The design depicts a legend that is common to several different tribes, which is the legend of the water serpent.  It has various names in different tribes, such as Kolowisi in Zuni, Pachua in Hopi, and Avanyu in tribes of the Rio Grande outlier regions.  When I showed the pot to a colleague, she commented that a very similar image was painted on the Zuni mission church. Later that day, we went to an upscale gallery in Santa Fe where I happened to notice this pot:

This might be an interesting exercise for an in-class discussion on what is protectable and what is not protectable cultural expression.  Of course, despite the shop owner’s assertions, neither utility nor design patents are apt here.  However, there could be source identification of a design with a particular artist.  (I did a quick search of the trademark office records online and, with the caveat that design mark records are notoriously difficult to find, didn’t find any marks registered by the artist.)  Perhaps the artist registered a copyright, and believes that affords exclusive protection.  In any event, this situation raises questions about the scope of various forms of IP protection, as well as public and private ownership of cultural expressions and heritage, which might be useful in the classroom.

Here are the basic facts: Nosal is charged with conspiracy to violate the CFAA, 18 U.S.C. 1030 because he conspired with employees at his former employer. Those employees accessed a database to obtain secret information that Nosal allegedly used in a competing business. Importantly, those employees had full access rights to that database. They didn’t hack, steal a password, rummage around, or anything else. They just logged on and copied information. Those employees had agreements that said they would not use the information for purposes other than their employment. I suspect that the agreement would not have even been necessary if it were reasonably clear that the information was trade secret, but that’s an issue for another post.

The provision at issue is 1030(a)(4), which outlaws: “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value….”

The district court dismissed the indictment, ruling that the employees could not have exceeded authorization. The court relied on a prior case, called LVRC HoldingsLLC v. Brekka, to rule that the employees could not have exceeded authorized access because database access was within their employment. According to the lower court, one can only exceed authorization if one wanders into an area where there is no authorized access. The appellate panel talks about drive letters. If the employees could access the F: drive, but not the G: drive, then any data taken from the F: drive for any purpose could not exceed authorized access, but gathering data from the G: drive would exceed because the employees were not supposed to go there. By analogy here, there could be no exceeded authority because the database was part of the employee access rights.

The Ninth Circuit panel disagreed. It starts with the definition in 1030(e)(6):

the term “exceeds authorized access” means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter

The Court focuses on the “so” term. It argues that “so” would be superfluous under the district court’s reading. After all, exceeding authorized access means you must have had the right to be there in the first place. To limit this to different areas of the database doesn’t work, since the statute plainly outlaws access to the computer when such access is then used to obtain information that the accessor is not entitled to obtain.

The problem with this reading, of course, is that the employees arguable were entitled to obtain the information. Not so, says the Court – and this is where the trade secret angle comes in. The employees were decidedly (or at least allegedly) not entitled to access the information if the purpose was to leak it to Nosal. 

How does the court deal with LVRC? It appears that the two cases are consistent:

1. LVRC says that “without authorization” requires no access at all to a drive, not exceeded authorization (there are some parts of the statute with require no authorization, and some where exceeded authorization is enough).

2. LVRC makes clear that where employers set access policies and communicate them, then employees may be deemed to have acted without authorization.

3. LVRC envisions exactly the result in this case: 

Section 1030(e)(6) provides: “the term `exceeds authorized access’ means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter.” 18 U.S.C. § 1030(e)(6). As this definition makes clear, an individual who is authorized to use a computer for certain purposes but goes beyond those limitations is considered by the CFAA as someone who has “exceed[ed] authorized access.” On the other hand, a person who uses a computer “without authorization” has no rights, limited or otherwise, to access the computer in question.

Of course, it is not this easy. LVRC had a footnote:

On appeal, LVRC argues only that Brekka was “without authorization” to access LVRC’s computer and documents. To the extent LVRC implicitly argues that Brekka’s emailing of documents to himself and to his wife violated §§ 1030(a)(2) and (4) because the document transfer “exceed[ed] authorized access,” such an argument also fails. As stated by the district court, it is undisputed that Brekka was entitled to obtain the documents at issue. Moreover, nothing in the CFAA suggests that a defendant’s authorization to obtain information stored in a company computer is “exceeded” if the defendant breaches a state law duty of loyalty to an employer, and we decline to read such a meaning into the statute for the reasons explained above. Accordingly, Brekka did not “obtain or alter information in the computer that the accesser is not entitled so to obtain or alter,” see 18 U.S.C. § 1030(e)(6), and therefore did not “exceed[ ] authorized access” for purposes of §§ 1030(a)(2) and (4).

This footnote seems directly contrary to the outome in Nosal. It is also an example of something I tell my cyberlaw students – make every argument you can! How could LVRC not have made the exceeded authorization argument directly on appeal? Surely that issue merited more than a footnote.

