Van Valin et al v. Google, Inc.

Filing 13

Amended Complaint (CLASS ACTION ALLEGATION COMPLAINT).Filed by Vicki Van Valin, Neil Mertz against Google, Inc.. (Klingbeil, Rick)

Rick Klingbeil, OSB #933326 RICK KLINGBEIL, PC 520 SW Sixth, Suite 950 Portland, OR 97204 Ph: [phone] [e-mail] Brady Mertz, OSB #970814, WSB #32558 2285 Liberty St NE Salem OR 97301 Ph: [phone] [e-mail] Brooks Cooper, OSB #941772, WSB #32460 520 SW 6th Ave., Ste. 914 Portland OR 97204 Ph: [phone] [e-mail]

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF OREGON

VICKI VAN VALIN, on behalf of herself No. CV 10-557 ST and all others similarly situated within the state of Oregon; NEIL MERTZ on AMENDED CLASS ACTION behalf of himself and all others similarly ALLEGATION COMPLAINT situated within the state of Washington; (Invasion of Privacy; 18 U.S.C. § 2511, et seq.; 47 Plaintiffs, U.S.C. § 605) v. GOOGLE, INC., a Delaware corporation; DEMAND FOR JURY TRIAL Defendant. Plaintiffs individually and on behalf of the below-described class amend their complaint, and allege as follows: NATURE OF THE CASE Page 1 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

1.

This is a class action. Plaintiffs, on behalf of themselves, and all similarly situated

persons seek recovery of monetary damages, penalties, attorney fees, and other relief based on certain acts of defendant, including invasion of their legally protected privacy interests, acquisition of personal and private information without permission or consent, and violation of privacy and security rights granted by 18 U.S.C. § 2511, et seq. and 47 U.S.C. § 605. JURISDICTION AND VENUE 2. This court has original jurisdiction over this class action under 18 U.S.C. § 1332(d)

the Class Action Fairness Act ("CAFA"). The CAFA explicitly provides for the original jurisdiction of the federal court in any class action in which any member of the class is a citizen of a state different from any Defendant, and where the matter in controversy exceed the sum of $5 million exclusive of interests and costs. Plaintiffs allege that the claims of individual class members in this action exceeds $5 million in the aggregate, exclusive of interest and costs, and that the total number of members of the proposed class is greater than 100, as required by 28 U.S.C. § 1332(d)(2), (5). As set forth below, plaintiffs are citizens of Oregon and Washington, and defendant is a Delaware corporation with its headquarters and main office located in California. This court also has jurisdiction under 28 U.S.C. § 1331 because plaintiffs have alleged a violation of 18 U.S.C. § 2511, et seq. 3. Venue lies within this District pursuant to 28 U.S.C. 1391(b)-(c) in that defendant

conducts business in this District; certain acts giving rise to the claims asserted in this Complaint occurred within this District; the actions of Defendants alleged in this Complaint caused damages to plaintiff Van Valin and a substantial number of class members within this District, and plaintiff Vicki Van Valin resides within this District. THE PARTIES Page 2 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

4.

Plaintiff Vicki Van Valin ("Van Valin") is an individual residing in Oregon. During

the class period, Van Valin used and maintained and used an open wireless internet connection ("WiFi connection") at her home. Van Valin used the wireless internet connection to transmit and receive personal and private data, including but not limited to personal emails, personal internet research and viewing, work-related emails, work-related documents, work-related internet research and viewing, credit card information, banking information, personal identification information such as social security numbers, date of birth, medical information, and telephone calls made using a voice over internet (VOIP) protocol. 5. Plaintiff Neil Mertz ("Mertz") is an individual residing in the state of Washington.

During the class period, Mertz used and maintained and used an open wireless internet connection ("WiFi connection") at his home. Mertz used the wireless internet connection to transmit and receive personal and private data, including but not limited to personal emails, personal internet research and viewing, credit card information, banking information, personal identification information such as social security numbers, date of birth, and medical information. 6. Defendant Google Inc. ("Google") is a multinational public cloud computing and

internet search technologies corporation. Google hosts and develops a number of Internet-based services and products. It was first incorporated as a privately held company on September 4, 1998, with its initial public offering to follow on August 19, 2004. Google is a Delaware corporation with its home office in the state of California. The company's stated mission from the outset of its existence has been "to organize the world's information and make it universally accessible and useful." DEFENDANT'S CONDUCT 7. Page 3 Google also offers a variety of location-based services, such as Google Latitude,

