The 3rd Party Doctrine: Or Why Lawyers May Not Ethically Be Able To Use Whatsapp

from the metadata-matters dept

In December I went to install the Flywheel app on my new phone. Flywheel, for those unfamiliar, is a service that applies the app-dispatching and backend payment services typical of Uber and Lyft to the local medallion-based taxi business. I'd used it before on my old phone, but as I was installing it on my new one it asked for two specific permissions I didn't remember seeing before. The first was fine and unmemorable, but the second was a show-stopper: "Allow Flywheel access to your contacts?" Saying no made the app exit with passive-aggressive flourish ("You have forcefully denied some of the required permissions.") but I could not for the life of me figure out why I should say yes. Why on Earth would a taxi summoning app require access to my contacts? Tweets to the company were not answered, so it was impossible to know if Flywheel wanted that permission for some minor, reasonable purpose that in no way actually disclosed my contact data to this company, or if it was trying to slurp information about who I know for some other purpose. Its privacy policy, which on the surface seems both reasonable and readable, was last updated in 2013 and makes no reference to why it would now want access to my contacts.

So I didn't finish installing it, although to Flywheel's credit, a January update to the app seems to have re-architected it so that it no longer demands that permission. (On the other hand, the privacy policy appears to still be from 2013.) But the same cannot be said for other apps that insist on reading all my contacts, including, conspicuously, Whatsapp.

Whatsapp has been in the news a lot lately, particularly in light of Facebook's announcement that it planned to merge it with its Messenger service. But the problem described here is a problem even as the app stands on its own. True, unlike the old Flywheel app, Whatsapp can currently be installed without demanding to see the contact information stored on my phone. But it can't be used effectively. It can receive an inbound message from someone else who already knows my Whatsapp number, but it refuses to send an outbound message to a new contact unless I first let Whatsapp slurp up all my contacts. Whatsapp is candid in its privacy policy (last updated in 2016) that it collects this information (in fact it says you agree to "provide us the phone numbers in your mobile address book on a regular basis, including those of both the users of our Services and your other contacts."), which is good, but it never explains why it needs to, which is not good. Given that Signal, another encrypted communications app, does not require slurping up all contacts in order to run, it does not seem like something Whatsapp should need to do in order to provide its essential communications service. The only hint the privacy policy provides is that Whatsapp "may create a favorites list of your contacts for you" as part of its service, but it still isn't obvious why it would need to slurp up your entire address book, including non-Whatsapp user contact information, even for that.

The irony is that an app like Whatapp should be exactly the sort of app that lawyers use. We are duty-bound to protect our clients' confidences, and encrypted communications are often necessary tools for maintaining a meaningful attorney-client relationship because they should allow us to protect the communications secrecy upon which the relationship depends. But that's exactly why I can't use it, didn't finish installing the old Flywheel app, and refuse to use any other app that insists on reading all my contacts for no good, disclosed, or proportionally-narrow reason: I am a lawyer, and I can't let this information out. Our responsibility to protect client confidences may very well extend to the actual identity of our clients. There are too many situations where if others can know who we are talking to it will be devastating to our clients' ability to seek the counsel to which they are Constitutionally entitled.

I wrote about this problem a few years ago in an amicus brief on behalf of the National Association of Criminal Defense Lawyers for the appeal of Smith v. Obama. This case brought a constitutional challenge to the US government's practice of collecting bulk metadata from Verizon Wireless without warrants and without their incumbent requirements of probable cause and specificity. Unfortunately the constitutional challenge failed at the district court level, but not because the court couldn't see how it offended the Fourth Amendment when so much personal information could be so readily available to the government. Instead the district court dismissed the case because the court believed that it was hamstrung by the previous Supreme Court ruling in Smith v. Maryland. Smith v. Maryland is the 1979 case that gave us the third-party doctrine, this idea that if you've already disclosed certain information (such as who you were dialing) you can no longer have a reasonable expectation of privacy in this information that the Fourth Amendment should continue to protect (and thus require the government to get a warrant to access). Even in its time Smith v. Maryland was rather casual about the constitutionally-protected privacy interests at stake. But as applied to the metadata related to our digital communications, it eviscerates the personal privacy the Fourth Amendment exists to protect.

