Author: JOLT Page 7 of 9

By Amanda Short

Do you know every person you add on social media? Do you know if your loved ones are adding strangers on social media? Human trafficking is the exploitation of persons for labor, services, or commercial sex.[1] Human trafficking is a form of modern-day slavery as victims are coerced and compelled against their will for the benefit of the trafficker.[2] As the modern age ushered in the use of social media, human traffickers have also adapted their tactics to recruit and sell victims through social media.[3] According to the Polaris Project, human traffickers use the following social media sites for recruitment purposes such as Facebook, Instagram, Snapchat, and Kik.[4] Traffickers are also known to find victims through dating sites like Tinder, Grinder, and Plenty of Fish.[5]

Human trafficking has been reported in every state in the United States,[6] with a disproportionate effect on children and women.[7] Reports by human trafficking victims and survivors to the National Human Trafficking Hotline increased by 20% from 2018 to 2019.[8] A few common misconceptions about human trafficking are that victims can only be foreign nationals or immigrants from other countries, there must be some type of physical restraint or force to be trafficked, and victims are only coming from poverty situations.[9] The top five recruitment techniques for sex trafficking include an intimate partner or marriage proposition, familial relationship, job offers, posing as a benefactor, and false promises. [10]

As the population has grown to enjoy the many uses of social media, so have human traffickers. 72% of the American public is reported to use some type of social media.[11] Not only are Americans using social media, but these sites are being visited every day by users.[12] Many social media sites include privacy settings, but these settings may still allow strangers to send friend requests and direct messages. In a study by the Pewter Research Center, one in six teens responded that they have been messaged by a person they did not know which incited fear or discomfort.[13]

Human traffickers often use a “loverboy” tactic to attract victims through befriending young girls in public or online.[14]The loverboy trafficker will make the victim feel special through gifts and affection, but the relationship will change drastically once the victim is demanded to provide services.[15] In 2018, the Allow States and Victims to Fight Online Sex Trafficking Act (FOSTA) was enacted by Congress to allow the civil and criminal liability of online marketplaces that knowingly participate in sex trafficking.[16] On April 28, 2020, the 14th Court of Appeals in Texas denied Facebook’s motion to dismiss in response to a suit alleging that Facebook facilitated enabled sex trafficking on its site.[17] The plaintiffs are 13, 14, and 16-year old girls that claim they were recruited by human trafficking pimps on Facebook or Instagram.[18]

You may be wondering what you can do to protect yourself and others from human traffickers and here are some tips from the Department of Homeland Security: (1) set your social media platforms to private so only real friends can see your information; (2) know whom you are talking to on social media sites and refrain from speaking with people who are not real friends; (3) only share photos of yourself that you would want to be seen by family, teachers, and employees; (4) don’t share personal information like your location or contact information; (5) do not meet up with any person you have only met online; and (6) report suspicious activity to law enforcement or a trusted adult if you are a minor.[19] Follow and share these tips to ensure yourself and others are safe from the dangers of human trafficking on social media platforms.

[1] Human Trafficking, U.S Dep’t of Just., https://www.justice.gov/humantrafficking (last visited Oct. 3, 2020).

[2] What is Human Trafficking?, The United States Department of Justice, https://www.justice.gov/humantrafficking/what-is-human-trafficking(last visited Oct. 3, 2020).

[3] Social Media in Recruitment, Polaris, https://polarisproject.org/human-trafficking-and-social-media/, (last visited Oct. 3, 2020).

[4] Id.

[5] Id.

[6] 2019 U.S. National Human Trafficking Hotline Statistics, Polaris, https://polarisproject.org/2019-us-national-human-trafficking-hotline-statistics/, (last visited Oct. 3, 2020).

[7] Id.

[8] Id.

[9] Common Myths and Misconceptions About Human Trafficking in the U.S., Polaris, https://humantraffickinghotline.org/sites/default/files/Common%20Myths%20and%20Misconceptions.pdf, (last visited Oct. 3, 2020).

[10] 2019 U.S. National Human Trafficking Hotline Statistics, Polaris, https://polarisproject.org/2019-us-national-human-trafficking-hotline-statistics/, (last visited Oct. 3, 2020) (stating the top five recruitment tactics for labor trafficking are job offers, false promises, smuggling-related, familial relationships, and posing as a benefactor).

[11] Social Media Fact Sheet, Pew Research Ctr. (June 12, 2019), https://www.pewresearch.org/internet/fact-sheet/social-media/.

[12] Id.

[13] Mary Madden et al., Teens, Social Media, and Privacy, Pew Research Ctr. (May 21, 2013), https://www.pewresearch.org/internet/2013/05/21/teens-social-media-and-privacy/.

[14] Michelle Lillie, How Street Traffickers Recruit Young Girls, Human Trafficking Search (2014), https://humantraffickingsearch.org/how-street-traffickers-recruit-young-girls/.

[15] Id.

[16] Tom Jackman, Trump Signs ‘FOSTA’ Bill Targeting Online Sex Trafficking, Enables States and Victims to Pursue Websites, Wash. Post. (Apr. 11, 2018, 11:41 AM), https://www.washingtonpost.com/news/true-crime/wp/2018/04/11/trump-signs-fosta-bill-targeting-online-sex-trafficking-enables-states-and-victims-to-pursue-websites/.

[17] Will Neal, US Court Approves Sex-Trafficking Lawsuits Against Facebook, Organized Crime and Corruption Rep. Project (April 29, 2020, 4:16 PM), https://www.occrp.org/en/daily/12224-us-court-approves-sex-trafficking-lawsuits-against-facebook.

[18] Id.

[19] Online Safety, Homeland Sec., https://www.dhs.gov/blue-campaign/online-safety, (last visited Oct. 3, 2020).

Image Source: https://www.cpomagazine.com/data-privacy/new-research-study-shows-that-social-media-privacy-might-not-be-possible/

Finding, Prosecuting, and Punishing Hackers: Comprehensive Changes Likely Necessary

By JOLT

On October 26, 2020

In Blog Posts

By Melisa Azak

In the past decade, data breaches have become more common with nearly 38 billion records reached in 2010.[1] To put that number in perspective, if all of those records belonged to American residents, each person would have nearly 116 accounts hacked.[2]

Some of the largest companies in the world have been plagued with how to deal with hackers. Equifax suffered one of the largest breaches in American history with 147 million Americans affected by their 2017 breach, which released highly sensitive information like credit cards, social security numbers, and dates of birth.[3] The company later settled with consumers for $671 million to resolve a multi-district consumer class action litigation, which created a resolution fund to restore “actual out-of-pocket losses related to the breach” as well as “other consumer benefits such as identity restoration services.”[4]

The particular danger of data breaches is that culpable hackers rarely get caught and prosecuted, leaving businesses and governments continuously vulnerable to targeted attacks. The Third Way, a center-left think tank, estimates that only 0.3% of cybercrime complaints are prosecuted and enforced.[5] Further, only one in six victims of cybercrime actually report to law enforcement, making the effective enforcement rate about 0.05%.[6]

