dollars in damages. The alleged damages are double the most recent "Estimated Market Cap" for the whole company listed on its investor relations page.
Curiously, while LIGATT's press release announcing the lawsuit and the accompanying video claim the suit was filed against "stock bashers," the complaint never once references the company's stock or alleges stock manipulation. While federal and state law prohibit certain forms of stock manipulation, criticizing a publicly traded company and its CEO is not a valid legal cause of action in and of itself.
In its complaint, LIGATT claims the defendants posted "false and defamatory statements" on the Yahoo Technology message board and a few other websites. But the purported defamatory statements are never identified in the complaint, much less set forth. There is no attempt to tie each of the defendants to particular statements. Under long-standing Georgia law, failure to clearly identify defamatory statements in a complaint is grounds for dismissing a defamation claim (with leave to amend). The allegation in this complaint is insufficient because it is just a bald conclusion that the unidentified statements are "false and untrue and defamed Plaintiffs." Under Georgia law, libel complaints are subject to a strict standard, and "allegations ... characterizing the publication as libelous and libelous per se are mere conclusions not supported by the pleaded facts" that must be dismissed.
Similarly, if the defendants were to move this case to a federal court (which may be possible if the defendants are not from Georgia), allegations of specific statements would be required and the complaint would be dismissed under the federal pleading standard that requires more than "conclusory allegations" and "legal conclusions masquerading as facts" (recently explained in two Supreme Court decisions, commonly known as Iqbal and Twombly).
LIGATT's "commercial disparagement" claim is simply a variation of the original defamation claim, and hangs on the same unidentified "false and defamatory statements" thread. The court should dismiss the claim for the same reasons. Moreover, even if the actual statements were pled, a federal court in Georgia recently noted that Georgia law does not support this type of claim, and a Georgia Supreme Court opinion both refused to recognize the similar tort of injurious falsehood and held that plaintiffs could not recover twice under two theories.
The complaint’s final substantive claim, accusing the defendants of interfering with LIGATT's business contracts, would also fail because LIGATT must identify wrongful conduct and provide facts, not legal conclusions, to support the cause of action. The complaint, however, does not identify any wrongful conduct on the part of the defendants beyond the deficient defamation claim. This claim should fall with the rest of the house of cards.
California’s anti-SLAPP law is another hurdle for LIGATT. Most of the defendants are anonymous Does, who have exercised their constitutional right to speak pseudonymously online. To the extent that LIGATT wants to issue subpoenas to Yahoo!, located in California, to uncover the identities of the posters on the message board, LIGATT would be wise to realize that California law mandates attorneys' fees for anyone who prevails in quashing or modifying such a subpoena, if the underlying action involves the person's online free speech rights and the plaintiff does not make a prima facie showing of the cause of action.
When courts, both in California and throughout the country, consider whether to allow a subpoena to unmask an anonymous speaker, they use a First Amendment test that requires the plaintiffs to show they have a real case. As explained above, the complaint fails to allege sufficient facts to do so. Moreover, since the plaintiffs would likely be considered public figures for purposes of this lawsuit, LIGATT would have to show a prima facie case for actual malice--a significant and difficult hurdle to overcome.
Through this lawsuit and its press release, LIGATT is affirmatively seeking to encourage and extend a disturbing trend of using the legal system as a weapon to intimidate online critics. Often, these deficient lawsuits are used to unmask online critics, even when those critics are engaged in constitutionally protected speech. LIGATT's complaint is rife with conclusory allegations and exemplifies the deficiencies with most of these lawsuits. LIGATT should voluntarily dismiss this lawsuit, and not refile unless and until it can state a valid claim that a critic has actually violated the law, quoting specifically the allegedly defamatory speech and alleging facts that show how the quoted speech is false, defamatory and was made with actual malice.
