Uber’s hell spyware created fake Lyft riders and accessed Lyft driver’s personal information: Is Uber liable?
In this week’s travel law article, we examine the case of Gonzales v. Uber Technologies, Inc., Case No. 17-cv-02264-JSC (N.D. Cal. April 18, 2018) wherein “Plaintiff Michael Gonzales brings this action on his own behalf and as a putative class action for Lyft drivers whose electronic communications and whereabouts were allegedly intercepted, accessed, monitored, and/or transmitted by Defendants Uber Technologies, Inc., Uber USA LLC, and Raiser-CA (together ‘Uber’)…Uber offers technology that competes with the Lyft App and operates in the same geographic regions as Lyft…Starting in 2014 or earlier and continuing into 2016, Uber secretly used ‘Hell spyware’ to access servers and smartphones owned and operated by Plaintiffs, Class Members and Lyft. The ‘spyware extracted information from Lyft by posing as Lyft customers in search for rides’. These fake Lyft riders sent forged requests to Lyft’s servers. When Lyft’s servers received ‘a request from a forged rider account they believed that the ride requests were coming from actual Lyft riders, not the Hell spyware’. As a result, Lyft’s servers transmitted a response to Uber’s fake Lyft requesters containing the IDs, on duty status, pricing and exact locations of nearby Lyft drivers”. Plaintiff’s Amended Complaint set forth six causes of action to include (1) Federal Wiretap Act as amended by the Electronic Communications Privacy Act(ECPA), (2) the California Invasion of Privacy Act (CIPA), (3) the California Unfair Competition Law (UCL), (4) common law invasion of privacy, (5) the Federal Stored Communications Act (SCA) and (6) the California Computer Fraud and Abuse Act (CFAA). All claims, except the UCL claim, were dismissed, some with leave to amend.
Terror Targets Update
In Over 40 police, servicemen killed in Farah, W. Afghanistan after Taliban attack bases-officials, travelwirenews (5/11/2018) it was noted that “Taliban fighters attacked Afghan bases in the western province of Farah, killing more than 40 police officers and servicemen…on Friday…fighters had stormed a police base overnight in Balabuliuk, a district that has been under heavy pressure for months”.
In 8 sentenced to death in Iran over 2017 ISIS attacks, travelwirenews (5/13/2018) it was noted that “Iranian authorities have sentenced eight people to death over attacks in June 2017, where were claimed by Islamic State…head of the Tehran Revolutionary Courts Mousa Ghazanfarabadi told state TV, Reuters reported. The men were found guilty of aiding five extremists, who launched an attack on the Iranian parliament building and a shrine…The attacks killed 18 people and injured 50. All of the assailants were killed by security forces”.
In Paris knife attacker, 20, was born in Chechnya-reports, travelwirenews (5/13/2018) it was noted that “The man who stabbed one person to death and injured several others at the Place de l’Opera in central Paris was born in Chechan Republic and was aged around 20…The assailant was neutralized by police…Shouting ‘Allaha akbar’, the attacker injured five people, two of them, critically, on Saturday evening”.
Surabaya, East Java
In Indonesia links church attacks to local ISIL-inspired group, travelwirenews (5/13/2018) it was noted that “At least 35 people were wounded in attacks on three churches in Surabaya, East Java…At least nine people have been killed and 38 others wounded in explosions at three churches…A spokesman for the country’s intelligence agency said Sunday’s bombings were suspected to have been carried out by the ISIL-inspired group Jemaah Ansharut Daulah”.
Family Of Five Suicide Bombers
In Indonesia: More explosions in Surabaya after church attacks, travelwirenews (5/14/2018) it was noted that “At least 23 people have now died and dozens more injured in the past 24 hours…More bombs have exploded in Indonesia’s second-largest city of Surabaya, a day after a wave of deadly attacks on three churches killed at least 13 people on Sunday…the suicide attack…on Monday morning was carried out by a family of five, including an eight-year-old girl who survived the attack”.
In 3 killed in car bomb attack at Iraqi polling station, travelwirenews (5/12/2018) it was noted that “Two voters and a bystander near a polling station were killed by a bomb attached to their car in Kirkuk on Saturday. Islamic State…terrorists have claimed responsibility for the attack”.
In ‘Real carnage’: Dozens killed in attack on Burundi border village, travelwirenews (5/12/2018) it was noted that “At least 26 people have been killed and seven others wounded in an attack in northwest Burundi…24 people were killed in their homes on Friday night, while two others died of their wounds at the local hospital”.