And even when hackers are found, diplomatic relations can draw out complex prosecutions. Yevgeniy Aleksandrovich Nikulin, for instance, was found guilty earlier this year of numerous charges including computer intrusion and data theft eight years after he hacked LinkedIn and Drobox in 2012.[7] His defense team argued unsuccessfully that prosecutors relied improperly on misinformation from the Russian government and “asked the jury to consider the possibility that the U.S. government was prosecuting the wrong person.”[8] Nikulin’s case seems to demonstrate a broader tactic by the United States to send a firm message to foreign hackers that although they may rarely be found, they will be severely punished when caught.[9]

However, with breaches becoming more severe and ubiquitous, forceful prosecution may not be enough to stop hackers from obtaining sensitive information and hacking with near impunity. The Third Way recommends the United States adopt ten key strategies in order to meet the growing cybersecurity threat.[10] One of the key goals of the country, the think tank suggests, should be to expand law enforcement’s role in combatting hackers.[11] Currently, state and local law enforcement officers, prosecutors, and judges in digital/cybercrime investigations are grossly underfunded.[12] Further, less than a quarter of publicly funded crime labs offered “dedicated digital evidence support services.”[13] Effectively meeting the cybersecurity threat requires that the country allots more resources to already existing law enforcement organizations to meet the growing threat.

Some other key findings include amping up international efforts by seeking mutual legal assistance treaties and agreements, which are binding documents “typically bilaterally signed between the United States and other countries to formalize the parameters of their criminal justice cooperation.”[14] Given the global nature of successful hacks, these treaties can be “critical tools for sharing data and digital evidence in cyber investigations and prosecutions.”[15]

Another effective tactic may be to adopt the old adage “if you can’t beat them, join them.” A new start-up company called Synack provides ways for companies to discover their security flaws, and then turns those problems over to hackers “who use their powers for good” to see how they can use the flaws to breach the client, better preparing the client for future attacks from hackers who want use their powers for nefarious purposes.[16]

However, too offensive a cyber security approach may raise legal complications. Although the Justice Department officials find that the “the optics would be ‘awfully poor’ if the department prosecuted a company that had retaliated against foreign hackers”, the Computer Fraud and Abuse Act prohibits any form of hacking.[17] Many cybersecurity firms “hack back” by creating “honeypots” or “caches of documents that fool hackers into think they are inside a target’s system” so they can trace the identities of hackers from their digital trails.[18] Considering the growing cyber security threat and the need for new strategies to meet it, the Act may have to be modernized to allow companies to add “hacking back” to their arsenal of tools of cybersecurity defense.[19]

The growing cyber security threat is not unlike 9/11. Before 9/11, the government struggled with “lack of prioritization of the [terrorist] threat, competing priorities and immense bureaucratic challenges.”[20] If the United States wants to avoid repeating history’s mistakes and avoid a “digital” 9/11 incident, it must take an unprecedented, comprehensive approach and meet elusive hackers head on.

[1] Megan Leonhardt, The 10 Biggest Data Hacks of the Decade, Make It, CNBC (Dec. 27, 2019 9:01 AM), https://www.cnbc.com/2019/12/23/the-10-biggest-data-hacks-of-the-decade.html.

[2] Id.

[3] Id.

[4] See Press Release, Equifax Announces Comprehensive Consumer Settlement Arising from 2017 Cybersecurity Incident (Jul. 22, 2019), https://investor.equifax.com/news-and-events/press-releases/2019/07-22-2019-125543228.

[5] Mieke Eoyang et al., To Catch a Hacker: Toward a Comprehensive Strategy to Identify, Pursue, and Punish Malicious Cyber Actors, Third Way 7 (Oct. 29, 2018), https://thirdway.imgix.net/pdfs/override/To_Catch_A_Hacker_Report.pdf.

[6] Id.

[7] Hannah Albarazi, Russian LinkedIn, Dropbox Hacker Gets 7-Year Sentence, Law360 (Sep. 29, 2020 11:26 PM), https://www.law360.com/articles/1315137.

[8] Hannah Albarazi, Russian Convicted in LinkedIn, Dropbox Cyberattacks, Law360 (Jul. 10, 2020 9:13 PM), https://www.law360.com/articles/1291090?scroll=1&related=1.

[9] See supra note 7 (“Assistant U.S. Attorney Michelle Kane sought out a tougher sentence; one that would send a message to other foreign hackers that they cannot act with impunity.”).

[10] See supra note 5 at 2.

[11] Id. at 13–15.

[12] Id. at 15.

[13] Id.

[14] Id. at 20.

[15] Id. at 20–21.

[16] See Kate Fazzini, Why Some of the World’s Top Cybersecurity Hackers Are Being Paid Millions to Use Their Powers for Good, Disrupter 50, CNBC (May 18, 2019 10:00 AM), https://www.cnbc.com/2019/05/17/cybersecurity-hackers-are-paid-millions-to-use-their-powers-for-good.html.

[17] See Nicholas Schmidle, The Digital Vigilantes Who Hack Back, New Yorker (Apr. 30, 2018), https://www.newyorker.com/magazine/2018/05/07/the-digital-vigilantes-who-hack-back.

[18] Id.

[19] Id.

[20] See supra note 5, at 26.

Image Source: https://newconomy.media/news/hacker-claims-to-steal-personal-data-of-840-million-users

Loot Boxes: A New Way to Gamble

By JOLT

On October 23, 2020

In Blog Posts

By: Megan Haugh

On May 6, 2020, Epic Games announced Fortnite had over 350 million registered players.[1] Like Minecraft (a video game played monthly by 126 million people),[2] Fortnite is a household name.[3] Fortnite, similar to Suzanne Collins’s The Hunger Games, is a game of survival.[4] Fortnite players gather resources, create tools or weapons, and fight to stay alive.[5] A popular feature in Fortnite—and other mainstream video games—is the “loot box.”[6] In 2019, the University of York reviewed the most popular video games on Steam (an online video game retailer) and found that seventy-one percent contained these loot boxes.[7] While today’s popular video games (such as the FIFA franchise, Fortnite, and Overwatch) widely use loot boxes, many people liken the virtual loot box to a Las Vegas slot machine.[8] Like the gambler who pays to play the slot machine without knowing the outcome, today’s gamer purchases a loot box without knowing the items she will receive. With many players under the age of eighteen, should the government regulate loot boxes in video games like gambling in casinos?

