6 ms·

How did this even get to the Supreme Court? This was a 9-0 decision because it was such a clear cut case. > Noah Duguid sued Facebook under the act because he

by sxp 6y ago

How did this even get to the Supreme Court? This was a 9-0 decision because it was such a clear cut case. > Noah Duguid sued Facebook under the act because he received several text messages from the company, alerting him that someone had attempted to access his Facebook account from an unknown browser — even though Duguid never had a Facebook account or gave the company his number. Those messages were sent to him using a form of automated technology, but one that did not use a random or sequential number generator. It's obvious that companies should be allowed to contact you for a good reason if your number was entered into the system by someone else. Whether it was done by a robot or a human doesn't matter. The offender here was whoever put Duguid's phone number into FB's database.

NovemberWhiskey 6y ago
I agree entirely; this is a dumb case. If decided for Duguid, here's a list of things that would probably have become illegal for businesses to do under TCPA: 1) using caller ID to return a missed call unless you were sure you were calling an existing customer 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer 3) using call-center software that automatically connects an operator to the customer's on-file telephone number in order to validate that the number was correct!
- kmonsen 6y ago
  2) and 3) would probably always be illegal since phone numbers are recycled and you can never know when that happens. I guess it’s fairly likely that is what happened in this case? So even if you are sure it is the number of a customer, it is verified and used for correspondence it can still be sometime else number a year (I don’t know how long the recycling waiting time is) later.
  - duskwuff 6y ago
    > you can never know when that happens There's work being done to address that: https://www.fcc.gov/reassigned-numbers-database https://www.fcc.gov/reassigned-numbers-database https://www.reassigned.us/ https://www.reassigned.us/
- nulbyte 6y ago
  Regarding the first two, it's not just a matter of an existing relationship, but also consent. As to the latter, this was the effect, and likely will continue to be, until companies decide to implement changes in response to this ruling. Especially larger corporations have been capturing consent and even relying on third-parties to manually dial numbers, because this was the prevailing interpretation until the Supreme Court reintroduced common sense.
  - NovemberWhiskey 6y ago
    I don't see the relevance of consent: you can't consent on behalf of a third party. The evidentiary question of whether a customer had actually consented to receive calls/texts from a service to which they had subscribed is separate from the question of liability for using automation to call/text a number that turns out not to belong to a customer.
- Der_Einzige 6y ago
  Two factor auth is so bad over SMS for security that id love to see it banned (even for the wrong reasons). The other two are fine casualties for a world with far less autodialing. Call centers probably ought not exist.
- toast0 6y ago
  > 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show? Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.
  - connorproctor 6y ago
    Rather than texting the consumer a security code and having them enter it in the browser, you could display a security code in the browser and have them text it to your automated system. But there’s still no way to know if that number later gets released to another person.
    - anticristi 6y ago
      AFAIU, caller ID can be faked. Getting an SMS from a phone number does not demonstrate anything. Probably this is why the send factor is received, not sent.
    - toast0 6y ago
      As the sibling comment says, spoofing sender ID or caller ID is relatively easy. You can't trust it, outside of some very narrow cases (although, shaken/stir may change that). Some carriers do make available lists of recycled numbers, and some telephone information companies aggregate these lists, when I was looking, coverage was sparse though, and questions about reliability and privacy were too big relative to the limited coverage. Sharing of confidential information was an issue too: carriers wanted to provide events only for numbers of interest to a 3rd party service, so the carrier didn't divulge the number of customers leaving their service; the 3rd party service didn't want to provide numbers of interest because it would divulge user count. I may be biased (I was working for a service), but the recycled number list feels less privacy invasive than providing numbers of intetest. The numbering space is small, so you can't meaningfully obscure the numbers, etc. Determining which carrier is responsible for a number is also tricky, of course.