The reality is that metadata is revealing. And as I wrote in this amicus brief, the way it is revealing for lawyers not only violates the Fourth Amendment but the Sixth Amendment right to counsel relied upon by our clients. True, it is not always a secret who our clients are. But sometimes the entire representation hinges on keeping that information private.

Thus metadata matters because, even though it is not communications "content," it can nevertheless be so descriptive about the details of a life. And when it comes to lawyers' lives, it ends up being descriptive of their clients' lives as well. And that's a huge problem.

As the brief explained, lawyers get inquiries from uncharged people all the time. Perhaps they simply need advice on how to comport their behavior. Or perhaps they fear they may be charged with a crime and need to make the responsible choice to speak with counsel as early as possible to ensure they will have the best defense. The Sixth Amendment guarantees them the right to counsel, and this right has been found to be meaningful only when the client can feel assured of enough privacy in their communications to speak candidly with their counsel. Without that candor, the counsel cannot be as effective as the Constitution requires. But if the government can easily find out who lawyers have been talking to by accessing their metadata, then that needed privacy evaporates. Who a lawyer has been communicating with, especially a criminal defense lawyer, starts to look like a handy list of potential suspects for the government to go investigate.

And it's not just criminal defense counsel that is affected by metadata vulnerability. Consider the situation we've talked about many times before, where an anonymous speaker may need to try to quash some sort of discovery instrument (including those issued by the government) seeking to unmask them. We've discussed how important it is to have procedural protections so that an anonymous speaker can find a lawyer to fight the unmasking. Getting counsel of course means that there is going to be communication between the speaker and the lawyer. And even though the contents of those communications may remain private, the metadata related to the communications may not be. Thus even though the representation may be all about protecting a person's identity, there may be no way to accomplish it if it turns out there's no way for the lawyer to protect that metadata evincing this attorney-client relationship from either the government helping itself to it, or from greedy software slurping it up – which will make the app maker yet another third party that the government can look to demand this information from.

Unfortunately there is no easy answer to this problem. First, just as it's not really possible for lawyers to avoid using the phone, it is simply not viable for lawyers to avoid using digital technology. Indeed, much of it actually makes our work more productive and cost effective, which is ultimately good for clients. And especially given how unprotected our call records are, it may even be particularly important to use digital technology as an alternative to standard telephony. To some extent lawyers can refuse to use certain apps or services that don't seem to handle data responsibly (I installed Lyft and use Signal instead), but sometimes it's hard to tell the exact contours of an app's behavior, and sometimes even if we can tell it can still be an extremely costly decision to abstain from using certain technology and services. What we need, what everyone needs, is to be able to use technology secure in the knowledge that information shared with it travels no farther and for no other purpose than we expect it to.

Towards that end, we – lawyers and others – should absolutely pressure technology makers into (a) being more transparent about how and why it is accessing metadata in the first place, (b) enabling more gradated levels of access to it, and use of it, so that we don't have to tell any app or service more than it needs to know about our lives for it to run, or that it might ever have to ask for any more than it needs in order to run, and (c) being more principled in both their data sharing practices and resistance to government data demands. Market pressure is one way to affect this outcome (there are a lot of lawyers, and few technologies can afford to be off-limits to us), and perhaps it is also appropriate for some of this pressure to come from regulatory sources.

But before we turn to regulators in outrage we need to aim our ire carefully. Things like the GDPR and CCPA deserve criticism because they tend to be like doing pest control with a flame thrower, seeking to ameliorate harm while being indifferent to any new harm they invite. But the general idea of encouraging clear, nuanced disclosures of how software interacts with personal data, as well as discouraging casual data sharing, is a good one, and one that at the very least the market should demand.

The reality of course is that sometimes data sharing does need to happen – certain useful services will not be useful services without data access, and even data sharing among partners who together supply that service. It would be a mistake to ask regulators to prevent it altogether. Also, it is not private actors who necessarily are the biggest threat to the privacy interests we lawyers need to protect. Even the most responsible tech company is still at the mercy of a voracious government that sees itself as entitled to all the data that these private actors have collected. Someday hopefully the courts will recognize what an assault it is on our constitutional rights for metadata access not to be subject to a warrant requirement. But until that day comes, we should not have to remain so vulnerable. When we turn to the government to help ensure our privacy, our top demand needs to be for the government to better protect us from itself.

