hacker, cybersecurity Photo: Shutterstock

Singer Mariah Carey's 2019 ended with some controversy when a string of lewd messages were made on her official Twitter account on New Year's Eve. Media reports have connected that incident to "The Chuckling Squad," a group tied to the August hacking of Twitter co-founder and CEO Jack Dorsey's Twitter account.

A California district attorney's office is pursuing the Dorsey hacking according to a report, while Twitter said it was investigating the matter as well. But with hackers hard to pin down, when is it beneficial for a company or individual to bring civil action? 

Lawyers contacted by Legaltech News note that while suing a hacker may not net financial gain, repairing an online reputation could incentivize companies and individuals to pursue legal action.

"Reputation is the new currency; it is really starting to be recognized as fundamental and important," said Enrico Schaefer, founding attorney of Traverse Legal, whose practice includes internet and social media law. He added, "If you can identify the person that did that and get around the anonymous aspect, juries and judges have no tolerance for that behavior."

Still, accurately identifying the hacker and getting them in a courtroom is challenging for those seeking legal recourse, lawyers acknowledged.

"The odds are you won't have jurisdiction or you won't be able to exactly identify them, and hackers don't have significant money to go after or engage in litigation or track down," said defamation and legal privacy attorney Daniel Szalkiewicz of Daniel Szalkiewicz & Associates.

Identification and jurisdiction aside, Szalkiewicz noted there are various federal and state laws plaintiffs can pursue against a hacker. The Stored Communication Act could apply if someone gained access to information that was private, while a litigant can bring a conversion charge and prove the hacker intentionally interfered with someone's right of property, Szalkiewicz explained. If trade secrets were disclosed through a breached social media account, the Defend Trade Secrets Act (DTSA) could also be utilized, he added.

Indeed, losing trade secrets to a competitor or disgruntled employee presents the opportune moment to pursue action against a hacker, Szalkiewicz said. What's more, bad publicity that follows a hack can motivate companies to launch an internal investigation or lawsuit to prove a point to the public.

"From a public relations standpoint, [companies] engage in a thorough investigation to prove a hacking went on and that's one reason why they may bring a lawsuit or internal investigation," he said.

To be sure, some big-name corporations have publicly lodged civil actions against alleged hackers recently. In October Facebook filed a federal civil suit against "grey market" cyber company NSO Group over an alleged WhatsApp backdoor. Similarly, Delta Air Lines sued its vendor in August after the airline was breached and leaked thousands of clients' data.