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

Google Toolbar with My Location, and location aware browsing through the Mozilla Firefox browser using Google Maps. Collectively, t\he underlying technology is called Google Location Service ("GLS"). Developers, websites, and programs can use GLS to gain access to a user's approximate location. This allows an important business advantage because information, such as mapping, social networking, and advertising can then be keyed to the user's specific location. 8. One of Google's web-based and web-accessed internet services is Google Street

View ("GSV"). GSV is a technology featured in the Google Maps and Google Earth products that provides panoramic views from various positions along many streets in the United States and throughout the world. It was launched on May 25, 2007, originally only in several cities in the United States, and has since gradually expanded to include more cities and rural areas throughout the states of Oregon and Washington, the United States, and worldwide. GSV displays images taken from a fleet of specially adapted vehicles ("GSV vehicles"). Areas not accessible by a full-sized vehicle, such as pedestrian areas, narrow streets, alleys and ski resorts are sometimes covered by Google Trikes (tricycles) or a snowmobile. 9. On each of the GSV vehicles there are typically nine directional cameras for 360°

views at a height of about 2.5 meters, GPS units for positioning, three laser range scanners for the measuring of up to 50 meters 180° in the front of the vehicle. There are also 3G/GSM/Wi-Fi antennas for scanning 3G/GSM and Wi-Fi broadcasts (sometimes called "hotspots") and associated electronic hardware for the capture and storage of wireless signals and data ("WiFi data"). 10. In 2006, Google generated or incorporated programming code into the electronic

hardware on its GSV vehicles that sampled and decoded all categories of publicly broadcast WiFi data. This type or class of program is commonly called a packet analyzer, also known as a network analyzer, protocol analyzer or packet sniffer, or for particular types of networks, an Ethernet sniffer Page 4 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

or wireless sniffer ("wireless sniffer"). As data is transmitted across the wireless network, the sniffer secretly captures each packet (or discreet package) of information, then decodes and analyzes its content according to the appropriate specifications. 11. To view data secretly captured by a wireless sniffer in readable or viewable form,

after being captured and stored on digital media, it must be decoded. Because the data "as captured" by the wireless sniffer is typically not readable by the public absent special and sophisticated decoding or processing, it is reasonably considered and understood to be private, protected information by users and operators of home-based WiFi systems. 12. When Google created its data collection systems on the GSV vehicles, it included

wireless packet sniffers that, in addition to collecting the user's unique or chosen WiFi network name (SSID information), the unique number given to the user's hardware used to broadcast a user's WiFi signal (MAC address), and other information, the systems also collected data consisting of all or part of any documents, emails, video, audio, VOIP, and other content being sent over the network by the user ("payload data"). 13. After Google collected and decoded the data collected from users (including payload

data) it stored the information on its servers. On information and belief, hundreds if not thousands of Google employees throughout the United States and the world have access to data maintained on Google's servers, including the decoded payload data collected by the GSV vehicles. 14. Users had an expectation of privacy with respect to the payload data collected and

decoded by Google. Because the GSV packet sniffing data collection was done in secret, and without requiring the device used by Google to be associated with the user's device, users could not, and did not give their consent to Google's activities. 15. Page 5 On November 26, 2008 United States Patent Application No. 12/315,079, entitled

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

"Wireless Network-Based Location Approximation" was filed with the United States Patent and Trademark Office. On January 28, 2010 Patent Application No. 12/315,079 was published as US 2010/0020776 A1 ('776 Application"). Google Inc. was the assignee of the '776 Application. The '776 Attached is as Exhibit "A." 16. The '776 Application discloses a method devised by Google for gathering, analyzing,

and using data sent by users over their wireless routers and other wireless access points (collectively "wireless APs"). One way the data can be gathered, Google claims, is through a wireless receiver, using a sensitive high gain antenna, operating in a "sniffer" mode to obtain all types of data transmitted by a user's wireless AP. The data so gathered, explains Google, can then be analyzed or decoded with an "analyzer program." 17. The '776 Application shows that with data collected from a user's wireless AP,

Google can determine, among other things (1) the vendor and model of their wireless AP device, (2) the geographic coordinates, and therefore the location or street address where the wireless AP is located, and (3) the approximate location of the wireless AP within the user's residence or business. The invention also provides the capability for Google, or others with access to the data collected and analyzed as described by Google, to directly correlate the data, including the user's payload data, with a precise location, such as geographic coordinates or a street address. 18. As disclosed in the '776 Application, the more types and greater the quantity of WiFi

data obtained, decoded, and analyzed by Google from any particular user, the higher its "confidence level" in the calculated location of that user's wireless AP. Collection, decoding, and analysis of a user's payload data would, therefore, serve to increase the accuracy, value, useability, and marketability of Google's new method for wireless network-based location approximation, and any service that relied upon that method, such as the Google Location Service. Page 6 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

19.