Filed Under: 3rd party doctrine, confidentiality, contact info, lawyers, metadata, privacy
Companies: facebook, whatsapp

DOJ Unconcerned About The Constitution, Obtained AP Reporters' Phone Records

from the freedom-of-the-press?-ha!-what's-that? dept

We've talked quite a bit about how the federal government has been pretty aggressively shattering any remnants of the 4th amendment, and while there are some parts of the 1st amendment that are still respected, our government doesn't always seem so keen on that one either. Apparently, they've decided to kill two birds with one stone recently, in obtaining a broad collection of phone records concerning Associated Press journalists, which is almost certainly in violation of the law. The AP only just found out about this on Friday, despite the data already being obtained, and covering more than 20 separate phone lines (including work, home and mobile phones) for multiple AP journalists -- and a period covering approximately two months in early 2012. The AP has sent a quite reasonably angry letter to Attorney General Holder about this collection.

There can be no possible justification for such an overbroad collection of the telephone communications of The Associated Press and its reporters. These records potentially reveal communications with confidential sources across all of the newsgathering activities undertaken by the AP during a two-month period, provide a road map to AP’s newsgathering operations, and disclose information about AP’s activities and operations that the government has no conceivable right to know.

That the Department undertook this unprecedented step without providing any notice to the AP, and without taking any steps to narrow the scope of its subpoenas to matters actually relevant to an ongoing investigation, is particularly troubling.

The sheer volume of records obtained, most of which can have no plausible connection to any ongoing investigation, indicates, at a minimum, that this effort did not comply with 28 C.F.R. §50.10 and should therefore never have been undertaken in the first place. The regulations require that, in all cases and without exception, a subpoena for a reporter’s telephone toll records must be “as narrowly drawn as possible.’’ This plainly did not happen

The AP also (again, quite reasonably) notes that this appears to be a "serious interference with AP's constitutional rights to gather and report the news" and demand that the government destroy all copies of the data it received.

This really is an incredibly broad move by the government. Especially when it comes to reporters, the government has generally respected the right for reporters to keep their sources private, even if this administration has been known to threaten reporters if they won't reveal sources. In case you're wondering the law here is pretty clear about the limitations on getting this kind of info.

There should be reasonable ground to believe that a crime has been committed and that the information sought is essential to the successful investigation of that crime. The subpoena should be as narrowly drawn as possible; it should be directed at relevant information regarding a limited subject matter and should cover a reasonably limited time period. In addition, prior to seeking the Attorney General's authorization, the government should have pursued all reasonable alternative investigation steps as required by paragraph (b) of this section.

I'm sure that Eric Holder will try to tapdance around this one as well, but the claims here are very serious. On the positive side, perhaps this will finally help the press wake up to the continued expansion of the federal government's surveillance operations and their general disdain for the constitution if it helps them go after whoever they want. The press likes to go nuts when some startup accidentally leaks some data or tracks what people are doing online, but routinely ignores how the government seems to feel entitled to any bit of private data about anyone, often without a warrant. Perhaps having the press have their records taken will wake some of them up to the fact that it impacts them as well (perhaps even more than others).

Filed Under: 1st amendment, 4th amendment, confidentiality, doj, eric holder, reporters, sources
Companies: associated press

Miami Heat Owner Now Threatening To Separately Sue The Lawyer Defending Blogger Who Linked To Unflattering Image

from the the-plot-thickens dept

So... remember that story we just had about Raanan Katz, a real estate developer and a minority owner of the Miami Heat suing a blogger for defamation (and seeking to have her entire blog shut down and stop her from future posting) and then for copyright infringement over a hotlink to an "unflattering" photo of Katz? We'd mentioned that the blogger was defended by lawyer Marc Randazza, who has now revealed that Katz's lawyers are now threatening to sue him directly if he doesn't give up confidential attorney-client communications.

