MSBA Computer and Technology Law Section

Practice tip on use of digital forensics experts

This op-ed post by Sean L. Harrington provides opinions that do not necessarily reflect the positions of the Minnesota State Bar Association or its other constituents.

_____________________________________

Let me share with you the interesting case of Blythe v. Bell, (2012 NCBC 42 (N.C. Super. Ct. 2012,  http://www.ncbusinesscourt.net/opinions/2012_NCBC_42.pdf).  There, defendants engaged an outside "expert," Tom Scott, owner of Computer Ants, for e-discovery work. Defendants' counsel failed to conduct any intervening review Scotts' work. Instead, defendants relied exclusively on Scott to conduct a privilege review, among other things.

Unfortunately for defendants, Scott had "never provided any forensic computer services in the context of a lawsuit," and had never "been engaged as a computer expert or provided an opinion in any legal proceeding." Rather, Scott had worked as a "truck driver, a Bass Pro Shop Security Manager, a respiratory therapist, and a financial auditor for a retail seller." Put differently, Scott had no experience in e-discovery.

The Court found that Scotts' paucity of qualifications to serve as an e-discovery "expert" rendered the defendants' actions particularly unreasonable. Consequently, defendants produced nearly 2,000 pages of otherwise privileged documents to the plaintiff.

Lesson here is that, if you have e-discovery issue or digital forensics issue, don't call the computer dude or dudette you use to fix your slow computer, or printer, or to set up your wireless network.  That person and a digital forensics expert or e-discovery consultant will rarely be one and the same.

_______________________________

The author, Sean L. Harrington, is a law student and digital forensics examiner, information security professional, and e-discovery, trial, and litigation consultant with the private practice firm of Attorney Client Privilege, LLC, and a risk management team lead for US Bank. Harrington holds the MCSE, CISSP, CHFI, CSOXP, and LexisNexis CaseMap support certifications, served on the board of the Minnesota Chapter of the High Technology Crime Investigation Association in 2011, is a member of Infragard, a member of Century College's Computer Forensics Advisory Board and [erstwhile] Investigative Sciences for Law Enforcement Technology (ISLET) board, and is a council member of the Minnesota State Bar Association (MSBA) Computer & Technology Law Section.

Trending: Negligent Enablement of Cybercrime

This op-ed post by Sean L. Harrington provides opinions that do not necessarily reflect the positions of the Minnesota State Bar Association or its other constituents.

_____________________________________

This post concerns a First Circuit ruling where plaintiffs who had lost significant funds due to fraudulent wire transfers authorized by a Bank were permitted to assert causes of action against the Bank because the Bank's security protocols may not have been commercially reasonable.

What reminded me of this decision was an upcoming CLE on September 12th entitled, "Disclosure of Cybersecurity Risk: What You Need to Do and Say About It" Amy C. Seidel (Faegre Baker Daniels LLP) will talk about the new guidance from the SEC Division of Corporation Finance regarding company disclosures of cybersecurity risk. In the presentation, Amy will suggest what attorneys should consider to be certain that clients are in compliance. Topics include: What the SEC guidance requires companies to disclose about cybersecurity risk; procedures companies are following to assess cybersecurity risk; the kinds of disclosures companies are including in SEC reports about cybersecurity risk; and what the SEC saying about cybersecurity risk in comment letters.

Indeed, I've noticed an increasing volume of posts in the MSBA listservs in the recent year regarding fraud and attempted or successful fraudulent transfers of funds. In fact, one listserv member contacted me when it was discovered that someone has hacked into a Hotmail account and was sending requests to a personal banker to transfer funds out of the country.  Fortunately, the banker was astute enough to recognize that the requests were abnormal for the client, and she sought voice verification.  There was another recent post seeking referrals for a cause of action regarding the same.  And I may also recall a recent post about a pending claim by a lawfirm that was duped by a phishing scam or something of the sort, and had initiated a suit against on the basis of the same.

And, I gave a couple of presentations in 2011 on "Corporate and Individual Liabilities of Releasing Vulnerable Code." In that presentation, I discussed the concept of "Negligent Enablement of Cybercrime," which is a cause of action advanced by Rustad & Koenig. See Michael L Rustad & Thomas H. Koenig, The Tort of Negligent Enablement of Cybercrime, Berkeley Technology Law Journal, Vol. 20 No.4, Fall 2005, 1553-1611,  (http://www.btlj.org/data/articles/20_04_03.pdf).

Although, in the PATCO decision (discussed below), the First Circuit didn't use the "Negligent Enablement" parlance, the concept is the same.

Significantly, the PATCO case is based on the Uniform Commercial Code, adopted by most states, including Minnesota.

The Court explained that the commentary to the applicable UCC section governing electronic funds transfers does not, on its face, preclude an action for breach of contract or breach of fiduciary duty, because those common law claims are "not inherently inconsistent" with Article 4A.  On the other hand, the Court perceived that a closer question is whether Article 4A, on these particular facts, precludes a negligence claims insofar as such claims might be inconsistent with the duties and liability limits set forth in Article 4A. The Court suggested that it, indeed, does.

What the Court actually said is that the UCC establishes a particular set of obligations, remedies, and limitations on liability that were intended by the drafters to provide clarity to funds transfers because the preexisting common law was uncertain, and that this provision of the UCC appears to preclude plaintiffs from bringing a common law negligence claim for losses related to the fraudulent funds transfers. However, the UCC does not restrain the parties from agreeing to more stringent provisions above and beyond the Article, which would be governed by other common law causes of action (such as contract), if the UCC Article doesn't conflict. And it does not.

