Bozeman, MT Goes Phishing--Applicants Seeking City Jobs Must Disclose Usernames and Passwords

It's no secret that more and more employers are doing a quick Google search for a job applicant’s name as part of their background checks, but the City of Bozeman is taking it one step further.

In an article published yesterday afternoon, Montana's News Station reports that applying for a city job now requires turning over some fairly sensitive information. Specifically, the background check form for city jobs requires applicants to

list any and all, current personal or business websites, web pages or memberships on any Internet-based chat rooms, social clubs or forums, to include, but not limited to: Facebook, Google, Yahoo, YouTube.com, MySpace, etc.,...There are then three lines where applicants can list the Web sites, their user names and log-in information and their passwords.

When the station asked Bozeman City Attorney Greg Sullivan about the new policy he stated,

So, we have positions ranging from fire and police, which require people of high integrity for those positions, all the way down to the lifeguards and the folks that work in city hall here. So we do those types of investigations to make sure the people that we hire have the highest moral character and are a good fit for the City...

In other words, in order to apply to become a lifeguard employed by the City of Bozeman, I can never have any expectation of privacy online. At any given time, some random city employee can use my login credentials to chat on AOL using my name. Perhaps the form should include authorization for the City to enable one-click purchasing on Amazon.com using my account in order to expedite the hiring process.

Although thorough background checks are mandated for certain types of jobs in both the public and private sectors, requiring all job-seekers, no matter the position, to disclose sensitive login information on an application that may be seen by dozens of people raises major concerns regarding discrimination, privacy, and the safety of data stored on remote servers.

[Update (6/19/09): According to this article in the Bozeman Daily Chronicle, the City's policy caused enough of a stir on the internet to prompt the ACLU to look into the matter. Consequently, "City Attorney Greg Sullivan said in light of concerns being expressed by the public, officials are looking at ways to alter the policy so that they might view an applicant’s online information without asking for log-in codes."]

[Update (6/21/09): According to cnet, Bozeman stopped asking for passwords as of midday on Friday.]

California Continues to Endorse Unconstitutional Content Restriction

Back in February I wrote about the Ninth Circuit decision holding a 2005 California law banning the sale of violent video games to minors unconstitutional.

Apparently, California isn’t satisfied with that ruling. According to the Associated Press, Attorney General Jerry Brown has petitioned the Supreme Court for a Writ of Certiorari to review the Ninth Circuit’s holding in Video Software Dealers Association v. Schwarzenegger, 556 F.3d 950 (9th Cir. 2009).

So, instead of focusing on the budget crisis, prison overcrowding, and/or subpar public schools, California is going to spend as much money as possible trying to keep our impressionable youth from playing GTA IV. Then again, maybe the excessive penalties that video game retailers will face for selling a game to a minor that someone in Sacramento decided was too violent for innocent children will solve all the budget woes?

Hopefully, the Supreme Court will just deny cert, saving both the video game industry and the taxpayers money. I doubt that even the conservative justices on the Supreme Court really want to tackle the issue of whether the definition of obscenity should be extended to include violence.

On the other hand, if the Court does hear the case and rules in favor of the State, it may become easier for kids to figure out which video games are the best. All they’ll have to do is look for the big “18” sticker on the front of the boxes.

You can find a copy of California’s petition here (warning: pdf).

MN Supreme Court Decision on Breathalyzer Source Code Intentionally Ambivalent?

Last week, the Minnesota Supreme Court ruled that one DWI defendant is entitled to examine the source code of the breathalyzer used to determine his blood alcohol content, and that another DWI defendant is not entitled to examine the source code of the same make and model of breathalyzer.

The court reasons as follows:

Under Minn. R.Crim. P. 9.01, subd. 2(3), it was an abuse of discretion for a district court to order discovery of the source code of the Intoxilyzer 5000EN when a defendant did not submit any evidence on how the source code may relate to his guilt or innocence; however, it was not an abuse of discretion for a court to order discovery of the source code to a defendant who submitted evidence that an analysis of the source code may reveal deficiencies that could challenge the reliability of the Intoxilyzer and would relate to his guilt or innocence. State v. Underdahl, Nos. A07-2293, A07-2428, 2009 WL 1150093 (Minn. Apr. 30, 2009).