Join EFF for a plethora of appearances in Las Vegas, NV, at Black Hat USA 2010 and DEFCON 18. There is still time to register, and EFF supporters receive a 25% discount on Black Hat registration. Remember to stop by the EFF booths to get reduced-rate EFF memberships and top drawer swag! And be on the lookout for the limited edition "Things to Hack" t-shirt available only in Las Vegas.
Check out talks presented by members of our legal and technology teams throughout the week:
Wednesday, July 28
Kevin Bankston and Kurt Opsahl will play the role of the defense attorneys for an indicted hacker in the 2010 edition of Black Hat Hacker Court from 1515-1800 in Forum 25 at Caesar's Palace.
Thursday, July 29
EFF staffers will be at Vegas 2.0's 6th Annual Summit Fundraiser to thank our supporters, including the DEFCON 18 Getaway contest winners and the contest sponsors, Tenable Network Security, iSec Partners, and IOActive. As a special bonus, Summit attendees can receive a complimentary EFF Advocate Level membership and an opportunity to pick up the "Things to Hack" shirt at vastly reduced rates. Many thanks to Vegas 2.0 for their generosity in organizing this amazing benefit event.
Friday, July 30
On this big day for EFF, Marcia Hofmann will teach DEFCON attendees "How to Get Your FBI File (and Other Information You Want From the Federal Government)," from 1000-1050 in Track 3 at the Riviera Conference Center.
On Friday afternoon, Peter Eckersley will talk about the Panopticlick project on the "How Unique Is Your Browser?" panel from 1200 to 1250 in Track 2, and Jennifer Granick, Kevin, Marcia, and Kurt will teach about "The Law of Laptop Search and Seizure" in Track 3 from 1300 to 1350.
In the evening, Peter will join iSEC Partners' Jesse Burns in presenting "An Observatory for the SSLiverse" from 1700 to 1750 in Track 3. A gaggle of EFF attorneys and staff will answer your questions on the annual "Meet the EFF" panel from 1800-1850 in Track 1. From 2000 to 2050, Kevin and the ACLU's Nicole Ozer will present "Big Brother on the Big Screen: Fact/Fiction?" in Track 3.
Saturday July 31
Jennifer and Matt Zimmerman will discuss "Legal Developments in Hardware Hacking" from 1000 to 1050 in Track 1.
Good news: another federal judge has ruled that violating a website terms of service is not a crime. But there's bad news, too — the court also found that bypassing technical or code-based barriers intended to limit access to or uses of a website may violate California's computer crime law.
The decision comes in Facebook v. Power Ventures, a case in which Facebook is suing a company that offers a tool for users to access and aggregate their personal information across social networking sites. Because Facebook's terms of service don't allow users to access their information through "automated means," Facebook claimed that Power accesses its service "without permission" in violation of California Penal Code Section 502. Facebook has also argued that Power broke the law by evading Facebook's effort to block the Power browser’s IP address, which was meant to try to keep users from accessing their Facebook accounts though the Power website.
The court agreed with our position, relying heavily on our brief. This part of the ruling is great.
Unfortunately, the court also said that Power might be liable if it changed its IP address so that its browser could continue to interoperate with the Facebook service. In other words, it may be a crime to circumvent technological barriers imposed by a website, even if those measures are taken only to enforce the terms of service through code. There's nothing inherently wrong or unlawful about avoiding IP address blocking, and there are valid reasons why someone might choose to do so, including to sidestep anticompetitive behavior by other Internet services. As long as an end user is authorized to access a computer and the way she chooses doesn't cause harm, she should be able to access the computer any way she likes without committing a crime.
Overall, yesterday's opinion is an important precedent that aligns with United States v. Drew, a decision last year finding that a woman did not violate the federal hacking law when she created a fake MySpace profile, as well as recent Ninth Circuit cases. We welcome the court's rejection of terms of service violations as triggers for criminal liability, but will continue to work to demonstrate to courts that not all technological measures are created equal. If the measure seeks to control access to or use of data, then evasion of it is almost certainly criminal. But if the restriction merely seeks to impose owner preferences or terms of service on otherwise authorized users, bypassing it should not be a crime.
