Michael Schill A Finalist To Lead UW - Madison

Dean Michael Schill of the University of Chicago Law School has been named one of four finalists in the search for a new Chancellor of the University of Wisconsin - Madison.

Comments

["Aduren" is Brian Leiter's Pseudonym]

Professor Filler,

While we appreciate this update on the "Kremlinology" of US law school dean searches, credible allegations have surfaced that TFL shared the IP addresses of anonymous commentators with Professor Brian Leiter.

Do you plan to address these concerns in a forthright and transparent manner with readers and the TFL community? From my vantage, this issue constitutes nothing less than an existential threat to the credibility of TFL and its moderators/administrators.

Many long-time readers are anxious for a response from you. A number of VAPs and VAP candidates provided candid and courageous feedback on the "VAP Trap" thread. I think you owe them some reassurance that their information was not shared with Professor Leiter.

[terry malloy]

Is this blog an instrumentality of Brian Leiter?

Are you, Dan Filler, in favor of his bullying tactics?

[Lois Turner]

"I'm involved in a philosophy conference the next few days, and then finals are coming up for winter quarter, so I won't have much new for a bit. But hopefully Dan will have some news."

From http://leiterlawschool.typepad.com/ today.

Any news, Dan?

[Paul Campos]

You seem to be too busy to answer your emails Dan. Hope you find some time soon.

[Decency for a change]

Dan Filler (calling you professor would imply respect), you need to understand - the machinations you have engaged in with Brian Leiter will not go away. Until you address the leaks to Leiter and the behaviour that it is evident that you facilitated long after it was obvious that the leaked information was bing used nefariously by Leiter and your role in it - you are without any respect as a commentator on the state of US legal education. You have ruined yourself - and tenure now is the sole fig-leaf left to you.

To be blunt, your fellow administrators on this blog need to do two things: (a) announce a strict privacy policy, and (b) announce that you have decided that you will have nothing more to do with this (or any other blog) in favor of spending more time with your pet rocks. Your final act should be to send a grovelling and humiliating apology to everyone whose e-mail you provided to Leiter.

You seem to be under the delusion that if you stay silent - and Leiter (who has been posting even today as "Brian") pretends to too busy at a philosophy conference (while frantically calling various website administrators) for a few more days, this will all "blow over." No it won't - you have destroyed yourself with the assistance of your friend Leiter.

Time to come clean and beg for understanding. While you are at it, drop Leiter in the brown stuff, after all he did it to you.

["Robert Markfield" is Paul Campos's Pseudonym]

"credible" allegations?

[john]

If the allegations aren't true, it would seem Filler and Leiter would have said something by now. Silence doesn't look good.

[marion]

I think it's unfair to expect Dan to admit giving Leiter the information in light of possible criminal liability for doing so if it violates any laws of the states in which he, Leiter, or the posters were living. That's up to whatever authorities take an interest in the matter (unless someone presses charges, not much will probably happen along those grounds).

However, like many people here I am in academia and would rather focus on developing my career rather than worrying about personal information getting into vindictive hands that might interfere with that development.

So, what would be nice if TFL could provide a privacy policy and a listing of who exactly has access to IP addresses and email addresses, a promise that going forward that privacy policy will be vigorously enforced, and a promise that if that policy ever changes then it will be non-retroactive (whatever new person gains access will not gain access to old poster information).

[Paul Campos]

I suggest that anyone who wants to post anonymously on this board read this first:

http://www.lawyersgunsmoneyblog.com/2013/03/brian-leiters-slow-motion-car-crash-cont

I also suggest that anyone who wants to continue to co-blog with Dan Filler consider the ramifications of that decision.