The lesson here seems to be that the UCC does establish guidelines on who bears the loss in the event there is a breach of the duty to act reasonably (which duties are defined by the FFIEC, OCC, and generally accepted industry standards), but if the parties have agreed to something more robust, they can be held accountable for breach of loyalty or breach of contract.

_______________________________

The author, Sean L. Harrington, is a law student and digital forensics examiner, information security professional, and e-discovery, trial, and litigation consultant with the private practice firm of Attorney Client Privilege, LLC, and a risk management team lead for US Bank. Harrington holds the MCSE, CISSP, CHFI, CSOXP, and LexisNexis CaseMap support certifications, served on the board of the Minnesota Chapter of the High Technology Crime Investigation Association (http://mn-htcia.org) in 2011, is a member of Infragard, a member of Century College's Computer Forensics Advisory Board and [erstwhile] Investigative Sciences for Law Enforcement Technology (ISLET) board, and is a council member of the Minnesota State Bar Association (MSBA) Computer & Technology Law Section.

patent-eligible subject matter - laws of nature

Case: Mayo Collaborative Servs. V. Prometheus Labs., Inc., No. 10-1150 (Mar. 20, 2012).

In a unanimous decision the Supreme Court held that Prometheus’ patents claim a law of nature and are invalid. The patent claims relate to the use of thiopurine drugs to treat certain diseases. Specifically, the claims require “administering a drug,” “determining the level” of metabolites in the blood, and, depending on the level, either increasing or decreasing the dosage. Slip. Op. at 5-6. Whether doctors should increase or decrease the dosage is determined by comparing the concentration of metabolites in the blood with the correlations embodied in the patent claims.

As the Court explained, although a law of nature is not patentable, the application of a law of nature may claim a patent-eligible process: “If a law of nature is not patentable, then neither is a process reciting a law of nature, unless that process has additional features that provide practical assurance that the process is more than a drafting effort designed to monopolize the law of nature itself.” Id. at 8-9. Reciting the law of nature and then adding the words “apply the law” do not transform the process into a patent-eligible application of the law of nature. The process needs additional elements “sufficient to ensure that the patent . . . amounts to significantly more than a patent upon the natural law itself.” Id. at 3 (citations omitted).

The Court first concluded that Prometheus’ patents claim laws of nature. The laws of nature present in the claims are the “relationships between correlations of certain metabolites in the blood and the likelihood that a dosage of thiopurine drug will prove ineffective or cause harm.” Id. at 8. The correlations are an attempt to articulate the bounds of wholly natural processes and exist independently of human action. Because the patents describe laws of nature, the patents must “add enough” to the processes “to qualify as patent-eligible processes that apply natural laws.” Id. at 8 (emphasis in original).

In determining the patent-eligibility of the patent claims, the Court addressed each of Prometheus’ claims and concluded that the additional steps in the claims “involve well-understood, routine, conventional activity previously engaged in by researchers in the field,” and, “when viewed as a whole, add nothing significant beyond the sum of their parts taken separately.” Id. at 4, 11. “[U]pholding the patents would risk disproportionately tying up the use of the underlying natural laws, inhibiting their use in the making of further discoveries.” Id. at 4. The Court thus held that the additional steps in the claims do not transform the process into a patent-eligible application of the laws of nature.

Dealing with Data Encryption in Criminal Cases

This comment by Sean L. Harrington provides opinions that do not necessarily reflect the positions of the Minnesota State Bar Association or its other constituents.

————————————————

Introduction

Over the last several years, I've posted a handful of short blog entries about the topic of compelling a criminal defendant to surrender a passphrase to an encrypted volume or hard-drive.  These entries concern the three cases of re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, United States v. Fricosu, (D.Colo, 2012), and In re Grand Jury Subpoena (Boucher), 2009 U.S. Dist. Lexis 13006 (D. Vt., 2009).

I have developed the opinion —admittedly, more on hunch than scholarly research— that a defendant should not be able to knowingly withhold a passphrase or password to an evidence trove any more than he should be permitted to hang on to a physical key that could be used to open a safe that the Government has a valid warrant to search, and which is believed to contain evidence.

Unfortunately, I have found myself on the wrong side of this issue.  My colleagues Sharon Nelson and Craig Ball disagree with me on some aspects of the issue.  And my position is seemingly at odds with the Eleventh Circuit in Grand Jury Subpoena Duces Tecum Dated March 25, supra, a decision that Professor Orin Kerr described as mostly correct (although I note that the Eleventh Circuit did distinguish Boucher, and recognize exceptions).

Privilege

Setting aside, for the sake of this comment, the question of whether knowledge of the passphrase is both "testimonial" and "incriminating" for purposes of the Fifth Amendment (the very issues central to the aforementioned cases), or whether the knowledge of the passphrase should be distinguished from possession of a physical key, my belief has been based on a principle that parties to either criminal or civil litigation should simply not be permitted to purposefully withhold admissible evidence from each other.

Now, before I continue, let's recognize that purported principle for what it really is:  incorrect.    In fact, there are several basis under our system of law when a party is permitted to withhold otherwise relevant, admissible evidence.  We call it "privilege."  Privilege is that annoying rule of law (I'm being facetious here) that, "to protect a particular relationship or interest, either permits a witness to refrain from giving testimony he otherwise could be compelled to give, or permits someone (usually one of the parties) to prevent the witness from revealing certain information" Waltz & Park, Evidence, Gilbert Law Summaries, § 635. Perhaps the most common example of it is the attorney-client privilege. See Upjohn Co. v. United States, 449 U,S, 383, 389 (1981) (acknowledging the attorney-client privilege as “the oldest of the privileges for confidential communications known to the common law”).

