The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/etc/hacklaw/suesysop.txt

Text File | 2003-06-11 | 8.0 KB | 168 lines

TITLE:  Electronic Privacy: Bulletin Board User Says Hers Was Violated

Electronic privacy rights.  They fall into a grey area of the law
that is ill-defined, despite the 1986 passage of the federal
Electronic Communications Privacy Act, and remain untested by the
US legal system.  That could all change with a lawsuit, filed by
a bulletin board system user against a local sysop, alleging a
violation of electronic privacy rights.

Linda Thompson, who filed suit in the US District Court for the
Southern District of Indiana, alleges that BBS operator Bob
Predaina violated her privacy rights as they relate to her
electronic correspondence.  The suit cites 10 counts under the
federal Electronic Communications Privacy Act of 1986 and Indiana
state law.  She is asking for $112,000 in damages. The lawsuit
looks to be a landmark case as no litigation involving electronic
privacy has yet been tried under the ECPA.

The ECPA mandates the protection and privacy of electronic
communications, including cellular phone conversations and
electronic mail, found on commercial and bulletin board systems.
Predaina's board, known as The Professional's Choice Bulletin
Board, is a fee-based system.  "The definition of privacy is
outlined in the ECPA very clearly, and the courts won't have to
deal with that; the act is very specific as to the tampering of
files," said Robert Smith, editor of the Washington DC-based
Privacy Journal.  "If private files were tampered with, then the
sysop is going to be accountable under the law."

The ECPA outlines that anyone using an electronic conferencing or
e-mail system has an expectation of privacy, regardless of the
fact that a sysop can peruse any files stored on the system. "The
analogy would be to a hotel PBX system," said Smith.  "The caller
knows that an operator has every opportunity to listen in;
however, there is an expectation of privacy, which is accorded to
him by law, which strictly prohibits the unauthorized
eavesdropping on telephone conversations."

So although the sysop has a certain "license" to roam around
through files (for routine maintenance, for example), that sysop
does not have the right to make those files public without the
consent or knowledge of the recipient or author.


Allegations of Private Messages Made Public
--------------------------------------------

Thompson's sworn complaint claims that during December 1987,
Predaina allegedly allowed several other "non-designated
recipients" to read the contents of her electronic correspondence
in what she alleges was a private file area of the BBS. In
addition, the suit charges that some of Thompson's previously
deleted private messages were restored and placed in an open
conference so others could read them; Thompson's private e-mail
were among some of those messages, she said.

This happened again in January of 1988, according to the text of
the complaint. The suit charges that the sysop intentionally "or
recklessly intercepted and restored to the public portion of the
board" private messages that Thompson had deleted, and therefore,
she assumed, were erased from the disk.  In addition, some of
Thompson's private messages were apparently restored to an open
conference that is also an "echo conference," meaning that the
message traffic contained in that conference is automatically
uploaded to other BBSs linked via an "echo mail" program.

Thompson charges further aggravation due to a "lock out" action
by the sysop; she was denied access to the BBS, even though she
had paid for the service, she said.  Requests by Thompson to
regain access on the grounds that such actions were in violation
of the law went unheeded by Predaina, she said.

"Initially I said to him, `Let's shake hands and stipulate to
dismiss the case,' and he agreed, or I thought we had agreed.
This was before I ever filed in federal court, but then he got an
attorney, and he asked for a continuance," Thompson told
Microbytes Daily.

Predaina refused to comment, referring all questions to his
attorney, Philip Stults.  "Anybody can run into court and file a
complaint if they plop down the filing fee.  The plaintiff is
also a sysop and a third-year law student," Stults said.

Stults, who is also a sysop, said that the case has no current
court date. "We're doing everything we can to settle this matter
out of court."   Thompson agrees: "I hope we can settle out of
court. I'm sure we will. I really have no desire to be remembered
as `The Person That Sued The Sysop' and set the precedent for
future ECPA rulings."

Beyond the simple privacy issues, however, Thompson is claiming
personal damages.  Counts nine and ten of the complaint cite that
the sysop intentionally, "maliciously or with reckless disregard
for the truth, made statements which on their face are damaging
to the professional and personal reputation of [Thompson] in
public and to another person subjecting [Thompson] to
humiliation, personal anguish and ridicule."  In addition, the
suit claims that Predaina made other damaging comments in open
conferences for other users to see.

Thompson is submitting the suit on her own behalf without an
attorney. "I've filed the complaint because he [Predaina] didn't
seem to be making a good-faith effort to resolve this issue.  If
a sysop is going to run a board that claims to give some sort of
privacy, then I have a reasonable expectation that my messages
are indeed private and not spread all over the board for others
to see."

"Clearly, a fee-based system that maintains that it provides a
private messaging capability is covered by the ECPA," Mike
Cavanagh, executive director of the Washington DC-based
Electronic Mail Association, said in a phone interview.  Although
Cavanagh said he isn't familiar with the details of the Thompson
case, he said the crux of the lawsuit is how private messages
have been traditionally treated on this particular BBS.  "If it's
common practice for this sysop to openly display private mail,
then this is common knowledge and no one should be surprised," he
said.  Cavanagh noted, however, such a practice is highly
undesirable.

Cavanagh compared the availability of private messages on a local
BBS to the thousands of "mom-and-pop-owned" rural telephone
systems. "Just because those are small-time operations doesn't
give them the right to wiretap or eavesdrop on private
conversations.  These small telephone systems are subject to the
same laws and regulations as the Bell Operating Companies. The
anology to small BBS systems, and the private correspondence they
carry, is the same," Cavanagh said.


`The Law Is in Effect'
---------------------

The lawsuit foreshadows a new climate of awareness among systems
operators.  "This is an important event," said Cavanagh.
"Obviously, there is going to be some concern from sysops.
Clearly, this is going to inform some people that the new law is
in effect.

"We are going to have uniform responsibility under the law;
that's what ECPA is intended to do. The point that sysops should
understand is that the ECPA doesn't have to be onerous.  Sysops
will have to be aware: if you really want to offer some sort of
private system to the public, then you can't fool around with
them.  Either the system is private or it isn't.  If it isn't,
then some sort of disclaimer should be plainly stated, otherwise,
they [sysops] are going to be held accountable under the law."

"To be truthful, I didn't even know the statute [ECPA] existed
when I started looking into this," Thompson said. "I just thought
that if there wasn't some kind of law against making private
messages public, then there should be.  That's when I discovered
the ECPA."

Thompson, however, fears that more will be made of the case than
she intends. "I'm afraid that sysops will just adopt a `There's
no privacy here' stance, to guard against any future action like
this. And that's just the opposite reaction I'd hope to see come
of all this."
                                   --- Brock N. Meeks