Digital Miranada Warning: IAC Executive Learns The Hard Way That You Have the Right To Remain Silent Online

Too many people don't understand the power of social media.  Fortune 500 executives, professional athletes, student-athletes, students, entertainers, politicians, etc... have all gotten into hot water because of their digital usage.  I regularly counsel members of these groups about the legal, business, and reputational challengers inherent with social media and other digital communication tools and it pains me whenever I hear about someone posting something online that may destroy their professional career. 

The latest Tweet that has gone viral and may be a career killer was posted on an account allegedly utilized by pr executive Justine Sacco of IAC.  She allegedly wrote while en route to Africa, "Going to Africa. Hope I don't get AIDS.  Just Kidding.  I'm white!"  By the time Ms. Sacco's plane landed, this message on her account went viral and caused a pr nightmare for herself and her employer IAC.

Too many self styled "branding experts", "social media consultants", etc.. advise people to share too many personal opinions online.  I disagree with this advice and generally agree with Mark Twain's adage, " [i]t is better to remain silent and be thought a fool than to open one's mouth and remove all doubt."

It is better to remain silent and be thought a fool than to open one's mouth and remove all doubt.
Read more at http://www.brainyquote.com/quotes/quotes/m/marktwain103535.html#STC0rGBGPI5OUGP7.99

It is better to remain silent and be thought a fool than to open one's mouth and remove all doubt.
Read more at http://www.brainyquote.com/quotes/quotes/m/marktwain103535.html#qG8bQHKbUMwqmy7s.99

It is better to remain silent and be thought a fool than to open one's mouth and remove all doubt.
Read more at http://www.brainyquote.com/quotes/quotes/m/marktwain103535.html#qG8bQHKbUMwqmy7s.99

Internet users may want to learn about my Digital Miranda Warning that is a take off of the criminal law Miranda Warning that suspects are provided. The Miranda Warning states, "You have the right to remain silent. Anything you say can and will be used against you in a court of law. You have the right to an attorney. If you cannot afford an attorney, one will be provided for you. Do you understand the rights I have just read to you? With these rights in mind, do you wish to speak with me?"

My Digital Miranda Warning sates, "You have the right to post online.  Anything you post online can and will be used against you by employers, schools, the media, etc....  You have the right not to post online.  If you feel compelled to post, don't upload anything that may make you look unprofessional.  With these rights in mind, do you still wish to post online?"

While my Digital Miranda Warning has saved some of my clients from digital career destruction, my hope is that more people become educated about the risks associated with utilizing social media before their online behavior destroys their reputation.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Snapchat iOS Update May Be A Danger To Privacy

Privacy is in vogue.  I believe Mark Zuckerberg's so called "Law of Information Sharing" is dead. While we as a society may continue to share more information online via social media, the cloud, apps, email, etc... people are more aware of the dangers of sharing too much so they are changing their behavior accordingly. 

Facebook recently admitting that younger teens are using their platform less.  Why? The answer is debatable; however, I believe it has something to do with parents, employers, schools, the police, governments, etc... wanting access to their personal digital content.  To help users believe the content they send online is safe from prying eyes multiple apps and other digital services have popped up that claim that user privacy is built in by design.  One of the most popular apps that claim they are built with privacy in mind is Snapchat.

Snapchat has become so popular that it was recently reported that Facebook tried to acquire the company for $3 billion dollars and Google may have offered $4 billion dollars.  There are allegedly 400 million snaps (images sent via Snapchat) received daily on the platform apparently because users believe their content is safer sent via Snapchat than through other services.

While Snapchat offers some better privacy protections than other content sharing apps due to its allegedly disappearing photo offering, its latest iOS update Replay feature actually endangers user privacy by allowing an image to be re-viewed at a later time.  In general, when opening a snap you don't have another image capturing device handy to take an image of the snap being viewed.  Usually, one opens a snap and it disappears after several seconds.  No harm, no foul unless the receiver has another image capturing device handy.  With the new Replay option enabled, if someone sends a  nude selfie or other potentially scandalous image, the receiver now may have plenty of time to have another device ready to capture the image.

Before this iOS update, images sent via Snapchat could be re-purposed beyond their intended usage and there have been some publicized incidents of snaps creating problems for those in the image(s).   For example, a Missouri mom is in legal trouble and was recently charged with endangering the welfare of a child (one of her kids) due to a topless photo her daughter took of her that was sent via Snapchat.  This case demonstrates the potential dangers users may encounter when taking personal photographs/videos and disseminating the images via digital platforms; even through Snapchat.

Providing a "second bite at the apple" to view content that a user has deemed "Snapable" or more private than images shared via Facebook is a danger to privacy.  Once content is digitized, it can potentially be sent anywhere in the world and saved for an infinite period of time.  Allowing more opportunities to view potentially scandalous content may put users' privacy at risk.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Sextortionist jailed for sexual cyber blackmail

A sexual cyber blackmailer was jailed for 5 years for hacking the digital media accounts of at least 350 women.  Sextortionist Karen "Gary" Kazaryan pleaded guilty in July to charges that he hacked into women's email and/or social media accounts and trolled them for nude and sexually-suggestive pictures from his California home.

According to court documents, Kazaryan gained unauthorized access to digital accounts and then obtained naked pictures of his victims and extorted them to provide additional photos and/or videos. If his victims refused his demands, he posted the original embarrassing content on the Internet.  The sentencing memorandum stated "[Kazaryan's] victims were devastated and felt like they had been raped".  More than 3000 nude images were found on Kazaryan's computer.

It wouldn't surprise me if more of these types of crimes are prosecuted in the near future.  However, is 5 years enough of a sentence to deter others from following in Kazaryan's footsteps? 