7 Shot Dead In Australian Town
In 7 people, including 4 children, shot dead in Australian town-police, travelwirenews (5/11/2018) it was noted that “Seven people have been discovered dead near the town of Margaret River, south of Perth, Australia, police say. They are believed to be the victims of a mass shooting, with guns found nearby…Police are expected to remain at the scene for some time, but they say the area is not dangerous for the general public”.
Kenya Dam Collapse
In Search for survivors after deadly Kenya dam collapse, travelwirenews (5/11/2018) it was noted that “At least 41 people have been rescued so far by Kenya’s Red Cross…A search and rescue operation is under way in Kenya after a deadly dam collapse, which killed at least 49 people with many more still missing. Water burst through the banks of the Patel Dam in Kenya’s Rift Valley about 150 km north of the capital Nairobi”.
Globster Visits Philippines
In Horrific ‘hairy’ creature washes up on Philippine beach, travelwirenews (5/12/2018) it was noted that “An enormous dead creature seemingly covered with hair was washed up on a beach in the Philippines, inciting some locals to ask for prayers in fear of impending doom. The 20-foot-long (sic-meter-long) globster-washed ashore in Barangay, San Antonio, in the Oriental Mindoro province of the Philippines on Friday night. Local Tam Maling, who was one of the first to witness the beast, asked people on Facebook to ‘pray for us’”.
Avoid Burning Buses In Rome, Please
In Pianigiani, Rome Is Burning (or at least Its Buses Are), nytimes (5/10/2018) it was noted that “as we approached the area around Parliament, a tremendous boom shocks the street…‘Is that an attack?’ he asked nervously as we watched a plume of black smoke rise a couple hundred yards in front of us. No, it was not an attack, to blamed on saboteurs, terrorists or anarchists, but ATAC, the city’s own transportation service, which has a record of buses short-circuiting and bursting into flames on the city’s streets. Romans, long used to waiting for buses that never come, have now gotten used to ones that burst into flames”.
Two Planes Collide In Istanbul
In Turkish airlines plane tail smashed in dramatic collision at Istanbul Intl’ Airport, travelwirenews (5/14/2018) it was noted that “A dramatic collision took place at Istanbul-Ataturk International Airport, as a South Korean Asiana passenger plane sliced into the tail of a Turkish Airlines plane while taxiing on the runway”.
Airbnb Causing Increase In NYC Rents
In Comptroller Stringer Report: NYC Renters Paid an Additional $616 Million in 2016 Due to Airbnb, comptroller.nyc.gov/newsroom (5/3/2018) it was noted that “In the midst of an affordability crisis fueled by rising rents, a new report released today by New York City Comptroller Scott M. Stringer found renters citywide paid a whopping $616 million in additional rent in 2016 due to the exponential growth of Airbnb listings. The new analysis sheds light on how Airbnb listings, particularly in neighborhoods where they are most heavily concentrated, exacerbate New York City’s affordability challenges and make it harder for working- and middle-class families to make ends meet. Comptroller Stringer’s groundbreaking report-the first that’s empirically estimated a monetary impact on New Yorkers due to Airbnb’s rapid growth-shows how tenants in neighborhoods from Chelsea to Bushwick have seen their rents skyrocket in no small measure because of the heavy concentration of Airbnb listing in their communities”.
Holidaymaker Insurance In UK
In Millions of holidaymakers fail to get the right travel insurance, travelwirenews (5/11/2018) it was noted that “In the past year 38 per cent of holidaymakers who took trips abroad did not have the right kind of travel insurance, new research has revealed. Of those, 22 per cent has been away without any kind of insurance and 27 per cent have bought insurance but either hadn’t declared pre-existing medical conditions or took part in activities which weren’t covered on their policy. But by going away without cover, or the wrong type of policy, travelers risk their insurance being invalidated and having to foot the bill themselves”.
You Got Bumped. What Do Airlines Owe You?
In Josephs, You got bumped. Here’s what airlines owe you, msn (5/7/2018) it was noted “Here’s what you’re entitled to: Passengers could opt to take a later flight in exchange for compensation. But they can also be involuntarily bumped, when there are no volunteers. Airlines often select which passengers to bump based on the fare paid and the passenger’s frequent flyer status. If you’re involuntarily bumped, you are likely entitled to some money from the airline. Some airlines may try to offer vouchers or free tickets, but the Department of Transportation says travelers have the right to demand a check. Passengers are not entitled to compensation if the airline involuntarily denies them boarding due to its use of s smaller aircraft (say, in the event of a mechanical problem) or if the traveler arrives late to the gate, Just how much involuntarily bumped passengers are entitled to depends on how quickly the airline can get the traveler to his or her destination. If the new flight arrives within an hour of the original flight’s scheduled arrival times, airlines aren’t required to pay anything. If the arrival time is between one and two hours later, passengers are entitled to 200 percent of the one-way fare, up to $675. If the flight gets in more than two hours later for a domestic flight or more than four hours if the trip is international, passengers are entitled to 400 percent of the one-way fare, with maximum compensation set at #1,350. The airline must also refund fees for a la carte services like seat selection or a checked bag if travelers do not receive those services on the new flight. Travelers can always push for more. This can include asked for more compensation to cover any additional costs like meal vouchers, transportation and lodging”.