A loot box is an optional in-game purchase that provides a randomized reward.[9] The modern loot box is like the old, yellow mystery box in Nintendo’s Super Mario Brothers.[10] In that video game, a person tapped the mystery box and Mario or Luigi received a randomized special ability (such as shooting fireballs at enemies).[11] Like the mystery box in Super Mario Brothers, today’s loot box provides a randomized reward, such as a skin (i.e. a new outfit for a player’s avatar) or a catchphrase.[12] The crucial difference between the mystery box in Super Mario Brothers and the loot box in today’s video games is money. Today, a player must purchase the loot box (with either in-game currency or real currency) to reap the randomized reward.[13] By 2022, the video game industry anticipates $50 billion in revenue from loot boxes.[14]

As loot box purchases rise, lawmakers are taking notice.[15] In both Belgium and the Netherlands, lawmakers moved to ban loot boxes.[16] In Australia, lawmakers suggested that video games with loot boxes receive an “R” rating.[17] However, people disagree on whether immediate regulatory action is appropriate.[18] While some advocate for further studies,[19] others (like Republican Senator Josh Hawley) see the correlation between loot boxes and gambling as a justification for immediate regulatory action.[20] In May of 2019, Senator Hawley introduced a bill that bans loot box sales to minors.[21] Conceivably, a minor—lacking impulse control and financial judgement—is more susceptible to the “loot box effect”[22] (i.e. the compulsion to keep playing the odds). In an NPR interview, Senator Hawley stated “[Video game creators] need to be upfront about what their games are actually doing, and they need to stop practices that intentionally exploit children.”[23]

Compared to traditional gambling, a loot box costs as much as an average lottery ticket.[24] For example, in Overwatch (a first-person shooter game) a person pays $9.99 for eleven loot boxes.[25] Unlike a lottery ticket though, a minor can purchase a loot box. An easily accessible and inexpensive loot box (like the lottery ticket) can trigger addictive behaviors in an individual.[26] Many players report spending hundreds to thousands of dollars on these in-game purchases.[27] Some adults even claim that their children used credit cards without their knowledge to purchase loot boxes.[28] In my opinion, there is no significant difference between the gambler who pays to play the slots and the gamer who purchases a loot box. In both scenarios, a person is paying to play her odds. The virtual loot box ought to be regulated.

[1] See @FortniteGame, Twitter (May 6, 2020, 10:01 AM), https://twitter.com/FortniteGame/status/1258079550321446912.

[2] See Tom Warren, Minecraft Still Incredibly Popular as Sales Top 200 Million and 126 Million Play Monthly, The Verge (May 18, 2020, 9:00 AM), https://theverge.com/2020/5/18/21262045/minecraft-sales-monthly-players-statistics-youtube.

[3] See Nick Statt, Fortnite is Now One of the Biggest Games Ever with 350 Million Players, The Verge (May 6, 2020, 1:54 PM), https://theverge.com/2020/5/6/21249497/fortnite-350-million-registered-players-hours-played-april.

[4] See Sarah LeBoeuf, What is ‘Fortnite’?: A Look at the Video Game that has Become a Phenomenon, NBC News (Jun. 30, 2018 8:27 AM), http://nbcnews.com/tech/tech-news/what-fortnite-look-video-game-has-become-phenomenon-n887706.

[5] See id.

[6] See Isobel Asher Hamilton, There’s a Debate Raging in Video Games Over Whether Loot Boxes Should be Classified as Gambling, Business Insider (July 5, 2020, 5:22 AM), https://www.businessinsider.com/classifying-video-game-loot-boxes-as-gambling-2020-7.

[7] See id.

[8] See id.; see also Julie Steinberg, Loot Box Lawsuits Liken Transactions to Slot Machine Gambling, Bloomberg Law(Sept. 1, 2020, 1:57 AM), https://news.bloomberglaw.com/product-liability-and-toxics-law/loot-box-lawsuits-liken-transactions-to-slot-machine-gambling.

[9] See S. 1629, 116th Cong. § 2 (2019).

[10] See Ben Johnson, Loot Boxes are a Lucrative Game of Chance, But are They Gambling, NPR: All Things Considered(Oct. 10, 2019, 5:08 PM), https://www.npr.org/2019/10/10/769044790/loot-boxes-are-a-lucrative-game-of-chance-but-are-they-gambling.

[11] See id.

[12] See id.

[13] See id.

[14] See id.

[15] See id.

[16] See id.

[17] See id.

[18] See Hamilton, supra note 6 (stating “‘We’re really only in the early phases of gathering scientific research evidence about the nature of loot box effects,’ Professor Pete Etchells . . . told Business Insider. ‘What we really need is a clearer and stronger evidence base before legislation is changed.'”)

[19] See id.

[20] See Johnson, supra note 10.

[21] S. 1629, 116th Cong. § 2 (2019).

[22] See Steinberg, supra note 8.

[23] See Johnson, supra note 10.

[24] See id.

[25] See id.

[26] See id.

[27] See id; see also Steinberg, supra note 8.

[28] See Steinberg, supra note 8.

Image Source: https://techcrunch.com/2018/09/17/loot-boxes-face-scrutiny-from-an-international-coalition-of-gambling-authorities/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAK4VebthFFKiNJaXSq2noSSUje6H0QKvGLVhnBlpzlBGYPVDmKi_7ft0v2Kb1s8H1CZbs3A84vrQgF2vS_HXkJN67tJwZyLSi7wmPpAcUwmITpoa9NToAzpVp3b6HcjfCERhgkt2nC-0NjS6VH17EuQjjZw81SHdauvFpeE20fog

COVID-19 Tracking Apps and the Attack on Student Privacy

By JOLT

On October 21, 2020

In Blog Posts

By: Christopher Vinson

As COVID-19 continued to spread in the United States throughout the summer months, the conversation shifted towards how to safely reopen universities in the fall. In response, universities implemented a variety of safety measures from social distancing to mandatory mask-wearing. Universities have also been keen to utilize technology to help avoid outbreaks among their student populations. One of the more interesting tools used by colleges and universities are apps that can be used for COVID-19 symptom screening and contact tracing.

These apps are seen by many universities as the key to an effective reopening. Many colleges across the nation have either developed their own apps or are using apps developed by third parties. Rutgers University has taken the step of creating their own apps.[1] The apps allow for students, faculty, and staff to self-screen for COVID-19 symptoms before traveling to campus and allow for effective contact tracing to take place.[2]

Other universities have used contact tracing apps developed using tools from Google and Apple.[3] Stockton University in New Jersey has piloted an app that uses Bluetooth to sense whether someone came into close proximity for a specific period of time with someone that contracted COVID-19.[4] A similar app is being used at the University of Alabama at Birmingham.[5] Their app utilizes the signal strength between smartphones to determine whether someone was within six feet for at least fifteen minutes of someone else who contracted COVID-19.[6]

While undoubtedly innovative, the proliferation of these apps has led to increased concerns over privacy. Countries such as Norway have suspended the use of COVID-19 tracking apps.[7] The app used in Norway uploaded live GPS coordinates of its users to a central server.[8] Uploading information to a central server increases the risk of that information being stolen or reused in the future. Additionally, providing the government with live data of their locations understandably worried citizens. The fear is that it may lead to unintended consequences of surveillance outside of COVID-19 tracking.

Even more pressing are the data privacy concerns. A recent study found that thirty out of fifty contact tracing apps available on Google devices access invasive data such as call history, the phone microphone, and the phone camera.[9] Out of those thirty, only sixteen took the additional step of making that data anonymous.[10]The failure to take even the most basic steps for privacy raises serious concerns regarding an individual’s civil rights.

Certain schools are attempting to combat privacy concerns through other methods of location data collection. At the University of California, Irvine, a group of researchers wanted to calm those concerns through the development of an app that repurposes data already collected by the school.[11] Their system would rely on tracking devices connected to the campus Wi-Fi to determine if social distancing was being adhered to.[12]Collecting data in this manner avoids the need to share personal information, further protecting users.[13]

As mentioned above, other schools are hoping to use Bluetooth to assist in COVID-19 tracking.[14] This is more privacy friendly since this information is stored as anonymized beacons only on a user’s cellphone.[15]Further, this system operates without noting where the individual device is exactly located.[16] However, other schools have opted for tracking student locations in real time.[17] Regardless, many of these apps are a condition of enrollment and place students in a position where they have no choice but to download the apps.

