Walking into the lawyers' lounge at the federal courthouse in Miami, Michael Daugherty found his lawyer, Ropes & Gray partner Doug Meal, poring over documents, deep in concentration as he prepared for arguments. It was June 2017, and Daugherty was where he wanted to be—finally—in his years-long fight against the Federal Trade Commission. A year earlier, he felt oddly relieved when the FTC found that his medical testing company, LabMD, had failed to adequately protect patients' personal information. For Daugherty, the decision at least meant escaping the FTC's administrative process and taking his company's defense to the U.S. Court of Appeals for the Eleventh Circuit. There, on that June morning, Daugherty said his bespectacled lawyer almost resembled a tennis player waiting to step on Wimbledon's Centre Court. “'I said, 'Hello, I'm leaving you alone, goodbye,'” Daugherty recalled in an interview Thursday. “I could just see in his face: I've got to get out of this guy's way.” It was that competitive spirit that had drawn Daugherty to Meal, who had brought a previous challenge to the FTC's authority to regulate data security—and who was ready to bring another. Meal said he was “dying to bring” LabMD's case, which the firm took on pro bono for the defunct company. “When Mike's case came along, it was like we were made for each other,” Meal said. “Literally no one in the country has thought harder about these issues than the people at our firm have.” By the time LabMD's case reached Ropes & Gray, it had spent years winding through the FTC. In 2014—a year after the FTC blamed lax data security practices at LabMD for the exposure of nearly 10,000 patients' personal information—an administrative law judge dismissed the complaint in a decision that noted a lack of evidence about anyone being harmed. The FTC's commissioners later reversed that ruling in a decision that described LabMD's data security practices as “unreasonable, lacking even basic precautions to protect the sensitive consumer information maintained on its computer system.” In addition, Daugherty claimed that FTC lawyers had ramped up their efforts against LabMD in retaliation for a book he self-published—titled “The Devil Inside the Beltway”—that criticized their conduct in the investigation. It's enough to leave a lawyer wondering where to begin. But Meal said the challenge for his team was deciding where to stop as they built out their brief for the U.S. Court of Appeals for the Eleventh Circuit. The final product, filed in December 2016, broke from his preference of limiting appeals court briefs to two arguments. “I had never seen a more target rich environment in terms of strong, powerful arguments that could be made for overturning the decision,” he said. “We had various versions of the brief that had lots of arguments that we felt were really good that never made it into the final brief. But at the same time we probably made more arguments than you typically would in an appeal because there were so many arguments that were strong that you couldn't imagine leaving them on the cutting room floor.” Out of all the arguments that were raised, it was a single one that won over the Eleventh Circuit. On Wednesday, a three-judge panel of the court erased the FTC's decision against LabMD, siding with the Ropes & Gray team's argument that the agency's order was impermissibly vague. The decision faulted the FTC for commanding LabMD “to overhaul and replace its data-security program to meet an indeterminable standard of reasonableness.” “This command is unenforceable,” Circuit Judge Gerald Bard Tjoflat said in the ruling. The decision could have wider repercussions because it struck down a compelled data security program that has been a linchpin of the FTC's cyber enforcement efforts. The panel did not make any broader rulings about the FTC's authority to regulate cybersecurity. Meal had devoted the early sections of his brief to arguments on the FTC's authority, saving what turned out to be his winning appeal for the latter half. “What was interesting about it was, if we had followed the rule of 'thou shalt not make more than two arguments,' we may never have made that argument. It shows that you need to have flexibility,” Meal said. |

Honorable Mentions