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

FTC Settles Charges Android Flashlight Mobile App Deceived Users

The FTC is continuing to crack down on companies that are intentionally misleading their users about privacy issues.  According to the FTC, the "Brightest Flashlight" app shared users' location, and device ID without their users' consent. Goldenshores Technologies, LLC was behind the app and this enforcement action appears to be the first involving geo-location data obtained from mobile devices.

The FTC put the mobile ecosystem on notice almost 2 years ago about their privacy concerns.  For example, in February 2012, the FTC issued a mobile privacy report that was focused on children and did a follow up titled Mobile Apps For Kids Report in December 2012.  These investigations demonstrated that some industry players needed to do a better of protecting their users' privacy.  The FTC released another report in February 2013 that reinforced the importance of these issues.  In July 2013, the National Telecommunications and Information Administration (NTIA) published a draft of self-regulatory guidelines for privacy notices for mobile app and the Digital Advertising Alliance released a best practices guide for its members.

The FTC's announcement of this action is very timely considering that the lead article on the front page of today's Washington Post discussed how the NSA tracks cellphone locations worldwide.  A major problem with Goldenshores' app was that it did not disclose that user information would be "sent to third parties, such as advertising networks."  Another problem with the app was that before a consumer could choose to accept its terms and conditions, it began collecting and sending the potential users' personal information to third parties.

To view the settlement here is the link.  Public comments will be accepted through January 6, 2014. To contact the FTC regarding this matter here is the link.  Mobile app creators must be transparent and honest with their customers about the information that they collect and re-purpose. I make a personal choice to avoid many apps due to the privacy issues inherent and it would not surprise me if more mobile app companies incorporate privacy into the design of their products in the near future.

With access comes responsibility.  The more information a mobile app maker collects about their users the more information that the NSA and/or other government entities may be able to collect and utilize.  Apps and mobile ecosystems that are collecting a lot of information about their users are not only harming their users' personal privacy but also making it easy for the NSA to spy on their users.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Are States Taking The Lead to Enforce Digital Privacy Laws?

Recently, 37 states and the District of Columbia reached a $17 million dollar settlement with Google over its intentional circumvention of Internet users' privacy settings.  The case stemmed from "Google's bypassing of privacy settings in Apple's Safari browser to use cookies to track users and show them advertisements in 2011 and 2012."  This multi-state agreement followed Google's $22.5 million dollar settlement with the Federal Trade Commission over the same practice.  In total, Google has paid approximately $40 million dollars to federal/state regulators for intentionally harming the personal privacy rights of Internet users in this matter.

Google's ability to circumvent Apple's Safari browser setting was uncovered and publicized by the Wall Street Journal on February 17, 2012.  According to the Wall Street Journal's investigation, Google and several other advertising "companies used special computer code that trick[ed] Apple's Safari Web-browsing software" into letting them track the web-browsing habits of users who tried to protect their personal privacy.  After the Wall Street Journal contacted Google about its alleged illegal activities the company disabled the code.  However, why did the Wall Street Journal need to contact Google in order for it to stop violating the personal privacy rights of Internet users?

In 2011, the FTC "resolved charges that Google used deceptive tactics and violated its own privacy promises to consumers when it launched its social network, Google Buzz."  In 2012, Google paid a $7 million dollar fine to 38 states for privacy violations regarding its Street View project which collected "passwords, e-mail and other personal information from unsuspecting computer users."   Earlier this year, a lawsuit was allowed to proceed that, "alleges that Google illegally scanned emails for users of Internet service providers who used a self-branded version of Gmail, as well as for Google Apps for Education users".

While the focus of the state attorney generals and FTC investigations regarding this privacy matter have been on consumers why hasn't there been media attention on how Google's actions may have harmed students who utilized school provided Apple products?  In 2011, the New York Times discussed how thousands of students across the country were utilizing iPads because of special pilot programs and multi-million dollar government grants.  

Did Google intentionally disable the privacy settings on tax payer funded and/or government owned student iPads and other Apple products that use Safari browsers to track student interactions with teachers and/or other students for pecuniary gain?  How many students had their privacy rights violated by Google while utilizing school provided Apple products?  If a student surfing the web using Safari was logged into a Google account (i.e. Gmail, YouTube, Google +, Blogger, etc...) all of his school related web usage may have been tracked and monetized by Google.  Did Google's behavior violate the Family Educational Rights and Privacy Act (FERPA)?  Why hasn't the Department of Education  opened an investigation into this matter?

If Google intentionally disabled the privacy settings of Internet users who chose to utilize a competitor's product (i.e. web browser Safari instead of Google's Chrome) how can Google be trusted to respect and protect the personal privacy of those who utilize Google products?  While Google has claimed it does not show ads by default to student users of its Google Apps For Education services, how can parents, guardians, teachers, and school administrators be sure that Google isn't still collecting, combining, and monetizing student data behind the scenes since it has been fined millions of dollars multiple times for violating the privacy rights of users in the past?

Sweden appears to have lost faith in Google's privacy promises and is requiring a municipality in Stockholm to rework its Google Apps For Education Agreement to better protect student data or its schools will be required to stop using Google's services.  Should Sweden's students have more privacy protections than those in the United States?

In Google's settlement agreement with 37 state attorney generals it lists in Appendix A the state consumer protection statutes/computer abuse statutes that Google allegedly violated.  Since some of these statutes may be utilized in conjunction with the federal U.S. Computer Fraud and Abuse Act (CFAA) when digital wrongdoing is alleged why hasn't the Department of Justice (DOJ) opened an investigation into this matter?  Shouldn't the DOJ at least investigate these issues with the same vigor that resulted in Google forfeiting $500 million dollars due to its actions that enabled its users to unlawfully import controlled and non-controlled prescription drugs into the United States that may have violated the Federal Food, Drug and Cosmetic Act and the Controlled Substances Act?