All these methods beg the question of whether the desire to curb the spread of COVID-19 is infringing on certain privacy rights. Schools risk being seen as prioritizing their finances over the privacy of their student body. The intrusion may be justified for now in the name of public health, but what will happen with all this data in the future? The potential for serious civil rights violations exists and may cause more trouble for these schools in the future than the benefit derived from reopening today.

[1] Hayley Slusser, Rutgers Creates Application for Coronavirus Symptom Screening, Contact Tracing, The Daily Targum (Sep. 28, 2020), https://www.dailytargum.com/article/2020/09/rutgers-creates-applications-for-coronavirus-symptom-screening-contact.

[2] Id.

[3] See Natalie Schwartz, Colleges Look to Apps that Screen for Virus Symptoms and Trace Contacts, The Education Dive (Aug. 12, 2020), https://www.educationdive.com/news/colleges-look-to-apps-that-screen-for-virus-symptoms-and-trace-contacts/583387/.

[4] Molly Bilinksi, Stockton University Among Colleges Piloting COVID-19 Exposure-Tracing App, The Press of Atlantic City, (Sep. 24, 2020), https://pressofatlanticcity.com/news/local/stockton-university-among-colleges-piloting-covid-19-exposure-tracing-app/article_b4bd39c7-c063-559a-9942-ed17ba781593.html.

[5] Schwartz, supra note 3.

[6] Id.

[7] See Thomas Brewster, COVID-19 Tracking Apps ‘A Privacy Trash Fire’ as Norway Nixes its Own, Forbes (Jun. 16, 2020, 6:26 AM), https://www.forbes.com/sites/thomasbrewster/2020/06/16/covid-19-tracking-apps-a-privacy-trash-fire-as-norway-nixes-its-own/#6e6ec65341b4.

[8] Id.

[9] See Tanusree Sharma & Masooda Bashir, Use of Apps in the COVID-19 Response and the Loss of Privacy Protection, Nature Med. (May 26, 2020) https://www.nature.com/articles/s41591-020-0928-y#citeas.

[10] Id.

[11] See Schwartz, supra note 3.

[12] See id.

[13] See id.

[14] See Bilinski, supra note 4.

[15] Jeremy Hsu, Contact Tracing Apps Struggle to be Both Effective and Private, IEE Spectrum (Sep. 24, 2020, 10:00 AM),https://spectrum.ieee.org/biomedical/devices/contact-tracing-apps-struggle-to-be-both-effective-and-private; Elisa Miebach, War Between Privacy and Efficiency, Bloomberg Businessweek (Sep 8, 2020, 1:01 AM), https://www.bloomberg.com/news/articles/2020-09-08/coronavirus-pandemic-covid-19-apps-grapple-with-privacy-and-efficiency.

[16] Schwartz, supra note 3.

[17] See id.

Image Source: https://economictimes.indiatimes.com/tech/software/covid-19-tracing-apps-face-privacy-concerns/mired-in-controversies/slideshow/77783271.cms

Zoom Bombing: Are We Truly Safe in Our Digital Meeting Space?

By JOLT

On October 19, 2020

In Blog Posts

By Joleen Traynor

In the midst of the COVID-19 pandemic, businesses, schools, and other groups have moved to remote learning and work. In the course of this shift, Zoom has been a popular platform for video calls, meetings, and lectures. However, this has introduced a new avenue for hackers and unwelcome parties to hijack these online meetings, a practice known as “Zoom bombing”. This involves hackers joining online meetings throughout the world and sharing disturbing, and even illegal, images and videos with those in the meeting. Zoom bombing “refers to a form of cyber harassment reported by some app users, who have reported that some of their calls have been hijacked by unidentified individuals and trolls who spew hateful language or share graphic images.”[1] “Anyone who has a link to a public meeting can join. Links to public Zooms are traded in Facebook Groups and Discord chats, and are easily discoverable on Twitter and public event pages.”[2] These public meetings are fairly easy to find and access, providing ample opportunities for hijackers to enter meetings. This phenomenon has become so severe so quickly, even the FBI is getting involved. “The FBI has received multiple reports of conferences being disrupted by pornographic and/or hate images and threatening language.”[3]

The sudden explosion in popularity of Zoom is part of the reason this phenomenon exists. “Before the coronavirus pandemic, Zoom had 10 million daily users. By April, it claimed to have 300 million – before backtracking to admit the statistic is really 300 million ‘meeting participants’ per day.”[4] With this increased usage, Zoom has released updated guidelines for safer use of the platform to prevent these Zoom bombing incidents. Zoom recommends taking safety precautions such as creating and using a secure meeting room, creating waiting rooms, and only allowing the host to screen share.[5]

Police departments have also stepped up their game in handling incidents of Zoom bombing. In early September, a nineteen-year-old man was arrested for making threats while interrupting a University of Houston remote class.[6]Another individual was arrested and charged with computer crimes earlier this year in Connecticut.[7] It is important that these threats are taken seriously and swift action is taken against perpetrators.

Finally, users may face an internal threat when using Zoom for meetings. It was recently discovered that Zoom was sharing user information and data with Facebook, “even data on people who are not Facebook users.”[8] Zoom has ceased sharing this information once this was discovered[9], but this just shows that there is still work to be done in order to better secure our online meeting space.

Looking ahead, online meeting and learning spaces will likely be the new normal, at least for the immediate future. In an increasingly digital world, it is more important than ever to secure our online meeting spaces, and to ensure that there are safe, reliable, and secure ways for people to meet and communicate remotely. This is a safety issue that affects us all, and online meetings, on Zoom or otherwise, are likely here to stay.

[1] Dakin Andone, FBI warns video calls are getting hijacked. It’s called ‘Zoombombing’, CNN (Apr. 2, 2020, 5:00 PM), https://www.cnn.com/2020/04/02/us/fbi-warning-zoombombing-trnd/index.html.

[2] Taylor Lorenz, ‘Zoombombing’: When Video Conferences Go Wrong, N.Y. Times (Apr. 7, 2020), https://www.nytimes.com/2020/03/20/style/zoombombing-zoom-trolling.html.

[3] Press Release, FBI, FBI Warns of Teleconferencing and Online Classroom Hijacking During COVID-19 Pandemic (Mar. 30, 2020), https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic.

[4] Sebastian Meineck and Paul Schwenn, ‘Zoom Bombers’ Are Still Blasting Private Meetings With Disturbing and Graphic Content, Vice (June 10, 2020, 8:42 AM), https://www.vice.com/en_us/article/m7je5y/zoom-bombers-private-calls-disturbing-content.

[5] Security at Zoom, https://zoom.us/security (last visited Sept. 20, 2020).