The court doesn’t deal with this footnote, but instead makes some factual distinctions that work for me. First, in LVRC the defendant had unfettered access with no clear rules about the data. Second, in this case there is a clear trade secret misappropriation, whereas in LVRC the allegation was a nebulous “breach of duty” argument without any real showing that the email accessed would be competitively used against LVRC.

Maybe it is because of my background in trade secret law, and I suspect that I may be in the minority among my cyberlaw colleagues, because I think this was the right interpretation and the right outcome.  Exceeding authorized access has no meaning if it does not apply in this case. To me, at least, this was a textbook case of access that starts authorized, but becomes unauthorized as soone as the nefarious purpose for the access is revealed.

And now the scary part

That said, this is still scary – but the problem is with the law, not the court’s ruling. Why is it scary?

First, employees who look where they shouldn’t could now be considered a criminal under the CFAA, so long as they are looking at material they know they shouldn’t be accessing.

Second, this is not necessarily limited to employees. Anyone using a website who starts using information from it in a way that the web operator clearly does not desire could theoretically be criminally liable.

Now that’s scary.

The Nosal court tries to explain this away by saying that fraudulent intent and obtaining something of value are required under 1030(a)(4). True enough, but that’s not the only subsection in the CFAA. Section 1030(a)(2), for example, outlaws simply obtaining information. Sure, the penalties may not be as severe, but it is still barred.

So, how do we reconcile this case with common sense? Are all web users now criminals if they lie about their age or otherwise commit minor violations? I doubt it. 

First, I think there must be some independent wrongful action associated with the action – a tort that common folk would understand to be wrongful. In this case, trade secret misappropriation was clear. LVRC v. Brekka went the other way because it was not at all clear the action was independently wrongful and thus something the employer would never authorize. I tend to think that browsewrap agreements on websites won’t cut it.

Second, the wrongful action has to be tied somehow to the unauthorized access. In other words, lying about your age shouldn’t affect access rights generally, but lying about your age might very well be a problem if the reason you did so was to prey on young children. I’ll leave others to debate how this might apply to the Lori Drew case. The recent case of MDY v. Blizzard makes this connection for the Digital Millenium Copyright Act, and it seems like a reasonable one under the CFAA as well.

The CFAA scares me, and it should scare you, too. But its not as scary as many make it out to be – at least I hope not.

“Does George Clooney dress well off and on the screen? Thanks to Giorgio Armani, he does. No one wears a suit better. Which is what some Italian entrepreneurs in Milan thought two years ago, when they cooked up a clothing line called GC by George Clooney. Problem is, the superstar had nothing to do with it. The fraudulent business people even organized a show in a Milan hotel and used the actor’s name to promote the line. But this week, the real George Clooney – who has a home in Lake Como, Italy – had to appear in an [sic] Milan court to play out a lawsuit against the people who used his name without consent, permission, or even an attempt to contact him. Of course, there was a crush of cameras in the Milan court, but Clooney remained cool throughout, even cracking jokes. Only one defendant — Vincenzo Cannalire — attended the trial. He and associates apparently forged Clooney’s name – and photo – on many documents. They even claimed Clooney was dating one of their female partners, and doctored pictures to insinuate that. Clooney turned to greet him after recognizing the man from of the photos he was looking at. “This is the first time I’ve ever seen him,” Clooney said, motioning to the defendant. Then with he added, “So I’d like to say hello, nice to meet you.” So if you’re in Italy and someone tries to sell you clothes by George Clooney – buy Armani instead. But – perhaps someone should get Clooney to design and back a line of mens’ clothes. It would probably be extremely cool – and well tailored.”

(source, Fashion Rules!)

from Paul Zukofsky

TO WHOM IT MAY CONCERN

Far too many people, especially perhaps-innocent grad. students, have been misled into thinking that, in terms of quoting LZ or CZ, they may do what they want, and do not have to worry about me. These people are then suddenly faced with the reality of an irascible, recalcitrant MOI, and are confronted with the very real prospect of years of work potentially down the tubes. I therefore wish to post an obvious “do not trespass” sign where LZ aficionados may see it.

All Louis and Celia Zukofsky is still copyright, and will remain so for many many years. I own all of these copyrights, and they are my property, and I insist upon deriving income from that property. For those of you convinced that LZ would find my stance abhorrent, the truth is that he kept all copyrights (initially in his name) as he had the rather absurd idea that said copyrights would be sufficient to allow for the economic survival of my mother, and their son. My stance is congruent with that hope.

Despite what you may have been told, you may not use LZ’s words as you see fit, as if you owned them, while you hide behind the rubric of “fair use”. “Fair use” is a very-broadly defined doctrine, of which I take a very narrow interpretation, and I expect my views to be respected. We can therefore either more or less amicably work out the fees that I demand; you can remove all quotation; or we can turn the matter over to lawyers, this last solution being the worst of the three, but one which I will use if I need to enforce my rights.