Katz's lawyers sent Randazza a "draft complaint" they say they are prepared to file against him, claiming that he "acted in concert" with the blogger, and "substantially assisted or encouraged her in unlawful activities or have given substantial assistance to her in accomplishing a tortious result, and your own conduct, separately considered, constitutes a breach of duty."

Randazza has responded, in court as part of the ongoing lawsuit, asking for a protective order against this "threatened litigation," which Randazza suggests is really intended to get access to communications between him and his client, breaking lawyer-client confidentiality.

This letter seeks discovery of facts and circumstances outside of the Florida Rules of Civil Procedure.... This letter seeks exculpatory data from a Defendant's attorney which is clearly attorney-client communications. In order to avoid being sued by RKA, defense counsel must tell RKA's lawyers how and why defense counsel did not assist or promote Defendant's critical blogging about the RKA Plaintiffs.

Given the activity in this case already, this certainly feels like an attempt to bury the case in more paperwork. We've seen this kind of thing before, with wealthy individuals who file a bunch of lawsuits, including against the lawyers who defend those they sue. It certainly seems like an attempt to create a nuisance, rather than to address any actual legal conflict (and, yes, to Katz's lawyers: that's an opinion).

Filed Under: civil procedure, confidentiality, defamation, marc randazza, raanan katz
Companies: miami heat

NY Company Threatens 800Notes Via UK In Legal Comedy Of Threats & Errors

from the where-to-start? dept

We've recently had our own run-in with a ridiculous threat of a libel lawsuit from the UK, in what appeared to be a clear attempt to intimidate us, rather than an action with any serious legal basis. As we mentioned in that post, thankfully, the US recently passed an important and broad anti-libel tourism law that protects US websites against overreaching foreign libel claims that go against US laws, such as Section 230 safe harbors for service providers.

So, we're always interested in hearing about other similar threats, and here's a doozy that gets more ridiculous the further you read. It starts off with just such a libel tourism attempt, but then devolves into a true comedy of threats and errors, involving misaddressed threats, ridiculous claims of confidentiality and implied threats of copyright lawsuits on publishing the letters that reveal this comedy of errors. Make sure you read through the whole thing.

It starts out with a NY-based company, GDS Publishing, who was apparently upset about the complaints about its telemarketing practices found on the website 800notes.com, specifically calling out the NY-based phone number (212 area code) used by GDS. After GDS complained to Julia Forte, who runs the site, she removed the comments that violated the site's terms of service, but left plenty of the other (non-violating, but still complaining) comments up, which GDS apparently did not appreciate. It then had a UK law firm threaten to sue her in the UK under UK libel laws. Now, it is true that GDS's parent company is based in the UK, but Julia and 800notes are in the US, and thus protected by Section 230 and the libel tourism law. And, while it doesn't even matter, given 800notes' status, this was about actions by the subsidiary, which is incorporated in New York, and all of the actions and complaints concerned that NY company (using a NY phone number).

Already, this seems like a classic case of over-aggressive lawyering, perhaps from someone unaware of the SPEECH Act, or from someone who simply hoped to intimidate an American website into compliance. However, the story gets even more ridiculous. First, the lawyer in question, one Leigh Ellis of Gillhams Solicitors LLP in the UK, apparently made a typo when copying the email address of Ms. Forte from the whois page for 800notes, resulting in him sending the initial complaint to a totally different Julia Forte (who happened to be a lawyer) based in NY, rather than the 800notes Julia Forte (who happens to live in North Carolina). Oops.

After the NY lawyer Julia Forte told Ellis of his mistake, rather than recognizing that he made a mistake, Ellis appears to have both emailed the same (wrong) Julia Forte again, and interpreted the email from the NY lawyer Julia Forte to mean that the North Carolina 800notes Julia Forte was denying her association with the site -- even though the NY lawyer Julia Forte told Ellis that he had the wrong email address. So, instead of correcting the mistake and emailing the correct Julia Forte, he sent a letter to 800notes' webhost, SoftLayer Technologies (pdf), claiming that the content on 800notes was defamatory, and saying that Forte "has informed us that she is not associated with the Website," and asking SoftLayer to confirm that Ms. Forte really is the account holder, and also demanding that SoftLayer take down the content GDS doesn't like, or face defamation charges itself.

