Wednesday, July 13, 2016
Ninth Circuit Appeals Panel Partially Reverses Facebook’s $3 Million Spam Award
By KENNETH OFGANG, Staff Writer
The Ninth U.S. Circuit Court of Appeals yesterday reversed, in substantial part, an award of more than $3 million to Facebook, Inc. against a social-networking integration company that sent spam emails to Facebook users.
The panel said the case against Power Ventures, Inc. and its chief executive officer Steve Vachani must be reconsidered because one of the two statutes on which the award was based didn’t apply and the other only applied in part.
Facebook claimed that Power lured users of the social network into giving entrée to their contact lists and then sent those contacts spam emails advising them to join the now defunct power.com, which aimed to combine content from social networks of users in one central machine.
The emails went to more than 60,000 targets with ‘spoofed’ header particulars that gave the apparent look of coming from facebookmail.com, and asserted to be from The Facebook Team. U.S. District Judge Lucy H. Koh of the Northern District of California—who faces a Senate committee hearing today on her nomination to be a judge of the Ninth Circuit—found that Power infringed upon Facebook’s rights under the Controlling the Assault of Non-Solicited Pornography and Marketing Act, more popularly known as the CAN-SPAM Act.
The damage award was calculated on the basis of $50 in statutory damages for each of the 60,627 junk emails the judge found to have been sent. She also enjoined Power and Vachani from engaging in similar activities in the future, and mandating that they destroy data unlawfully acquired from Facebook and its users.
Vachani criticized the judgment at the time, telling valuewalk.com that it “set a dangerous model for the future of user’s rights to own and control their data.”
The appeals court, in yesterday’s opinion by Judge Susan P. Graber, said the CAN-SPAM Act did not apply because the messages sent by Power to Facebook users were not “materially misleading” in the sense intended by the statute.
The judge explained:
“It is true that the CAN-SPAM Act includes as materially misleading a technically accurate header that includes information accessed through false or fraudulent pretenses or representations….But Power users consented to Power’s access to their Facebook data. In clicking ‘Yes, I do!,’ users gave Power permission to share its promotion through event invitations.”
Nor, she wrote, were internal messages sent though the Facebook system misleading under the act, because the body of the messages accurately identified Power and included a link to its website, and the Facebook users who were identified as the senders actually did send the messages.
Graber went on to say, however, that the defendants did violate the Computer Fraud and Abuse Act of 1996, or CFAA, which prohibits the intentional accessing of a computer without authorization or in excessed of authorized access, if the trespasser “obtains…information from any protected area.”
While Power users arguably gave the company permission to use Facebook’s computers, and Power reasonably could have thought that consent from Facebook users was equivalent to permission from the company itself, whatever permission it had was expressly rescinded on Dec. 1, 2008 when Facebook became aware of Power’s campaign and sent a cease-and-desist letter, the appellate jurist explained.
“[A]s it admitted, Power deliberately disregarded the cease and desist letter and accessed Facebook’s computers without authorization to do so,” the judge wrote. “It circumvented IP barriers that further demonstrated that Facebook had rescinded permission for Power to access Facebook’s computers. We therefore hold that, after receiving written notification from Facebook on December 1, 2008, Power accessed Facebook’s computers ‘without authorization’ within the meaning of the CFAA and is liable under that statute.”
The panel sent the case back to the district judge “to reconsider appropriate remedies under the CFAA…including any injunctive relief” and to recalculate CFAA damages covering only the period after Power received the cease and desist letter.
The case is Facebook, Inc. v. Power Ventures, Inc., 13-17102.
Copyright 2016, Metropolitan News Company