Hawaiian Vog, Anyone?
In How dangerous or safe is travel to Hawaii with volcanic smog taking a sudden change of direction?, travelwirenews (5/11/2018) “The Big island volcanic activities are currently making headlines around the world. Noxious sulfur dioxide gas and other pollutants emitted from Kilauea Volcano react with oxygen and atmospheric moisture to produce volcanic smog also known as vog and acid rain. Vog poses a health hazard by aggravating pre-existing respiratory ailments, and acid rain damages crops and can leach into water supplies”.
Hawaiian Disaster Relief
In Disaster declared in Hawaii after volcanic eruption, travelwirenews (5/12/2018) it was noted that “US President Donald Trump has declared a disaster in Hawaii after a volcanic eruption on May 3 destroyed 36 structures, including 26 homes, and covered more than 117 acres of land in lava. Hawaii Governor David Ige confirmed the declaration on Friday (and) expects the estimated repair costs from the Kilauea volcano to exceed $2.9 billion over the next month”.
Patagonia: “The Activist Company”
In Gelles, Patagonia v. Trump: Inside a battle over public lands, nytimes (5/6/2018) it was noted that “President Trump announced plans to sharply reduce the size of two national monuments in Utah. Bears Ears, an expanse of red-rock canyons rich with archaeologically significant sites, would be slashed in size by 85 percent, more than a million acres. Another monument, Grand Staircase-Escalante, would be reduced by half…It bills itself ‘the Activist Company’ and publicly advocates for environmental protection, fair trade and stricter labor standards. It supports thousands of grass-roots environmental activists and has been involved with Bears Ears since 2012. But until December, Patagonia had never tangled with a President. Working with a handful of local groups and the law firm of Hogan Lowells, Patagonia filed a lawsuit in U.S. District Court in Washington. The lawsuit named as defendants Trump, Interior Secretary Ryan Zinke, the secretary of agriculture, the director of the Bureau of Land Management and the chief of the Forest Service. And the argument was simple. The Antiquities Act of 1906 gave presidents the power to create national monuments. But it did not grant the power to reduce them.
Bravo For Southwest Airlines Pilots
In Haag, Southwest Pilot Who Landed Fatal Flight Wasn’t Supposed to Be On It, nytimes (5/10/2018) it was noted that “Everything was going smoothly until Southwest Airlines Flight 1380 reached about 32,000 feet. Then there was chaos…Captain Tammie Jo Shults…was not initially supposed to be in (the Captain’s) seat. Her husband, David Shults, a fellow Southwest pilot, had agreed to swap flights so she could attend their son’s track meet…In the explosion, a piece of the engine broke off, slammed into a window in Row 14 and shattered it. The passenger sitting in the window seat, Jennifer Riordan, was partially sucked out of the plane before she was pulled back inside the cabin. She later died. The pilots have been praised, including in a White House visit with President Trump, for bringing the plane under control and averting a far worse outcome”.
Next Time In Bangladesh, Take A Train
In New Rail Line to Reduce Travel Time Between Agartala Kolkata by 21 Hrs, travelwirenews (5/14/2018) it was noted “The new 12.3 km Akhaura rail line will reduce journey time between Agartala and Kolkata by 21 tours, by cutting through Bangladesh’s capital of Dhaka instead of Guwahafi. The travel time between Agartala and Kolkata will now be reduced to around 10 hours from current 31 hours as it will travel a mere 550 km instead of 1600″. Bravo.
World’s Longest Sea-Crossing Bridge
In China unveils world’s longest sea-crossing bridge, travelwirenews (5/12/2018) it was noted that “Spanning 34 miles (55 kilometers) this is the longest sea-crossing bridge ever built…Due to open to the public this summer, the long snake of bitumen will connect a relatively small city on the Chinese mainland with the Special Administrative Regions of Hong Kong and Macau…the bridge can be seen as a physical manifestation of the Chinese leadership’s determination to exert its regional influence”.