- privacylawthrow 6y ago
  These were already violations of the TCPA in the 9th Circuit under the 9th Circuit's previous ruling in Marks where the court found that an autodialer is any equipment that dials a number from a stored list. Marks was used as precedent for this lawsuit. Facebook argued that this case was different from Marks. The Ninth Circuit found otherwise. SCOTUS appears to have shot down the ruling from Marks. Marks was widely regarded as a terrible decision because it made no sense at the time. It's nice to see SCOTUS return some common sense to the law. Note also that the TCPA allows for statutory damages of up to $1500 per violation, so it takes less than 675 calls/texts to rack up $1M in liability. Class action attorneys love it because they don't have to show damages. They only have to show that the call or text was sent using an autodialer.
  - NovemberWhiskey 6y ago
    Having now read Marks it now makes a whole lot more sense why this is in the Supreme Court; the Ninth Circuit seems to have gone off the deep end with that decision.
  - andjd 6y ago
    >Marks was widely regarded as a terrible decision because it made no sense at the time. Citation? I've looked over _Marks_, and it doesn't seem unreasonable, and the 9th circuit was not the only court to adopt the same interpretation of the statute. I can see why certain industries would lothe that rule, but it doesn't seem to me that the Court's opinion is a fine, if not exemplary, example of legal interpretation. Similarly, it's far from clear that Congress intended that such behavior be permissible when they passed the law. Honestly, _Marks_ makes more sense to me than the Supreme Court's interpretation does. Reading a law's text in the narrow and formal way that they did causes the law to be nonsensical.
flyingfences 6y ago
> The offender here was whoever put Duguid's phone number into FB's database. Without reading further into the details of this case than what's given in TFA, I would go so far as to say that there probably wasn't an "offender" in any strict sense. Most likely what happened is that someone entered their own number in connection to their own account, then they got a new number and never bothered updating Facebook, then the number got recycled and assigned to Duguid so he got the alert. That's what happened to me when I first got the number that I have now -- it had, from what I could piece together, belonged to a young woman from a couple towns over who had apparently up and moved halfway across the country and gotten a new number without bothering to tell anybody at all. It was an annoyance to be sure but never once did I think of blaming the callers/texters.
- nonameiguess 6y ago
  I once had an internal number on a corporate system that, for some reason, was assigned to multiple desks at the same time. It took a while for us to figure out that anyone who called the number just called both of us simultaneously and only got to talk to whoever happened to answer first.
- whoopdedo 6y ago
  > Most likely what happened is that someone entered their own number in connection to their own account, then they got a new number and never bothered updating Facebook, then the number got recycled and assigned to Duguid so he got the alert. I've had this happen to me and really wish phone companies would wait at least 90 days before putting a disconnected number back in service. The worst part of it is I was given the option to "disable" SMS. But it turns out that doesn't actually prevent shortcode messages from going through.
- MertsA 6y ago
  Forget recycled phone numbers, I get this same problem with email for a domain I bought around a year ago. Just the other day I had an email with an attached transcript for someone's recent Medrite visit. The domain I bought was at one point used for some corporate email, almost all of the emails I get for it are not business related though, it's basically all personal stuff. There needs to be a method to declare "This identifier has changed hands" for phone numbers, domains, IP addresses, street addresses, etc.
chiefalchemist 6y ago
Perhaps. But when a phone # gets entered then FB should authenticate it on the spot. Then someone else can't use your number nefariously. As it is, couldn't this be FB more or less phishing? That is, baiting non-users to register? Certainly, such tactics have been used with email. Why not SMS?
- ipsum2 6y ago
  In another article, I believe it said that the phone number was recycled from an actual user.
throwawaysea 6y ago
I might not understand the terminology or process here, but doesn’t SCOTUS often refuse to hear cases that aren’t worth their time? Last year they chose not to hear a number of second amendment cases where it seemed like there was much more on the line and they would have overturned lower court rulings, so I’m surprised they chose to spend time on this one, which seems uncontroversial given the 9-0 vote.