But even the hallowed attorney-client privilege has its limits.  Under the civil fraud and criminal fraud exceptions, an otherwise privileged communication becomes discoverable. See, e.g., United States v. Zolin, 491 U.S. 554, 562–63 (1989) (stating goals of attorney-client privilege are not served by protecting communications made for purpose of getting advice for commission of crime or fraud). And see Deborah F. Buckman, Annotation, Crime-Fraud Exception to Work Product Privilege in Federal Courts, 178 A.L.R. FED. 87, § 2[a] (2002).

Encryption as Evidence Destruction

Craig Ball often reminds his audiences of the three ways to destroy electronically stored information: (1) overwrite the bytes with new data; (2) physically destroy the media upon which the data was written; or (3) use strong encrypt on the data and forget the passphrase.  Thus, in my assessment, if an individual encrypts evidence while engaging in the commission of a crime, it is tantamount to flushing drugs down the toilet, throwing the murder weapon in a lake, or silencing a witness. These are independent criminal acts, separable from the underlying charges.   Likewise, a civil litigant, who encrypts evidence after the duty to preserve has attached (articulated best in Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003)(“Once a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a litigation hold' to ensure the preservation of relevant documents”)), engages in spoliation that may be punishable.  Therefore, I contend, by using encryption, a defendant or litigant may engaged in spoliation of evidence —albeit undoable— which may be subject to independent criminal liability, civil sanctions, or an adverse jury instruction.

Notice, these phrases in bold, above, establish mens rea, (i.e., intent -- purposeful or knowing conduct) that the actor was using encryption in the furtherance of a crime, or to destroy evidence to thwart a law enforcement investigation.  An instructive analog may be the safe harbor provision, Fed.R.Civ.P. Rule 37(f), as applied to electronic discovery in civil cases. The provision shields a party who cannot produce evidence lost as a result of the routine, good faith operation of an electronic information system. In other words, if an individual was using whole-disk encryption not to obfuscate criminal activity, but rather because he was trying to protect against identify theft, or because the system came with it by default, there is no intent, hence no criminal culpability. Another helpful analog might be found in Arizona v. Youngblood, 488 U.S. 51, 58 (1988), where the U.S. Supreme Court held charges may be dismissed based upon evidence lost or destroyed by the Government, which is deemed to be only potentially exculpatory (as opposed to apparently exculpatory), only if defendant can show the evidence was destroyed in bad faith.

But, perhaps the best authority addressing the mens rea requirement is probably that required for the 18 U.S.C. § 1503 (conduct that, among other things, corruptly endeavors to obstruct or impede the due administration of justice): To sustain its burden of proof, the government must "show that the defendant knowingly and intentionally undertook an action from which an obstruction of justice was a reasonably foreseeable result. Although the government is not required to prove that the defendant had the specific purpose of obstructing justice, it must establish that the conduct was prompted, at least in part, by a corrupt motive.” United States v. Barfield, 999 F.2d 1520, 1524 (11th Cir. Ala. 1993) (internal quotations omitted).  Unlike the duty-to-preserve in civil cases, which requires only reasonable anticipation of litigation, the federal criminal context requires there to have been a pending judicial proceeding known to defendant at the time. See, e.g., U.S. v. Fineman, 434 F. Supp 197 (E.D.Pa 1977) (In applying the obstruction of justice statute to issues of destruction of documents, federal courts generally have not required that a subpoena have issued. Rather, it is sufficient for an obstruction conviction that the defendant knew that a grand jury was investigating possible violations of federal law and intentionally caused destruction of the incriminating document.). In fact, 18 U.S.C. § 1503  has even been applied to prosecute those who, in a civil case, were accused of willfully destroying documents subject to discovery. U.S. v. Lundwall, 1 F.Supp.2d 249 (S.D.N.Y.,1998).

Note that my theory is not that the presence of encryption is somehow admissible as relevant in demonstrating defendant's mental state or aptitudes, as it appears to have been in State v. Levie, 695 N.W.2d 619 (Minn.App. 2005) ("the existence of an encryption program on [defendant's] computer was at least somewhat relevant to the state's case against him," and the jury was allowed to consider it). See also Jessica Murphy, Swiss Cheese That's All Hole: How Using Reading Material To Prove Criminal Intent Threatens The Propensity Rule, 83 Wash. L. Rev. 317 (May 2008).  Rather, my theory is that, even if a court finds that a defendant cannot be compelled to aid in his prosecution by surrendering a passphrase (because doing so would be testimonial and incriminating), a defendant may nevertheless be criminally liable for evidence spoliation.  Further, when evidence is spoliated, a factfinder may be entitled to presume that the evidence was unfavorable to the spoliator. See Washington Gas Light Co. v. Biancaniello, 87 U.S. App. D.C. 164, 183 F.2d 982 (D.C. Cir. 1950) (Willful destruction of evidence by a party properly raises the inference that the materials destroyed were adverse to the party which brings about the destruction); Brown & Williamson Tobacco v. Jacobson, 827 F.2d 1119, 1134 (7th Cir. 1987) ("A court and a jury are entitled to presume that documents destroyed in bad faith while litigation is pending would be unfavorable to the party that has destroyed the documents."); Dale A. Oesterle, A Private Litigant's Remedies for an Opponent's Inappropriate Destruction of Relevant Documents, 61 Tex. L. Rev. 1185, 1232-39 (1983) ("[A] party's bad faith destruction of relevant documents is an admission by conduct that he believes his case is weak and cannot be won fairly."). See generally 2 John Henry Wigmore, Evidence §291 (James H. Chadbourn rev. ed., 1979) (discussing evidence spoliation).