State attorney generals are utilizing their powers to hold Internet companies accountable for online violations of state law.  While the FTC is increasing its Internet enforcement activities, it is imperative for all interested parties to work in conjunction to ensure that those companies that break state and/or federal digital privacy laws are held accountable for their actions.

 

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Vietnam Enacts Law To Fine Social Media Critics

During the Thanksgiving holiday it is important that we give thanks to our country's forefathers who created a government and society that protects and values the freedom of speech.  This freedom is the bedrock of our democratic society.  The First Amendment of the U.S. Constitution generally protects our citizens from being punished for criticizing the government.  This protection applies not only in the real world but also in the digital world. 

Not every country provides its citizens a "Frist Amendment" right to criticize their government.  According to AllThingsD.com, Vietnamese officials recently announced a new law that appears to provide its government the power to jail or issue steep fines to citizens who disparage the state via social media.

Vietnam's new law, "Decree 72" enables the government to hand out fines of 100 million dong ($4,740) to anyone criticizing the country on social media, and/or uses the Internet and information on the web to undermine the state.  According to the Electronic Frontier Foundation, earlier this year 13 bloggers/activists were sentenced to prison terms ranging from 3 to 13 years for expressing their opinions on line. 

It is important to remember that when visiting foreign countries you must be aware of their laws to ensure that your digital activity does not create an international incident and/or land you in jail.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Do Not Track Kids Act of 2013 Would Amend COPPA

Senator Ed Markey and Rep. Joe Barton have reintroduced House and Senate versions of their Do Not Track Kids Act, which would extend the Children's Online Privacy Protection Act of 1998 (COPPA) protections for "collection, use and disclosure of children's personal information" to teenagers 13-15.

The legislation would:  prohibit Internet companies from collecting personal and location information from anyone under 13 without parental consent and anyone 13 to 15 years old without the user's consent; require consent of the parent or teen prior to behavioral advertising to children and teens; establish a "Digital Marketing Bill of Rights for Teens" that limits the collection of personal information of teens, including geo-location information of children and teens; create an "eraser button" for parents and children by requiring companies to permit users to eliminate publicly available personal content when technologically feasible; and require digital companies to explain the types of personal information collected, how that information is utilized, and the policies for collection of personal information.

While I am not generally in favor of stricter regulations on the digital ecosystem that may potentially put greater constraints on how Internet companies may operate, the data collection and privacy policies of some companies have crossed the line and appear to require greater legal scrutiny.  According to a recent USA Today article about digital privacy and young people, "....the NSA can tap into online data to the extent it does largely because commercial companies, led by Google and Facebook, pursue business models that treat consumer privacy as a free profit-making resource."

The bottom line is that some companies have abused their marketplace position and it appears that a legislative fix is needed to protect our children from companies that put profits ahead of privacy.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

Did the NFL's Richie Incognito Violate Florida's Cyber-Harassment Law?

A very troubling situation in the Miami Dolphins' locker room is unfolding regarding alleged hazing and bullying.  It is alleged that Dolphins guard Richie Incognito was bullying offensive tackle Jonathan Martin in person, on the phone, on social media, and in texts.  My first job out of law school was with the National Football League Player's Association (NFLPA) and during my time there I assisted the NFLPA's Health and Safety Committee on several matters.  While hazing has long been a part of many professions, the reported allegations here are very troubling.

Hazing occurs in many walks of life and may be considered part and parcel of the team building process.  This behavior occurs in the military and the plot of the movie "A Few Good Men" centers around what happens when hazing goes to far.  A recent case in Afghanistan demonstrates that in some instances this type of behavior can kill.  The movies "Full Metal Jacket" and "An Officer and A Gentleman" also provide examples of hazing by fellow soldiers and by one's commanding officer.  Hazing incidents at some colleges demonstrate that this behavior is not confined to the military and may take many forms.  Mental cruelty, physical labor, and over work until exhaustion or death have been documented. 

When do hazing incidents cross the line from "team building exercises" to violations of the law?  Florida has a statute that appears to shed some light on this issue.  Under Florida's law,
(2) A person who willfully, maliciously, and repeatedly follows, harasses, or cyberstalks another person commits the offense of stalking, a misdemeanor of the first degree, punishable as provided in s. 775.082 or s. 775.083.

(3) A person who willfully, maliciously, and repeatedly follows, harasses, or cyberstalks another person and makes a credible threat to that person commits the offense of aggravated stalking, a felony of the third degree, punishable as provided in s. 775.082, s. 775.083, or s. 775.084.

While it is too early to speculate on whether Incognito violated Florida law since not all of the facts are known, if Incognito's voice mails, texts, Tweets, in person interactions, etc.. demonstrates that he "repeatedly" harassed Martin it would not surprise me if charges are brought against Incognito to make an example out of him.  Last month, two girls (12 and 14 years of age) in Florida were arrested after they allegedly tormented a 12-year-old until she committed suicide.  Therefore, Incognito may want to seek legal counsel sooner rather than later.     

The bottom line is that states across the country are amending their laws to account for digital harassment.  While some of these laws may potentially conflict with the First Amendment, the march towards treating digital matters the same as off line issues continues and demonstrates the need for not only NFL players but for everyone to better understand how their digital usage may create tremendous legal liability.     

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

Penn State Sex Abuse Scandal Costs Approach $200 Million Dollars Due To Digital Evidence

The Jerry Sandusky sex abuse scandal at Penn State was horrific.  More than 2 dozen young men were molested by former Penn State football coach Sandusky.  Their lives were forever changed because it appears that some members of the Penn State community tried to cover up the situation instead of stepping in to help those abused.

Last year, a jury found Sandusky guilty of 45 charges of sexual abuse and he will most likely spend the rest of his life in prison.  The fallout from the matter has included numerous lawsuits against Penn State.  Earlier today, Penn State announced that it had agreed to pay almost $60 million dollars to 26 plaintiffs who alleged they were molested by Sandusky.