[6] Christina Carrega, Texas man arrested for ‘Zoombombing’ a university class lecture with a bomb threat, CNN (Sept. 8, 2020, 5:30 PM), https://www.cnn.com/2020/09/08/us/university-zoombombing-isis-arrest/index.html

[7] Teen Arrested After ‘Zoom Bombing’ High School Classes, NY Post, (April 8, 2020), https://nypost.com/2020/04/08/teen-arrested-after-zoom-bombing-high-school-classes/.

[8] Shannon Bond, A Must For Millions, Zoom Has A Dark Side — And An FBI Warning, NPR (Apr. 3, 2020, 5:00 AM), https://www.npr.org/2020/04/03/826129520/a-must-for-millions-zoom-has-a-dark-side-and-an-fbi-warning.

[9] Id.

Image Source: https://www.theburnin.com/technology/what-is-zoom-bombing-how-to-stop-it-2020-3/

“Zestimated” Damages: How Zillow is Changing the Way Buyers and Sellers Interact

By JOLT

On October 16, 2020

In Blog Posts

By: Sophia Studer

The residential real estate market is historically isolated. Before the creation of public-friendly websites like Zillow, multiple listing services (“MLSs”) held monopolies over real estate data and listings within each particular jurisdiction.[1] Because of this insular framework, if a person was buying a home in a different jurisdiction than she was selling her current home in, that could potentially necessitate buying access to the foreign jurisdiction’s MLS (if offered) or even hiring an entirely separate real estate agent in the new jurisdiction.[2] Seeing this evident gap in the market, startups like Zillow “have supplemented MLS data with user-friendly interfaces to become indispensable tools for many house-hunting consumers.”[3]

While websites like Zillow can make house hunting more approachable, discrepancies between actual appraisal values and “Zestimates” can leave some sellers feeling burned. The Zestimate is a home valuation device that is calculated through a “proprietary algorithm that incorporates data from county and tax assessor records and direct feeds from hundreds of multiple listing services and brokerages.”[4] The algorithm also accounts for factors such as square footage, location, unique home features, comparable homes in the area, and the like.[5] Zillow states that “in most major markets, the Zestimate for on-market homes is within 10% of the final sale price [for] more than 95%” of sales.[6] This generally bodes well for sellers who have an accurate or higher-than-appraised-value Zestimate because it allows the Zillow-using consumer to feel as though she is getting a great deal.[7] On the other hand, if the Zestimate is “lower than the list price, the home appears to be overpriced,” and the buyer might feel like she is being swindled.[8]

This exact issue was reviewed by The Court of Appeals for the Seventh Circuit in Patel v. Zillow, Inc. when a homeowner claimed that the Zestimate for his home was too low and that upon learning of the higher selling price, prospective buyers were “scared away.”[9] The Seventh Circuit denied the plaintiff’s plea for the Zestimate to be taken down or changed; one of the reasons being that Zestimates are not “statements of fact . . . [but] . . . opinions, which [under the trade practices act] are not actionable.”[10] The court’s line of reasoning for affirming this decision is that if Zillow were to remove the Zestimates that were below selling price, the data would run the risk of becoming skewed in the other direction.[11] Removing data points that favor buyers or sellers renders the Zestimate even more inaccurate, and does so at no benefit to the real estate market as a whole.[12]

This being said, the imperfections of sites like Zillow pale in comparison to the immense accessibility it grants to laypeople trying to gain access to the real estate market. Zillow and the Zestimate are valuable tools that allow buyers, sellers, and real estate brokers to operate on a semi-level playing field when it comes to freedom of real estate data and listing information.[13] As services of this nature grow, there will inevitably be new challenging legal questions—like the one in Patel—that will alter the way buyers, sellers, and real estate professionals interact with the real estate market.

[1] James S. Bradbury, Revenge of the Realtors: The Procompetitive Case for Consolidating Multiple Listing Services, 90 U. Colo. L. Rev. 267, 298 (2019).

[2] See id.

[3] Id. at 270.

[4] Definition of Zestimate, Zillow.com, https://www.zillow.com/zestimate/ (last visited Sep. 25, 2020).

[5] Id.

[6] Id.

[7] John M. Newman, Antitrust in Digital Markets, 72 Vand. L. Rev. 1497, 1537 (2019).

[8] Id.

[9] Patel v. Zillow, Inc., 915 F.3d 446, 447 (7th Cir. 2019).

[10] Id. at 448 (punctuation omitted).

[11] Id. at 448.

[12] Id. at 448-49.

[13] See generally Bradbury, supra note 1, at 285 (discussing how Zillow may eventually render the real estate broker useless if enough information from MLSs is provided for free online).

Image Source: “Real Estate = Big Money” by thinkpanama is licensed with CC BY-NC 2.0. To view a copy of this license, visit https://creativecommons.org/licenses/by-nc/2.0/

The Revolution Should Be Cautiously Televised

By JOLT

On October 14, 2020

In Blog Posts

From Lynching to Livestreams: Trauma Porn and the Historic Trivializing of Black Death

By Danielle M. Taylor

The Grio defines Trauma Porn as “any type of media – be it written, photographed or filmed – which exploits traumatic moments of adversity to generate buzz, notoriety or social media attention”.[1] In the age of technology, daily portions of such media are readily available and often presented without warning. This is the very reason that, on May 26, 2020, the morning after his death at the hands of now former Minneapolis police officer, Derek Chauvin, George Floyd became a household name. The nearly nine minute long cellphone video capturing Floyd’s pleas for his life and cries for his mother went viral overnight. Many people, myself included, witnessed a man die before so much as having their morning coffee.

The video of Floyd’s slow death was shown on news stations across the world, the homepage of search engines, and on social media platforms like Facebook, Instagram, and Twitter. For some, the eight minutes and forty-six seconds that George Floyd laid on the ground with Chauvin’s knee pressing into his neck was an awakening to the motivation behind the Black Lives Matter movement. However, for many Black people, these videos are not informative, they are terrorizing. The viral clips are always the same, but with different names and faces – Rodney King in 1992, Eric Garner in 2014, and Tamir Rice four months later, Walter Scott in 2015, Alton Sterling in 2016, and Philando Castile the following day. This year alone includes Ahmaud Arbery, Jacob Blake, and too many others. The American Psychological Association reports that racialized groups battle higher rates of post-traumatic stress disorder, compared to White Americans.[2] According to the National Institute for Mental Health, factors that increase the risk of PTSD include: living through dangerous events and traumas; seeing another person hurt, or seeing a dead body; and feelings of horror, helplessness, or extreme fear.[3] The continual viewing of videos and images of Black bodies being mercilessly assaulted and murdered, coupled with the knowledge that society does not often punish those actions, unquestionably satisfies those risk factors. As the numbers rise and the names increase, the question we must ask is whether the awareness that these videos bring outweighs the trauma that they continually inflict on already suffering communities.