Conclusion

The right to privacy as, Justice Douglas recognized in Griswold v. Conneticut, arises from “penumbras, formed by emanations from those [specific] guarantees . . . in the Bill of Rights.”  And the Bill of Rights operates as a constraint on the Government.  But, those penumbrae do not, in my view, confer a magical privileged status to file or disk encryption under the rubric of privacy, when, in certain limited circumstances, such encryption is really just evidence spoliation.

As a forensics examiner, I am already seeing and foresee a higher frequency of criminal and civil investigations thwarted by the use of file or disk encryption and the privilege under the Fifth Amendment.  Absent new statutes addressing the misuse of encryption technology, a prosecutor should closely examine the Eleventh Circuit decision to see if his or her case falls under the limited exceptions that would require defendants to surrender the passphrase under the penalty of remedial contempt. Alternatively or conjunctively, prosecutors should determine whether the use of encryption by defendants fall within the scope of an applicable federal or state statute for destroying evidence in the furtherance of a crime, or incident to a criminal investigation, where there is extrinsic evidence of a corrupt motive.

____________________________

The author, Sean L. Harrington, is a law student and digital forensics examiner, information security professional, and e-discovery, trial, and litigation consultant with the private practice Midwest digital forensics firm of Attorney Client Privilege, LLC, and a risk management team lead for US Bank. Harrington holds the MCSE, CISSP, CHFI, CSOXP, and LexisNexis CaseMap support certifications, served on the board of the Minnesota Chapter of the High Technology Crime Investigation Association in 2011, is a member of Infragard, a member of Century College's Computer Forensics Advisory Board and [erstwhile] Investigative Sciences for Law Enforcement Technology (ISLET) board, and is a council member of the Minnesota State Bar Association (MSBA) Computer & Technology Law Section.

skydiving damages in the 9th Circuit

Case: Skydive Arizona, Inc. v. Quattrocchi, Nos. 10-16099, 10-16196 (9th Cir. Mar. 12, 2012).

Skydive Arizona sued Skyride, claiming false advertising (15 U.S.C. § 1115(a)), trademark infringement (15 U.S.C. § 1125(a)), and cybersquatting (15 U.S.C. § 1125(d)). Skydive Arizona operates a popular skydiving business that has become “one of the most well known skydiving centers in the world” through use of its “SKYDIVE ARIZONA” mark. Slip Opinion at 2921. Skyride, on the other hand, advertises and arranges skydives for its clients through various websites and domain names with references to various cities in Arizona. Skydive Arizona, which never used Skyride’s services, claimed that Skyride mislead consumers and traded upon its goodwill.

Below, the jury had awarded Skydive Arizona $1M in actual damages for willful false advertising; $2.5M in actual damages for willful trademark infringement; $2.5M in lost profits; and $600K in statutory cybersquatting damages. Additionally, the district court had doubled the amount of actual damages awarded to Skydive Arizona, raising the amount of willful false advertising and willful trademark infringement damages to $2M and $5M, respectively.

On appeal, Skyride challenged the district court’s grant of partial summary judgment, the jury’s award of damages, and the district court’s enhancement of the same. Skydive Arizona sought to broaden its injunction beyond Arizona. The 9th Circuit reversed the district court’s enhancement of damages, but affirmed both the jury’s award of damages and the scope of the injunction.

Partial Summary Judgment. The district court granted partial summary judgment on Skydive Arizona’s false advertising claim. One element of false advertising is materiality: A defendant’s false statement must be “likely to influence the purchasing decision.” Id. at 2924 (citing 15 U.S.C. § 1125(a)(1)(B)). The 9th Circuit rejected Skyride’s arguments that the consumer declaration testimony that Skydive Arizona admitted as evidence of materiality was ambiguous. According to the court, the declaration testimony stated that the consumer had purchased coupons from Skyride based upon its representations that the coupons were redeemable at Skydive Arizona. The court stated that this evidence proved that Skyride’s representations caused actual confusion. The court also refused to hold that consumer surveys are the only way to prove materiality. Because the declaration testimony and other admitted evidence supported the district court’s grant of partial summary judgment, the 9th Circuit affirmed.

Actual Damages (15 U.S.C. § 1117(a)). Skyride argued that Skydive Arizona presented insufficient evidence to support the amount of actual damages awarded by the jury to Skydive Arizona for harm to its goodwill and reputation because the jury did not use a “specific mathematical formula” in its calculations. Id. at 2928. According to the court, Skydive Arizona’s evidence of the original value of its goodwill, the expenditures in building its goodwill, customers’ angry reactions, and the need for corrective advertising was sufficient. The court explained that “neither empirical quantification nor expert testimony” is required. Id. at 2929. Rather, a  “crude” measure of damages suffices so long as the jury’s calculation is based upon “reasonable inferences” and reflects a “fair and reasonable assessment.” Id.

Lost Profits. The 9th Circuit rejected Skyride’s argument that the district court’s upholding of the jury’s award of $2.5M in lost profits constitutes an abuse of discretion. Skyride argued that Skydive Arizona’s damages expert’s testimony failed to “deduct vendor payments or overhead costs” and “applied an improper interest rate.” Id. at 2931. The 9th Circuit, however, rejected that argument. First, according to the court, Skyride’s arguments hinge on the “substance and credibility” of the expert’s testimony. Id. Second, Skyride never challenged the admissibility of the testimony before or during trial under FRE 702. Skyride, thus, had waived its ability to challenge the expert’s testimony, and the district court did not abuse its discretion.