As other courts look at this issue, we hope that they will agree that code-based restrictions require a very fact-specific inquiry, and will remain open to the possibility that bypassing such measures should not necessarily be criminal.
The White House recently released a draft of a troubling plan titled "National Strategy for Trusted Identities in Cyberspace" (NSTIC). In previous iterations, the project was known as the "National Strategy for Secure Online Transactions" and emphasized, reasonably, the private sector's development of technologies to secure sensitive online transactions. But the recent shift to "Trusted Identities in Cyberspace" reflects a radical — and concerning — expansion of the project’s scope.
The draft NSTIC now calls for pervasive, authenticated digital IDs and makes scant mention of the unprecedented threat such a scheme would pose to privacy and free speech online. And while the draft NSTIC "does not advocate for the establishment of a national identification card" (p. 6), it’s far from clear that it won’t take us dangerously far down that road. Because the draft NSTIC is vague about many basic points, the White House must proceed with caution and avoid rushing past the risks that lay ahead. Here are some of our concerns.
Is authentication really the answer?
Probably the biggest conceptual problem is that the draft NSTIC seems to place unquestioning faith in authentication — a system of proving one's identity — as an approach to solving Internet security problems. Even leaving aside the civil liberties risks of pervasive online authentication, computer security experts question this emphasis. As prominent researcher Steven Bellovin notes:
The biggest problem [for Internet security] was and is buggy code. All the authentication in the world won't stop a bad guy who goes around the authentication system, either by finding bugs exploitable before authentication is performed, finding bugs in the authentication system itself, or by hijacking your system and abusing the authenticated connection set up by the legitimate user. All of these attacks have been known for years.
A Real ID Society?
The draft NSTIC says that, instead of a national ID card, it "seeks to establish an ecosystem of interoperable identity service providers and relying parties where individuals have the choice of different credentials or a single credential for different types of online transactions," which can be obtained "from either public or private sector identity providers." (p. 6) In other words, the governments want a lot of different companies or organizations to be able to do the task of confirming that a person on the Internet is who he or she claims to be.
Decentralized or federated ID management systems are possible, but like all ID systems, they definitely pose significant privacy issues. 1 There’s little discussion of these issues, and in particular, there’s no attention to how multiple ID's might be linked together under a single umbrella credential. A National Academies study, Who Goes There?: Authentication Through the Lens of Privacy, warned that multiple, separate, unlinkable credentials are better for both security and privacy (pp. 125-132). Yet the draft NSTIC doesn’t discuss in any depth how to prevent or minimize linkage of our online IDs, which would seem much easier online than offline, and fails to discuss or refer to academic work on unlinkable credentials (such as that of Stefan Brands, or Jan Camenisch and Anna Lysyanskaya).
Providing a uniform online ID system could pressure providers to require more ID than necessary. The video game company Blizzard, for example, recently indicated it would implement a verified ID requirement for its forums before walking back the proposal only after widespread, outspoken criticism from users.
Pervasive online ID could likewise encourage lawmakers to enact access restrictions for online services, from paying taxes to using libraries and beyond. Website operators have argued persuasively that they cannot be expected to tell exactly who is visiting their sites, but that could change with a new online ID mechanism. Massachusetts recently adopted an overly broad online obscenity law; it takes little imagination to believe states would require NSTIC implementation individuals to be able to access content somehow deemed to be "objectionable."
The draft NSTIC "envisions" that a blogger will use "a smart identity card from her home state" to "authenticate herself for . . . [a]nonymously posting blog entries." (p. 4) But how is her blog anonymous when it’s directly associated with a state-issued ID card?
The proposal mistakenly conflates trusting a third party to not reveal your identity with actual anonymity — where third parties don’t know your identity. When Thomas Paine anonymously published Common Sense in 1776, he didn’t secretly register with the British Crown.