It is necessary to underscore that this country’s obsession with Black pain and death predates the internet.[4] Long before the deaths of Black people were social media click bait, lynchings were arranged as social gatherings.[5] From 1882-1968, 4,743 people were lynched in the United States, and 3,446 (72.7%) of them were Black.[6] An overwhelming majority of these lynchings took place in the South[7] and were treated as celebrations. Weeks before these planned lynchings, the “event” would be advertised in local papers as an invitation for people to come from all over, not just to bear witness to black death, but to eat and socialize while the victim was tortured, and take pictures for postcards after the victim had been killed and the body had been burned.[8] On-lookers were even allowed to take home a souvenir, usually a piece of rope, or a piece of the victim’s flesh or bone.[9] These organized lynchings were designed to “humiliate and inflict pain and suffering on Black bodies”.[10] They were a “method of social and racial control” used to “terrorize Black Americans into submission”[11] and deter them challenging white supremacy[12]. Today, the ease with which the public is served, and allowed to consume, videos depicting “police brutality and vigilante murders [serves as] an extension of that tradition.”[13]

Shortly after George Floyd’s death, another video surfaced – that of a ten-year-old black boy named Eliah. Eliah was shooting hoops in the driveway of his parents’ home in Trumbull, Connecticut when a police car rode down the street behind him. The video depicts Eliah noticing the police car and quickly hiding behind a car parked in the driveway. He can then be seen waiting to ensure that the police were gone before he returns to innocently playing. In opening up about the now viral video, Eliah’s father, Stacey Pierre-Louis, shared that when he asked his son why he did what he did, Eliah responded, “[b]ecause they killed George Floyd”.[14]

There is a popular, and admittedly understandable, argument that posting and sharing videos exposing violence against Black bodies is a “necessary evil”.[15] They are imperative, many argue, not just to create awareness and invoke public outcry, but to hold perpetrators – whether they be police officers, vigilantes, or otherwise – accountable. This is an argument that also predates the internet. In 1955, Mamie Till-Mobley summoned local and national news sources to see the body of her 14 year old son, Emmett, after he had been kidnapped, tortured, mutilated, and drowned by two white men for allegedly whistling at a white woman.[16] 60 years later, Emmett’s accuser admitted that she lied about the encounter.[17] This admission is seemingly forgotten, but what has echoed through time is Mamie Till’s decision to have an open casket at Emmett’s funeral, stating, “I think everybody needed to know what had happened to Emmett Till”.[18]

65 years after the barbaric murder of Emmett Till and the acquittal of his killers, it is clear that the argument for putting Black death on display for the sake of justice is shaky at best. The frequency with which violence still occurs, videos go viral, and victims’ names become popular hashtags, far surpasses the slow, rarely occurring issuance of repercussions. In contrast, the agenda of fear and submission that viral images depicting Black death push back onto the Black community is solid and heavy hitting.

I will not argue that we ought to stop pulling out our phones when we see the police acting unlawfully, or see citizens taking the law into their own hands, rather I make a plea that we offer these videos more reverence. I ask that we consider how the long-standing history of violence against Black bodies allows these images to be shared and consumed with an ease that is incredibly alarming. I ask that we recognize the impact these videos have and do so for the sake of the legacy of the victims and their families, the psychological health and safety of Black America, and for ten-year-old Eliah.

[1] Blue Telusma, Before You Share ‘Trauma Porn’ Videos on Social Media Consider These Critical Things, The Grio (Apr. 4, 2019), https://thegrio.com/2019/04/04/nipsey-hussle-trauma-porn-social-media-blue-telusma/.

[2] See Diana Doung, Videos of Shootings Are a “Sick Sort of Voyeurism,” Can Cause PTSD, Healthing.Ca (June 12, 2020), https://www.healthing.ca/mental-health/somatics-how-watching-trauma-manifests-in-your-body.

[3] National Institute of Mental Health, Post-Traumatic Stress Disorder (last revised May 2019), https://www.nimh.nih.gov/health/topics/post-traumatic-stress-disorder-ptsd/index.shtml#part_145372.

[4] See Ashlee Marie Preston, Sorry, Consuming Trauma Porn Is Not Allyship: Why Aren’t Black victims afforded the same dignity in death as white victims?, Marie Claire (June 9, 2020), https://www.marieclaire.com/politics/a32802688/stop-sharing-trauma-porn-black-deaths/.

[5] See id.

[6] History of Lynchings, NAACP (2020), https://www.naacp.org/history-of-lynchings/.

[7] See id.

[8] See Preston, supra note 2.

[9] See id.

[10] Id.

[11] James Lartey and Sam Morris, How White Americans Used Lynchings to Terrorize and Control Black People, The Guardian (Apr. 26, 2018, 2:00 PM), https://www.theguardian.com/us-news/2018/apr/26/lynchings-memorial-us-south-montgomery-alabama.

[12] See Preston, supra note 2.

[13] Id.

[14] Caught on Camera: Young Black Boy Playing Basketball Hides as Police Drive Past, NBC 12 (July 1, 2020, 6:15 AM), https://www.nbc12.com/2020/07/01/caught-camera-young-black-boy-playing-basketball-hides-police-drive-past/.

[15] Alisha Ebrahimji, Some Say Sharing Videos of Police Brutality Against Black people is Just ‘Trauma Porn‘, CNN (Aug. 25, 2020, 2:00 PM), https://www.cnn.com/2020/08/25/us/police-brutality-videos-trauma-porn-trnd/index.html (quoting Attorney S. Lee Merritt, one of the attorneys representing the family of Ahmaud Arbery).

[16] See DeNeen L. Brown, Emmett Till’s Mother Opened His Casket and Sparked the Civil Rights Movement, The Washington Post (July 12, 2018, 3:44 PM), https://www.washingtonpost.com/news/retropolis/wp/2018/07/12/emmett-tills-mother-opened-his-casket-and-sparked-the-civil-rights-movement/.

[17] See id.

[18] Id.

Image Source: Danielle M. Taylor, Jan. 21, 2017, Black Lives Matter, Women’s March in Washington D.C.

Virginia Sports Gambling: Ironing Out the Latest Details

By JOLT

On October 12, 2020

In Blog Posts

By Mike Marciano

The first major domino to fall in the efforts to legalize sports gambling came in the Supreme Court’s decision passed down on May 14th, 2018, Murphy v. National Collegiate Athletic Association.[1] In Murphy, the Supreme Court found that the Professional and Amateur Sports Protection Act (PASPA), which attempted to federally restrict the ability for states to lawfully authorize gambling on sporting events,[2] violated the anti-commandeering doctrine under which congressional power to “issue direct orders to the governments of the states,” in some instances, is wrongful.[3] Writing for the majority, Justice Alito opined, “Congress can regulate sports gambling directly, but if it elects not to do so, each State is free to act on its own.”[4]

Since Murphy decided that the states may individually choose whether or not to legalize sports gambling for its citizens, a handful of states have opted in favor of legalization.[5] Recently, among those states is Virginia.[6]

In April of this year, Governor Ralph Northam approved sports betting in Virginia by signing off on three different bills.[7] Since then, the Virginia Lottery Board (hereinafter “the Board”) has received hundreds of comments regarding the rules and guidelines that would accompany the implementation of sports gambling in Virginia.[8] Predictably, an important topic of consideration that arose regarding these rules has been which internet-based sports betting platforms, including mobile apps, will be permitted to operate in Virginia, and what rules will guide their operation.[9]