Damages Enhancement. Under 15 U.S.C. § 1117(a), a court may, in its discretion, enhance “the amount found as actual damages” by up to three times to compensate the mark holder—not to punish the infringer. Id. The 9th Circuit looked at the district court’s rationale for enhancing the jury’s awards of actual damages and Skyride’s actual profits and found an “apparent intent to punish.” Id. at 2932. The district court had discussed Skyride’s “deceitful” and “willful” conduct, “disregard for the people [it] harmed,” and need to “appreciate . . . the wrongfulness of [its] conduct.” Id. The 9th Circuit viewed the district court’s rationale as a discussion that “reveals its punitive motivation” and reversed. Id.

Grossly Excessive. Skyride also challenged the entire judgment. Skyride specifically argued that the size of the damages award is grossly excessive relative to the small size of its business and its gross revenues. According to Skyride, because such a grossly excessive award of damages must have been motivated by the jury’s desire to punish or its unbridled discretion, the district court abused its discretion in denying the defendants’ motion for a new trial and the entire judgment should be vacated. The 9th Circuit, however, rejected the defendants’ arguments because the defendants cited no authority for its position and failed to persuade the court.

Nationwide Injunction. Skydive Arizona argued that the district court erred by failing to issue a nationwide injunction. Skydive Arizona sought to prohibit the defendants from “falsely stating that they own or operate skydiving centers anywhere in the United States where they do not in fact own or operate such centers.” Id. at 2934. Because Skydive Arizona only proved that the defendants’ conduct is illegal in Arizona—and not in other states—the 9th Circuit held that the district court did not abuse its discretion in denying Skydive Arizona’s motion for a nationwide injunction.

Dissent. Judge Noonan dissented. According to Judge Noonan, the evidence below did not support the jury’s award of actual damages in the amount of $2.5M because neither a company’s expenditures in building goodwill nor a defendant’s profits should be considered evidence of harm to a company’s goodwill. 

claim construction and patentable subject matter

Case: MySpace, Inc. v. GraphOn Corp., No. 2011-1149 (Fed. Cir. Mar. 2, 2012).

The district court granted summary judgment in favor of MySpace, Craigslist, and Fox Audience Network on the ground that all of GraphOn’s patent claims were invalid as either anticipated or obvious. While the patents claimed a method and apparatus for creating, modifying, and searching for data on a computer network, a system for organizing such data was at the core of this declaratory judgment action. One system, called the file system, stored data hierarchically; the other system, called a relational system, stored data relationally in compartments.

Claim Construction and Invalidity. The issue before the Federal Circuit boiled down to whether the district court erred in its construction of the patent claim term “database.” If, as the district court had found, “database” is construed broadly to include both file systems and relational systems, the prior art would invalidate GraphOn’s claims, as either anticipated under section 102 or obvious under section 103. If construed narrowly to cover only relational systems, a genuine issue of disputed fact would likely exist and summary judgment would be inappropriate. The Federal Circuit relied heavily on language in the written description, and inferences drawn therefrom, to conclude that nothing supports a conclusion that the claim term “database” should be limited to relational systems. With the claim construction issue resolved, the rest of the pieces fell into place, and the Federal Circuit affirmed the district court’s grant of summary judgment.

In resolving the claim construction issue, the Federal Circuit took a moment to discuss the suggestion that claim construction determinations “depend on the judges’ predilection for one of two approaches.” Slip Opinion at 8 (citation omitted). Under the “what was invented” approach, the court looks at what the patentee contributed to the art for guidance in construing claims. Under the “what exactly was claimed” approach, the court focuses on the claims and construes them by applying rules of construction.

The Federal Circuit sought to clarify this perceived dichotomy by declining to view these two approaches as mutually exclusive. Rather, because the approaches are complementary, both “what was invented” and “what exactly was claimed” are limiting factors in construing claims. “What was invented” determinations require looking “at the entire patent, with particular attention to the specification (the written description of the invention and the several claims made).” Slip Opinion at 8. “What exactly was claimed” determinations require focusing “on the precise words of the particular claim[(s)] . . . at issue; the written description and preferred embodiments are aids in understanding those words.” Slip Opinion at 8-9.

Patentable Subject Matter. The Federal Circuit seemed eager to address the section 101 patentable subject matter issue raised by the dissent. To be clear, the parties never raised and the district court never decided whether GraphOn’s patents claimed an unpatentable “abstract idea.” Rather, the case was decided on section 102 and section 103 grounds. However, because the dissent argued section 101 is an “antecedent question” and thus should be resolved before reaching sections 102 or 103, the court launched into a discussion of section 101.  

According to the court, the problem with deciding whether a patent claims an unpatentable “abstract idea” is that formulating a rule that describes such an idea “in terms that are something less than abstract” is terribly difficult. Slip Opinion at 14 (footnote omitted). Indeed, the court acknowledged that “still we continue to disagree vigorously over what is or is not patentable subject matter.” Slip Opinion at 15 (citations omitted). The court believed that the better approach is to avoid the “murky morass that is [section] 101 jurisprudence” by following the trail blazed by Congress because it provides “a clear path for courts in deciding the question of patent validity.” Slip Opinion at 17, 15-16.

The “clear path” starts at section 282, which creates a presumption of validity for issued patents and lists sections 102 and 103, among others, as defenses available in any action involving the validity of patents. The court believes that both section 282 and a court’s “inherent power to control the processes of litigation” allow courts, as a matter of case management, to “insist that litigants initially address patent validity issues.” Slip Opinion at 17 (citation omitted). Such practices, according to the court, would conserve judicial resources and provide more certainty for patentees.