In general, as a matter of principle, and for your own well-being, I urge you to not work on Louis Zukofsky, and prefer that you do not. Working on LZ will be far more trouble than it is worth. You will be far more appreciated working on some author whose copyright holder(s) will actually cherish you, and/or your work. I do not, and no one should work under those conditions. However, if you have no choice in the matter, here are the procedures that I insist upon, and what you must do if you wish to spare yourself as much grief as possible.

1– people who want to do their dissertation on LZ, or want to quote from him in their diss., must, if only as a common courtesy, inform me of their desire to use this material, and obtain my permission to do so. If you do that, and if I agree, the permission will be only for the purposes of the diss. and there will be no charge for limited use within the diss. You will not be allowed to distribute the diss. publicly. Distribution via on-line publication is not allowed. I urge you to keep quotation to a minimum, as the more quotation, the less likely I am to grant permission.

2– people who quote Louis Zukofsky in their dissertations without having had the courtesy to request my permission, and who do so without having obtained my permission to quote LZ, do not have permission to use LZ quotations, and will, in the future, be refused all permission to quote any and all LZ in their future publications, and I promise to do my utmost to hamper, hinder, and preferably prevent all such quotation.

3– people who obtain copies of LZ manuscripts, marginalia, etc. etc. such as at UTexas or elsewhere, and who have not first requested and received my permission to have such copies made, will thereafter be refused permission to use any such materials in any of their future publications. Note that fair use is far more restrictive on unpublished material than on already published material.

4– people who wish to perform LZ or CZ (“A-24”; the “Masque” etc) require performance rights from me. A fee will be charged. People who wish to set LZ to music also require permission to do so.

5– I forbid so-called electronic “publication”. People may not quote LZ in their “blogs”.

6– if you proceed to the point of publishing articles in journals, books etc, or if you publish a book, you must obtain my permission to quote, and fees will be charged. Once again I urge you to quote as little as possible. That will minimize your cost.

Final points.

I can perhaps understand your misguided interest in literature, music, art, etc. I would be suspicious of your interest in Louis Zukofsky, but might eventually accept it. I can applaud your desire to obtain a job, any job, although why in your chosen so-called profession is quite beyond me; but one line you may not cross i.e. never never ever tell me that your work is to be valued by me because it promotes my father. Doing that will earn my life-long permanent enmity. Your self-interest(s) I may understand, perhaps even agree with; but beyond that, in the words of e.e.cummings quoting Olaf: “there is some s I will not eat”.

Next, other than for the following, I am not trying to censor you. I hardly give a damn what is said about my father (I am far more protective of my mother) as long as the name is spelled properly, and the fees are paid. My interest is almost purely economic. That being said, I do not approve of delving into the personal lives of my parents. If you wish to spend your time worrying if LZ did or did not shtupp alligators, that is your problem, but I will not approve quotation. That is not scholarship. That is gossip, and beneath contempt.

Third, do not lie, or try to dissemble. If I ask for something, and you agree, be certain that you do it. If I find out after the fact that you have not, there will be trouble.

Finally, when all else fails, and you remain hell-bent on quoting LZ, but you really, really REALLY do not want to deal with me, or you have been stupidly advised to try to circumvent me — remind yourself again and again, and yet once more, what Lyndon Baines Johnson’s said about J. Edgar Hoover i.e.: “I’d rather have him inside the tent pissing out, than outside pissing in”.

PZ

Hong Kong

Sept. 17, 2009

… Jammie Thomas-Rasset and Joel Tenenbaum captured the nation’s attention when they were defendants in the RIAA’s first two trials against accused online infringers. But here’s the mind-warping reality: both defendants would have been far better off monetarily if they had simply ignored the complaint altogether and failed to show up in court.

That counterintuitive logic played out again this week in Massachusetts, where federal judge Nancy Gertner issued four default judgments against accused P2P file-swappers who never bothered to respond to the charges against them. Their failure to appear meant an automatic loss, and though the judge does have some discretion in setting penalties, judges often pick the minimum awards in such cases.

That was true in all four cases, where Gertner accepted the record labels’ claims and awarded them the minimum statutory damages of $750 per song. The defendants were accused of downloading an average of ten songs, putting total awards in the $7,500 range, in addition to a few hundred more for court costs. …

…Thomas-Rasset’s retrial ended up with a $1.92 million award, while Tenenbaum faces $675,000 in damages. Those who didn’t show up owe around $7,500. …

That is pretty darned disconcerting. Punishing people for defending themselves serves the RIAA pretty well, but justice? Not so much.

(Fast forward about 40 second if you want to skip the legalese.)