CAN THE INTERNET KILL? HOLDING WEB INVESTIGATORS LIABLE FOR THEIR CRIMINAL CUSTOMERS

As the wealth of online information grows, private investigation websites are becoming more powerful and popular. Their client lists include attorneys, insurance agencies, banks, neighbors, employers, and, oh yes, stalkers and identity thieves. When a stalker used information from a web investigator to track down and kill his victim, the New Hampshire Supreme Court held the investigator liable for its customer's criminal acts. This iBrief considers how far liability should extend for a web investigator, distinguishes web investigators from handgun and bullet retailers, and explains how this decision realizes a policy against privacy invasions.

Introduction

¶          As the wealth of online information grows every day, so too grows the power and popularity of online research and investigation companies. Benign research tools, like Google, freely provide public information, sifting through masses of data to find what customers want most. Others charge for their services, providing a range of public and private information. Online information brokers, or "web investigators," can find anything about a person from an unlisted phone number to criminal records to hidden bank accounts.¹ Who would want this kind of information? Attorneys looking for hidden assets or "unavailable" witnesses, banks tracking down runaway debtors, and suspicious neighbors and employers checking up on "the new guy" find these services invaluable. Unfortunately, web investigators are also treasure chests for stalkers and identity thieves!

¶          One powerful web investigator is Docusearch.com, recently rated "Best of the Web" by Forbes magazine.² "A stalker would kill for the wealth of information [Docusearch co-owner Daniel] Cohn was able to dig up," wrote Adam Penenberg in a separate Forbes cover story that showed how invasive Docusearch could be.³ Sadly, that's exactly what happened. Two months before Forbes published the article, a stalker hired Docusearch to learn the social security number and employment address of his victim.⁴ Five weeks later, the stalker went to his victim's workplace and fatally shot her and himself.⁵

¶          In February 2003, the New Hampshire Supreme Court found Docusearch civilly liable for the criminal acts of its stalker-customer, holding stalking and identity theft to be foreseeable risks of selling personal information.⁶ This iBrief examines that decision and explores the following questions:

• How far should liability extend for a customer's criminal actions?
• What distinguishes a web investigator from a handgun or bullet retailer?
• How does this decision realize a policy against invasions of privacy?

The Case of Remsburg v. Docusearch

¶          In 1999, New Hampshire resident Liam Youens contacted Docusearch through its website and paid $20 to learn the birth date of Amy Boyer, a woman he was stalking.⁷ When Docusearch returned birth dates for multiple women with that name, Mr. Youens provided Docusearch with her home address to narrow the field.⁸ Mr. Youens, who maintained a website about stalking and killing Ms. Boyer, then requested her social security number, which Docusearch provided for a $45 fee.⁹ The next day, Mr. Youens requested Ms. Boyer's employment information.¹⁰ After its first attempt failed, Docusearch used a pretextual phone call to obtain Ms. Boyer's employment address, which it passed on to Mr. Youens for $109.¹¹ One month later, Mr. Youens drove to Ms. Boyer's workplace and fatally shot her as she left work.¹² Mr. Youens then killed himself.¹³

¶          In February 2003, the Supreme Court of New Hampshire found Docusearch liable for the criminal acts of its customer Mr. Youens. Generally in tort law, private citizens have no duty to protect someone from the criminal attacks of third parties.¹⁴ Therefore, a company generally has no duty to foresee the criminal actions of its customers. However, in special situations, courts find exceptions to this general principle. Where a party's conduct creates an unreasonable risk of harm from criminal misconduct, the party owes a duty to those foreseeably endangered.¹⁵ In this case, the court found that Docusearch had "a duty to exercise reasonable care in disclosing a third person's personal information to a client."¹⁶ When Docusearch sold Ms. Boyer's social security number and employment address, stalking and identity theft were "sufficiently foreseeable" risks.¹⁷ Thus, Docusearch was negligent in selling Ms. Boyer's personal information, and Docusearch is liable for the harm that came to her.

¶          Although this case involves emerging technology, the court's line of reasoning is consistent with traditional tort law. Section 302B of the Restatement (Second) of Torts states an act may be negligent if "the actor realizes or should realize that it involves an unreasonable risk of harm to another," even through the intentional criminal conduct of a third person.¹⁸ "[W]here the actor's own affirmative act has created or exposed the other to a recognizable high degree of risk of harm through such misconduct, which a reasonable man would take into account," the actor has a duty to "anticipate and guard against the intentional, or even criminal, misconduct of others."¹⁹ Specifically, negligence may occur "where the actor's affirmative act is intended or likely to defeat a protection which the other has placed around his person or property for the purpose of guarding them from intentional interference."²⁰ Docusearch's collection and distribution of Ms. Boyer's social security number and employment information defeated her privacy protections. Furthermore, negligence may occur "where property of which the actor has possession or control affords a peculiar temptation or opportunity for intentional interference likely to cause harm."²¹ To a stalker (or an identity thief), the private details of a person's life are extremely tempting, and Docusearch should have realized that when selling Ms. Boyer's information to her stalker.