UK Package Travel Pre-Action Protocol
In Food Poisoning: The Package Travel Pre-Action Protocol-Headlines For Practitioners, internationalandtravellawblog (5/9/2018) it was noted that “In this blog post, James Beeton of 12 King’s Bench Walk sets out the key features of the new Pre-action Protocol for the Resolution of Package Travel Claims. The main points to note are: (1) the extension of gastric illness claims of the fixed recoverable costs regime in Part 15, (ii) a prescriptive system of claims notification and response, (iii) accelerated disclosure obligations (including potentially onerous disclosure requirements on defendants) and (iv) confirmation that an expert medical report for a GP followed by Part 35 questions is likely to continue to represent the totality of the expert evidence in the vast majority of cases”.
The Queen Of Las Vegas
In Stewart, With Steve Wynn Gone, ‘Queen of Las Vegas’ Does Boardroom Battle, nytimes (5/10/2018) it was noted that “Elaine Wynn, known as the Queen of Las Vegas for her long involvement with Mirage Wynn Resorts, the casino and resort companies she founded with ex-husband Steve Wynn, might seem an unlikely champion of shareholder rights and good corporate governance…Instead, she has had a crash course in corporate law and was working the phones to reach major Wynn shareholders, drumming up support to oust a long-serving board member who’s up for re-election at the annual meeting next week. The outcome is of far more than academic interest, given that Ms. Wynn is now the company’s largest shareholder, with a 9 percent stake valued this week at nearly $2 billion”.
Shop Like A British Royal
In Koch, A Road Map to Shopping Like a Royal in London, nytimes (5/9/2018) it was noted that “the British royal family has long been a source of public fascination, captivating mere mortals in Britain and beyond with a passion for all things Windsor…Another way to gain insight into the predilections of the royal family is by examining the brands that hold the royal warrant-the top-of-the-line British purveyors that have earned the royal family’s seal of approval. Royal warrants, which have been issued by the British royal family since the 15th century, are a mark of distinction…There are currently about 800 royal warrant holders throughout Britain…With the help of a royal warrant road map, tourists can effectively shop the royal family’s go-to brands (which) includes purveyors of cheese, tea, books and grooming products. The road map is an opportunity to scoop up meaningful souvenirs without spending a fortune”.
Travel Law Case Of The Week
In the Gonzales case the Court noted that “Uber used the fraudulently received geolocation data and driver identifiers ‘to create grid-like detection nets over cities including San Francisco, Los Angeles and New York’. For instance, a forged rider account would transmit a request indicating that the rider was at the Philip Burton Federal Building with specific GPS coordinates. In response Lyft servers ‘would transmit back information for all nearby Lyft drivers’. The Hell spyware would simultaneously also send another set of requests indicating that a different fake Lyft rider was a few blocks away on O’Farrell Street with specific geolocation data. This process was repeated with a large number of fake Lyft drivers, ‘allowing Uber to obtain complete geographic coverage of entire metropolitan areas, and the exact locations of all Lyft drivers and other information’. ‘Uber repeated this process millions of times using the Hell spyware from 2014 through 2016″.
Discouraging Lyft Drivers
“Uber used the data collected…’to learn personal details about Lyft drivers including, but not limited to, the drivers’ full names, their home addresses, when and where they typically work each day and for how many hours, and where they take breaks’. ‘Uber was able to use this data to determine the identities of the drivers’ rider customers’. ‘Uber combined the data harvested by Hell [spyware] with Uber’s internal records…to identify Lyft drivers who also worked for Uber’. ‘Uber used the information gleaned from Hell to direct more frequent and more profitable trips to Uber drivers who also used the Lyft app’. ‘By inundating these drivers [with] Uber rides, Uber was able to discourage drivers from accepting work on the Lyft platform, reducing the effective supply of available Lyft drivers’. ‘With the supply of Lyft drivers reduced, Lyft customers faced longer wait times’. As a result, Lyft drivers would cancel the ride requested with Lyft and request a new ride from Uber, and Lyft drivers experienced decreased earnings. ‘Over time, this would reduce the effectiveness of the Lyft App thus harming drivers such as Plaintiff and absent Class Members’”.
The Wiretap Act
“Plaintiff alleges that when he activates the Lyft App he sends Lyft his unique Lyft driver identification, his precise geolocation data, his affirmation that he is willing to provide rider to drivers and an estimated price for the ride…With the possible exception of the estimated price, this information does not qualify as the ‘contents’ of a communication within the meaning of the Wiretap Act…The ‘content’ analysis may be different as to pricing information; however, there are no allegations in the FAC that suggest that Plaintiff intended to communicate pricing information…Plaintiff has not alleged facts sufficient to satisfy the ‘contents’ prong of the Wiretap Act”. Plaintiff also does not allege facts that plausibly suggest that Uber ‘intercepted’ any of his communications”.