[anon]

While Paul Campos continues to cyber-stalk and bully the Faculty Lounge blogger, normal people might be interested in Leiter's brief comment about this spectacle in a March 8 update:

http://leiterlawschool.typepad.com/leiter/2013/03/we-get-mail-thomas-r-grover-esq-edition.html

[Paul Campos]

I would have thought it was impossible for me to have a lower opinion of Brian Leiter’s moral character, and/or deeper suspicions about his mental health, but then I read his astonishingly mendacious response to the claims in these posts. Suffice it to say (for now) that Leiter manages to give the impression that he’s denying the truth of what I wrote without actually denying almost anything. He doesn’t deny that he’s “Peter Aduren,” he doesn’t deny that he sent emails to the formerly anonymous people with whom I spoke (and who considered these emails to be cyber-harrassment), and he doesn’t even deny that Dan Filler wrongfully and quite possibly illegally disclosed the email addresses of these people to him after they provided confidential information to TFL, in order to post at that site. The record, I think, pretty much now speaks for itself.

[anon]

Maybe someone at an academic conference abroad doesn't spend enough time parsing your lengthy postings, but it seems clear that you're a pathological liar and you've libelled Leiter. Good luck!

[Bruce Boyden]

"wrongfully and quite possibly illegally disclosed the email addresses"

I hesitate to prolong the hijacking of this thread, but the damage appears to have been done. Paul, what is the law that you believe potentially applies to the disclosure of email addresses used to comment on a blog? I can't imagine what it might be. I'm not aware of a law that requires a noncommercial website operator to protect email addresses.

[Decency for a change]

Brucie:

If you don't know of the various provisions that might apply you ought to. Say The California Online Privacy Protection Act of 2003 or the FTC Code of Fair Information Practices. The California act requires a site to show its privacy policy and precludes this sort of disclosure. The FTC code has similar requirements. Also if you were not a law professor - and hence in practice you would by now have heard of the EU's data protection directive and the consequential FTC Safe Harbor regs that most US lawyers doing anything with data know about since they impact US businesses including TypePad, Google, etc.

[Bob]

May I suggest that everyone who has been cyber-stalked by Leiter (like me) - post on the thread:

http://www.lawyersgunsmoneyblog.com/2013/03/pathological-liars

Post with a distinct handle so victims can be counted – it does not have to be the one you were stalked with (Bob is not). I am willing to say I have been. Let’s see how many people there are?

And when you do so, note what forums you posted on – prawfsblawg, faculty lounge, etc. And Yes, I'm convinced my e-mail was leaked and that it was from this forum.

And Dan, don't bother handing this to your buddy, this posting was made though a proxy server and not with my e-mail address.

Inter alia, I will work hard to ensure there are consequences not just for Dan, but for all the administrators here who allowed this to happen.

[anon]

I am no jurisdictional expert, but why does EU or California law apply to the Faculty Lounge?

[Bob]

anon - Posters in California, Posters in the EU, the host of the faculty lounge if international almost certainly has signed on to the FTC safe harbor rules which would apply essentially the same regs. as the EU.

The safe harbor is interesting - a lot of us companies and banks have had to sign up to operate in Europe. You can end up in EU jurisdiction easily - someone takes their smartphone to Europe and you collect data while they are there, you have customers or posters in Europe.

[Bruce Boyden]

Decency and Bob: I suspected that Paul might have been thinking along the lines that you two apparently are, that the FTC Act, California Online Privacy Protection Act, or EU Data Protection Directive might apply here. But none of them do. There is no general requirement under U.S. law that would prohibit the operator of a website from voluntarily disclosing an email address or basic log information such as an IP address to third parties. There are some laws and regulations that would apply to various *commercial* website operators, such as some of those that you cite, that would require either a disclosure of privacy practices or in some instances take affirmative steps to protect personally identifiable information. But none of them would govern here.

For example, the California Online Privacy Protection Act applies only to "[a]n operator of a commercial Web site or online service." The Faculty Lounge does not even have advertisements, which in any event would not be enough to make it "commercial," in my view. In addition, the California OPPA only governs the collection of information from an individual "who seeks or acquires, by purchase or lease, any goods, services, money, or credit" from the website. It clearly does not apply here.

