Cloud Computing Case Clarifies Applicability of US Privacy Law to Non-U.S. Nationals

By Susan Altman

The Ninth Circuit Court of Appeals, in its October 3, 2011 decision in Suzlon Energy Ltd v. Microsoft Corporation, has taken another step in defining the rights of people to protect their emails from being disclosed in civil court proceedings. The question before the Suzlon court was whether a party can require a U.S. electronic communication service provider to produce emails stored on a U.S. server for the account of a non-U.S. national without regard to the safeguards and restrictions imposed by the Electronic Communications Privacy Act of 1986 (ECPA). The court answered with a clear “no,” stating that the protections of the ECPA against unrestricted disclosure of emails by an electronic communication service provider apply to non-U.S. nationals as well as to U.S. citizens.

The Suzlon case originated out of an Australian civil claim by Indian wind energy company Suzlon against Indian citizen Rajagopalan Sridhar, a former employee accused of committing fraud against the Suzlon empire through a multijurisdictional shipping scam. In the course of the Australian action, Suzlon’s lawyers sought to obtain Sridhar’s emails, which resided in a Microsoft Hotmail email account on a server located in the U.S. Sridhar did not consent to the production of his emails (nor did he consent in a related case where Google was the electronic communication service provider). Microsoft objected to the production of the emails and both the U.S. District Court for the Western District of Washington and the Ninth Circuit agreed that Sridhar was protected by the ECPA. (In an interesting procedural sidenote, the court summarized the arguments presented to the lower court relating to assistance to foreign tribunals and outlined how a U.S. federal court ends up in the position of ruling on what is essentially a discovery issue relating to an Australian case.)

The Suzlon case provides useful guidance to electronic communication service providers offering cloud services in the U.S. Certainly those within the jurisdictional reach of the Ninth Circuit, and most likely service providers throughout the U.S., can operate with the expectation that the ECPA will apply to all customers using a U.S. account. The service providers will not have to distinguish between U.S. citizens and non-U.S. nationals in determining rights to stored emails. Litigants will have to follow the same procedures in filing motions to compel production regardless of citizenship. The decision will not affect issues of national security as it does not address law enforcement action in any way. The Suzlon case doesn’t change the world, but it does add a small measure of clarity.

White House Jobs Bill Includes Spectrum Auction Plan

By Marc Martin and Marty Stern

After being abandoned during the Congressional debate over the debt ceiling, the proposal to free up broadcast spectrum through “incentive auctions” is now part of the American Jobs Act announced by President Obama on Thursday and sent to Congress yesterday. Incentive auctions allow broadcast spectrum licensees to cede portions of their spectrum for auction by the FCC in return for a portion of the auction revenue. According to the Obama Administration’s estimates, the auctions will raise approximately $28 billion, which, under the proposed legislation, would be used to fund the creation of a nationwide, interoperable wireless network dedicated to public safety – bringing front and center the long simmering D Block controversy that has stymied earlier efforts to pass incentive auction legislation.

The current incentive auction proposal borrows from legislation introduced earlier this year by Sen. Jay Rockefeller (D-WV) and Sen. Kay Bailey Hutchinson (R-TX), and approved by the Senate Commerce Committee. The Senate bill would allocate, without auction, an additional swath of 700 MHz band “D Block” spectrum for public safety use and provide $7 billion to a new quasi-governmental entity named the “Public Safety Broadband Corporation” to fund and oversee the a new public safety network. This plan conflicts with draft legislation introduced by House Republicans of the House Energy and Commerce Committee. The House bill would not allocate the additional D Block spectrum but rather would auction this additional spectrum to commercial wireless companies that would construct nationwide networks for use by the public safety community. House Republicans contend that auctioning the D Block to private industry would save taxpayers from having public safety entities construct the networks and would likely result in the networks becoming operational much more rapidly. The House Republican draft legislation would have also allowed successful spectrum auction bidders to remain exempt from certain transparency rules imposed by the FCC's 2010 Net Neutrality Order, a provision omitted from the new jobs bill.