It was also recently disclosed that Penn State has so far spent more than $50 million dollars in legal fees and fines defending its conduct in this matter and the university still owes $48 million dollars of a $60 million dollar fine to the NCAA. While it is too soon to speculate on the overall economic loss to the entire Penn State community, this cost may reach hundreds of millions of dollars.  While we may never be able to fully measure the precise human toll this scandal has caused, we can put a ball park figure on the economic toll so far and it appears to be north of $150 million dollars ($60 million dollars in settlements, $50 million dollars in legal fees/fines, etc.., $48 million dollars over the next 4 years in NCAA fines).

Strong eye witness testimony at trial that Sandusky was a sexual abuser appears to have swayed the jury.  Interestingly, there was not much evidence that appeared to demonstrate that Penn State knew or should have known that they were allowing a child molester to roam free throughout its football facilities.  The main evidence that appears to prove Penn State officials turned a blind eye to Sandusky's illegal activities was a handful of emails more than ten years old.

On November 10, 2011, I warned that the Sandusky scandal may cost Penn State more than $100 million dollars.  On June 30, 2012, I wrote, "[d]igital evidence from eleven years ago may be the smoking gun that demonstrates that Penn State knew about Sandusky but intentionally did nothing to stop Sandusky...."  On July 23, 2012, I stated, "[i]t appears that this scandal may end up costing Penn State closer to $150-$200 million dollars now that the NCAA has taken unprecedented action.

Many of the social media monitoring companies that approach schools lie about their founder's background/experience and/or monetize the personal student data they are collecting.  Schools that engage these social media monitoring companies may be on the hook for tens or hundreds of millions of dollars in legal liability if they continue to engage these companies.

The Obannon vs. NCAA case demonstrates that schools are very vulnerable to legal liability issues regarding a student-athletes' image and likeness rights.  The Obannon case along with the Penn State sex abuse scandal should put schools and the NCAA on notice that once they are aware of an issue but do not act to properly resolve it they may be liable for tens or hundreds of millions (or more) of dollars in damages. 

Schools that utilize social media monitoring services to track their student-athletes' and/or employees' personal digital activities are treading on thin ice.  Engaging these companies may not only lead to lawsuits, but to punative damage settlements that are designed to deter this behavior in the future.  Does every school need to experience a major scandal before realizing the legal liability issues inherent with digital evidence?
  
Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

White House Twitter Critic Fired Over Tweets

A Twitter Critic of the White House was recently unmasked and fired from his Obama administration job.  According to the Daily Beast, Jofi Joseph, a member of in the National Security Staff was terminated from his position after he was caught as the person behind the Twitter handle @natsecwonk.

In the past, those who wanted to criticize the President and/or his staff would reach out to Bob Woodward of the Washington Post or another reporter and the information would end up in the newspaper and/or in a book.  However, now it appears that internal administration critics are going directly to the public via Twitter and/or other digital platforms.

At first glance, it doesn't appear that Mr. Joseph released top secret material in his Tweets.  Anonymous digital postings are usually not very reliable.  However, Mr. Joseph's unmasking and termination has now provided some credibility to the anonymous Tweets that previously were not given much weight by those outside the administration.  According to Mr. Joseph's comments to Politico, "[w]hat started out as an intended parody account of DC culture developed over time into a series of inappropriate and mean-spirited comments."       

Why is the Obama administration spending tremendous resources hunting down Twitter critics?  The administration has been actively targeting journalists and their sources for some time.  How did the White House actually unmask its Twitter critic?  Did the White House ask for and receive Twitter's assistance?  Does the administration realize that silencing a Twitter critic has made the matter worse because of the Streisand Effect?  Since the Tweets in question appear to be just inappropriate and mean-spirited why should the administration care?

Mishandling and/or leaking classified documents and/or information may be a crime depending upon the circumstances.  If Mr. Joseph's digital activities violated any laws he should be prosecuted like anyone else.  However, posting negative Tweets about those in the government is not a crime.   In a democracy, this is called exercising our freedom of speech rights.  Last week, I spoke to a group of international government officials who wanted to know what to do when someone anonymously mocks them online.  My response was to "get some thicker skin". 

While there may be some potential First Amendment, employee/employer, and national security legal issues to address once all of the facts have come to light, at the end of the day this is about a person who happens to be a government employee Tweeting anonymously about his personal observations and/or thoughts about the inner workings of the government.  Nothing more.   

President Obama is the first President to become elected because of social media and his administration has utilized multiple digital platforms to convey his message directly to the entire world without a media filter.  Its time for some members of the President's inner circle to get some thicker skin and realize they are the first administration to govern in the Social Media Age.  The administration's "Twitter critic mole hunt" raises more questions than it answers. 

Copyright 2013 by the Law Office of Bradley S. Shear, LLC. All rights reserved.

Facebook criticized for ending ban on beheading videos

Facebook has recently announced that it will end its ban on beheading videos.  Within hours after announcing that it was lifting its ban, it was criticized for its new policy.  This change caused such an uproar that even British Prime Minister mentioned his dismay about it.

Facebook is a private entity and if you want to utilize its platform you need to play by its rules.  It creates policies to drive as much traffic to its web site as possible.  The more users/eyeballs the more advertising dollars. The more advertising dollars it generates the more profits that may be sent to its stockholders.  Facebook is not in the privacy and censorship business but in the digital monetization business.  

Parents and politicians need to understand that Facebook was not created as a sanitary place for kids to "hang out".  Facebook was created by Mark Zuckerberg to encourage Harvard college students to meet and interact with other college students to do "grown up things".  The sooner people realize this the better.   

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.       

Will Facebook's New Timeline Policy Assist Cyber bullies, Stalkers, and Murderers?

