Published on: | by

In our last blog post, we mentioned eBay, Inc. v. Bidder’s Edge, Inc. While the case wasn’t related directly to ransomware, it creates an important precedent for tort liability. Specifically, it supports the idea that common law torts can be carried out and applied in the digital world.  So, what does eBay give us as a legal theory? How might it get applied to ransomware in a hypothetical case? What is the likelihood of succeeding on such a case?

Case Analysis: eBay, Inc. v. Bidder’s Edge, Inc.

In this case, eBay sued Bidder’s Edge for the use of a type of program known as a “spider” or “bot.” These programs would automatically go to eBay, search for information, and repost it on Bidder’s Edge. The purpose of this was to allow others to get better ideas of what to bid on items by searching multiple auction sites. While there were negotiations to allow Bidder’s Edge to access eBay, however, the negotiations broke down, and ultimately prompted the lawsuit.

Continue Reading ›

Published on: | by

Now, we know what ransomware is and a little on how to fight against it.  So, what are the applicable statutes and how can you recover? Naturally, after a person pays the ransom, or loses their data, they have been harmed by a violation. This could be potentially devastating to a small business or an individual.  Yet, there’s no explicit way to recover the funds or recover from the harm except through a lawsuit. While, there is a statute specific to ransomware in California, individuals do have other avenues and claims.  What is this new statute? What can someone recover in a lawsuit? Are there any difficulties for ransomware lawsuits?

Ransomware Statutes

In September 2016, California passed a ransomware statute under SB 1137, which in essence amended Penal Code § 523.  This was prompted by an uptick of the attacks on hospitals.  In the statute, the use of ransomware is punishable by 2-4 years in prison. This is in line with treating ransomware like extortion crimes.  Furthermore, it defines ransomware in the statute as a “computer contaminant or lock placed or introduced without authorization into a computer . . . which the person responsible for the placement or introduction of the ransomware demands payment . . . to remove the computer contaminant . . .”

Continue Reading ›

Published on: | by

A business’s computer network, which may comprise of network and database servers, is the operation’s lifeline.  A successful business should require its computer network to be secure and protected.  There are many ways that these measures can go wrong.  Yes, sometimes hackers can get in and access sensitive information (e.g., trade secrets, intellectual property) without authority.  There are countless ways for a hacker to obtain unauthorized access to a private network.  However, what happens when the hacker has gained unauthorized access? In the hacker’s tool belt is a special kind of malware known as “ransomware.” What can ransomware accomplish? How can you spot it? How dangerous can it be to your business?

What is Ransomware?

As the name might suggest, ransomware is a program that holds (or claims to hold) data hostage.  It then encrypts data, and renders it inaccessible until the data owner pays off the hacker.  Generally, the hacker will place the malware on the host computer through an email attachment, special program, unverified email, or malware that accesses a computer through pivoting, and then releasing the “payload” which consists of the malware.  After ransomware is activated, it sends an alert on the electronic device, usually demanding payment to an account, in the form of cryptocurrency (e.g., Bitcoin) or credit card payment.

Continue Reading ›

Published on: | by

In the last article, we ended our comments with anonymous online speech and the related complications.  However, unmentioned before is an act that’s generally prohibited on websites, and indeed, it will probably be prohibited pursuant to state, federal, or international laws.  This is “doxing” which is a practice of taking another individual’s personal information – e.g., name, address, telephone, photographs or other confidential information and publishing it online without authorization.  So, how do doxers do it? How can you protect yourself? What are the remedies, if any?

What is doxing?

Doxing (a/k/a “doxxing”) is a common aspect of activism and vigilantism that occurs online.  Frighteningly, this action does not require an individual to necessarily perform an illegal act to “dox” a person. Rather, it relies on perseverance and the type of information is available to the general public.

Continue Reading ›

Published on: | by

Following from libel proof individuals to the realm of Twitter, and the “Wild-West” approach towards online statements, comes an interesting idea.  It is given that most people will communicate anonymously on the web.  So, if a person is a victim of libel, then how can he/she recover? The online service provider technically didn’t publish it, but only acted as the forum. The person who published the statement cannot be easily found because the statement was posted under a pseudonym.  So, what if the online service provider could be forced to give up identifying information (e.g., name, address, telephone, email, IP address) of the commenting individual? How much is that anonymity worth? Is there a way to actually engage in defamation and get away with it?

How does anonymity make things harder?

Naturally, an unknown person is difficult to sue in court.  The amount of damages he or she could pay is difficult to ascertain. While there are rules allowing a lawsuit without knowing the individual’s identity­­ (which is common in some cases), however, it adds the difficulty in discovering the identity of the “Doe Defendants.”

