- You Don’t Have to Assume that One Password Hack Leads to Another
- A Family That Owns Together Doesn’t Necessarily Stay Together
- Employee Handbook Did Not Override Employee-At-Will Status
You Don’t Have to Assume that One Password Hack Leads to Another
In Sewell v. Bernardin, the U.S. Court of Appeals for the Second Circuit revived part of a lawsuit by a woman who claims her ex-boyfriend altered her Facebook account and then posted malicious statements about her sexual activities.
Chantay Sewell’s entire case against former boyfriend Phil Bernardin had been dismissed on statute of limitations grounds by an Eastern District Court Judge.
The Second Circuit, in deciding a case of first impression, said that claims for alleged unlawful access to her Facebook account under the Computer Fraud and Abuse Act (“CFAA”) and the Stored Communications Act (“SCA”) were timely filed. Claims based on her e-mail account were rightly dismissed as untimely.
The CFAA criminalizes, among other things, “intentionally accessing a computer without authorization or exceeding authorized access, and thereby obtaining … information from any protected computer,” 18 U.S.C. §1030(a)(2)(C), and “intentionally accessing a protected computer without authorization, and as a result of such conduct, causing damage and loss,” Id. at §1030(a)(5)(C). The statute also provides a civil cause of action to “any person who suffers damage or loss by reason of a violation of this section.” Id. at §1030(g).
Under the SCA, it is a crime to “(1) intentionally access without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceed an authorization to access that facility; and thereby obtain, alter, or prevent authorized access to a wire or electronic communication while it is in electronic storage in such system … . As with the CFAA, the SCA establishes a civil cause of action. “Any … person aggrieved by any violation of this chapter in which the conduct constituting the violation is engaged in with a knowing or intentional state of mind” may file suit. Id. § 2707(a).
Under the CFAA’s civil enforcement provision, a complaint must be filed “within 2 years of the date of the act complained of or the date of the discovery of the damage.” The SCA provides that “[a] civil action under this section may not be commenced later than two years after the date upon which the claimant first discovered or had a reasonable opportunity to discover the violation.”
Sewell filed her lawsuit suit on January 2, 2014. She alleged in her complaint that she discovered she could not log into her www.aol.com (AOL) e-mail account on or about August 1, 2011 “because her password was altered.” She further alleged that more than six months later, on or about February 24, 2012, she discovered that she could not log into her www.facebook.com (“Facebook”) account “because her password was altered.”
In finding the Facebook claims timely, the Court concluded that they accrued around February 24, 2012. “There is nothing in the facts as alleged in the complaint from which to infer that anyone gained unauthorized access to her Facebook account before then.”
“The fact that Sewell had discovered ‘damage’ to her AOL account based on her inability to access AOL’s computer servers at an earlier date does not lead to a different result. Contrary to the district court’s remark, Sewell did not allegedly discover ‘that the integrity of her computer had been compromised’ as of August 1, 2011. She discovered only that the integrity of her AOL account had been compromised as of that time. Her CFAA claim accordingly is premised on impairment to the integrity of a computer owned and operated by AOL, not of her own physical computer. As a result, Sewell has two separate CFAA claims, one that accrued on August 1, 2011, when she found out that she could not access her AOL account, and one that accrued on February 24, 2012, when she found out that she could not access her Facebook account.”
The Court stated further that “like her Facebook-related CFAA claim, Sewell’s Facebook-related SCA claim is also timely. *** There is no allegation in the complaint that Sewell’s Facebook account and the computer servers on which her information was stored were tampered with before February 24, 2012, when she alleges that she was unable to log into her Facebook account. She could not reasonably be expected to have discovered a violation that, under the facts as alleged in the complaint, had not yet occurred. *** We take judicial notice of the fact that it is not uncommon for one person to hold several or many Internet accounts, possibly with several or many different usernames and passwords, less than all of which may be compromised at any one time. At least on the facts as alleged by the plaintiff, it does not follow from the fact that the plaintiff discovered that one such account—AOL e-mail—had been compromised that she thereby had a reasonable opportunity to discover, or should be expected to have discovered, that another of her accounts—Facebook—might similarly have become compromised.”
A Family That Owns Together Doesn’t Necessarily Stay Together
In Matter of Brauner, an administrator of her mother’s estate petitioned to eject her brother from two real properties in Brooklyn, and for authority to sell both. After a hearing, the Court found the decedent, at the time of her death, owned the two parcels of improved real property in Brooklyn—a commercial property at 62-15 14th Avenue, and a residential property at 1035 E. 52nd Street—with the siblings as “tenants in common” of both. It also found the brother was in possession and ousted the sister from both properties, denying her any access.