Dissent. The dissent appears to rely on the widespread use of the technology claimed in GraphOn’s patents to argue that the patents’ claims are “abstract.” In fact, according to the dissent, the patents are invalid under section 101 because they are “too useful and too widely applied to possibly form the basis of any patentable invention.” Slip Opinion at 4 (Mayer, J., dissenting).  Given the “staggering” potential scope of GraphOn’s patents, allowing GraphOn to assert its patent rights “would preempt use of one of the ‘basic tools’ of modern social and commercial interaction.” Slip Opinion at 3, 5 (Mayer, J., dissenting).

Because “[a] robust application of section 101 is required to ensure that the patent laws comport with their constitutionally-defined objective,” slip opinion at 13 (Mayer, J., dissenting), and because the section 101 analysis cannot be “subsumed by the section 102 novelty and section 103 obviousness inquiries,” slip opinion at 10 (Mayer, J., dissenting), the dissent argued that courts must decide whether a patent claims an unpatentable “abstract idea” before proceeding to “subordinate issues” such as obviousness and anticipation. Slip Opinion at 2 (Mayer, J., dissenting).

Summary. This case is interesting for two reasons. First, it tries to reconcile two approaches to claim construction. Second, it discusses patentable subject matter in considerable depth even though neither the parties nor the district court raised or discussed section 101. Having listened to the oral argument recordings fromMayo Collaborative Services v. Prometheus Laboratories, Inc., I know that the Supreme Court also struggled with a related issue: whether the issue of patentable subject matter should be an isolated analysis, meaning courts should resist the urge to “peak” into other sections such as 102 and 103 in resolving the 101 issue. It will be interesting to see how that decision, once decided, will relate to this one. 

Eleventh Circuit Rules Defendant Cannot Be Compelled to Divulge Encryption Password

Barely three weeks after I penned Encryption Password not Testimonial Under the Fifth Amendment, the Eleventh Circuit has held that a defendant’s “decryption and production of the hard drives’ contents would trigger Fifth Amendment protection because it would be testimonial, and that such protection would extend to the Government’s use of the drives’ contents.”

For the reasons set forth in my previous posts on this topic, and for the reasons more fully set forth below, I disagree, and I hope the Government petitions for a writ of certiorari on this issue.

In this case, captioned,  In re Grand Jury Subpoena Duces Tecum Dated March 25, 2011, law enforcement officials began an investigation of an individual using a YouTube.com account whom the Government suspected of sharing explicit materials involving underage girls.  During the course of the investigation, officers obtained several  IP  addresses from which the account accessed the internet.  Three of these IP addresses were then traced to hotels, which hotels’ guest registries revealed the sole common hotel registrant during the relevant times was defendant.

Although probable cause was not raised as an issue in this case, it should be noted that the Government’s forensic investigator testified the Government believed that data existed on the still-encrypted parts of the hard drive and “introduced an exhibit with nonsensical characters and numbers, which it argued revealed the encrypted form of data.” Further, the Government’s forensic expert conceded that, although encrypted, it was possible the volumes contained nothing.  When defendant asked the forensic expert, “So if a forensic examiner were to look at an external hard drive and just see encryption, does the possibility exist that there actually is nothing on there other than encryption?  In other words, if the volume was mounted, all you would see is blank.  Does that possibility exist?,”  the expert replied: “Well, you would see random characters, but you wouldn’t know necessarily whether it was blank.” And, when pressed by defendant to explain why Government believed something may be hidden, the expert replied, “The scope of my examination didn’t go that far.”  In response to further prodding, “What makes you think that there are still portions that have data[?],” the expert explained, “We couldn’t get into them, so we can’t make that call.”  Finally, when asked whether “random data is just random data,” the expert concluded that “anything is possible.”

Of course, everything the expert said –taken in isolation– was true, but I fail to see why these explanations undermine the Government’s right to the unencrypted data.  Sure, the expert could or should have pointed to circumstantial trace evidence (such as registry data, link files, that should exist had the defendant possessed and viewed the files as alleged).  Sure, the Government could or should have asked for an adverse inference as to the presence and use of a forensic wiping utility, if trace evidence was not be present, as it should have been had the defendant possessed and viewed the files, as alleged.  But the Government wasn’t required to have probable cause as to the encrypted volumes specifically, because probable cause as to the entire computing equipment had already been satisfied.

Indeed, some discussion of the Fourth Amendment is here necessary:  The Fourth Amendment provides that, “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”  As relevant here, the warrant must describe the place to be searched with particularity, and the things to be seized.  Note that the comma following the word “searched,” limits the particularity requirement to the place to be searched. And, although warrants must establish probable cause and particularly name the place to be searched, the Supreme Court has rejected the argument that warrants must include "a specification of the precise manner in which they are to be executed." Dalia v. United States, 441 U.S. 238, 257 (1979).

In this case, the place to be searched was the hotel where defendant was staying and, presumably, any computers found therein were identified as the “things to be seized.”  But, some urge that computer hard drives should be regarded as a “virtual home” or “virtual warehouse.” See, e.g., Orin Kerr, Searches and Seizures in a Digital World, 119 Harv. L. Rev. 531, 539, 542 (2005) ("While houses are divided into rooms, computers are more like virtual warehouses . . . While computers are compact at a physical level, every computer is akin to a vast warehouse of information."). If so, the warrant may be construed to refer to the computers as among the “places to be searched” (in addition to the hotel room), as well as the things to be seized. See United States v. Ross, 456 U.S. 798, 821 (1982) (“When a legitimate search is under way, and when its purpose and its limits have been precisely defined, nice distinctions between closets, drawers, and containers, in the case of a home, or between glove compartments, upholstered seats, trunks, and wrapped packages, in the case of a vehicle, must give way to the interest in the prompt and efficient completion of the task at hand”).  My point here is that, if the warrant was sufficient to justify the search of the computers, that justification extended to all portions of each computer.