Facebook's recent decision to eliminate the ability for users to hide from a Timeline search may be a boon to Cyber bullies, stalkers, murders, etc.. who utilize Facebook to harm others.  As Forbes noted earlier this year, "the new tool will make Facebook stalking much easier".

Facebook's business model is basically, "we built an online hang out for you to you play in, so go play; however, everything you do in our playroom is subject to our rules and we may change them at anytime so we can better monetize your digital activities."  This philosophy is made crystal clear in Facebook's terms and conditions.

Facebook is currently being used by murderers, rapists, criminals, etc.. to commit unlawful acts.  For example, a model was killed last year after her stalker lured her to her death utilizing Facebook.  In 2010, a rapist used Facebook to create a fake profile so he stalk an ex-girlfriend.  Earlier this year, a murderer connected with his victim through Facebook to kidnap and kill a teenager.  

The bottom line is that Facebook should do more to protect its users' privacy.  This policy change may be perceived as one that does not protect the privacy of its users.  Perception becomes reality.  One simple way for users to perceive that Facebook still cares about its users' privacy is to enable users to be able to hide from a Timeline search.

While Facebook has generally been immune from defections due to its privacy policies could this be the tipping point that changes its users' perception about the social network?

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

Court: Fake Social Media Profiles Of Teachers By Students Ok

In the Social Media Age, the old adage that "sticks and stones can break my bones, but names can never harm me" is more important than ever.  In a recent case, an assistant middle school principal sued 5 students and their parents because the students allegedly created fake social media profiles of him that were not flattering. 

The assistant middle school principal claimed that the students violated the federal Computer Fraud and Abuse Act.  The court dismissed one of the students from the lawsuit and it would not surprise me if the court dismisses the rest of the plaintiff's claims soon.  While the plaintiff may have a stronger case suing under another theory, I believe the students and their parents have a strong First Amendment defense that may defeat most if not all potential claims. 

Last year, North Carolina enacted a law that makes it unlawful for students to:

Use a computer or computer network to do any of the following:

(1)        With the intent to intimidate or torment a school employee, do any of the following:

a.         Build a fake profile or Web site.

b.         Post or encourage others to post on the Internet private, personal, or sexual information pertaining to a school employee.

c.         Post a real or doctored image of the school employee on the Internet.

While North Carolina's law has good intentions, I would find it hard to believe that it does not violate the First Amendment.  It would not surprise me if a federal court eventually rules that this law is unconstitutional.   

The bottom line is that schools need to do a better job of educating their students, teachers, and administrators about digital issues.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

Will the European Union Ban Data Mining of Student School Content?

To lower costs and increase efficiencies a growing number of educational institutions are transitioning from utilizing internal servers to external cloud based services.  Well known technology companies such as Amazon, Google, HP, IBM, Microsoft, and Oracle are competing to become the go-to cloud service provider for schools.

Milton Friedman, a famous economist, popularized the phrase, "there ain't no such thing as a free lunch".  In other words, one always has to pay for a good or service, whether by exchanging money or giving up something of value.  During the past decade, a growing number of digital companies have adopted a model where they offer their services for free in the hope that their platform gains widespread acceptance.  In return, those utilizing these services pay for the service by giving up their personal privacy by accepting agreements that enable service providers to monetize their personal information. 

Education budgets in some European member states have been slashed during the past several years due to the economic downturn.  Some cloud computing providers appear to be capitalizing on these deep budget cuts as part of their pitch to governments and educational institutions.  Unfortunately, some digital service providers do not have the best intentions because strong privacy protections are not built into the design of some of their platforms.  

These companies may require schools to execute agreements that do not properly protect the personal data of students.  For example, Sweden's data protection authority recently ordered a school district to stop utilizing Google Apps for Education because the service contract didn't comply with Sweden's Data Protection Act.  In other words, Google's agreement with a municipality in Stockholm did not provide the proper safeguards to protect student data.

The model UK Google Apps For Education Agreement, states, "Customer agrees that Google may serve advertisements (“Ads“) in connection with the Service to End Users who are not designated by Customer as enrolled students."  Does this clause mean that teachers, administrators, and almuni are served ads?  Since students most likely are utilizing school provided email to communicate with their teachers and teachers may discuss student matters with administrators via email are teacher-student and administrator-student, and teacher-administrator emails data mined and monetized by Google? 

Another troubling agreement clause states, "Customer agrees that any revenue generated by Google from the Ads or otherwise derived by Google from the Services will be retained by Google and will not be subject to any revenue sharing."  Does this indicate that in addition to serving ads based upon teacher-student/administrator-student/teacher-administrator digital interactions, the information contained in these emails may be monetized in other forms not necessarily mentioned in the agreement?   

SafeGov.org recently released a report about cloud computing and student privacy.  The organization conducted "in-depth interviews with over a dozen  representatives of European Data Protection Authorities (DPAs) as well as a number of European Commission officials involved in the development of data protection policy."  Their report found, "wide support for the idea that vulnerable data subjects such as school children deserve special protection."

SafeGov.org's findings stated that some cloud providers may be offering schools services that were initially built for the consumer behavioral advertising market and that these services do not appear to have privacy by design built into their architecture.  According to SafeGov.org, "advertising-oriented cloud services may jeopardize the privacy of data subjects in schools, even when ad-serving is nominally disabled." 

Some major threats to student privacy noted in SafeGov.org's report include:

Lack of privacy policies suitable for schools: "[C]loud providers may deliberately or inadvertently force schools to accept policies or terms of services that authorize user profiling and online behavioral advertising."

Potential for commercial data mining: "When school cloud services derive from ad-supported consumer services that rely on powerful user profiling and tracking algorithms, it may be technically difficult for the cloud provider to turn off these functions even when ads are not being served."

