UVA Law Student Body v. Microsoft
73 U.Va 23 (2021)
Gladden, J., delivered the opinion of the court.
Today we have before us a civil suit brought by the UVA student body, plaintiffs, against Microsoft, defendant. Plaintiffs bring suit under 18 U.S.C. Section 1030(g) (the Computer Fraud and Abuse Act or CFAA), as well as an action alleging trespass to chattels. Specifically, students are seeking to enjoin Microsoft SignIn Verification from calling their phones or requiring signing in on their app less than seven days apart.
The facts are indeed egregious. UVA students, attempting to sign in to their law school accounts, suddenly and without warning find a notification flash upon their computer screen: “We’re calling your phone. Please answer it to continue.” Before students can react, their phones are accosted by a call that is impossible to ignore. Students must answer and press the pound key, and only then are they allowed into their Zoom classes or email accounts. Moreover, when Microsoft SignIn Verification calls a student, the statement “Don’t ask again for 7 days” appears next to a box that can be checked. However, plaintiffs who check this box are then faced with a brutal reality: Microsoft does not wait the full seven days. Rather, plaintiffs report being called multiple times within the span of a week. In a more horrifying account, several individuals recount having Microsoft SignIn Verification calling them multiple times within minutes of each other, continuously rejecting their frantic pressings of the pound key before finally declaring that the request has timed out and the student must start over, wasting precious minutes. This Court will not stand for such an atrocity, and it will grant the requested injunctive relief immediately.
First, we turn to the CFAA claim. Clearly, Microsoft has exceeded its authorized access under contract-based restrictions.[1] Seven days means seven days. It is well-established that law students are not great at math, but an expert witness need not be provided here. We may take judicial notice here that seven quite clearly equals seven. This language explicitly places a restriction on Microsoft’s ability to access students’ devices, and even if it did not, a lack of authorized access may also be implicit or norm-based.[2] It should be evident by now that calling any person without warning should be recognized as implicitly taboo; regardless, the plain text of the statement is precise. Therefore, when Microsoft SignIn Verification calls students within that precious seven-day window, it violates that contract-based restriction.
Second, we hold that there is a viable trespass to chattels claim here. Plaintiffs certainly have a possessory interest in their phones. Defendants cite Intel v. Hamidi to argue that there was no damage to the physical phones, thereby nullifying this claim. However, they failed to properly distinguish the facts. The emails sent by Hamidi did not affect Intel’s email system, and the only other harm alleged was a decrease in employee productivity associated with the constant emails.[3] By contrast, it is a far more dire situation when students are three minutes late to class because Microsoft is hampering their ability to sign in. A three-minute delay is enough to miss several tomes’ worth of valuable information in a Nelson class.
Sorry, Microsoft, you’re no Kourosh Kenneth Hamidi. And it’s too late for you and your white horse to come around. Photo courtesy of Kolleen Gladden, '21.
Furthermore, plaintiffs have taken self-help steps by checking the box pleading with Microsoft not to call them again for seven days. The potential for irreversible harm from missing valuable classroom instruction or compromising professor relationships is beyond debate. Honestly, there should have been an emotional distress claim thrown in here just for making Millennials and Gen Z’s answer their phones. All individuals in these age brackets know all too well the horror of being called unexpectedly and without warning, let alone being forced to answer.
There is no possible conclusion other than that we must immediately remediate this situation. Defendant’s additional argument—the “1Ls always lose” rule[4]—is inapplicable here because 2Ls and 3Ls are joining the complaint. When the collective good of the upperclassmen is at stake, 1Ls may enjoy the subsequent windfall. Finally, the defendant forgets the cardinal rule of this Court: “We do what we want.”[5] Unfortunately for them, SCOTUS precedent is no good here—who do you think we are, Law Review?[6]
It is so ordered.
Bninski, J., concurring in the result.
I write to express my qualified agreement with the opinion ably written by my colleague. While the importance of the interests adversely affected by Microsoft’s failure to honor its contract terms indicate the propriety of ordering specific performance, in my opinion, public policy requires us to go further. I believe that Microsoft should be enjoined from calling anyone.
It is an accepted principle of judicial review that, when a justice perceives that an issue may have an adverse impact on her or his own life, that the legal question becomes subject to strict and capricious scrutiny.[7] And let me say: this justice does not relish receiving phone calls from robots.
Let us examine custom within the sign-in verification community. DuoMobile, that stalwart and stultifying staple of the UVA Law experience, sends a push notification. A diverse sampling of online services requiring security – from my banking app to the systems used by various food-delivery schemes, which I have oft encountered this semester as the Law School attempts to ameliorate despair with RSVP-contingent nutrition – utilize SMS, sending a “code” that a party must “enter” in order to “verify” that one is, indeed, who one purports to “be.”[8]
This brief survey indicates that placing a verification phone call departs from industry practice. One might go so far as to term it an abhorrent anomaly. For public policy, as the opinion of the court explains, strongly supports action that minimizes the number of robotically placed calls—and indeed, the number of calls from anyone other than parties attempting to hire the holder of the telephone in question.[9] Moreover, these alternative methods indicate that technological advancement has far outstripped any need for pound-sign-pressing in order to attest to the truth of one’s being.
The nature of Microsoft’s business also merits consideration. As a pioneer in information technology, it has the resources to use verification techniques which do not, as my colleague notes, amount to the intentional infliction of emotional distress. Microsoft can muster no convincing showing of necessity.
Microsoft is no one’s mother, nor anyone’s best friend. Microsoft’s verification call lights no one’s cell phone screen with the smiling photo of a loved one. Its calls embody only the worst parts of telephonic communication. Not only should Microsoft refrain from calling would-be signers-in multiple times within the seven-day window, Microsoft should never call anyone again.[10]
---
kcg3ar@virginia.edu
am6ag@virginia.edu
[1] U.S v. Nosal (9th Cir. 2012).
[2] EF Cultural v. Zefer (1st Cir. 2003).
[3] Intel v. Hamidi (Cal. 2003).
[4] See 1Ls v. God, 73 U.Va 16 (2021).
[5] See Zoom v. HopIn, 73 U.Va 21 (2021).
[6] This Court has said before in no uncertain terms, “Like we’d want anything to do with Law Review, gross.” Law Weekly v. COPA Copiers, 999 U.Va 963 n.1 (2019).
[7] Orin S. Kerr, A Theory of Law, 16 GREEN BAG 2D 111 (2012).
[8] Let us set aside, for now, the issue of imposter syndrome and the question of what existence means.
[9] We discovered documented incidents of parties receiving career counselling being told to “answer your phone” or at least to “actually set up your voicemail” and “call back, for Pete’s sake. Do you even want a job?” This places a substantial call-answering burden on already emotionally fragile law students, which should not be unnecessarily increased by telephone calls from robots.
[10] Unless, of course, it’s offering entry-level in-house positions…