- nulbyte 6y ago
  The effect of declining a case is to leave the lower court's decision in place. However, the lower court sided with Duguid, not Facebook. Here, the Supreme Court overturned that decision.
xxpor 6y ago
Were they resolving a circuit split? That's usually the way "silly" cases get up there.
- my_username_is_ 6y ago
  That does seem to be the case here. >the Third, Seventh, and Eleventh Circuit Courts of Appeal require number generation in order for technology to qualify as an ATDS. [...] The Second and Ninth Circuit Courts of Appeal, in contrast, have liberally construed the statutory text and do not require number generation. https://www.mintz.com/insights-center/viewpoints/2301/2020-07-10-breaking-scotus-will-decide-atds-definition-facebook-inc https://www.mintz.com/insights-center/viewpoints/2301/2020-0... This was an appeal from the 9th Circuit, so provided an opportunity for the Supreme Court to overturn the lower Court's ruling.
Traster 6y ago
Reminds me of a kafkaesque situation I had a few years back. I was getting text messages from Barclays about my account (I don’t have an account). I contacted them telling them to desist but because I’m not a customer I can’t actually tell them to change details on an account that isn’t mine.
- an_ko 6y ago
  I keep getting email from PayPal about their terms and conditions changing. I have a PayPal account, which I can't delete, because to delete it, I'd have to log in, but when I enter my details (which I know are correct; I use a password manager), I get a generic error message. Trying the password recovery procedure with my username gives me the same generic error message. I've emailed customer support twice, but they don't seem to be staffed by humans, because both times I got the same "you should use the password recovery procedure" template response, even though I explained it doesn't work. I've created a filter to send them to trash, but it just feels so very sad.
  - chaps 6y ago
    Years ago (2008?) I was able to get PayPal's customer support to tell me my password over the phone. Try that ;)
    - jedberg 6y ago
      No you didn't. PayPal has never stored passwords in plaintext. I know because I worked anti-fraud for PayPal, and even I couldn't get access to that database, much less see passwords, even though I had a list of passwords I was trying to verify that I had gotten from people who steal accounts.
      - droopyEyelids 6y ago
        wait. so you think a plain text db of customer passwords does exist? Or are you saying you couldn't access it because it doesn't exist
tick_tock_tick 6y ago
It came to them from a weird Ninth Circuit ruling. The Ninth Circuit is pretty much the poster child for weird ruling and judicial overreach. I wish there was more repercussions for it's behavior maybe for some of these cases where it is such a clear 9-0 kind of case the Supreme Court should look into if the lower justices are fulfilling there duty.
jakelazaroff 6y ago
FWIW, 9–0 verdicts are actually the most common: https://www.washingtonpost.com/news/posteverything/wp/2018/06/28/those-5-4-decisions-on-the-supreme-court-9-0-is-far-more-common/ https://www.washingtonpost.com/news/posteverything/wp/2018/0...
leephillips 6y ago
Does the fact that he tried to get them to stop harassing him and they refused make the case any less clear cut?
Taniwha 6y ago
I disagree, facebook is terrible at this stuff - someone used my email account to create a facebook account, no verification of the address was done, but I started receiving daily annoying emails from fb, fb is impossible to contact, there's no contact email on their web page, no phone numbers, nothing, I didn't have a fb account so I couldn't contact the person using my email address ... complete bunch of morons as far as running a web service
- deleted 6y ago
  [deleted]
A4ET8a8uTh0 6y ago
I know it may be something of an unpopular opinion, but maybe collecting vast amounts of information is not such a great idea after all. In a similar manner, I have certain level of beef with bank managing to bamboozle the public that bank's failing to establish, who they are dealing with is identity theft and not their negligence. It took years, but notice how people no longer even question this perspective. Hell, there is ID theft insurance now too. In other words, it is not obvious at all. It just unfortunate turn of events for average prole.
- hn_throwaway_99 6y ago
  I don't think you'll find that "collecting vast amounts of information is not such a great idea after all" is an unpopular opinion on HN. That said, it seems quite reasonable that companies collect ways to contact you, including email and phone number (at least until there are ways to easily make these unique per business so they can't be used to track you). I'm just confused about how his phone number got associated with another account. Doesn't FB include a verification step for setting a phone number?