User interfaces that don't separate ad-free and ad-based services: "By failing to create interfaces that distinguish clearly between ad-based and ad-free services, cloud providers may lure school children into moving unwittingly from ad-free services intended for school use (such as email or online collaboration) to consumer ad-driven services that engage in highly intrusive processing of personal information (such as online video, social networking or even basic search)."

Contracts that don't guarantee ad-free services:  "By using ambiguously worded contracts and including the option to serve ads in their services, some cloud providers leave the door open to future imposition of online advertising as a condition for allowing schools to continue receiving cloud services for free."

SafeGov.org's findings are very troubling and demonstrate the need for regulators and lawmakers in the EU to be proactive to protect the personal privacy of our next generation of leaders.  While this report was based upon research performed in the EU, it would not surprise me if regulators and lawmakers around the world have similar thoughts and ideas regarding the need to protect vulnerable groups such as students and children from behavioral advertising.  Shouldn't all students and children, regardless of their geographic location, be afforded the same privacy protections?  

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

France's CNIL: Google Failed To Comply With EU Data Protection Laws Before Enforcement Notice Deadline

The CNIL, France's Data Protection Authority has released a statement that Google has failed to comply with its order set in its enforcement notice to reverse its 2012 privacy policy change.  According to the CNIL,

"[o]n the last day of the three-month time period [September 20, 2013] given to Google Inc., the company [Google] contested the reasoning followed by the CNIL, and notably the applicability of the French data protection law to the services used by residents in France. Therefore, it has not implemented the requested changes. In this context, the Chair of the CNIL will now designate a rapporteur for the purpose of initiating a formal procedure for imposing sanctions, according to the provisions laid down in the French data protection law."

On October 15, 2012, I wrote that the CNIL may require Google to reverse its March 2012 privacy policy update that enables it to better monetize its users' personal information.  On June 20, 2013, "France's data protection watchdog (CNIL) said Google had broken French law and gave it three months to change its privacy policies or risk a fine of up to 150,000 euros ($200,000)."  

While potential fines may be a drop in the bucket to Google's bottom line, it would not surprise me if data protection authorities across the world turn up the heat against Google and utilize all available legal and regulatory avenues to ensure that Google complies with their data protection laws.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

New California Law Protects Minors From Digital Mistakes

A new California law is leading the way to protect our children's digital privacy.  Earlier today, Gov. Brown signed into SB-568 Privacy: Internet: Minors that will protect the online privacy of those under 18 years of age who reside in the State of California.  According to CA Senate President Pro Tem Darrell Steinberg, the bill's sponsor, the legislation "requires all web sites, social media sites and apps to allow anyone under 18 to remove content they posted earlier."

The new law will become effective as of January 1, 2015.  It has two main provisions. It seeks to protect minors by generally prohibiting operators of digital platforms (such as web sites, online services, online applications, mobile apps, etc...) from knowingly marketing and advertising to a minor a broad range of products specified in the law.  Some of these products may include alcoholic beverages, firearms, ammunition, tobacco products, fireworks, lottery tickets, tattoos, drug paraphernalia.  In addition, the new law requires operators of digital platforms to notify minors of their rights to remove content or information they posted and honor their requests to remove such data, subject to specified conditions and exceptions.

California has become the first state to offer greater digital protections to minors than the recently revised Children's Online Privacy Protection Act.  While SB-568 is a win for the digital privacy of minors, those under 18 should not use this as an excuse to be reckless about their digital lives.  For example, the law does not enable a minor to require a digital platform remove content that another person posts about that minor.  In addition, Internet companies are only required to remove publicly available content a minor posts and not data that is not publicly viewable.

While SB-568 may help protect California minors from some digital mistakes that may harm their ability to gain acceptance into the college of their dreams, it should not replace educating our children about these issues.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.  

Dead Cyberbullying Victim's Image Used In Facebook Ad

Bullying whether offline or in cyberspace has the potential to cause great pain for its victims and their families.  With the increased usage of social media, more bullies are going online to target their victims.  Unfortunately, the children's rhyme, "sticks and stones may break my bones, but words will never harm me," is losing some power in today's social media fueled world. 

Over the past several years, there have been multiple incidents where online bullying has been a contributing factor in teenagers committing suicide. These tragedies demonstrate the need for parents and teachers to stress the importance that the above children's rhyme is now more important than ever.  In addition to better educating our children, social media platforms must do a better job of policing their web sites and making the personal privacy of their users a top priority.

One such example of a social media platform putting profits ahead of personal privacy is when Facebook was recently caught featuring a photo of Canadian teenage Rehtaeh Parsons who killed herself earlier this year.  Even though Facebook apologized for allowing this to happen, it demonstrates that most digital platforms are reactive in nature and not proactive when it comes to privacy.  While I am generally not a proponent for stricter regulations, this appears to be another example of why stronger digital privacy laws may be needed to protect our children from companies that may be putting profits ahead of privacy.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.  

Social Media Scam Entangles Miami Heat Star

Athletes and other high profile individuals are constant targets of scams offline and on social media.  Earlier this year, Manti Te'o, then a student-athlete with Notre Dame was the target of an elaborate catfishing scheme that almost destroyed his NFL career before he was even drafted.  Manti Te'o is not alone in being targeted by con artists who utilize electronic communications.  The Miami Heat's Chris Andersen was also recently entangled in a digital scheme that almost destroyed his NBA career and personal life.  

These incidents are the tip of the iceberg.  I have counseled multiple high profile individuals who have been the target of these scams.  Fortunately for most of my clients, they usually contact me before these issues become public knowledge.  When I provide services to professional athletes, professional sports teams, college athletic departments, Fortune 500 executives, and other high profile clients, I discuss these type of issues and the importance of limiting one's digital footprint.  Unless one is able to authenticate the person with whom they are texting with and/or sending emails/social media messages with I do not recommend communicating with them.

