Rubin v. New Jersey (Tidbit)
Jeremy Rubin, a 19 year old MIT student in Massachusetts, developed a computer program called Tidbit with some classmates as part of the Node Knockout Hackaton in November 2013. Tidbit allows users to mine for Bitcoins on a client's computer as a replacement for traditional advertising. Tidbit was presented as a proof of concept and won the award for having the highest innovation score at the hackathon.
In December 2013, the New Jersey Attorney General's office issued a sweeping subpoena to Rubin and Tidbit, seeking Tidbit's source code, documents and narrative responses about how Tidbit worked, which websites it was installed on and the Bitcoin accounts and wallet addresses associated with Tidbit.
With the help of attorney Frank Corrado, EFF moved to quash the subpoena in New Jersey state court, challenging New Jersey's ability to regulate out of state Internet activity and its exercise of jurisdiction over Rubin, who is a Massachusetts resident. EFF also challenged the subpoena as infringing on Rubin's constitutional right not to incriminate himself, as the subpoena seeks answers to questions that could expose Rubin to liability under the federal Computer Fraud and Abuse Act ("CFAA") and New Jersey's anti-hacking statute.
Judge Garry Furnari of the Essex County Superior Court dismissed Rubin's complaint in November 2014, finding that the state had jurisdiction over him and could regulate Tidbit's Internet activity. Importantly, the court noted it had "serious concerns" that the state "may be acting to discourage creative and ‘cutting edge’ new technology" and that it appeared "the Tidbit program and other similar creative endeavors serve a useful and legitimate purpose" and had no "inherently improper or malicious intent or design."
In May 2015, the parties entered into consent order ending New Jersey's investigation of Tidbit. Under the order, the parties agree to the imposition of a $25,000 settlement amount over Tidbit that is suspended—meaning no money is due—and that will be vacated as long as Tidbit complies with the other conditions of the consent order for two years. Those conditions are that Tidbit will not violate New Jersey’s consumer or computer fraud statutes. As the settlement makes clear, the students have not admitted to any wrongdoing or legal liability. And the state itself echoed the comments of Judge Furnari, noting in its press release announcing the consent order “we do not believe Tidbit was created for the purpose of invading privacy.”