by sxp 6y ago

NovemberWhiskey 6y ago

I agree entirely; this is a dumb case. If decided for Duguid, here's a list of things that would probably have become illegal for businesses to do under TCPA: 1) using caller ID to return a missed call unless you were sure you were calling an existing customer 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer 3) using call-center software that automatically connects an operator to the customer's on-file telephone number in order to validate that the number was correct!

kmonsen 6y ago
2) and 3) would probably always be illegal since phone numbers are recycled and you can never know when that happens. I guess it’s fairly likely that is what happened in this case? So even if you are sure it is the number of a customer, it is verified and used for correspondence it can still be sometime else number a year (I don’t know how long the recycling waiting time is) later.
- duskwuff 6y ago
  > you can never know when that happens There's work being done to address that: https://www.fcc.gov/reassigned-numbers-database https://www.fcc.gov/reassigned-numbers-database https://www.reassigned.us/ https://www.reassigned.us/
nulbyte 6y ago
Regarding the first two, it's not just a matter of an existing relationship, but also consent. As to the latter, this was the effect, and likely will continue to be, until companies decide to implement changes in response to this ruling. Especially larger corporations have been capturing consent and even relying on third-parties to manually dial numbers, because this was the prevailing interpretation until the Supreme Court reintroduced common sense.
- NovemberWhiskey 6y ago
  I don't see the relevance of consent: you can't consent on behalf of a third party. The evidentiary question of whether a customer had actually consented to receive calls/texts from a service to which they had subscribed is separate from the question of liability for using automation to call/text a number that turns out not to belong to a customer.
Der_Einzige 6y ago
Two factor auth is so bad over SMS for security that id love to see it banned (even for the wrong reasons). The other two are fine casualties for a world with far less autodialing. Call centers probably ought not exist.
toast0 6y ago
> 2) sending a one-time password over SMS, unless you had already validated that the telephone number belonged to your customer Note that it's pretty hard to validate a phone number belongs to someone. You could ask their telephone company, but their telephone company shouldn't disclose subscriber information, and even if they did, maybe you get a name, but lots of people have the same name as me, so what does that show? Commonly, people send a text message with a code or a phone call with a code to demonstrate control (not belonging), but that's almost always automated, and you would need the number to be validated before you could validate it.
- connorproctor 6y ago
  Rather than texting the consumer a security code and having them enter it in the browser, you could display a security code in the browser and have them text it to your automated system. But there’s still no way to know if that number later gets released to another person.
  - anticristi 6y ago
    AFAIU, caller ID can be faked. Getting an SMS from a phone number does not demonstrate anything. Probably this is why the send factor is received, not sent.
  - toast0 6y ago
    As the sibling comment says, spoofing sender ID or caller ID is relatively easy. You can't trust it, outside of some very narrow cases (although, shaken/stir may change that). Some carriers do make available lists of recycled numbers, and some telephone information companies aggregate these lists, when I was looking, coverage was sparse though, and questions about reliability and privacy were too big relative to the limited coverage. Sharing of confidential information was an issue too: carriers wanted to provide events only for numbers of interest to a 3rd party service, so the carrier didn't divulge the number of customers leaving their service; the 3rd party service didn't want to provide numbers of interest because it would divulge user count. I may be biased (I was working for a service), but the recycled number list feels less privacy invasive than providing numbers of intetest. The numbering space is small, so you can't meaningfully obscure the numbers, etc. Determining which carrier is responsible for a number is also tricky, of course.
privacylawthrow 6y ago
These were already violations of the TCPA in the 9th Circuit under the 9th Circuit's previous ruling in Marks where the court found that an autodialer is any equipment that dials a number from a stored list. Marks was used as precedent for this lawsuit. Facebook argued that this case was different from Marks. The Ninth Circuit found otherwise. SCOTUS appears to have shot down the ruling from Marks. Marks was widely regarded as a terrible decision because it made no sense at the time. It's nice to see SCOTUS return some common sense to the law. Note also that the TCPA allows for statutory damages of up to $1500 per violation, so it takes less than 675 calls/texts to rack up $1M in liability. Class action attorneys love it because they don't have to show damages. They only have to show that the call or text was sent using an autodialer.
- NovemberWhiskey 6y ago
  Having now read Marks it now makes a whole lot more sense why this is in the Supreme Court; the Ninth Circuit seems to have gone off the deep end with that decision.
- andjd 6y ago
  >Marks was widely regarded as a terrible decision because it made no sense at the time. Citation? I've looked over _Marks_, and it doesn't seem unreasonable, and the 9th circuit was not the only court to adopt the same interpretation of the statute. I can see why certain industries would lothe that rule, but it doesn't seem to me that the Court's opinion is a fine, if not exemplary, example of legal interpretation. Similarly, it's far from clear that Congress intended that such behavior be permissible when they passed the law. Honestly, _Marks_ makes more sense to me than the Supreme Court's interpretation does. Reading a law's text in the narrow and formal way that they did causes the law to be nonsensical.