The evidence presented by the defendant who won access to the code consisted of a definition of source code, and a declaration by a computer science professor discussing voting machines and the law regarding breathalyzer source code in New Jersey. The unsuccessful defendant's lawyer argued that he should have the right to attack the reliability of the test itself, and that the source code was necessary in order to do so, but he only did it during oral argument. Apparently, this is not a distinction without a difference although I fail to understand why. 

From a cynical point of view, I guess there is a positive aspect of the decision--since the court reached two completely opposite conclusions in two very similar cases, it left the breadth of trial courts' discretion in discovery matters intact. From a reasonable point of view, the decision leaves the question of whether defendants in DUI or DWI cases should have access to breathalyzers' proprietary source code unanswered.

In sum, both DWI defendants want to challenge the reliability of the breathalyzer through analysis of the source code. One of the defendants won the right to do so because he presented evidence that the source code "may reveal deficiencies about the test's reliability." That evidence was based on access to proprietary source code obtained in a case in New Jersey. So, in order to provide evidence sufficient for discovery purposes that the State should grant a defendant access to otherwise inaccessible proprietary source code, one must provide a copy of buggy proprietary source code. I believe computer programmers would call this an infinite loop.

With One Billion Apps Downloaded, Should Apple Be Worried About iPhone Hackers?

As I write this post, about 965,000,000 iPhone applications have been downloaded from Apple's App Store. Apple is celebrating by giving away a variety of free Apple products to the lucky billionth downloader. Nevertheless, Apple wants the right to sue iPhone owners who jailbreak their phones.

However, as law professor Mark Roark points out in a column published in the Daily Journal (subscription required) yesterday, [t]here is just one problem. The law does not necessarily afford Apple a remedy. See Mark L. Roark, Will iPhone Network Hacking Shake Apple to Its Core?, L.A. Daily J., Apr. 15, 2009, at 5.

Presently, according to Roark, Apple cannot sue under the Digital Millennium Copyright Act ("DMCA") (that may change in October). However, Roark suggests that Article 2 of the Uniform Commercial Code ("UCC"), may allow Apple to maintain control of endusers' behavior through the terms of the iPhone's warranty. In short, Apple's warranty for the iPhone could include enforceable terms stating that if a user alters the hardware or software, the user loses the warranty. See Id.

Finally, Roark discusses some empirical research he conducted with 150 individuals. The results essentially suggest that the threat of losing the warranty is enough to deter a decent percentage of consumers from altering their iPhones, depending on how valuable the consumer perceives the warranty to be. See Id.

In essence, Apple, or any other device-maker, can lawfully maintain a certain level of control over their products, without resorting to threats of litigation because it can still reduce the value of the device post-purchase. But, for Apple it doesn't seem to be enough.

  • Apple's warranty for the iPhone most likely already prohibits jailbreaking.

The Genius Bar at your local Apple Store probably won't provide service for an iPhone that is obviously jailbroken because the warranty is already rather restrictive.

The relevant terms of the iPhone 3g's warranty already includes the following language:

This warranty does not apply...to damage caused by operating the product outside the permitted or intended uses described by Apple; [or]...to a product or part that has been modified to alter functionality or capability without the written permission of Apple. See Apple's Limited Warranty for the iPhone 3g (warning: pdf).

Apple also has similar provisions in its warranties for its other products although they generally aren't quite as strict with regard to software.

  • Jailbreaking an iPhone is not the same thing as unlocking it.

One thing that Roark overlooks in his column is that there is a distinction between jailbreaking and unlocking an iPhone. The process of jailbreaking entails altering the iPhone so as to allow it to run applications other than those from Apple's official App Store. Unlocking, on the other hand, refers to enabling the iPhone to be used on other cellular networks. Presumably, unlocked phones threaten the profits of both Apple and AT&T whereas jailbroken phones really only threaten Apple's monopoly over the software distribution channel.

  • Apple contends that merely jailbreaking an iPhone should be illegal under the DMCA.

In February, the Electronic Frontier Foundation ("EFF") submitted exemption requests to the U.S. Copyright Office as part of the 2009 DMCA Triennial Rulemaking. One of them pertains specifically to jailbreaking.

  • Proposed Class #1: Computer programs that enable wireless telephone handsets to execute lawfully obtained software applications, where circumvention is accomplished for the sole purpose of enabling interoperability of such applications with computer programs on the telephone handset. (The entire text is available here as a PDF).