Indeed, the draft NSTIC barely recognizes the value of anonymous speech, whether in public postings or private email, or anonymous browsing via systems like Tor. Nor does it address issues about re-identification, e.g. the ability to take different sets of de-identified data and link them so as to re-identify individuals.
Bellovin credits the draft NSTIC for suggesting the use of attribute credentials rather than identity credentials — that is, using credentials that could establish that you're authorized to do something without saying who you are. But, as he puts it, "We need ways to discourage collection of identity information unless identity is actually needed to deliver the requested service," and the draft NSTIC doesn't seem to address this.
Privacy, Identity Theft and Surveillance
The draft NSTIC seems to presuppose widespread use of smart ID cards. In one example, it envisions that an individual will use "a smart identity card from her home state" to "authenticate herself for a variety of online services," presumably modeled upon driver’s licenses. (p. 4)
One major concern, acknowledged briefly in the draft, is whether people's computers can really be secure enough to be used for these purposes — smart ID cards or no smart ID cards. As noted above, the vast majority of privacy and authentication vulnerabilities stem from buggy software, and when a computer is trivial to compromise, its users’ credentials are easy to steal. The NSTIC proposal could, in fact, decrease user privacy and enable identity theft: once a user’s digital ID is stolen, it could be used to both pose as the user and access all the user’s accounts and data.
Consider, for example, the proposal to use a state digital ID card to access health records and online banking. What happens next time you lose your wallet?
Furthermore, by consolidating your credentials, the NSTIC plan may provide the government with a centralized means of surveilling your online accounts. And if the government issues your digital ID itself, it won’t even need to approach a third party with any kind of legal process before surveilling you.
The draft NSTIC also mentions the development of a public-key infrastructure (PKI). (pp. 15, 27) We support good, widespread encryption, which could allow people to get correct public keys reliably and possibly cut down on phishing, spam, fraud, and pretexting. But as Bruce Schneier and Carl Ellison have explained, doing PKI properly isn’t easy.2 All of their concerns apply, in some form, to the NSTIC proposal.
Another concern that’s emerged recently is whether governments could coerce certificate authorities in a PKI to issue false credentials in order to facilitate surveillance. Chris Soghoian and Sid Stamm have reported on an industry claim that governments could get "court orders" giving them access to falsified cryptographic credentials. This threat seems greater if the government itself is running the PKI.
Much more could be said. The NSTIC is only a draft, and the Department of Homeland Security and the White House sought public input online through July 19th. Because of the importance of this issue, EFF has joined with a coalition of concerned civil liberties group to ask the Administrations for a longer comment period and a way to submit more detailed comments. We hope and expect that this will be only the beginning of a public debate about ID management online.
Today the Eleventh Circuit issued an unfortunate amended decision in Rehberg v. Hodges. The case arose from an egregious situation in which, among other misconduct, a prosecutor used a sham grand jury subpoena to obtain the private emails of whistleblower Charles Rehberg after he brought attention to systematic mismanagement of funds at a Georgia public hospital.
The Court held that Mr. Rehberg's privacy interest in his emails held by his ISP was not "clearly established" and therefore his claim against the prosecutors could not proceed. The Court relied on a legal doctrine called qualified immunity, which holds that lawsuits against government officials for violations of constitutional rights cannot proceed unless those rights were "clearly established" at the time. The Court declined to rule on whether individuals have a privacy interest in the content of their emails.
We're disappointed in this decision. Not only is it wrong for Mr. Rehberg, who had his emails turned over to a prosecutor based on a sham subpoena, but it's troubling for the millions of individuals in the Eleventh Circuit who have their email stored with ISPs. Our most sensitive and private thoughts, ideas and correspondence are contained in our emails. The Fourth Amendment requires judicial supervision (usually a warrant) before the government can access your personal papers in order to protect against just the sort of abuse that Mr. Rehberg suffered -- a rogue government official seeking to get your emails from your ISP with no court oversight and then turning it over to others who seek to harm you.