The bottom line is that some people are putting their guard because a growing number of self-styled social media consultants are advocating that high profile individuals should focus on increasing one's social media usage to build one's personal brand and/or their school and/or corporate brand.  My philosophy is different.  It is about protecting the individual, school, corporation, etc... first.  Brand building is a long process that takes years of hard work and a handful of Tweets or Facebook posts won't do it despite what some self-styled social media consultants advocate.  

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

4th Circuit Appeals Court: Facebook "Like" Is Protected Free Speech

The Fourth U.S. Circuit Court of Appeals has ruled that "liking" a Facebook page may be protected free speech.  In this case, a Virginia man, Daniel Ray Carter, “Liked” the “Jim Adams for Hampton Sheriff” Facebook page in 2009. The incumbent sheriff learned of his subordinate’s (Mr. Carter's) “Like” for his opponent and fired Carter shortly after he won re-election. Mr. Carter sued, and in 2012 a U.S. District judge ruled that "Facebook ‘Likes’ aren’t enough speech to warrant constitutional protection." 

To help explain the context of its opinion, the court cited the 1994 case, City of Ladue v. Gilleo, and reasoned that Facebook "likes" are similar to political lawn signs because they are both symbolic expressions.  In addition, the court stated the "thumbs-up" symbol may be considered similar to a 1974 case (Spence v. Washington), which held that expression occurs when "there is an intent to convey a particularized message".

This ruling demonstrates that a growing number judges are willing to extend free speech protections that we have in the traditional world to the digital or social media world.  The bottom line is that government and private sector employers along with schools need to better understand the issues inherent with social media to avoid social media legal liability.

Copyright 2012 by the Law Office of Bradley S. Shear, LLC All rights reserved. 

The terms and conditions that apply to the storage of your data are important

The terms and conditions of a digital service provider are extremely important because they govern their legal obligations to their customers.  Businesses, governments, and schools are moving from internal servers to cloud based platforms and with this change in platforms comes a concern regarding the privacy and security of sensitive corporate, government, and personal identifiable information.

Clicking "I Agree" when registering for a new digital account/service or when a digital service's policies have been updated may have major legal consequences.  The television show South Park made an interesting observation about what may happen when a company changes its terms and conditions in an episode last year titled the Human Centipad.  While this episode demonstrated the potential pitfalls of what may happen when you agree to terms and conditions you may not understand, an online British retailer once inserted a clause into its digital agreements that gave it the right to reclaim its customers' immortal souls. 

Recently, I attended a showing of a new documentary titled Terms and Conditions May Apply (TACMA). The film emphasizes the importance of reading and understanding the terms and conditions of  digital platforms.  In particular, the  documentary explores in-depth the privacy policies and data collection practices of some of the most popular web based services that are utilized by businesses, governments, and schools.

TACMA spends a significant amount of time discussing the privacy policies and practices of LinkedIn and Google.  As a platform focused on professionals and the corporate market one may think that LinkedIn's terms and conditions would protect the privacy of the data that its professionals and corporate partners post.  However, according to TACMA's director, Cullen Hoback, "LinkedIn's [terms and conditions are] abysmal.  It’s the most over-reaching, ridiculous and shouldn’t-be-allowed-to-exist contract out there that I found." This description is not surprising since LinkedIn recently announced that it has lowered its minimum U.S. user age from 18 to 14 years old.  This move appears to be designed to enable it to collect a treasure trove of personal information from high school students.  

LinkedIn is not alone in requiring users to agree to terms and conditions that may not properly protect the privacy and security of its users.  Google's March 2012 privacy policy change eroded the personal privacy of its users in order to enable it to better monetize the data it collects about those who utilize its services.  Before Google's consolidated privacy policy became effective, data protection authorities across Europe raised serious concerns about the legality of the change and stated that they would investigate the matter.  During the past several months,  multiple European data protection authorities have stated that Google's privacy policy change violates data protection laws.  

When TACMA premiered in January of this year at the Sundance Film Festival, the film alleged that Google's earliest privacy policies were not listed in its publicly available privacy policy archive.  One of Google's earliest privacy policies from December of 2000 stated, "A cookie can tell us, [t]his is the same computer that visited Google two days ago, but it cannot tell us, [t]his person is Joe Smith or even, [t]his person lives in the United States."  This privacy policy indicates that during its early years Google had a policy in place that respected and protected its users' personal privacy. 

However, by December of 2001, the language "it [a cookie] cannot tell us, this person is Joe Smith or even, [t]his person lives in the United States," had been removed from Google's privacy policy.  Eliminating these protections from its privacy policy appears to have been the turning point when Google stopped making user privacy a top priority.  Updating a privacy policy that removes user anonymity protections may jeopardize personal privacy and security.    

According to CNET, TACMA "provides special scrutiny of Google, and argues that the company bowed to advertiser pressure by removing language from its privacy policy promising users anonymity unless they willingly gave it up."  Regarding Google's privacy policy history, Hoback stated, "[t]hey [Google] really did care in the beginning quite a lot about privacy. But when your profit margins come in direct opposition to your principles, sometimes those principles suffer." 

Interestingly, Google declined to be interviewed for TACMA.  May Google's refusal to directly answer TACMA's questions serve as an admission that Hoback's film provides an accurate portrayal of Google's privacy policies?  For those who question the film's accuracy, The Wall Street Journal recently stated "the breadth of Google's information gathering about Internet users rivals that of any single entity, government, or corporation....Google's privacy policy puts few restrictions on how much it can collect or use."    

TACMA publicizes the importance of reading and understanding the terms and conditions of digital platforms.  However, is greater awareness about these issues the only solution or are stronger laws and more robust enforcement actions required to protect users from companies that put profits ahead of privacy?

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

NJ Federal Court: Password Protected Facebook Posts Covered By Stored Communications Act

A New Jersey federal district court recently ruled that non-public Facebook posts are protected by the Stored Communications Act.  The decision in Ehling v. Monmouth-Ocean HospitalService Corp., demonstrates that courts are continuing the trend of recognizing that we still have an expectation of privacy in the digital age.