Ah, the comedy of errors. Of course, it was the wrong Julia Forte who accurately denied being associated with the website. The correct Julia Forte has no problem standing behind her site. Thankfully, SoftLayer is well aware of the legal issues involved here, and well aware of Section 230 and the SPEECH Act that protects it, as well as Julia Forte, so it passed along the letters to Forte's lawyer, Paul Levy. If only the comedy of threats and errors ended there. But, it did not...

Levy responded in great detail to Ellis (pdf), highlighting the specific legal realities of Section 230 and the SPEECH Act, as well as detailing Ellis' own mistakes in emailing the wrong person. You should read the letter. It gets better and better as it goes along (or just skip to page 3): Comedy of threats and errors over? Not by a long shot. After receiving Levy's letter, as well as an email correspondence in which Levy noted plans to publish Ellis's original letter to SoftLayer Technologies, Ellis' firm, Gillhams tried to warn Levy that publishing the original letter would be "unlawful" (pdf). Specifically, the law firm claims that since the original letter said "NOT FOR PUBLICATION" across the top, he had no license to publish it, and since all of their emails have a boilerplate "confidentiality notice" at the bottom, it prevents publication.

Of course, such things are simply not legally binding, leading Levy to (1) question whether or not Gillhams is charging GDS Publishing by the hour and (2) highlight how Gillhams appears to have misstated its own confidentiality clause and gotten confused over who might hold any copyright (and, thus, license-rights) to the letter in question. His response is here (pdf), though I'll restate the relevant paragraphs:

My question about whether you have been charging GDS Publishing by the hour is relevant because, in the criticism of your conduct that I am drafting for publication, I am trying to figure out whether your misadventures in trying to send correspondence to Forte, and your subsequent threats directed to SoftLayer, reflect only incompetence, or rather reflect an effort to run the meter at your client's expense. I'd be grateful, therefore, if you would respond to my question.

Finally, I note your email referring to confidentiality notices that are contained in your emails. Even if the emails purported to forbid publication, such notices do not override fair use. Sad to say, however, you have misstated the fine print in your own emails. I invite you to re-read that text. The disclaimer says that the emails "may" contain privileged or confidential information, not that they do. I see nothing in the emails that merits treatment as either privileged or confidential in any event. Moreover, they instruct the recipients not to disseminate the emails if they are NOT the intended recipients. By negative implication, these notices tell the intended recipients that they ARE free to disseminate the emails. Your office deliberately sent the emails to me, thus effectively giving me permission to publish them.

Your letter also states that your "clients" are reserving their rights about the publication of your letter and emails. However, I see no reason to believe that your clients own the copyright in your letters. The owner would be you and/or your firm. If you choose to try to enforce the copyright by raising a claim of infringement, you will have to do so in your own name.

As Levy notes in his blog post on the whole situation: "I invite Ellis to bring suit here in the United States and show us that he is right. Ellis is also invited to use the comment feature to reply."

Filed Under: confidentiality, copyright, defamation, errors, julia forte, leigh ellis, libel tourism, section 230, threats, uk
Companies: 800notes, gds publishing, gillhams

Misguided Insult To Misguided Injury: HP Sues To Stop Mark Hurd From Taking New Job

from the what-a-waste dept

The most credible explanation I've seen so far as to why HP fired Mark Hurd last month, even after it determined that he had not actually engaged in sexual harassment, was that the Mark Hurd help lead the investigation into the board over the infamous pretexting scandal, and that the whole story about the supposed harassment and fudged expense reports were just an excuse to get rid of a CEO the board didn't like -- even as he was performing tremendously well.

If that explanation is actually true, it also helps explain the news that HP is now going to sue Hurd for accepting his new job as President at Oracle. As HP's lawyers absolutely must know, California has a law that the courts have interpreted quite broadly, that says noncompete agreements are not enforceable, because you cannot deny a person the right to earn a living. HP is (weakly) trying to get around this by claiming the job shift would violate "confidentiality agreements" and trade secrets, but there's almost no chance a court buys that. The lawsuit seems like a non-starter. In fact, the only reason for filing the lawsuit really seems to be an absolute pest. It's an incredibly childish move by a company that should know better.

