Antitrust Law Daily Wrap Up, ADVERTISING—N.D. Cal.: Decision imposing CAN-SPAM and CFAA liability for spamming Facebook users and scraping Facebook data not reconsidered, (Sep 27, 2013)

By Tobias J. Gillett, J.D., LL.M.

The federal district court in San Jose has denied reconsideration of an order holding a social media integration company liable for violations of the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (CAN-SPAM Act), the Computer Fraud and Abuse Act (CFAA), and California Penal Code § 502 for sending misleading and unsolicited e-mails to Facebook users, scraping Facebook’s data from user accounts, and bypassing Facebook’s attempts to block the company (Facebook, Inc. v. Power Ventures, Inc., September 25, 2013, Koh, L.). The court also found the company’s chief executive officer personally liable, imposed a permanent injunction, and awarded Facebook $3,031,350 plus compensatory damages.

Power Ventures operates a website at www.power.com that offers to integrate users’ social media accounts. In December 2008, social networking company Facebook filed suit against Power Ventures and its Chief Executive Officer, Steve Vachani, asserting claims for violation of the CAN-SPAM Act, the CFAA, § 502, and other causes of action.

Facebook alleged that the defendants had used Facebook’s proprietary information without its permission by inducing users to provide their login information and then using that information to scrape Facebook’s proprietary material. Facebook also alleged that the defendants sent unsolicited and deceptive e-mails. The defendants allegedly promised users $100 if they invited and signed up the most new users, and sent invited Facebook users e-mails from an “@facebookmail.com” address that claimed to be from “The Facebook Team.” Facebook never gave the defendants permission to send those messages.

On February 16, 2012, the court issued an order granting summary judgment to Facebook on the § 502, CFAA, and CAN-SPAM Act claims, but not deciding whether Vachani should be held individually liable or tackling the issues of damages and injunctive relief. In its present decision, the court addressed the defendant’s motion for reconsideration of the February 16 order, and the damages and injunctive relief issues.

Materially misleading e-mails. The court rejected the defendants’ contention that the February 16 order incorrectly applied the law by finding that the e-mail messages were materially misleading even though they identified the defendants in the body of the e-mail and no one had complained about being misled. The defendants failed to meet the standard for reconsideration because they had previously presented “essentially the same arguments” to the court when they argued “that the header information was not materially misleading because Facebook in fact had generated the emails and because no one complained about being misled.” Moreover, to the extent they had not presented their arguments before, they provided no reason why they could not have done so at that time.

Further, the court had considered whether the “from” line rendered the e-mails materially misleading and whether the body of the email corrected and misrepresentation, and therefore the court did not manifestly fail to consider the defendants’ arguments. Finally, the court had not committed clear error by concluding that the “@facebookmail.com” address did not allow recipients to identify, locate, or respond to the defendants, and therefore that the headers were materially misleading as defined by the statute.

Computer Fraud and Abuse Act and § 502. The court’s failure to find that the information the defendants took from Facebook had value also did not provide grounds for reconsideration of the court’s decision regarding the CFAA and § 502 violations. Facebook had alleged violations of both 18 U.S.C. § 1030(a)(2)(C) and 18 U.S.C. § 1030(a)(4), either of which could serve as the basis for its CFAA cause of action. Section 1030(a)(4) prohibited unauthorized access to a personal computer that resulted in obtaining “anything of value,” while Section 1030(a)(2)(C) prohibited such access when it resulted in obtaining only “information.” The court had found that the defendants violated Section 1030(a)(2)(C), and thus did not need to consider whether the information had value. Similarly, § 502 did not require the data taken to have any value. Therefore, the court had not manifestly failed to consider a dispositive legal theory.

Further, the court rejected the defendants’ argument that they should not have been held liable because they did not destroy any information or data. No case law or statutory language required that the information taken be destroyed, and the defendants had not explained why they did not previously raise that argument.

Standing. The court’s decision that Facebook had experienced a harm that was “both real and the type experienced by ISPs,” and thus that Facebook had standing to recover under the CAN-SPAM Act, was also not grounds for reconsideration. The defendants had previously presented the argument that Facebook’s injuries did not give rise to standing to the court, and thus had not established that reconsideration was warranted. Moreover, the court had considered the argument in the February 16 order, and there was no clear error or manifest injustice in its decision that Facebook’s evidence of injury from having to address the defendants’ unauthorized access amounted to the type of specialized harm against which the CAN-SPAM Act protected.

