In a 2-1 decision on August 16, the Sixth Circuit refused to dismiss a claim against the maker of an online surveillance tool for wiretapping under both federal and state laws, and for intrusion against seclusion. While the breadth of this holding is unclear, and the case may be an outlier, the Sixth Circuit’s reasoning provides a potential new roadmap for plaintiffs seeking to hold companies that make and operate electronic monitoring software and devices responsible for the actions of their users under wiretapping laws.

The Plaintiff, Javier Luis, started an over-the-internet extra-marital relationship with Catherine Zang in 2009, after meeting her in an America Online chat room for discussions of metaphysics. When the husband grew suspicious, he installed “WebWatcher” surveillance software on the computer used by Ms. Zang, and subsequently used the resulting evidence in the couple’s divorce proceedings.  Mr. Luis, filed the lawsuit pro se against “Awareness,” the creator of WebWatcher, and other parties including Ms. Zang’s husband.  All parties but Awareness settled and the district court dismissed Mr. Luis’ claims against Awareness. The Vanderbilt Law School appellate clinic represented Mr. Luis in his appeal, alleging that Awareness had:

• violated the Federal Electronic Communications Privacy Act (ECPA) and its Ohio analog by intentionally intercepting Plaintiff’s electronic communications in violation of 18 U.S.C § 2511;

• violated ECPA by manufacturing, marketing, selling, and operating software that Awareness had reason to know was to be used primarily for the illegal interception of electronic communication in violation of § 2512; and

• invaded Plaintiff’s privacy under the common-law tort of intrusion upon seclusion.

The district court initially dismissed the Plaintiff’s lawsuit on all counts, but the Sixth Circuit reversed in each instance.

First, considering ECPA’s interception provision under § 2511, the Sixth Circuit joined the majority view that the term “intercept” requires contemporaneous acquisition of an electronic communication, and cannot apply to the acquisition of electronic communications already “at rest” in electronic storage.  However, despite Awareness’s claims that its software did not capture any communications in real-time, the Court found sufficient ambiguity in WebWatcher’s marketing material—as cited in the Complaint—for Plaintiff to survive a motion to dismiss.

Awareness also argued, as the district court had held, that its user, Mr. Zang, was the person who had legally intercepted Plaintiff’s communication, and that the software company had no direct role in that process.  However, the Sixth Circuit found that “once installed on a computer, WebWatcher automatically acquires and transmits communications to servers that Awareness owns and maintains.  The alleged intercept of a communication thus occurs at the point where WebWatcher—without any active input from the user—captures the communication and reroutes it to Awareness’s own servers.”  The Court also found it relevant that Awareness manufactures and conducts “all marketing” for WebWatcher.  Notably, as the dissent criticizes, “[Plaintiff’s] novel theory of liability does not appear even to have been tried, much less to have been successful, in any previous case.”

This holding is especially significant because courts have overwhelmingly declined to find a cause of action for secondary liability under ECPA when manufacturers “merely provided a means through which a third party subsequently intercepts communications.”  See In re Carrier IQ, Inc., 78 F. Supp. 3d 1051, 1089 (N.D. Cal. 2015) (collecting cases).  Here, though, the Sixth Circuit relied on the fact that Awareness not only manufactured the WebWatcher program—but also continued to operate it even after its sale to a user.  Thus, by framing Awareness’s involvement in terms of direct liability by way of its post-sale interactions, the Court may open a new avenue for plaintiffs to pursue manufacturers under ECPA.  Moreover, the Communications Decency Act—which software companies often rely on as a shield against users’ actions—expressly does not apply to ECPA, or any similar State law.  See 47 U.S.C. § 230(e)(4).

Second, continuing to break new ground, the Sixth Circuit found that Awareness was independently and civilly liable as the manufacturer or the WebWatcher software under § 2512, which creates a fine for persons who “manufacture[], assemble[], possess[], or sell[] any electronic, mechanical, or other device, knowing or having reason to know that the design of such device renders it primarily useful for the purpose of the surreptitious interception of wire, oral, or electronic communications.”  § 2512(b).  Taking the Complaint on its face, the Sixth Circuit found that Awareness marketed its software as means for one spouse to illegally monitor the communications of another spouse, in a way that goes “far beyond” any legitimate purpose.  However, this section on its face applies only to criminal penalties, and not civil remedies.  Moreover, most courts—including every Circuit Court to date—have found that civil remedies in ECPA lawsuits are only available for interception claims under § 2511, and not for other provisions such as § 2512.

Nevertheless, the Sixth Circuit found that these cases were mostly distinguishable because they involved the simple possession  or “mere sale” of a device primarily useful for wiretapping, while the instant case involved the manufacture, marketing, and sale of a device, allegedly with knowledge that it would be primarily used to illegally intercept electronic communications.  It therefore held that a company is only liable for civil claims under § 2512 when it “also plays an active role in the use of the relevant device to intercept, disclose, or intentionally use a plaintiff’s electronic communications.”

Third, and finally, the Sixth Circuit found that Plaintiff had sufficiently alleged an intrusion upon seclusion under Ohio law.  As with the Wiretap allegations, the district court found that any liability should be attributed to the spouse who installed and used the software, and not the software company itself.  The Sixth Circuit disagreed, finding that just as Awareness had itself violated the federal and state Wiretap Acts, it had itself intruded upon Plaintiff’s privacy, concluding that it was insignificant that “a different party was actually more culpable.”

It is unclear how influential Luis v Zang will be over the development of ECPA law.  For example, putting aside the merits of its reasoning, the Court put significant stock in the fact that Awareness’s software was allegedly marketed and sold primarily for the purpose of illegal surveillance, and it is not clear that its holding can be extending to companies creating products with more legitimate uses.  Moreover, the Plaintiff’s Complaint was filed pro-se and evaluated under a motion to dismiss standard, and it is unclear whether the Plaintiff will be able to muster sufficient proof at later stages in the case.  However, this lack of clarity could lead to more litigation, especially against cloud software providers who continue to play some role in their software’s operation.