While the decision is very bad news for Mr. Rehberg, the Court did take the opportunity to correct some erroneous analysis in the panel's previous decision. The earlier decision had held that the Fourth Amendment did not apply at all once an email was received by your ISP. The Court had written that a "person also loses a reasonable expectation of privacy in emails, at least after the email is sent to and received by a third party" and that "Rehberg's voluntary delivery of emails to third parties constituted a voluntary relinquishment of the right to privacy in that information." This is not the law, and the incorrect statements are no longer precedent. In other words, the Court did not rule out the possibility that there is a reasonable expectation of privacy in your email. That is useful and will be important to other cases moving forward, as law professor Paul Ohm, who wrote an amicus brief in the case, has noted.
However, the Court did not rule that there was privacy protection for your emails either. Rather than embracing the obvious conclusion that our constitutional protections need to be recognized for email content, the court ducked the question, claiming that email is simply too new a technology for them to decide whether the Constitution applies. With all due respect, email is far too important to the daily lives of millions of Americans for its constitutional status to be unclear. Email content must be protected by the Fourth Amendment whether stored with an ISP or not. It's long past time that the courts recognize that the constitutional privacy protections for our "papers" still apply when they are in digital form.
Today, San Mateo Superior Court Judge Clifford Cretan granted an application by the San Mateo County D.A.'s office to withdraw the controversial warrant it obtained to search the house of Gizmodo.com journalist Jason Chen. Accordingly, "[a]ll items seized [from Chen's home] shall be returned forthwith to Gizmodo.com and Jason Chen..."
While the D.A.'s withdrawal of the April 23rd warrant is certainly a positive step, this likely isn't the end of the matter. As EFF repeatedlynoted at the time, the warrant-backed search of Chen's home was illegal as it violated California Penal Code section 1524(g)'s prohibition against the issuance of warrants for "unpublished information obtained or prepared in gathering, receiving or processing of information for communication to the public." As we pointed out, the police could (for example) attempt to subpoena the same material without running afoul of section 1524(g) and still proceed with their case.
In a landmark announcement issued today, the data protection officials across the European Union found that the way that EU Member States have implemented the data retention obligations in the 2006 EU Data Retention Directive is unlawful. The highlycontroversial 2006 EU Data Retention Directive compels all ISPs and telecommunications service providers operating in Europe to retain telecom and internet traffic data about all of their customers' communications for a period of at least 6 months and up to 2 years.
European privacy officials from the Article 29 Data Protection Working Party have been reviewing how the EU Member States have implemented these obligations in their national laws.
Among the most important findings of the Article 29 Working Party’s report are:
"Service providers were found to retain and hand over data in ways contrary to the provisions of the [data retention] directive."
"There are significant discrepancies regarding the retention periods, which vary from six months to up to ten years, which largely exceeds the allowed maximum of 24 months."
"More data are being retained than is allowed. The data retention directive provides a limited list of data to be retained, all relating to traffic data. The retention of data relating to the content of communication is explicitly prohibited. However, it appears from the inquiry that some of these data are nevertheless retained."
Regarding Internet traffic data: "Several service providers were found to retain URLs of websites, headers of e-mail messages as well as recipients of e-mail messages in "CC"- mode at the destination mail server.
Regarding phone traffic data: "it was established that not only the location of the caller is retained at the start of the call, but that his location is being monitored continuously."
"Member states have scarcely provided statistics on the use of data retained under the Directive, which limits the possibilities to verify the usefulness of data retention."
"The provisions of the data retention directive are not respected and the lack of available sensible statistics hinders the assessment of whether the directive has achieved its objectives."