The defendants also could not obtain reconsideration based on their argument that Facebook’s injuries from investigating the defendants’ actions and having its attorneys respond to them were insufficient to show harm under the CFAA and § 502. The defendants had previously raised that argument, and therefore had not established grounds for reconsideration. Moreover, the court had expressly decided that those injuries were sufficient to establish loss under the statutes, and therefore the court had not failed to consider material facts or dispositive legal arguments. Finally, the court found no manifest injustice or clear error in that decision.

Personal liability. The court found Steve Vachani to be jointly and severally liable with Power Ventures for the CAN-SPAM Act, CFAA, and § 502 violations. The court explained that a corporate officer could be held personally liable where the officer “authorized, directed, or participated in a corporation’s tort or statutory violation.” Vachani had controlled and directed Power Ventures’ activities with respect to Facebook, including the $100 prize campaign, which he had implemented and which he had admitted was his idea. Vachani had also “anticipated Facebook’s attempts to block Power Ventures’ access and oversaw the implementation of a system that would be immune to such barriers so that Power Ventures could access Facebook’s network.” He had also directed the company’s decision to circumvent Facebook’s blocking of Power Ventures’ IP address. Finally, Vachani’s admission that he had controlled and directed the $100 prize campaign was sufficient to show that he had also “led the company’s quest to obtain proprietary Facebook information, as that information was a necessary ingredient” to the campaign.

The court rejected the defendants’ argument that “corporate executives like Vachani cannot be held liable merely by virtue of their office,” because that argument ignored Vachani’s specific acts. Moreover, the court found Vachani did not have to be the “sole owner or director” of Power Ventures in order to be held liable.

Damages. The court found that the defendants had knowingly and willfully violated the CAN-SPAM Act by sending 60,627 messages to Facebook users, and had also obtained access to Facebook accounts through the incentive of monetary payments and designed a system to circumvent Facebook’s blocking attempts, and therefore that a statutory damages award was warranted. However, the court declined to grant Facebook its requested $18 million award, which would have amounted to a trebled award of the maximum statutory damages of $100 per message. The court found an award of $50 per message to be sufficient and consistent with other cases, and found trebling unnecessary given the size of the $3,031,350 primary award. The court also found Facebook to be entitled to compensatory damages under the CFAA. The court therefore awarded Facebook $3,031,350 plus compensatory damages.

Permanent injunctive relief. The court also granted Facebook permanent injunctive relief. Facebook had shown irreparable injury from the harm to its goodwill with its users, because the users were likely to associate the spam messages with Facebook. Money damages would be inadequate to compensate for Facebook’s injuries because they would not ensure that the defendants would not again spam Facebook users, and the defendants still possessed the software they used to carry out their activities and might still possess Facebook user data. Money damages would also not compensate for Facebook’s loss of goodwill, and non-monetary relief could also be necessary as a result of the defendants’ possible inability to satisfy a damages award, as evidenced by its voluntary petitions for bankruptcy.

The balance of hardships also favored Facebook. An injunction would merely force the defendants’ compliance with the law, and without an injunction Facebook could have to deal with future violations. Although the defendants claimed that an injunction would impermissibly threaten Vachani’s employability and livelihood, they provided no support for that claim, and the court found “the balance would not shift in favor of the defendants even if there were evidence to support” the claim. Finally, the public interest favored an injunction as well, because an injunction would prevent the defendants from impermissibly spamming Facebook users again and would deter violations by others.

Therefore, the court found the balance of the equitable factors favored Facebook, and granted it injunctive relief. The permanent injunction would enjoin the defendants from sending, or assisting others in sending, unsolicited commercial messages to Facebook users; making material misrepresentations when advertising or selling any good or service, including misrepresenting an association with Facebook; accessing, or directing, aiding, facilitating, causing, or conspiring with others to access, Facebook’s website or servers without its permission; using any data obtained as a result of the defendants’ unlawful conduct; and developing, using, selling, or distributing, or aiding, directing, or conspiring with others in developing, using, selling, or distributing, software allowing a user to engage in the unlawful conduct.

The defendants must also destroy any software, script, or code designed to access or interact with the Facebook website, Facebook users, or Facebook services, as well as any data obtained from Facebook or its users. The defendants must notify their current and former officers, agents, servants, employees, successors, and assigns, and any persons acting in concert or participation with them, of the injunction within three days, and must certify their compliance in writing within seven days.

The case is No. 08-CV-5780-LHK.

Attorneys: David P. Chiappetta (Corrs Chambers Westgarth) and Indra Neel Chatterjee (Orrick Herrington & Sutcliffe LLP) for Facebook Inc. Amy Sommer Anderson (Aroplex Legal Services) and Scott A. Bursor (Bursor & Fisher P.A.) for Power Ventures Inc.

Companies: Facebook, Inc.; Power Ventures, Inc.

Cases: Advertising Privacy CaliforniaNews