Does Information Kill?

¶          If placed in the wrong hands at the wrong time, the right information can make a big difference. In this case, Docusearch provided a stalker with details of his victim's life, and, without knowing it, contributed to Mr. Youen's stalking. However, the New Hampshire Supreme Court suggests that Docusearch is liable for murder as well. There is a difference between stalking and murder. When a customer inquires about a person's employment information or social security number, stalking and identity theft, respectively, may be foreseeable. Murder, however, is a separate and additional crime that is far more serious and less predictable. Should Docusearch be liable for the death of Ms. Boyer? The court writes, "[n]ot only is stalking itself a crime, but it can lead to more violent crimes, including assault, rape or homicide."²² While this may be true, it doesn't necessarily mean that Docusearch should be liable for every criminal action that its customer takes. At some point, the foreseeability of criminal action wanes, especially when customers take separate and additional criminal actions.

¶          Furthermore, the impact of the information provided by Docusearch is limited. Mr. Youens already possessed his victim's name, home address, and telephone number. Docusearch provided Ms. Boyer's social security number and employment information. The social security number, which is harder to obtain without help, is probably the biggest invasion of privacy. As the court writes, "a person may reasonably expect that the [social security] number will remain private."²³ However, for purposes of stalking and murder, the social security number is irrelevant, and Mr. Youens did not seem to use this information in any way. The employment information, which serves as the causal link between Docusearch and the murder, is much easier to obtain. In fact, the court admits:

A person's employment, where he lives, and where he works are exposures which we all must suffer. We have no reasonable expectation of privacy as to our identity or as to where we live or work. Our commuting to and from where we live and work is not done clandestinely and each place provides a facet of our total identity.²⁴

¶          Mr. Youens, who was already stalking Ms. Boyer and knew where she lived, could easily have followed her to work one day. Although the murder took place at her workplace, it could easily have been at her home or elsewhere. In other words, Docusearch's information may have facilitated the stalking, but it was probably not a "but for" cause of the murder.

¶          However, the Remsburg decision is not surprising given the dangers associated with web investigation. In determining the proper scope of a duty and foreseeability, the magnitude of risk from an activity must be balanced against the utility of the actor's conduct.²⁵ Web investigators fraudulently obtain information through pretextual phone calls, and then sell it to interested customers. Given the gravity of identity theft and stalking, the risks of web investigators are quite high. Another aspect that makes web investigation so risky is how little investigators know about their customers' purposes: Docusearch, for instance, knew nothing substantive about Mr. Youens or his purpose.²⁶ In contrast, firearms and ammunitions retailers must perform background checks on customers to prevent sales to convicted felons, drug users, the "mentally defective," those convicted of domestic violence, and those with restraining orders for harassing or stalking another person.²⁷ In Remsburg, Docusearch phoned Mr. Youens several times during their transactions, but never spoke to him for very long or learned his purpose. Given the power of Docusearch to find every intimate detail about a person, it is alarming that they never discovered that Mr. Youens "maintained a website containing references to stalking and killing [Ms.] Boyer as well as other information and statements related to violence and killing."²⁸ On the website, Mr. Youens wrote:

Her address was 10 Woodbury Drive she didn't move from home yet, no other information was provided in the background check.I found an internet site to do that, and to my surprize [sic] everything else under the Sun. Most importantly: her current employment. It's accually [sic] obsene [sic] what you can find out about a person on the internet. I'm waiting for the results.²⁹

¶          Tragically, the results are now clear, and the obscene danger of selling personal information online is, too.

¶          Meanwhile, the utility of web investigation is low. Web investigators operate in the "netherworld of private eyes, ex-spooks and ex-cops, retired military men, accountants and research librarians."³⁰ "They mine celebrity secrets, spy on business rivals and track down hidden assets, secret lovers and deadbeat dads."³¹ Although this information may be a helpful tool in the hands of banks or law enforcement officials, it is a dangerous weapon in the hands of the wrong person. With low costs, nominal screening, and easy online access, the risks of web investigation outweigh the benefits. Thus, web investigation is a high risk, low utility activity, and it is understandable that the New Hampshire Supreme Court extended the scope of foreseeability so far for Docusearch.