The White House bill authorizes the FCC to hold incentive auctions for non-D Block broadcast spectrum. In addition, it directs the agency to recover a substantial portion of the value of terrestrial broadband deployment rights originally set aside for satellite services through new spectrum fees on certain non-broadcast television and public safety licensees. In addition to receiving auction revenue, broadcast licensees may also be eligible for reimbursement of the costs incurred in “repacking” their licenses from their current allocations in order to make contiguous spectrum blocks available for auction. The Commission would also be given authority to adopt rules that allow public safety entities to roam and receive priority access on commercial networks during emergencies. The FCC would be required to make regular reports to Congress on the use of public safety spectrum and provide suggestions on how to increase spectrum efficiency. 

Wireless industry organizations, such as Mobile Future, quickly praised the auction proposal, stating that the additional spectrum freed under the proposal could produce half a million new jobs. A group of computer and software developers asked the FCC to “accelerate” the reassignment of spectrum to mobile broadband use if the agency receives auction authorization from Congress. Democratic leaders also called for prompt consideration of the President’s plan to avoid the delays, party conflicts, and broadcast industry opposition which hampered consideration of earlier spectrum auction proposals.

But some telecom observers suggest that the Obama Administration may be courting criticism from former allies through the new legislation. Specifically, the proposed legislation does not contain any language preserving the use of unassigned spectrum for unlicensed use. Major Internet companies, such as Google, which previously supported the Administration’s efforts regarding auctions, hoped to use this “white space” spectrum to expand broadband network coverage. The observers further contend that the bill could undermine the goodwill the administration cultivated with television broadcasters over the past few months on establishing auctions with sufficient protections for incumbent television licensees.

Even if opponents manage to strike incentive auctions from the new jobs legislation, the bipartisan “supercommittee” created during the debt debate could separately push broadcast spectrum auctions through debt reduction legislation. Public safety advocates have already lobbied many lawmakers on the supercommittee to include funding for a public safety network in any plan it sends to Congress later this year.

Google Loses Skirmish in "Wardriving" Class Actions [UPDATED 7/15/11]

By Dan Royalty

 Update (7/21/11):

U.S. District Judge James Ware on Monday granted Google’s request to certify his decision for appeal to the Ninth Circuit. The court noted that it had earlier found that the dispute “presents a case of first impression as to whether the Wiretap Act imposes liability upon a defendant who allegedly intentionally intercepts data packets from a wireless home network” and a “novel question of statutory interpretation.” Given the novelty of the issues presented, the court concluded that its earlier decision “involves a controlling question of law as to which there is a credible basis for a difference of opinion” and certified the decision for immediate interlocutory appeal. In granting Google’s motion, the court also stayed the case pending resolution of the matter on appeal.

-------

The Northern District of California issued an interesting, and at first blush, surprising, decision in the consolidated Google Street View privacy class actions last week, exploring some rarely trod real estate within the federal Wiretap Act, 18 U.S.C. § 2510 et seq., and denying Google’s attempt to dismiss the federal wiretap claims against it.  The court held that WiFi transmissions—which are carried by radio waves—are not “radio communications” under the Wiretap Act.  It also rejected Google’s argument that transmissions across unencrypted WiFi networks are “readily accessible to the general public,” because plaintiffs claimed that the packet sniffing software needed to intercept those transmissions are not readily available.  These rulings may be surprising to technophiles who know that WiFi is transmitted via radio waves, and who know at least three locations where free packet sniffing software can be downloaded. After the jump we explain the background of these cases and why, properly framed, the court’s decision is not so surprising after all.

 

Update (7/21/11)

The practice of driving around with a laptop to detect and record WiFi access points is known as “wardriving.” Google’s wardriving troubles began in spring 2010 when German data authorities questioned Google’s practice of collecting WiFi network information along with pictures from its roving Street View vehicles. 

Google acknowledged that its Street View cars collected WiFi network information such as network name and MAC address, but initially denied that its cars collected any payload data—i.e., the cars had not collected the content of any communications transmitted across WiFi networks. However, after the data protection authority of Hamburg, Germany asked Google to audit the Street View WiFi data it had retained, Google retained a forensic firm to do so and released its report. That report confirmed that the Google software stored payload data transmitted from unencrypted wireless networks, and Google began the mea culpas.

Unsurprisingly, several class action lawsuits were soon filed against Google around the United States, alleging that its collection of WiFi data violated the federal Wiretap Act, state wiretap laws, and other state statutory and common laws. These lawsuits were transferred and consolidated before Judge James S. Ware of the Northern District of California.