In its opposition, Apple argues that the EFF is trying to use the DMCA exemption to change Apple's business model.

Specifically, [the EFF] seeks through the proposed exemption to clear the path for those who would hack the iPhone's operating system so that a proprietary mobile computing platform protected by copyright can be transformed into one on which any third party application can be run, without taking account of the undesirable consequences that would ensue from the transformation. (The entire text of Apple's Comment is available here).

The Copyright Office will issue its final rulemaking order in October.

  • So, should Apple have the right to sue individuals who run unapproved third-party software on their iPhones?

I'm still somewhat undecided. In any case, I don't think it would be particularly worthwhile for Apple to start suing its customers. I doubt that the threat of litigation will prove an effective deterrent to iPhone hackers. Moreover, both the EFF and Apple agree that there are only a few hundred thousand jailbroken iPhones even though millions have been sold.

At best, Apple may get a few popular websites to shutdown. At worst, Apple will find itself in a position similar to that of the RIAA.

Bits that Bite Back: Republishing Your MySpace Blog Without Your Consent Is Not An Invasion of Privacy

  • "Undo Send"—Five More Seconds to Change Your Mind

undosend.pngGmail Labs added a new feature a few weeks ago—Undo Send. If enabled, a user has about 5 seconds to "hit the panic button" before the message is sent.

On one hand, given the time limitation, the feature's uses are limited. On the other hand, five seconds may, for example, be just long enough to realize that one made the commonly embarrassing and potentially damaging mistake of selecting "Reply to All" instead of "Reply."

  • Hitting the Panic Button Too Late—Moreno v. Hanford Sentinel, Inc.

Unfortunately, there generally isn't a simple way to undo the damage an ill-conceived email or blog post (or Tweet) can do—as is the case in Moreno v. Hanford Sentinel, Inc., No. F054138, 2009 WL 866795 (Cal. Ct. App. April 2, 2009). See also Mike Mckee, MySpace Musings Aren't Private, Appeals Court Rules, Law.com, April 6, 2009.

  • Background: Moreno v. Hanford Sentinel, Inc.

In 2005, after returning from a visit with her family in her hometown of Coalinga, CA, Cynthia Moreno, an undergraduate at UC Berkeley, wrote "An Ode to Coalinga" and posted it on her MySpace page. Apparently, she didn't have anything positive to say. As the court describes it,

[t]he Ode opens with "the older I get, the more I realize how much I despise Coalinga" and then proceeds to make a number of extremely negative comments about Coalinga and its inhabitants. Moreno, No. F054138, 2009 WL 866795, at *1-2.

Six days after posting the Ode, Moreno decided to take it down, but it was too late. Cynthia's high school principal in Coalinga had already read the post and given a copy to his friend, the editor of a local newspaper. The editor then republished Ode in the paper, and, of course, attributed it to Cynthia Moreno. Id. at *2.

Moreno's family received hate mail and death threats. Her father was forced to close the 20 year-old family business, and, ultimately, the family was forced to move. Id.

The family sued the principal, the school district, the editor, and the newspaper for invasion of privacy and intentional infliction of emotional distress ("IIED"). The editor and the newspaper were dismissed as defendants after winning an anti-SLAPP motion and motion to strike. The principal and the school district demurred to both of the plaintiffs' theories of liability, and the trial court sustained the demurrer on both claims without leave to amend.

On appeal, the court upheld the trial court's dismissal of the invasion of privacy claim, holding that the author of an article published on MySpace.com cannot state a cause of action for invasion of privacy against those who republished the article in a local newspaper. However, the court still allowed the case to move forward on at least one theory of liability by reversing the ruling of the trial court with regard to the claim of IIED. See Id.

  • Where nothing private is revealed, there is no invasion of privacy.

Eric Goldman, at his Technology & Marketing Blog, explains the court's decision as follows:

The privacy invasion claim was easily rejected. Once Moreno posted the essay to an open-to-the-public MySpace page (even if only briefly), it was no longer private. As the court says, "the fact that Cynthia expected a limited audience does not change the above analysis. By posting the article on myspace.com, Cynthia opened the article to the public at large. Her potential audience was vast." It also did not matter that Moreno did not use her last name on her MySpace page; the court says that her identity was readily ascertainable from her MySpace page (which included a photo)...