Filed Under: confidentiality, mark hurd, noncompete, trade secrets
Companies: hp, oracle

Documentary Filmmaker Has To Turn Over Some Footage To Chevron

from the not-so-shielded-after-all dept

Back in May, we wrote about a judge ordering a documentary filmmaker to turn over the footage that didn't make the film to Chevron. The documentary was about Chevron's alleged involvement in Ecuadorian rainforest pollution, and Chevron believes that some of the cut footage will help get a case that has been filed against it in Ecuador dismissed. The filmmaker tried to raise press protections, but the district court judge shot that down, saying that the material was not confidential (and, in fact, was filmed knowing it might be made public). The case was appealed, and the appeals court wasted little time in again telling the filmmaker to hand over footage, but the court also appears to have limited the scope somewhat:

• Berlinger has to turn over all footage showing (1) plaintiffs' counsel in Chevron's civil lawsuit in Ecuador, (2) private or court-appointed experts, and (3) current or former Ecuadorian officials;
• Chevron can only use the material produced for litigation, arbitration or submission to official government bodies;
• Chevron must pay for all reasonable costs incurred by Berlinger in turning over the footage; and
• The district court below shall maintain jurisdiction to address any disputes relating to the release of the footage.

Apparently, both sides are claiming victory, but as Itai Maytal at the Citizen Media Law Project notes, the full details of the ruling (not yet issued) will matter a lot, and no matter what, this could be seen as a "weakening" of previous case law about reporter's privileges, which could lead to more lawsuits against reporters.

Filed Under: confidentiality, documentary, footage, privacy
Companies: chevron

Open Sourcing A Disease Diagnosis

from the with-enough-eyes,-all-biological-bugs-are-shallow dept

If you follow Larry Lessig on Twitter, you noticed that all day Monday he was putting messages on Twitter about how "JZ" was sick and was trying to "open source" his diagnosis. This pointed to a blog that only referred to "JZ" as "Z" and had some basic info on the symptoms of "the patient." There were a series of blog posts, detailing some of the details of the sickness, tests that had been done, and some of the general questions that the doctors were trying to zone in on. It even included a list of possible diagnoses, crossing out the ones that had been ruled out. Relatively quickly, two separate readers came up with an obscure medical journal article from South Korea from 1994 "about heptatic mega-hemagionas and FUOs," which apparently quite accurately described the situation.

It didn't take long for people to realize that the JZ was Harvard professor Jonathan Zittrain, and once revealed, he put up a blog post of his own clarifying the situation, noting that they no longer needed help with the diagnosis, and everything sounds fine (what they diagnosed sounds treatable). He especially wanted to downplay the situation, and not create too much concern for his well-being or the need for any immediate help. The original blog where the details were being shared was taken down, and it now just points to Zittrain's own explanation.

It's great to hear that this worked out, and so rather than worrying about Jonathan, I thought it was interesting to think about this aspect of "open sourcing" a diagnosis. Obviously, when it comes to medical info, there are always serious privacy concerns, but this definitely does seem like a case where when there's confusion, more eyes and more brains can help. I'm reminded of the silly complaint often lodged against Wikipedia, that people wouldn't want brain surgery done by "a crowd," but by an expert. But, as has been noted over and over again, that presumes the crowd includes no experts, and that the real experts won't quickly establish themselves as such. On top of that, it ignores that once you have many different people -- some experts, some not -- you may get obscure or different perspectives that help lead to the important nugget of info you were seeking out, such as a medical journal article from Korea in 1994.

All this has me wondering if there's an opportunity out there for the medical profession to make more use of something like this, with patient consent, obviously. I know doctors converse informally all the time, but opening up some aspects of the diagnosis could be interesting. Of course, I also don't know how often situations like this occur, where the diagnosis is obscure enought that additional help might be useful, but it seems like an area that has possibilities.

Filed Under: confidentiality, crowd sourcing, jonathan zittrain, larry lessig, medicine