Guns Don't Kill People?

¶          Docusearch's information may have indirectly led to Ms. Boyer's demise, but what about the gun and bullets Mr. Youens used to shoot her? Like the personal information from Docusearch, the gun and bullets were instruments that aided Mr. Youens in his crime. Surely, the manufacture or sale of weapons creates a foreseeable risk of harm to others. If anything, the gun and bullets were more directly involved in the murder. So if Docusearch is liable for the harm it created, why are the companies that made and sold the gun and bullets not liable?

¶          The sale of firearms and ammunition is a legal activity regulated by the Gun Control Act.³² When a retailer sells guns or bullets in accordance with the Act, courts generally do not hold the retailer liable for the criminal actions of its customer.³³ However, when a retailer sells a gun or ammunition in violation of the Act, the retailer may be liable for the criminal actions of its customer.³⁴ Where there is no violation of the Act, the criminal use is, by law, unforeseeable. Presuming the gun and bullet retailers followed the Gun Control Act in making sales to Mr. Youens, they would not have the same duty to protect Ms. Boyer.

¶          In contrast, Docusearch's collection and sale of Ms. Boyer's personal information was illegal. In obtaining the social security from a credit reporting agency without Ms. Boyer's knowledge or permission, Docusearch invaded Ms. Boyer's privacy.³⁵ Furthermore, by using a pretextual phone call to obtain Ms. Boyer's employment information, Docusearch employed an unfair and deceptive practice that violates state law.³⁶ Thus, unlike the gun and bullet retailers, Docusearch conducted illegal business, violating its duty and making further criminal action foreseeable.

¶          Does one offensive or criminal action make another foreseeable? Not necessarily, but engaging in illegal business enterprises gives courts a policy incentive to find liability for other criminal actions. In Buczkowski v. McKay, the Michigan Supreme Court found K-Mart, an ammunition retailer, had no duty to protect an innocent bystander from the criminal actions of its customer, because the ammunition and sale met state regulations, even though the customer was intoxicated during the purchase.³⁷ The court considered the policy implications of its decision:

Ultimately, whether we should impose a duty on the defendant in this case despite the actual lack of foreseeability turns on whether as a matter of policy K-Mart should bear the burden of plaintiff's loss. We are persuaded that the fiction of foreseeability should not be imposed on the sellers of ammunition. The likely result will be to make such products unavailable to law-abiding users, or to raise the price of a multitude of potentially harmful products as sellers redistribute the cost of potential liability to all consumers.³⁸

¶          In Buczkowski, K-Mart engaged in the legal and regulated business of selling ammunition, and the Michigan Supreme Court was reluctant to impose liability on K-Mart as a result. In Remsburg, Docusearch was engaged in the illegal business activity of collecting and selling private information, and the New Hampshire Supreme Court had no problem imposing liability on Docusearch. As the Michigan Supreme Court suggests, finding liability in this situation creates such an economic burden that it could drive the retailer out of business.³⁹ Thus, where the defendant is engaging in illegal business activities, courts are more likely to stretch the foreseeability of future criminal actions by customers, and by doing so, create an economic obstacle for practicing that business.           

Conclusion

¶          Web investigators are dangerous because they provide personal information at a low cost, with easy online accessibility and nominal screening procedures. When Docusearch collected and sold private information to a stalker, it facilitated a crime that ultimately led to the death of a young woman. The Remsburg decision holds web investigators liable for the full effects of their customers' criminal actions. Unlike firearm and ammunition retailers, Docusearch committed invasive and illegal activities when it obtained and sold Ms. Boyer's information to Mr. Youens. Despite multiple, intentional crimes by Mr. Youens, the New Hampshire Supreme Court held Docusearch civilly liable for Ms. Boyer's death. The court's decision aggressively interprets the foreseeability element of negligence, but in doing so, realizes a policy against using the Internet to invade privacy. In effect, the Remsburg decision raises the cost of web investigation services, creating an economic obstacle for companies like Docusearch. Even if they remain in business, web investigators must now research and screen their customers more intensively. Adam Penenberg wrote four years ago, "America, the country that made 'right to privacy' a credo, has lost its privacy to the computer. But it's far worse than you think. Advances in smart data-sifting techniques and the rise of massive databases have conspired to strip you naked."⁴⁰ Until Congress passes more stringent privacy laws, Remsburg may serve as our best defense against privacy invasions.

Footnotes