flyingfences 6y ago

> The offender here was whoever put Duguid's phone number into FB's database. Without reading further into the details of this case than what's given in TFA, I would go so far as to say that there probably wasn't an "offender" in any strict sense. Most likely what happened is that someone entered their own number in connection to their own account, then they got a new number and never bothered updating Facebook, then the number got recycled and assigned to Duguid so he got the alert. That's what happened to me when I first got the number that I have now -- it had, from what I could piece together, belonged to a young woman from a couple towns over who had apparently up and moved halfway across the country and gotten a new number without bothering to tell anybody at all. It was an annoyance to be sure but never once did I think of blaming the callers/texters.

nonameiguess 6y ago
I once had an internal number on a corporate system that, for some reason, was assigned to multiple desks at the same time. It took a while for us to figure out that anyone who called the number just called both of us simultaneously and only got to talk to whoever happened to answer first.
whoopdedo 6y ago
> Most likely what happened is that someone entered their own number in connection to their own account, then they got a new number and never bothered updating Facebook, then the number got recycled and assigned to Duguid so he got the alert. I've had this happen to me and really wish phone companies would wait at least 90 days before putting a disconnected number back in service. The worst part of it is I was given the option to "disable" SMS. But it turns out that doesn't actually prevent shortcode messages from going through.
MertsA 6y ago
Forget recycled phone numbers, I get this same problem with email for a domain I bought around a year ago. Just the other day I had an email with an attached transcript for someone's recent Medrite visit. The domain I bought was at one point used for some corporate email, almost all of the emails I get for it are not business related though, it's basically all personal stuff. There needs to be a method to declare "This identifier has changed hands" for phone numbers, domains, IP addresses, street addresses, etc.

chiefalchemist 6y ago

Perhaps. But when a phone # gets entered then FB should authenticate it on the spot. Then someone else can't use your number nefariously. As it is, couldn't this be FB more or less phishing? That is, baiting non-users to register? Certainly, such tactics have been used with email. Why not SMS?

ipsum2 6y ago
In another article, I believe it said that the phone number was recycled from an actual user.

throwawaysea 6y ago

I might not understand the terminology or process here, but doesn’t SCOTUS often refuse to hear cases that aren’t worth their time? Last year they chose not to hear a number of second amendment cases where it seemed like there was much more on the line and they would have overturned lower court rulings, so I’m surprised they chose to spend time on this one, which seems uncontroversial given the 9-0 vote.

nulbyte 6y ago
The effect of declining a case is to leave the lower court's decision in place. However, the lower court sided with Duguid, not Facebook. Here, the Supreme Court overturned that decision.

xxpor 6y ago

Were they resolving a circuit split? That's usually the way "silly" cases get up there.