Section 5 of the FTC Act likewise only prohibits "unfair or deceptive acts or practices in or affecting commerce." Although "commerce" gets a very broad definition in Commerce Clause jurisprudence, it has been less broadly applied by the FTC. The FTC has construed its authority under Section 5 not to extend to political or charitable organizations, for example. With respect to websites the FTC has used its Section 5 authority to bring enforcement actions against various commercial website operators that have violated their privacy policies or that have engaged in other practices that put consumer privacy at risk, such as failing to secure credit card information or retail transaction data. I am not aware of any enforcement actions against private parties for disclosing information that was provided to them by another individual in a noncommercial transaction.

The EU Data Protection Directive does not apply here for the simple reason that neither the Faculty Lounge servers nor any of its operators are located in any EU country. Of course, as you two are no doubt aware, the EU Data Protection Directive itself is not law; rather, it is a directive to the member states to adopt compliant laws, so to determine if the relevant law had been violated we would need to first determine which member state's laws applied and then consult that law. But none apply here for the reason I mentioned. US companies wishing to obtain data from European companies may, in effect, voluntarily subject themselves to the requirements of the Data Protection Directive by signing up for the Dept. of Commerce's EU Safe Harbor, but relatively few U.S. companies have done this; essentially only companies engaging in cross-border information transactions with partners located in Europe. There would be absolutely no reason for a noncommercial blog like the Faculty Lounge to sign up for the Safe Harbor, and a quick perusal of the list (http://safeharbor.export.gov/list.aspx) reveals that neither it nor Typepad is listed.

I would think that if you were going to try to make an argument that a private website owner were under some legal obligation not to disclose information you would try to make that argument using the Stored Communications Act. Many plaintiffs have tried to use the unauthorized access provision of the SCA, 18 U.S.C. s 2701, to argue that when promises about how data will be handled are violated, that constitutes unauthorized access to the company's own servers, but courts have uniformly rejected that argument. Slightly more promising would be 2702, which provides that "a person or entity providing an electronic communication service to the public shall not knowingly divulge to any person or entity the contents of a communication while in electronic storage by that service." There's just a couple of problems with suggesting that it would prevent disclosure of identifying information concerning a blog commenter. First, there's considerable question about whether a website operator qualifies as a provider of an "electronic communication service." An ECS is defined for purposes of the SCA as "any service which provides to users thereof the ability to send or receive wire or electronic communications." Some courts, for example the Ninth Circuit, have held that that includes websites which allow the posting of public or semi-public messages; but the better reading seems to be that it refers to access providers and intermediate communications providers, and not the provider of a destination for a communication, which would make all recipients into ECS providers.

Second, the provision I quoted above applies only to the contents of communications, not to customer records. The contents of the communication here are the contents of the comment itself, which was posted with the consent of the commenter on the website for everyone to see. Posting contents with consent is expressly permitted under the SCA. Customer records, on the other hand, are subject to a much less stringent set of protections. Specifically, ECS providers are free to provide customer records to whomever they wish other than the government: "A provider described in subsection (a) may divulge a record or other information pertaining to a subscriber to or customer of such service . . . to any person other than a governmental entity." So the SCA clearly would not prohibit the behavior alleged here.

Of course, what do I know, I'm only a law professor.

[Anonymous]

Personally, I tend to believe the claims of illegality are a bit overblown, but to turn it around, how much does it really matter? I suspect no one really expects the Feds to break down Leiter's door any time soon, whether or not it's technically illegal. But regardless of its legal status, it's certainly contrary to the reasonable expectations of those who post on a website maintained by law professors, and a breach of the administrators' ethical obligations to those posters, particularly when posters' information is revealed for the purpose of furthering Leiter's childish campaign against those who dared to disagree with him on the internet. Moreover, from a practical point of view, potential posters should probably be alerted to the fact that their personal information could be revealed if they engage in discussion of any sensitive topics (such as, as has been pointed out, VAPs' experiences with their VAP programs). So, really the legal status of the activity is beside the point--it should be condemned whether or not it's illegal, and people should be alerted to the potential release of their information, regardless of whether that release technically broke any law.

[anon]

Except Leiter said he pursued the identity of one poster, "dybbuk," who did not "dare to disagree with him" but harassed and defamed a former student of his. That's a bit different.