Hey there, What's Next readers. This week we've got an exclusive Q&A about a case shaking up the cryptocurrency scene. We'll also look at an identity fraud schemerelying on tech from the U.S. Postal Service, a question of jurisdiction in a suit against telecommuters, and “wiretapping” for behavioral biometrics and other identifying info.

A heads up: Next week we'll be out for the holiday. Send any tips for the weeks ahead at [email protected] or @IanMichaelLopez.

➤➤ Would you like to receive What's Next as an email? Sign up here.

 

Will this Ripple Lawsuit Set the Tone for Future Crypto Law?

Some of you crypto nerds may have been following the suits stacking up against Ripple Labs for not registering its XRP cryptocurrency as a security. The third-largest crypto outfit kicked a consolidated XRP suit up from a California superior court into federal court last week, a move that raised a lot of eyebrows.

To get a pulse on why Ripple, repped by a lineup from Skadden and Debevoise & Plimpton that includes former SEC chair Mary Jo White, made the move and its significance, I got in touch with Kobre & Kim's cryptocurrency expert Jake Chervinsky. He tells me that while the case “wouldn't provide legal certainty for any companies aside from Ripple, it still could set the tone for US cryptocurrency lawmoving forward.”

“The cryptocurrency industry has been struggling with a lack of regulatory clarityfor a long time. Even though this case is in the early stages of litigation, it is among the furthest along of any securities cases of its kind: a nationwide class action involving a digital asset with a multi-billion dollar market capitalization. As a result, many industry players are watching this case for signs of whether digital assets in general—and ICO tokens in particular—are vulnerable to threats from regulators and private investors alike.

Here are some highlights from the interview, condensed for length:

Is this case unusual in the cryptocurrency space? No, it's not unusual. Although this case is one of the first of its kind—and one of the furthest along—it involves the same allegations that a plaintiff could hurl at nearly any company in the cryptocurrency industry that issued and sold a digital asset in the last five years. Assuming some digital assets do qualify as securities, it's likely that similar class actions will eventually be filed against the majority of companies that have raised funds through token issuances.

Do you think the SEC is watching this litigation? Yes, I expect the SEC is watching this case closely. The SEC has just started to ramp up its enforcement efforts in the cryptocurrency industry, but it's still unclear whether and when digital assets qualify as securities under the law. The SEC has advanced its own interpretation—most notably, through a speech given by William Hinman in July—but that interpretation hasn't been tested in the courts. The SEC will be looking to see if the courts are willing to agree with its stance before it decides to bring any difficult enforcement actions of its own. In the meantime, the SEC seems content to let private citizens like these class action plaintiffs litigate the difficult issues for them. If the plaintiffs win, the SEC will feel more comfortable bringing its own actions in the future. If the plaintiffs lose, the SEC will have saved significant time and resources by sitting on the sidelines instead of jumping into the fray.

RE Strategy: Why do you think Ripple's defense kicked this suit to federal court? There are a few reasons why Ripple's lawyers might prefer federal court. First, California state courts are generally seen as plaintiff-friendly, and that's particularly true in class action cases. Second, California has a number of rules and procedures that are more favorable to class action plaintiffs than the corresponding rules and procedures in federal court. Third, Ripple's lawyers are likely more comfortable in federal court for the simple reason that they have more experience and expertise practicing law there.

➤ Looking Ahead: We're probably a ways from seeing the status of XRP clarified, but the case could be viewed by the SEC as an indication of how to bring future actions.

 

On the Radar: Three Things to Know

➤ Going Postal is how identity fraudsters are nabbing credit card and other PII, according to a recent internal alert from the U.S. Secret Service to nationwide law enforcement. As Brian Krebs writes in his info security blog, the alert warns that USPS' Informed Delivery—a service that lets users view scanned images of incoming mail—was used by fraudsters to “identify and intercept mail, and to further their identity theft fraud schemes.” It doesn't stop there—in addition to schemes like stealing credit card info and registering for new accounts with unsuspecting victims' info, the memo claims that thieves were chatting on “criminal forums”about using the Informed Delivery service to keep an eye on identity theft victims.

➤ Alexa the Witness. Is Alexa's role in murder investigations becoming the norm? A New Hampshire judge last week ordered Amazon to fork over the recordings taken by an Echo device in a home where a double murder occurred in 2017. But, according to ABC News, Strafford County Superior Court Presiding Justice Steven Houran took it one step further by granting the state's motion calling for the online retailer to produce data from other cellular devices paired to the Echo in the days around the murder.

➤Out of Bounds? Here's an interesting question for the digital age—can a company take up suit in its home state against an employee telecommuting from another jurisdiction? In grappling with what Judge Robert Gross called this “increasingly common factual scenario,” Florida's Fourth District Court of Appeal ruled that Citrix's forum selection clause wasn't enough for the Florida-based company to establish personal jurisdiction in the Sunshine State when it sued seven North Carolina based former employees. The appeal stems from a lower court's denial without an evidentiary hearing of a motion to dismiss brought by the employees, who were accused of misappropriating trade secrets and breaching a contract with their employer. Now, as my colleague Raychel Lean writes, the appellate judges have kicked the case back to the trial court, where they'll again consider “whether the employees' Florida ties are strong enough to keep the case alive.”

Dose of Dystopia: Retailer Caught 'Wiretapping' Online Shoppers Via Computer Code

“Keystrokes, mouse clicks, and other electronic communications” are among the PII a retailer is accused in a California class action of surreptitiously nabbing from a website's visitors via computer code riddled with “wiretaps.”

That retailer is outdoor garb outlet Moosejaw, and it along with its tech partner behind the code, NaviStone, are being sued for allegedly breaching California privacy law. The complaint accuses the companies of “secretly embedding” code on Moosejaw.com that creates a “back door” for NaviStone to “spy on the visitor as he or she browses the website.”

In addition to capturing behavioral biometrics and unsubmitted info users type on forms to match with Navistone's database of consumer profiles, the companies are also accused of scanning users' computers for files with which they can be de-anonymized.

If this all sounds familiar, it may be because Gizmodo reported how sites for clinical trial group Acurian Health and Quicken Loans were using NaviStone's code to collect info users didn't explicitly submit. The practice, University of Washington law professor Ryan Calo told Gizmodo, constitutes a pretty clear violation of user expectation, and could violate federal unfair and deceptive practices law.

NaviStone is no stranger to legal action over its practices, either. Bursor & Fisher, the firm repping plaintiff in the Moosejaw suit, is also behind another, similar suit in California, as well as one in New Jersey. And hush-hush collecting of behavioral biometric info isn't unheard of, either. Banks are collecting such info for security purposes, a practice that has some, like EFF's Jennifer Lynch, spooked. As she told NY Times in August, “It's a very small leapfrom using this to detect fraud to using this to learn very private information about you.”

But is this collection illicit snooping or business as usual? As the plaintiff attorneys write in the complaint: “None of these actions was undertaken in the ordinary course of business. On the contrary, these actions are contrary to the legitimate expectations of website visitors, and are contrary to established industry norms.”

➤Takeaway: We're seeing a growing rift in what companies believe they're able to do vs. the privacy expectations of those using their services. It'll be interesting to see courts grapple with the various questions that arise on these grounds in the years ahead.

That's it for this week! Stay tuned for What's Next!