Stored Communications Act (SCA)
“”Plaintiff’s SCA claim fails because he has not alleged facts that plausibly suggest that the communications were in ‘electronic storage’; that is, that the communications were temporary or were in storage for the purposes of back-up protection. Plaintiff alleges that Lyft’s and Uber’s systems store the location of every driver, whether on duty or off duty, every few seconds and that neither Uber nor Lyft delete the geolocation data they collect from drivers. Given this information is never deleted, the communications at issue as not stored temporarily and therefore do not fall under section (A). Nor does section (B) apply…Plaintiff has not alleged facts that plausibly suggest that the communications Uber allegedly accessed without authorization are ‘backups’, the Stored Communications Act claim must be dismissed”.
California Invasion of Privacy Act (CIPA)
“The CIPA is California’s anti-wiretapping and anti-eavesdropping statute that prohibits unauthorized interceptions of communications in order ‘to protect the right of Privacy’.
“The analysis for a violation of CIPA is the same as that under federal Wiretap Act’…The plain language of Section 637.7 states that the statute does not apply when the owner of a vehicle consents to the use of the tracking device with respect to the same vehicle…Plaintiff consented to the tracking of his vehicle through his cellphone when he signed up to be a Lyft driver. Accordingly, Plaintiff’s Section 637.7 claim fails and shall be dismissed”.
Computer Data Access And Fraud Act (CDAFA)
“The (CDAFA)…’expand[s] the degree of protection to individuals, businesses and governmental agencies from tampering, interference, damage and unauthorized access to lawfully created computer data and computer systems’…These boilerplate allegations do not survive Rule 8. Did Uber use data, a computer or a computer system to wrongfully obtain money? How did Uber disrupt or deny the use of computer services? What was it that it did without permission? Neither Uber nor the Court should have to guess how Plaintiff contends these subsections were violated… Plaintiff’ claim under (CDAFA)is dismissed with leave to amend”.
Invasion Of Privacy
“The California Constitution creates a privacy right that protects individuals from the invasion of their privacy by private parties…Plaintiff alleges that Uber used the data collected from Lyft in conjunction with other databases to learn personal details about Lyft drivers including, but not limited to, rivers’ full names, when and where they typically work, where they take breaks, and the drivers’ home addresses. Plaintiff had sufficiently pled a protected privacy interest as to home addresses and arguable geolocation data…The second element, a reasonable expectation of privacy under the circumstances, is not met…Plaintiff consented to the sharing of his geolocation data with perfect strangers (Lyft riders); thus, under the circumstances he did not have a reasonable expectation of privacy in such information…The Court grants Defendants’ motion to dismiss Plaintiff’s constitutional invasion of privacy claim with leave to amend”.
Unfair Competition Law (UCL)
“California’s (UCL) prohibits and provides civil remedies for ‘unfair competition’ defined as ‘any unlawful, unfair or fraudulent business act or practice’…Its purpose ‘is to protect both consumers and competitors by promoting fair competition in commercial markets for goods and services’…Private parties can sue under the UCL only if, as a result of unfair competition they have (1) suffered an injury in fact, (2) lost money or property and (3) the economic injury was a ‘result of’ the unfair competition…Plaintiff alleges that by encouraging drivers to use the Uber platform exclusively, and not also drive for Lyft, that reduced the supply of Lyft drivers thereby increasing wait times and causing Lyft drivers to experienced decreased earnings; in particular the longer wait time would cause a passengers to cancel the Lyft request and request a new ride from Uber. These factual allegations, which the Court must accept as true, are sufficient to satisfy the lost money or property requirement of UCL standing…Accordingly, Plaintiff has alleged standing to bring a UCL claim”.
The author, Thomas A. Dickerson, is a retired Associate Justice of the Appellate Division, Second Department of the New York State Supreme Court and has been writing about Travel Law for 42 years including his annually updated law books, Travel Law, Law Journal Press (2018), Litigating International Torts in U.S. Courts, Thomson Reuters WestLaw (2018), Class Actions: The Law of 50 States, Law Journal Press (2018) and over 500 legal articles. For additional travel law news and developments, especially, in the member states of the EU see IFTTA.org.
This article may not be reproduced without the permission of Thomas A. Dickerson.
Read many of Justice Dickerson’s articles here.