Assuming the Government has a right to inspect all portions of the hard-drives, based on probable cause to believe they were an instrumentality of a crime, then it is appropriate to begin the Fifth Amendment analysis. Under the Fifth Amendment, “[n]o person … shall be compelled in any criminal case to be a witness against himself.”  The courts have consistently interpreted this provision as “protect[ing] a person . . . against being incriminated by his own compelled testimonial communications.” Fisher v. United States, 425 U.S. 391, 409 (1976).  Thus, to be afforded the protection, the statement must be: (1) compelled, (2) testimonial in nature, and (3) serve to incriminate the declarant in a criminal proceeding. If these elements are met, the declarant has the right “not to answer questions put to him in any proceeding, civil or criminal, formal or informal, where the answers might incriminate him in future criminal proceedings.” Lefkowitz v. Turley, 414 U.S. 70, 77 (1973).

In this case, there was no dispute that defendant had care, custody, and control of the computers and hard-drives. As the sole owner, no one else could have created the encrypted volumes, and the Eleventh Circuit’s opinion does not indicate that defendant claimed someone else had created those volumes.  Therefore, it is not clear to me why defendant’s mere knowledge of the passphrase is an admission of guilt, any more than it would be to surrender the a key hanging about his neck, or to surrender the combination code to a safe in a home, that was properly within the scope of a valid search warrant (as these hard-drives were).  Knowledge of the passphrase is not an element of the crime, but rather possession of child pornography.  (Conversely, a murderer’s knowledge of the secret location of his victim’s grave would be incriminating, because only the murderer would know that location). Therefore, although the court intoned, "the Government appears to concede, as it should, that the decryption and production are compelled and incriminatory," I don't agree that the act of decryption and production, by itself, is incriminatory (even though the fruits of that production could contain evidence that is incriminating).

That leaves the question of whether the passphrase is testimonial.  The Court noted, "an act of production can be testimonial when that act conveys some explicit or implicit statement of fact that certain materials exist, are in the subpoenaed individual’s possession or control." Yet, as noted above, it is uncontroverted that defendant had exclusive care, custody, and control of the encrypted volumes, and knows the passphrase, regardless of whether those volumes contain contraband.  Citing United States v. Hubbell, 530 U.S. 27 (2000) and Fisher v. United States, 425 U.S. 391 (1976), the court relied upon the so-called “foregone conclusion” doctrine, which posits that an act of production is not testimonial—even if the act conveys a fact regarding the existence or location, possession, or authenticity of the subpoenaed materials—if the Government can show with “reasonable particularity” that, at the time it sought to compel the act of production, it already knew of the materials, thereby making any testimonial aspect a “foregone conclusion.” I contend that exception is here met, because it is not in dispute that the contraband was traced back to three separate IP addresses in different hotel rooms rented by defendant, and that there was no other plausible repository for those files to exist but his computer equipment, and this satisfies the "reasonable particularity" requirement.

lexicography and disavowal - defining claim terms explicitly and implicitly

Case: Thorner v. Sony Computer Entm’t Am. LLC, No. 2011-1114 (Fed. Cir. Feb. 1, 2012).

When you’re playing video games with your friends or family, you probably noticed the video game controller vibrate after your car crashes into a wall or your player is tackled in a football game. The process by which you and other gamers receive this “tactile feedback” was at the center of the dispute in Thorner v. Sony Computer Entertainment America LLC. In that case, Thorner accused Sony of infringing its patent on a “tactile feedback system,” which claims an apparatus comprising “actuators [sic] attached to [a flexible] pad.” Slip Opinion at 7. In short, actuators vibrate the video game controller in response to signals created by virtual events such as tackling or crashing.

District Court. With issues of claim instruction before it, the district court was charged with construing the meaning of “attached.” While most people likely would not object to using “attached” to refer to one object being affixed to either the interior or exterior surface of another object, patentees can act as their own lexicographer or disavow the full scope of claim terms. The district court relied on these rules to hold that “attached” means affixing an actuator to an object’s outer surface only. “Attached” thus meant something narrower than its plain and ordinary meaning. The district court further held that the specification redefines “attached” by implication because the embodiments therein and claims both use language to distinguish between actuators affixed to interior and exterior surfaces. The patent consistently uses “embedded” when referring to interior surfaces and “attached” when referring to exterior surfaces.

Federal Circuit. As neither party disputed the plain and ordinary meaning of “attached,” the issue on appeal was whether the use of a claim term to describe only a single embodiment in the specification redefines the claim term or amounts to a disavowal of claim scope. Stated differently, “attached” means “affixing an item to either an exterior or an interior surface” unless the use of “attached” to refer only to actuators affixed to an exterior surface constitutes an explicit or implicit act of lexicography or disavowal of claim scope.

The Federal Circuit disagreed with the district court’s construction of “attached.” Even though the specification only uses “attached” in reference to embodiments with actuators affixed to exterior surfaces and only uses “embedded” for actuators affixed to interior surfaces, the Federal Circuit held that the use of “attached” in this manner is not “a clear and explicit statement by the patentee” and therefore “does not rise to the level of either lexicography or disavowal.” Slip Opinion at 9.

Although both the district court and Sony relied on the redefinition-by-implication argument, the Federal Circuit only briefly addressed this issue. First, the Federal Circuit acknowledged “certain pre-Phillips cases” that held the “use of two terms as alternatives could amount to an implicit redefinition of terms.” Slip Opinion at 10 (citing Bell Atl. Network Servs., Inc. v. Covad Commc’ns Grp., Inc., 262 F.3d 1258, 1271 (Fed. Cir. 2001)). After it narrowed its holding in those “pre-Phillips cases” by stating that “the ‘implied’ redefinition must be so clear that it equates to an explicit one,” the Federal Circuit held that the patent’s selective use of “attached” and “embedded” is not sufficiently clear to redefine “attached” by implication. Slip Opinion at 10.