During the Virginia Lottery Board’s public comment period (which concluded on September 9th), the Board fielded comments from many of the more prominent sportsbooks, including FanDuel, DraftKings, theScore, and Caesars Entertainment.[10] Comments from these sportsbooks expressed dissatisfaction with some of the rules laid out in the framework provided by the Board and urged it to reconsider rules that would be difficult or impossible to comport with their technology.[11]

For example, both DraftKings and FanDuel commented on a requirement obligating sportsbooks to provide bettors with an explanation about how each bet is calculated.[12] Both sportsbooks ardently pushed back, contending that not only has no other state in the country insisted on a similar condition, but that it would be next to impossible to comply with such a requirement.[13] Sportsbooks such as FanDuel and DraftKings provide a tremendous amount of wagers for bettors to bet on, including live bets, which feature constantly changing odds.[14] Specifically, the fast-paced nature of a basketball game, for example, naturally necessitates that real-time betting odds reflect the current score of the game.[15] With how quickly the score of a basketball game changes, one can clearly see how difficult it would be for a sportsbook like FanDuel or DraftKings to constantly provide an explanation for odds that change so quickly.[16]

The two sportsbooks also protest that the ability for bettors to parlay their bets (tether multiple wagers, such that a winning bet depends on the success of two or more wagers, making the bet harder to win but providing more rewarding odds to the bettor) presents sportsbooks with an even more difficult burden.[17] Of these rules, FanDuel complains, “Sports betting apps are simply not built to provide and display this type of information . . . As such, this requirement would force a re-engineering of the products, to create a demonstrably worse user experience, and all to provide information which is immaterial to the calculation of the odds and/or payout a bettor will receive.”[18]

On September 15th, The Virginia Lottery Board approved a “framework for legal sports betting.”[19] Presumably, this updated framework will address concerns like the ones voiced by FanDuel and DraftKings about the capability for the technology in their apps to comport with the rules approved by the Board.[20] Probably, though, with the rise in popularity of online sportsbooks and sportsbook apps,[21] it would be advantageous for both parties to come to an agreement where the interface of sportsbook apps like those of FanDuel and DraftKings remains as intuitive as possible, and the desire for the Board to maintain certain standards is respected.

Regardless, Virginia’s efforts toward implementing sports wagering and approving online and app-based sportsbooks are forging forward, and in the coming months, Virginia bettors will be able to place wagers on some of their favorite teams.[22]

[1] Murphy v. National College Athletic Ass’n, 138 S. Ct. 1461 (2018).

[2] See id. at 1470.

[3] Id. at 1475–76.

[4] Id. at 1484–85.

[5] See US States with Legal Sports Betting the Definitive Guide, The Game Haus (Sept. 16, 2020), https://thegamehaus.com/sports/us-states-with-legal-sports-betting-the-definitive-guide/2020/09/16/ (listing which states have legalized sports gambling).

[6] See Christina Monroe, Gov. Northam Approves VA Sports Betting Bills After Amendments, Legal Sports Betting (Apr. 29, 2020, 11:54 AM), https://www.legalsportsbetting.com/news/gov-northam-approves-va-sports-betting-bills-after-amendments/.

[7] See id.

[8] See WFXRtv.com Digital Desk, Virginia Lottery Board Approves Sports Betting Regulations, Brings Virginia Closer to Legal Sports Wagering, WFXR Fox (Sept. 16, 2020, 8:56 AM) https://www.wfxrtv.com/news/commonwealth-news/virginia-lottery-board-approves-sports-betting-regulations-brings-virginia-closer-to-legal-sports-wagering/.

[9] See Graham Moomaw, Virginia Rolls Out Initial Sports Betting Rules. Big Gambling Platforms Push Back, Virginia Mercury (Sept. 10, 2020) https://www.virginiamercury.com/2020/09/10/virginia-rolls-out-initial-sports-betting-rules-drawing-some-pushback-from-big-platforms.

[10] See Jill R. Dorson, Stakeholders Have Plenty to Say About Proposed Virginia Sports Betting Regulations, Sports Handle (Sept. 14, 2020) https://sportshandle.com/virginia-regulations-comments-betting/.

[11] See id.; See also Moomaw, supra note 9.

[12] Moomaw, supra note 9.

[13] See id.

[14] See id.

[15] See id.

[16] See id.

[17] See id.; See also Sports Betting Guide: Parlay Bets and Odds Explained, Odds Shark (last visited Sept. 18, 2020) https://www.oddsshark.com/sports-betting/parlay-betting (explaining how parlay bets function).

[18] Moomaw, supra note 9.

[19] WFXRtv.com Digital Desk, supra note 8.

[20] Chris Murphy, Virginia Moves to Legalize Sports Betting in Time for Early 2021, SBC Americas (Sept. 16, 2020) https://sbcamericas.com/2020/09/16/virginia-moves-to-legalize-sports-betting-in-time-for-early-2021/ (statement of Virginia Lottery Executive Director Kevin Hall) (“A lot of helpful feedback was provided during the public comment period, and the updated regulations approved by the Lottery Board today incorporate many of the suggestions from stakeholders and citizens.”).

[21] PYMNTS, Odds Are That Online Sportsbook Wins Big Post-COVID, PYMNTS (Sept. 16, 2020) https://www.pymnts.com/digital-payments/2020/odds-are-that-online-sportsbook-wins-big-post-covid/ (noting that the online sportsbook and esports wagering sector has ballooned during the first half of 2020).

[22] See Murphy, supra note 20.

Image Source: https://medium.com/@isatyam/top-10-sports-betting-apps-for-2020-that-deserve-space-in-your-mobile-d86b5f80ba54

The Lending Doctrines Fintech Lenders Can’t Ignore

By JOLT

On October 9, 2020

In Blog Posts

By: Rebecca Pinsky

Technology Can Expand Access to Credit

Traditionally, consumers in search of credit have two primary options: obtain credit from a bank or obtain credit from a non-bank direct lender. Typically, usury laws are written to privilege bank lending.[1] Consumer advocates are often wary of non-bank direct lenders, given the proliferation of predatory lenders willing to lend at high-interest rates to subprime borrowers.^[2]

Fortunately for consumers, as the capabilities of the internet have grown, so has the marketplace for financial products. Companies that offer digital financial instruments, an industry segment commonly known as fintech, have drastically broadened availability and convenience for consumers.^[3]

Bank Partnerships: Rent-a-Bank or Rent-a-Fintech?

Online lenders present interest rates on par with those permissible to banks by partnering with banks to offer digital-native credit products.^[4] Bank partnerships are not a recent invention–store-branded credit cards are an example of this model that has existed for years.^[5] Both predatory and consumer digital-native lenders rely on bank partnerships to provide loans to their customers. Through partnering with a bank, these lenders clear the significant hurdles that come with obtaining a bank charter and complying with banking law.