Continue Reading ›

Published on: | by

On the Internet, individuals can go out and make attempts to rib each other, or to mock certain celebrities or infamous individuals. This opens the realm of libel and slander laws to expand towards online activities. Yet, depending on the person’s history, defamation may be borderline impossible.  If defamation is harm to one’s reputation, then theoretically it should be impossible to harm an irredeemable reputation.  This idea is a concept known as being libel proof — i.e., a person who cannot be defamed any longer.  So, can a completely libel-proof person exist? How could someone argue the individual is libel proof? How might this affect online communications?

What is libel proof?

Libel proof means, quite simply, that a person cannot be defamed any further.  Generally, to even satisfy libel, it would have to be an unprivileged false written statement that was published towards third parties (compared to slander, which is an unprivileged false oral statement that was published towards third parties).  Even then, defamatory statements are judged differently to protect free speech interests.

Continue Reading ›

Published on: | by

Among the rights people have, many are unknown or unsung until there is a dispute and the courts get involved in the process. Rarely recognized is the right to reverse engineer under the Fair Use Doctrine and Digital Millennium Copyright Act.  However, this is not an absolute right.  Rather, it can be waived under certain circumstances. So, how can the right to reverse engineer be used? How might an individual hope to reverse engineer anything? Can you prevent others from reverse engineering your products?

What does the reverse engineering law apply to?

Reverse engineering is a method of taking a device or program and taking it apart to determine how it works, occasionally in attempts to duplicate or improve it. Generally, this would be applied to devices or physical products that are protected by patents. However, in the realm of copyright, reverse engineering is allowed in some situations. Specifically, this applies to computer programs to allow interoperability of devices or systems.  Since computer programs may be designed to only work with a few devices or systems, to allow a consumer to use them on another operating system, reverse engineering would be a necessity.  This would allow individuals to ensure programs operate without interference or to add integration features.

Continue Reading ›

Published on: | by

This month, we’re looking at various constitutional issues and tangential actions. Of these, there’s a recent hot-button issue regarding the purpose of “freedom of speech” online. From fake news to political speech on websites, the notion of “what is allowed” and “what should be allowed” is still raised by people.  So, what can a website do to maintain the balance between free speech rights and acceptable community standards? Is there any responsibility to allow negative views? What is the risk, if any, towards censorship?

Freedom of speech online

In the wake of 2016, there’s a new question of online service providers that if they allow people to express themselves then they should either act as a gate keeper or grant carte blanche to all users.  Most notably, there’s been the Facebook “fake news” complaints, as well as the actions of a Reddit executive towards supporters of Donald Trump. In the case of Facebook, there were both complaints that it was discriminatory not showing stories from every end of the political spectrum, and negligent that it was not taking action to curtail “fake news” and their influences.  For Reddit, an executive had made edits to statements by Trump supporters to change comments critical of him to individuals that were managing the Reddit group.

Continue Reading ›

Published on: | by

As we close out the year and enjoy the new technology from the holiday season, one piece of technology stands out as a forerunner.  It is something that we’ve dreamed and written about to the point it is a staple in science fiction. An artificial intelligence that anticipates and responds to a person’s desires and questions. This is the new technology, the “digital assistant,” such as Alexa, Siri, Cortana, and Google Home. These digital assistants manage to carry on conversations and answer questions.  How can these digital assistants think? How can they change and learn how to respond properly? Does the way these digital assistants work put data at risk?

How do digital assistants work?

Much like wearable technology, the digital assistant relies on “chatter” between itself and another computer hooked up through the internet.  However, the chatter tends to be slightly more reliant. Digital assistants, while they may have a few pre-programmed responses, are mostly reliant upon internet access to perform their duties. Alexa cannot work without WiFi, and Siri cannot work without a decent connection to data. When a person asks a digital assistant a question, the question is essentially pushed from the receiving device to the Cloud where it is answered, or some of the instructions are put out for the phone to follow. However, this may also entail, akin to a search history, a sort of assistant database where a person’s recorded voice may be kept, and in the case of the Amazon Echo at least, a user’s feedback on how Alexa did her job to allow it to grow and become more efficient, learning slang, or picking up on verbal tricks that are more similar towards human activities.

Continue Reading ›

Published on: | by

Wearable devices become more popular as the holiday season approaches. Among various new technologies, there’s a focus on the idea of wearable devices, which include items like smartwatches, fitness trackers, and other electronic accessories that can help make life easier.  However, with that comes the risk of privacy and security.  What would you need to know about your wearable device? What are the limitations of wearable devices? How secured are they, who has access to or owns the stored data?

What type of data do wearable devices collect?

When it comes to wearable devices, it is important to realize that the most prevalent data it stores tends to be personal, health, and fitness-related information.  For instance, the wearable device may track steps, take a pulse, measure heart rate, and in the case of the newer Apple Watch 2.0, they could record your geographic position. However, when it comes to other data, the wearable device’s ability is limited for the time being.

Continue Reading ›