The timing of the Article 29 Working Party’s opinion is particularly sensitive because the European Commission is currently conducting an evaluation of the impact of the Data Retention Directive on economic operators and citizens in Europe. One of the possible outcomes of this evaluation is a recommendation that the Data Retention Directive should be amended or repealed in its entirety. The Article 29 Working Party has submitted its report to the European Commission to provide the Commission with vital empirical evidence for its evaluation of whether to recommend the amendment or repeal the Directive.
Once completed, the Commission’s evaluation will be sent to the European Parliament and the Council of Ministers. Reflecting the far-reaching impact and sensitive policy issues involved in the Data Retention Directive, three Commissioners are likely to be engaged in its review. The EU Commissioner for Home Affairs, Commissioner Malmström leads the evaluation process, but it is expected that Vice President of the Commission and EU Commissioner for Justice, Fundamental Rights and Citizenship, Commissoner Reding and the Commissioner for the Digital Agenda, Commissioner Kroes will also participate actively in the review process.
EFF, AK Vorrat and a coalition of over 100 organizations across Europe recently called for an end to mandatory data retention of telecom and Internet traffic data. In a joint letter sent last month to European Commissioners Malmström, Reding, and Kroes, the coalition urged the Commissioners to "propose the repeal of the EU requirements regarding data retention in favor of a system of expedited preservation and targeted collection of traffic data as agreed in the Council of Europe's Convention on Cybercrime."
In her July 7 reply to the coalition letter, Commissioner Reding stated that, "the review of the EU Data Retention directive provides the European Commission, but also the 27 EU Member States and the European Parliament, with an opportunity to assess the effectiveness and proportionality of the measures included in the Directive. I will in this context ask for a particular focus on the considerable impact data retention may have on fundamental rights of all European citizens, especially with regard to their privacy."
With the recent adoption of the Lisbon Treaty and the entry into force of the Charter of Fundamental Rights, privacy and data protection has been strengthened in the European Union, including in the sensitive areas of law enforcement and crime prevention.
We must now see whether the European Commission will be faithful to the Charter of Fundamental Rights, and recommend the repeal of the overbroad 2006 Data Retention Directive.
The Federal Trade Commission has some strong words for the former publishers of a defunct magazine and website for gay youth: don't sell or use personal information provided by your customers. It's probably illegal.
The warning came during a contentious bankruptcy proceeding filed by the publisher of XY Magazine, which was a widely circulated magazine for gay teens published from 1996 to 2007. The publisher also operated XY.com, a dating website for gay youth that at one point had as many as a million users. XY's privacy policies promised customers that their personal information would not be given or sold to anybody.
Now the publisher and his former business partners are fighting over who owns the customer information, which includes names, street addresses, phone numbers, credit card numbers, email addresses, personal stories submitted by readers, online profiles, contact lists, and photos, among other data.
In a letter (pdf) to the publisher's former business partners, the Federal Trade Commission said that any sale or transfer of the customer information would violate XY's privacy promises and likely the Federal Trade Commission Act, which prohibits unfair and deceptive acts and practices.
The FTC also suggested that any continued use of the information — even by the publisher himself — might disclose the customers' identities to third parties, which could also violate XY's privacy policies and the law. The Commission asked that the data be destroyed "to avoid the possibility that this highly sensitive data could fall into the wrong hands."
EFF has been keeping a watchful eye on this case, and is glad to see that the FTC is too.
The XY customer information reveals the sexual preferences of more than a million men. Some of them may be openly gay, but others may not want certain people — like family members or employers — to know their sexual orientation or that they explored their sexuality when they were younger. If disclosed either purposefully or unintentionally, this information could cause severe personal and professional repercussions. The privacy interests of the customers outweigh any limited commercial value this outdated but extremely sensitive information might have to anyone else.
Like the FTC, we believe that the XY customer information should be destroyed. This is the best way to ensure that the data will never be disclosed to anybody — as XY promised — and to protect the customers from potential harm. We hope the bankruptcy court will agree.