Bank partnerships can benefit every party involved: banks, non-bank partners, and consumers. Non-bank partners enjoy the legal privileges extended to banks.^[6] Consumers gain a more competitive marketplace for lending products. Banks, especially state banks, can boost their national reaches. (The majority of banks in the United States are state-chartered banks.)^[7] In effect, fintech banking partnerships may be thought of as “rent-a-fintech” schemes. A bank saddled with legacy infrastructure, limited reach, and a modest tech stack can invest in innovation by partnering with a fintech to offer credit. The fintech maintains the technology, markets the product, and interfaces with the customer, while the bank originates the loan.^[8]

Consumer advocates have decried bank partnerships precisely because the structure allows the non-bank partners to slide past certain consumer protection laws.^[9] Indeed, some lenders have used bank partnerships as a way to charge otherwise illegally high interest on loans[10]. Courts and consumer advocates have referred to those as a “rent-a-bank” or “rent-a-charter” schemes.^[11]

Valid-When-Made: Federal Preemption of State Usury Laws

Perhaps the most consequential privilege gained by lenders that partner with banks is the right to charge interest at the maximum allowable rate of a state where the bank is located, a practice known as interest rate exportation.^[12] In essence, banks are able to “export” the most favorable interest rate from one state to borrowers in other states. The practice was upheld in Marquette National Bank v. First Omaha Service Corp.^[13] In Marquette, the Supreme Court ruled that a national bank located in Nebraska could apply an interest rate permissible by Nebraska law to its credit card customers in Minnesota when the same rate would violate Minnesota usury law.^[14] Federal preemption through rate exportation has compelled some lenders to shop for banks in states with lax or nonexistent usury limits.

Such a practice flirts with the boundaries of legitimacy, both for bank partnership structures and for preemption law. As a result, it has been addressed by high-profile litigation and recent regulatory rules.^[15] The Madden v. Midland Funding, LLC court ruled that once a loan is sold by a bank to a non-bank, the non-bank does not enjoy preemptive rights over state usury laws.^[16] The decision disregarded the common law “valid-when-made” doctrine, which bases whether current interest rates are permissible on the permissibility of the rates when the loan was originated.^[17] Selling loans is not an unusual banking practice and the Madden decision sent ripples of uncertainty across the financial field. Not long after the decision, the OCC and FDIC responded to Madden with rules that effectively restored “valid-when-made.”^[18]

True Lender: Who Made the Loan?

Madden and the aforementioned regulations address whether a loan is valid when made. Determining which entity in a bank partnership actually made the loan requires a separate analysis, commonly referred to as the True Lender doctrine.^[19] Courts test the doctrine by evaluating which party had the predominant economic interest in light of the totality of the circumstances surrounding the loan.^[20] Identifying the party that finances and bears the risk of the loan is determinative to that analysis.^[21] Courts use this practice to “look to the substance, not the form” of the loan.^[22] Non-banks who have been assigned or sold loans have been found to be the true lender, which may signal the importance of a bank owning and managing loans throughout the credit lifetime.^[23] The True Lender analysis is a holistic one so there may be numerous factors–particularly contractual provisions– unique to each bank partnership that could be decisive in court.^[24]

The True Lender doctrine has not benefitted lenders that form bank partnerships with the intent to evade state usury laws.^[25] A fintech lender that markets credit products needs to be clear that its role is to market and service the product, not to fund it or bear the risk. Teaming with the bank on compliance and operations functions could intimate that the bank is indeed the lender in fact.^[26] For fintech lenders aiming to quickly bring customer-centric credit solutions to market, it may not have to be a bane.

[1] See, e.g., Cal. Const. art. XV, §1 (Capping interest in loans but creating an exception for banks).

^[2] Will Kenton, Predatory Lending, Investopedia (June 15, 2020), https://www.investopedia.com/terms/p/predatory_lending.asp.

^[3] How Fintech Can Make Banking More Inclusive – and Empowering, Wharton: Knowledge@Wharton (Aug. 27, 2019), https://knowledge.wharton.upenn.edu/article/fintech-can-make-banking-inclusive-empowering-consumers/ (“Fintech as an industry has made improving and democratizing consumer financial health a key aim.”).

^[4] Mike Whalen, Bank Partnership Or Go It Alone?, Goodwin: Fintech Flash (Aug. 23, 2016), https://www.goodwinlaw.com/publications/2016/08/08_23_16-bank-partnership-or-go-it-alone.

^[5] See id.

^[6] See 12 U.S.C. 85 (2012).

^[7] See Statement for the Record: “Rent-a-Bank Schemes and New Debt Traps”, CSBS (Feb. 5, 2020), https://www.csbs.org/policy/statements-comments/statement-record-rent-bank-schemes-and-new-debt-traps.

^[8] See CSBS, supra note 5.

^[9] Consumer Fin. Prot. Bureau v. CashCall, Inc., No. CV 15-07522-JFW (RAOx), 2018 U.S. Dist. LEXIS 9057 at 4 (C.D. Cal. 2018).

[10] See id at 6.

^[11] See id. See also Letter from Linda A. Lacewell, Superintendent, N.Y. State Dep’t of Fin. Serv., to Brian P. Brooks, Acting Comp., OCC (Sept. 2, 2020), https://www.dfs.ny.gov/system/files/documents/2020/09/20200901_comment_letter_occ_true_lender_rule.pdf.

^[12] See 12 U.S.C. § 85 (2012). See also 12 U.S.C § 1831(d) (2011).

^[13] See Marquette National Bank v. First Omaha Service Corp., 439 U.S. 299, 313-18 (1978).

^[14] See id at 308-09.

^[15] See Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015). Compare with Permissible Interest on Loans that are Sold, Assigned, or Otherwise Transferred, 85 Fed. Reg. 33,530 (June 2, 2020) (to be codified at 12 C.F.R. pts. 7, 160); Federal Interest Rate Authority, 85 Fed. Reg. 44,146 (July 22, 2020) (to be codified at 12 C.F.R. pt. 331).

^[16] See Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015).

^[17] Rick Fischer, et al., Attorneys General Push Against OCC’s Attempts to Codify “Valid When Made” Rule, Morrison Foerster: Client Alert (Jan. 29 2020), https://www.mofo.com/resources/insights/200129-valid-when-made-rule.html.

^[18]See Permissible Interest on Loans that are Sold, Assigned, or Otherwise Transferred, 85 Fed. Reg. 33,530 (June 2, 2020) (to be codified at 12 C.F.R. pts. 7, 160); Federal Interest Rate Authority, 85 Fed. Reg. 44,146 (July 22, 2020) (to be codified at 12 C.F.R. pt. 331).

^[19] See CSBS, supra note 5.

^[20] See, e.g., Cash Call, Inc. v. Morrisey No. 12-274 2014 W. Va. LEXIS 587, at 41-45 (W. Va. 2014).

^[21] See id.

^[22] Consumer Fin. Prot. Bureau v. CashCall, Inc., No. CV 15-07522-JFW (RAOx), 2018 U.S. Dist. LEXIS 9057 at 16 (C.D. Cal. 2018).

^[23] See id at 19. See also Cash Call, Inc. v. Morrisey No. 12-274 2014 W. Va. LEXIS 587, at 49 (W. Va. 2014).

^[24] See id at 18.

^[25] See CSBS, supra note 5.

^[26] Mike Whalen, Marketplace Lending Bank Partner as True Lender, Goodwin: Fintech Flash (Sept. 6, 2016), https://www.goodwinlaw.com/publications/2016/09/09_06_16-marketplace-lending-bank-partner#[1].

Image Source: https://search.creativecommons.org/photos/f41058ae-ced8-4be4-a7ab-eb6e2e29a54d