  • So, does publication on the internet necessarily bar invasion of privacy actions?

In Moreno, the court doesn't entirely foreclose upon the possibility that one may still have a right to keep something private, even if published on the internet, but it certainly doesn't provide a clear test.

Using language borrowed from a case where alleged trade secrets were leaked online, the court states "[t]he publication was not so obscure or transient that it was not accessed by others." Id. at *3. This language raises at least two questions. First, does the work have to obscure and transient even if it isn't accessed by others? Second, can a work be accessed by others, and still be obscure and transient enough to retain its private status?

The trade secrets case that the court cites in Moreno doesn't provide much guidance because, with regard to leaked trade secrets,

[t]he concern is whether the information has retained its value to the creator in spite of the publication. Publication on the Internet does not necessarily destroy the secret if the publication is sufficiently obscure or transient or otherwise limited so that it does not become generally known to the relevant people, i.e., potential competitors or other persons to whom the information would have some economic value. DVD Copy Control Ass'n Inc. v. Bunner 116 Cal. App. 4th 241, 251 (2004) (citations omitted).

Since there is no dispute over the economic value of Cynthia Moreno's Ode, most of the analysis above is inapplicable in her case. Also, the court in Moreno seems to have conspicuously omitted the language about becoming known to the relevant people.

What if Cynthia Moreno's high school principal was the only person who read the Ode? Would the Ode have then been "transient and obscure" enough to remain private?

First Person Shooters Find Protection Under The First Amendment: A Win for the Video Game Industry

Last week, on February 20, 2009, the Ninth Circuit refused to extend the definition of obscenity to encompass portrayals of violence under the First Amendment, and thereby held a California law prohibiting the sale or rental of violent video games to minors an unconstitutional content-based restriction on freedom of expression. See Video Software Dealers Association v. Schwarzenegger, No. 07-16620, 2009 WL 415582 (9th Cir. Feb. 20, 2009).

In 2005, California passed a law prohibiting sales and rentals of violent video games to minors. If the law had gone into effect, the penalty for a violation would have been a $1000 fine. And, all video games, determined to be violent by the State, would have to have been labeled ‘18’ on the front of the packaging.

Thankfully, two industry trade groups, the Video Dealers Association (‘VDSA’), and the Entertainment Software Association (‘ESA’), quickly filed suit.

The district court granted a preliminary injunction prohibiting enforcement of the law before it went into effect, and later granted the plaintiffs' motion for summary motion judgment permanently enjoining the enforcement of the law on constitutional grounds.

The Ninth Circuit affirmed the district court's rulings in Video Software Dealers Association v. Schwarzenegger. The opinion, drafted by Judge Callahan, holds that obscenity laws cannot be applied to violent content under the First Amendment.

I imagine the ruling comes as more of a relief than a surprise to the ESA, who defeated a similar law in Illinois. Nevertheless, it is a major victory for the video game industry, retailers, and for a variety related businesses in California.

Video games are a multi-billion dollar industry, and, according to the ESA, “California is the largest employer of computer and video game personnel in the nation, accounting for 40 percent of the total industry employment nationwide.” Although the video game industry is probably not as “recession proof” as it appeared to be a month or two ago, it is still not being hit as hard as other other sectors of the economy. See e.g., The Los Angeles Times (detailing Electronic Arts’ projections for 2009).

Admittedly, this is just speculation on my part, but laws prohibiting the sales and/or rentals of violent video games, and levying fines on those that violate them, would hurt not only the video game industry, but a number of related industries as well, and could drive an already-shrinking economy further into recession. I know first hand that students in film school, music school, and recording school are increasingly looking toward the video game industry for employment as the music industry is in shambles and post-production jobs in the film industry are difficult to get.

I am not suggesting that, as matter of policy, business interests and the economy should be put ahead of protecting children from real risks of harm. And, I think it is fairly clear that not all video games are suitable for young children. However, a quantifiable risk of actual harm to a child's psychological and neurological well-being from playing ‘violent’ video games is anything but proven.

Moreover, I concede that beating up hookers in Grand Theft Auto completely lacks educational value, but other games, despite being gory and violent, may not. As the Ninth Circuit puts it,

Many of these games have extensive plot lines that involve or parallel historical events, mirror common fictional plots, or place the player in a position to evaluate and make moral choices. Id.

Continue Reading...