Finding neither an explicit nor implicit act of lexicography or disavowal, the Federal Circuit held that “attached” should be given its plain and ordinary meaning—affixed to either the interior or exterior surface. The construction of “flexible” was also at issue. Because no intrinsic evidence supported the district court’s definition of “flexible” as “capable of being noticeably flexed with ease,” the Federal Circuit held that the district court erred. Vacated and remanded.

Summary. The Federal Circuit’s opinion in Thorner explains that a patentee’s intent to act as a lexicographer or disavow claim scope must be clear, manifest, and explicit. Solely using claim terms with similar meanings in distinct ways will not impliedly redefine the meaning of claim terms for purposes of claim construction. By equating “implicit” with “explicit,” what is left of Bell Atlantic Network Services on this issue remains unclear.

section 271(e)(2) claims - subject matter jurisdiction and motions to dismiss

Case: Astrazeneca Pharm. LP v. Apotex Corp., No. 2011-1182 (Fed. Cir. Feb. 9, 2012). 

AstraZeneca holds the rights to patents claiming methods for using rosuvastatin calcium, a drug used for lowering cholesterol, in patients with heterozygous familial hypercholesterolemia (“HeFH”) and elevated circulating C-reactive protein (“CRP”). AstraZeneca filed a New Drug Application (“NDA”) with the Food and Drug Administration (“FDA”). The FDA's approval of the NDA related to the treatment of HeFH and elevated CRP, as well as two additional uses—relating to the treatment of homozygous familial hypercholesterolemia (“HoFH”) and hypertriglyceridemia—that are not claimed in any of AstraZeneca’s method-of-use patents.

The defendants subsequently submitted Abbreviated New Drug Applications (“ANDAs”) to obtain FDA approval to market generic rosuvastatin calcium for use in patients with HoFH and hypertriglyceridemia. AstraZeneca brought suit under 35 U.S.C. § 271(e)(2), alleging that the defendants’ ANDAs infringe its method-of-use patents. Section 271(e)(2) provides the following:

It shall be an act of infringement to submit—(A) an application under section 505(j) of the Federal Food, Drug, and Cosmetic Act [21 U.S.C. § 355(j)] . . . for a drug claimed in a patent or the use of which is claimed in a patent . . . if the purpose of such submission is to obtain approval under such Act to engage in the commercial manufacture, use, or sale of a drug . . . claimed in a patent or the use of which is claimed in a patent before the expiration of such patent.

35 U.S.C. § 271(e)(2). The defendants moved to dismiss, claiming, among other things, lack of subject matter jurisdiction and failure to state a cognizable § 271(e)(2) claim. 

The district court dismissed AstraZeneca’s patent infringement claims under § 271(e)(2) for lack of subject matter jurisdiction. Because the infringing act is the submission of the ANDA, the district court labeled § 271(e)(2) an “artificial cause of action” and reasoned that its jurisdiction depended on the “validity” of AstraZeneca’s § 271(e)(2) claim. The district court concluded that no “valid” § 271(e)(2) claim existed because the defendants’ ANDA did not list any of the uses claimed in AstraZeneca’s method-of-use patents.

The Court of Appeals for the Federal Circuit (“CAFC”) disagreed and concluded that the district court erred in its jurisdictional analysis. The existence of subject matter jurisdiction does not depend on the “validity,” or merit, of AstraZeneca’s § 271(e)(2) claims. Rather, subject matter jurisdiction exists “once a patent owner alleges that another’s filing of an ANDA infringes its patent under § 271(e)(2).” Slip Opinion at 13.

Even though the district court’s jurisdictional analysis was flawed, the CAFC agreed with the ultimate outcome and affirmed the district court’s decision to dismiss the case for failure to state a claim. In support of its position, AstraZeneca argued that it had stated a claim for relief under 271(e)(2) by alleging that the defendants submitted ANDAs for “a drug . . . the use of which is claimed in a patent,” even if the uses claimed in the patent are different from the uses stated in the ANDAs. The CAFC rejected this argument and held that “an ANDA seeking to market a drug not covered by a composition patent for unpatented methods of treatment cannot infringe under § 271(e)(2).” Slip Opinion at 17. 

 

Juror's social networking activities results in new trial for convict

The Arkansas Supreme Court reversed and remanded a death row inmate’s murder conviction, ordering a new trial because one juror slept and another used the Twitter service during court proceedings.

Significantly, the trial court instructed the jurors prior to opening arguments, as follows:

When you’re back in the jury room, it’s fine with me to use your cell phone if you need to call home or call business. Just remember, never discuss this case over your cell phone. And don’t Twitter anybody about this case. That did happen down in Washington County and almost had a, a $15 million law verdict overthrown. So don’t Twitter. Don’t use your cell phone to talk to anybody about this case other than perhaps the length of the case or something like that.

In one message, the Juror 2 wrote: “Choices to be made. Hearts to be broken...We each define the great line.” Less than an hour before the jury announced its verdict, he tweeted: “It’s over.”  Others including references to the trial, such as, “the coffee sucks here” and “Court. Day 5. Here we go again.”

The supreme court observed:

Because of the very nature of Twitter as an ... online social media site, Juror 2’s tweets about the trial were very much public discussions. Even if such discussions were one-sided, it is in no way appropriate for a juror to state musings, thoughts, or other information about a case in such a public fashion . . . More troubling is the fact that after being questioned about whether he had tweeted during the trial, Juror 2 continued to tweet during the trial.