my_username_is_ 6y ago
That does seem to be the case here. >the Third, Seventh, and Eleventh Circuit Courts of Appeal require number generation in order for technology to qualify as an ATDS. [...] The Second and Ninth Circuit Courts of Appeal, in contrast, have liberally construed the statutory text and do not require number generation. https://www.mintz.com/insights-center/viewpoints/2301/2020-07-10-breaking-scotus-will-decide-atds-definition-facebook-inc https://www.mintz.com/insights-center/viewpoints/2301/2020-0... This was an appeal from the 9th Circuit, so provided an opportunity for the Supreme Court to overturn the lower Court's ruling.

Traster 6y ago

Reminds me of a kafkaesque situation I had a few years back. I was getting text messages from Barclays about my account (I don’t have an account). I contacted them telling them to desist but because I’m not a customer I can’t actually tell them to change details on an account that isn’t mine.

an_ko 6y ago
I keep getting email from PayPal about their terms and conditions changing. I have a PayPal account, which I can't delete, because to delete it, I'd have to log in, but when I enter my details (which I know are correct; I use a password manager), I get a generic error message. Trying the password recovery procedure with my username gives me the same generic error message. I've emailed customer support twice, but they don't seem to be staffed by humans, because both times I got the same "you should use the password recovery procedure" template response, even though I explained it doesn't work. I've created a filter to send them to trash, but it just feels so very sad.
- chaps 6y ago
  Years ago (2008?) I was able to get PayPal's customer support to tell me my password over the phone. Try that ;)
  - jedberg 6y ago
    No you didn't. PayPal has never stored passwords in plaintext. I know because I worked anti-fraud for PayPal, and even I couldn't get access to that database, much less see passwords, even though I had a list of passwords I was trying to verify that I had gotten from people who steal accounts.
    - droopyEyelids 6y ago
      wait. so you think a plain text db of customer passwords does exist? Or are you saying you couldn't access it because it doesn't exist

tick_tock_tick 6y ago

It came to them from a weird Ninth Circuit ruling. The Ninth Circuit is pretty much the poster child for weird ruling and judicial overreach. I wish there was more repercussions for it's behavior maybe for some of these cases where it is such a clear 9-0 kind of case the Supreme Court should look into if the lower justices are fulfilling there duty.

jakelazaroff 6y ago

FWIW, 9–0 verdicts are actually the most common: https://www.washingtonpost.com/news/posteverything/wp/2018/06/28/those-5-4-decisions-on-the-supreme-court-9-0-is-far-more-common/ https://www.washingtonpost.com/news/posteverything/wp/2018/0...

leephillips 6y ago

Does the fact that he tried to get them to stop harassing him and they refused make the case any less clear cut?

Taniwha 6y ago

I disagree, facebook is terrible at this stuff - someone used my email account to create a facebook account, no verification of the address was done, but I started receiving daily annoying emails from fb, fb is impossible to contact, there's no contact email on their web page, no phone numbers, nothing, I didn't have a fb account so I couldn't contact the person using my email address ... complete bunch of morons as far as running a web service

deleted 6y ago
[deleted]

A4ET8a8uTh0 6y ago

I know it may be something of an unpopular opinion, but maybe collecting vast amounts of information is not such a great idea after all. In a similar manner, I have certain level of beef with bank managing to bamboozle the public that bank's failing to establish, who they are dealing with is identity theft and not their negligence. It took years, but notice how people no longer even question this perspective. Hell, there is ID theft insurance now too. In other words, it is not obvious at all. It just unfortunate turn of events for average prole.

hn_throwaway_99 6y ago
I don't think you'll find that "collecting vast amounts of information is not such a great idea after all" is an unpopular opinion on HN. That said, it seems quite reasonable that companies collect ways to contact you, including email and phone number (at least until there are ways to easily make these unique per business so they can't be used to track you). I'm just confused about how his phone number got associated with another account. Doesn't FB include a verification step for setting a phone number?