The federal Wiretap Act makes it unlawful to intentionally intercept any electronic communication. 18 U.S.C. § 2511(a). “Electronic communication” is broadly defined under the law to include any transfer of data by, among other things, radio, easily reaching Google’s collection of data collected from WiFi access points. 

In its motion to dismiss, Google sought the shelter of one of several exceptions to the Wiretap Act. That exception carves out from liability any interception of an electronic communication “made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.” 18 U.S.C. § 2511(g)(i) (emphasis added). Section 2510(16) defines communications that have been scrambled or encrypted, among other things, as not readily accessible to the general public. However, the statute defines “readily accessible to the general public” only “with respect to a radio communication.” 18 U.S.C. § 2510(16). 

The question, then, was whether the WiFi signals intercepted by Google could be considered “radio communications” under the law. WiFi signals are transmitted by radio waves using the IEEE 802.11 radio standards, and thus, Google argued, they should be considered radio communications. Because plaintiffs had not pleaded that their WiFi signals were scrambled or encrypted, their networks should be considered readily accessible to the general public, and Google could not be held liable for intercepting their broadcasts. Plaintiffs argued that Congress meant something narrower than all communications transmitted by radio waves when it used the phrase “radio communications,” and that electronic communications transmitted by WiFi networks fell outside Congress’s intended definition. 

Finding the statutory text ambiguous, Judge Ware took a deep dive into legislative history. He sussed out that Congress’s definitions of “electronic communication” and “radio communication” were largely written to bring the Wiretap Act in line with new standards of electronic communications, and to quell the concerns of radio scanning enthusiasts, respectively. After examining the legislative history and parsing other parts of the law that address “radio communications,” Judge Ware concluded that “radio communications” should be limited to “traditional radio services.” Because WiFi was not a traditional radio service, it did not qualify as a radio communication. Thus, for electronic communications, “readily accessible to the general public” was undefined under the Wiretap Act, and plaintiffs did not need to plead around the Section 2510(16) exception to liability.

Finally, the court rejected Google’s argument that, even under an ordinary meaning of the phrase, plaintiffs’ WiFi networks were “readily accessible to the general public.” Google had seized on plaintiffs’ claim that their networks were open and unencrypted, and argued that this meant that they were readily accessible to the general public. But plaintiffs claimed that only by using “rare packet sniffing software,” not widely available, was Google able to intercept the WiFi packets. The Court found that plaintiff had properly made out a claim under the Wiretap Act, and allowed the case to proceed.

To those familiar with the ubiquity and ease-of-use of packet sniffing software, this last ruling stands out. But at the motion to dismiss stage, the court was required to accept as true plaintiffs’ claims that the means by which Google intercepted payload data was not generally available to the public. Google will almost certainly mount a strong factual challenge on that point. But now the putative class representatives have stated a claim under the Wiretap Act, and will be able to move their cases towards class certification.

FTC Launches Antitrust Investigation Against Google

By Ryan Demotte

Last week Google acknowledged in an SEC filing that the Federal Trade Commission has launched a formal antitrust inquiry into the company’s search and advertising business practices, issuing a subpoena and notice of a civil investigative demand to the company. According to news reports, FTC lawyers have been informally gathering information for several months concerning the way Google orders search results and advertising. By taking this step, the FTC can compel Google to turn over a wide range of internal information concerning its business. Rivals argue that Google engages in anticompetitive conduct by using its dominance in the search market to favor its own services and reduce web traffic to competing services. Google already faces a similar investigation by European regulators.

In a response posted on its official blog, Google provided a preview of what may be its core defense to any antitrust allegations – that competition in the search engine market is “only one click away,” and that users are free to use any of a variety of alternatives to Google. 

Using Google is a choice – and there are lots of other choices available to you for getting information: other general-interest search engines, specialized search engines, direct navigation to websites, mobile applications, social networks, and more.   

According to this line of reasoning, since consumers, i.e. search engine users, can switch to alternative search engines at virtually no cost, Google does not have market power. Critics, on the other hand, point to Google’s high market share – over 66 percent in the U.S. and greater in Europe - as evidence that Google effectively controls traffic to web sites, and thus does have market power in search that can be leveraged anti-competitively in other businesses.

While Google has faced antitrust scrutiny on some of its acquisitions in the past, this investigation is the first to focus on its core business of search and advertising, and thus presents potentially serious legal risk for the company.