In Ehling, a paramedic working for a hospital made an alleged inappropriate post on her password protected Facebook account.  The post was forwarded by one of the paramedic's Facebook friends to management who disciplined the paramedic because of the post.  Initially, the paramedic challenged the discipline before the NLRB and lost. Subsequently, the paramedic filed a lawsuit in federal court claiming that management violated the federal Stored Communications Act and the common law invasion of privacy tort.  

While the Court granted summary judgment in favor of hospital management on both claims it stated, "The Court finds that, when users make their Facebook wall posts inaccessible to the general public, the wall posts are “configured to be private” for purposes of the SCA. The Court notes that when it comes to privacy protection, the critical inquiry is whether Facebook users took steps to limit access to the information on their Facebook walls. Privacy protection provided by the SCA does not depend on the number of Facebook friends that a user has."

This decision is a huge victory for privacy because it recognizes that employers and schools may not require employees and/or students turn over their digital user names, passwords, or password protected digital content.  The bottom line is that employers and schools may not require their employees or students to "Facebook Friend" them as a requirement to keep their scholarship or job unless they are interested in losing a lawsuit.

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.

New Jersey Bans NCAA Social Media Monitoring Companies

New Jersey Governor Chris Christie proclaimed that New Jersey employees have an expectation of privacy in the digital age when he signed A2878 into law earlier today.  New Jersey has joined the growing number of states that are protecting the personal digital privacy of their employees and students.  At least 13 states have enacted similar laws and 36 states along with Congress have introduced bills to protect NCAA schools, students, employers, employees, etc... from companies that are selling social media monitoring legal liability time bombs. 

Some social media monitoring companies may claim they are a "leader" in social media monitoring and/or in "educating" student-athletes.  Does the NSA claim they are monitoring personal digital accounts to educate?  No.  Therefore, any claim by Varsity Monitor, UDiligence, Fieldhouse Media, etc...that they are monitoring to "educate" is absolute *&%%&*$%. 

Varsity Monitor, UDiligence, and Fieldhouse Media each sell social media monitoring services that NCAA schools in at least 13 states may not utilize to track the personal digital accounts of their coaches and/or student-athletes.  Schools deploying the social media monitoring services of these companies may be fined hundreds of thousands of dollars, and/or may be sued for violating their student's first and/or fourth amendment rights, and/or may lose millions of dollars in federal funding.

According to Deadspin, Varsity Monitor may have some troubling ethical and legal problems to address.  The Courier Journal reported that Varsity Monitor's Centrix Social service was caught last year monitoring University of Kentucky student-athletes for using the terms "Arab" or "Muslim" online.  Why did Sam Carnahan, the owner of Varsity Monitor allow this to occur?

According to Time Magazine, UDiligence was monetizing the personal photographs of the student-athletes it was monitoring to advertise its services until it was confronted about this troubling practice.  Unfortunately, UDiligence's founder Kevin Long only removed the offending photos from his UDiligence web site but not another one of his company web sites (I have screen shots if he claims otherwise).  This demonstrates that schools, student-athletes, and sports related entities should think long and hard before trusting any entity that Mr. Long owns or controls.

The most troubling service may be Fieldhouse Media because it appears to be trying to differentiate itself as having less invasive tactics than the other companies.  NCAA athletic departments should not be fooled.  It appears that in order for Fieldhouse Media's social media monitoring service to properly work  student-athletes need to at least authenticate their social media username(s).  Arkansas, California, Delaware, Illinois, Michigan, New Jersey, and New Mexico have generally banned schools from being able to ask a student to verify this information.

Fieldhouse Media's Kevin DeShazo's business practices appear to raise serious ethical questions.  For example, last year Mr. DeShazo created a press release announcing his social media monitoring service that quoted me without my cooperation.  Did Mr. DeShazo ask for my permission to be quoted in a press release designed to sell his social media monitoring services? No. Why is Mr. DeShazo trying to associate my reputation with a practice that I along with lawyers and risk professional from around the country believe may create tremendous legal and financial risks?  

If you perform due diligence on Mr. DeShazo you may find some issues that warrant further explanation.  For example, according to his publicly available LinkedIn Profile from last year it states that before he started his social media monitoring firm he had no verifiable social media or NCAA compliance/advisory experience.  Interestingly, according to his recent publicly available LinkedIn Profile it now claims that prior to starting his social media monitoring company he was working for a social media marketing firm. If Mr. DeShazo was actually working for a social media marketing company before he started his social media consulting firm why wasn't it listed previously? Why has Mr. DeShazo recently claimed he launched Fieldhouse Media in 2010 (I have screen shots if this is denied) which conflicts with his LinkedIn Profile claims and the information on file with the Oklahoma Secretary of State?

In 2001, George O'Leary, Notre Dame's head football coach resigned five days after being hired because of "inaccuracies" in his published biography.  In other words, Mr. O'Leary was caught intentionally misleading NCAA athletic departments about his background.  After George O'Leary, Jayson Blair was caught creating a web of lies and was terminated from the New York Times, and then James Frey, the author of "A Million Little Pieces" was caught lying to Oprah.   

Anyone that approaches schools to sell services to track personal social media accounts is selling a legal liability time bomb.  If a school hires a social media monitoring firm to track the personal digital content of their students or employees and it misses an indication that there may be a crime committed it may cost the school more than $100 million dollars.  For proof, just review the Penn State emails regarding the Jerry Sandusky matter.  Does a school want to be on the hook for tens or hundreds of millions of dollars in legal liability because it was utilizing a social media monitoring service to track personal digital accounts?    

Copyright 2013 by the Law Office of Bradley S. Shear, LLC All rights reserved.