As we stated in an earlier HMY newsletter this summer, “tenants in common” in New York is a type of property ownership that allows each owner to hold an individual interest. Owners typically use tenants in common for business and investment properties or tax purposes. The other two joint ownership types in New York—joint tenancies and tenancies by the entirety—have different rules and rights than tenants in common. Tenants in common in New York each hold an individual interest percentage in the property—which does not have to be equal, but each is entitled to use and enjoy the entire real estate equally, no matter what their respective ownership percentage. A tenant in common can sell his or her interest to another party at any time and can force the sale of the property in court if the other owner(s) do not want to sell—referred to as a partition action. When one tenant in common prevents the other from using the property, New York has a statutory remedy.
Real Property Actions and Proceedings Law §633 provides:
Where the action is brought by a tenant in common or a joint tenant against his co-tenant, the plaintiff, besides proving his right, shall also prove that the defendant actually ousted him or did some other act amounting to a total denial of his right.
Finding the sister had proven the ouster, the Court issued directives to the brother ordering him to permit his sister prompt access to both properties to ensure they were being properly maintained, and to be able to be administered as estate assets. It also directed the sister to have exclusive possession of the 14th Avenue property and ordering the brother to grant her reasonable access to the 52nd Street property. The Court stated the brother’s failure to do so may result in his immediate ejectment from it. Also, the sister was granted permission to sell both properties, but the Court stated any contract for sale was subject to Court approval as required by New York’s Surrogate’s Court Procedure Act.
Employee Handbook Did Not Override Employee-At-Will Status
In Nicholas v. Wyndham Hotel Group, LLC, an ex-employee, Nicholas sued his former employer, Wyndham Hotel Group, for breach of his employment contract. Wyndham moved to dismiss the complaint on the ground that the plaintiff was an “at-will employee,” and thus could not state a contract breach claim based on termination of employment. The court held that the former employee could not overcome New York’s presumption of at-will employment.
New York is an “at-will employment” state, which generally means that absent an employment contract for a specific term or a statutory right to employment (such as tenure, civil service, or anti-discrimination laws), an employer may fire an employee with or without reason at any time.
Here, Nicholas argued that the “totality of circumstances”—including his participation in Wyndham’s 401(k) and long-term Incentive plans, and a provision in Wyndham’s Employee
Handbook stating a preference for a multi-step disciplinary process—showed he had an implied employment contract. As the Court noted, the “bulk of his argument hinges on a provision of Wyndham’s Employee Handbook, which states: ‘We prefer an approach to discipline which calls for corrective actions before more serious forms of discipline become necessary. This promotes honesty, cooperation, trust and progress.’”
Before he was terminated, Nicholas had received a “Final Warning” memo which, while acknowledging Nicholas’s competence in running the hotel’s operations and finances, reported that “multiple sources” had expressed dissatisfaction with Nicholas’s management and communication style, calling him a “bully” and complaining about his tendency to use profanity and to yell at people in public. It also faulted Nicholas for failing to adhere to company policies, including by failing to follow basic accounting guidelines and by hiring an individual as an independent contractor without authorization. It warned Nicholas that failure to improve his “behavior, communication, and adherence to company policies and procedures” could result in termination of his employment.
Nicholas contended that once Wyndham initiated a disciplinary process by sending the “Final Warning” memo, he was entitled to a fair review, but that instead he received only a “sham process, which was conducted in bad faith, in order to improperly withhold the severance package that would be rightfully owed to Plaintiff had he been terminated without cause.”
Importantly, Wyndham’s Employee Handbook contained a disclaimer stating that Wyndham“ reserves the absolute right to initiate the form of discipline it deems appropriate. Nothing in this policy is intended to alter the at-will nature of your employment with [Wyndham]. Thus, you or [Wyndham] may terminate employment at any time, with or without just cause.” The Court held that “[i]t is well settled, however, that such an explicit disclaimer ‘prevents the creation of a contract and negates any protection from termination [a] plaintiff may have inferred from’ other portions of the same document. *** ‘An employee seeking to rely on a provision arguably creating a promise must also be held to reliance on the disclaimer.’ Nicholas thus cannot rely on the Handbook to argue that his employment was not at will.”
The Court concluded: “None of the other facts alleged by Nicholas, alone or in combination, show that he was ever anything other than an at-will employee. The fact that Nicholas worked for Wyndham for five and a half years and was assigned important tasks does not help him, because ‘the quality and length of an employee’s service are not relevant factors in determining whether the presumption of at-will employment has been overcome.’ Nicholas cites no authority for the proposition that an employee’s participation in his employer’s retirement or shareholder incentive plans overrides the at-will presumption. Accordingly, Nicholas has failed to rebut the presumption of at-will employment, and his breach of contract claim must be dismissed.”