The '776 Application also discloses that the confidence level in determining the

location of a user's wireless AP can be enhanced or increased by decoding, then analyzing what types of data has been captured (i.e. management frames, control frames, or payload data), then reviewing the decoded data to determine whether it arrived in an intact or corrupted state. 20. The '776 Application also discloses that the receiver or device used to collect the

WiFi data "may be placed in a vehicle and data may be obtained continuously or at predetermined time increments" and that the rate of speed of the vehicle "may be factored into the analysis." 21. Google has employed one or more of the methods disclosed in the '776 Application

to collect, decode, analyze, store, and make beneficial use of wireless data (including payload data) it collected from plaintiffs and class members. PLAINTIFFS VAN VALIN'S EXPERIENCE 22. Since the time Google began collecting users' payload data with its GSV vehicles,

plaintiff Van Valin has consistently maintained an open wireless internet connection at her residence. 23. Van Valin's residence is located on and adjacent to a street for which a GSV vehicle

has collected data on at least one occasion since May 25, 2007. 24. Van Valin works in the high technology field, and works from her home over her

internet-connected computer a substantial amount of time. In connection with her work and home life, Van Valin transmits and receives a substantial amount of data from and to her computer over her wireless internet connection ("wireless data"). A significant amount of the wireless data is also subject to her employer's non-disclosure and security regulations. 25. Unauthorized access to Van Valin's personal and work-related data invades her

objectively reasonable expectations of privacy, and invades her rights to privacy. Page 7 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

26.

On information and belief, a GSV vehicle has collected, and defendant has stored,

and decoded Van Valin's wireless data on at least one occasion. PLAINTIFFS MERTZ'S EXPERIENCE 27. Since the time Google began collecting users' payload data with its GSV vehicles,

plaintiff Mertz has consistently maintained an open (non-password protected) wireless internet connection at his residence. 28. Mertz's residence is located on a street for which a GSV vehicle has collected data

on at least one occasion since May 25, 2007. 29. Mertz transmits and receives a substantial amount of data from and to his computer

over his wireless internet connection ("wireless data"). 30. Unauthorized access to Mertz's personal and work-related data invades his

objectively reasonable expectations of privacy, and invades his rights to privacy. 31. On information and belief, a GSV vehicle has collected, and defendant has stored,

and decoded Mertz's wireless data on at least one occasion. CLASS ALLEGATIONS 32. Plaintiff Van Valin brings this action on her own behalf, and on behalf of the

following sub-Class: All residents within the state of Oregon whose wireless data was captured, stored, and decoded or decrypted by defendant. 33. sub-Class: All residents within the state of Washington whose wireless data was captured, stored, and decoded or decrypted by defendant. 34. Page 8 Excluded from this class are defendant, any person, firm, trust, corporation, officer, Plaintiff Mertz brings this action on his own behalf, and on behalf of the following

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

director, or other individual or entity in which defendant has a controlling interest or which is related to or affiliated with defendant, and the legal representatives, heirs, successors-in-interest or assigns of any excluded party. 35. Plaintiffs and members of the Class are so numerous that joinder of all members

individually, in one action or otherwise, is impractical. 36. This action involves questions of law and fact common to plaintiff Van Valin and all

members of the Oregon sub-Class which include: (a) Whether defendant has engaged in an unlawful invasion of plaintiff's and

class members' privacy interests; (b) The appropriate amount of nominal damages necessary to compensate

plaintiff and class members for defendant's invasion of their privacy interests; (c) The appropriate amount of punitive damages under Oregon law necessary

punish defendant for its conduct, and prevent further, similar conduct by defendant and others in the future; (d) U.S.C. § 2511 et seq.; (e) The appropriate amount of statutory damages necessary to compensate Whether defendant's conduct violated of one or more of the provisions of 18

plaintiff and the class members under 18 U.S.C. § 2520; (f) The appropriate amount of punitive damages necessary to punish defendant

for its conduct, and prevent further, similar conduct, pursuant to 18 U.S.C. § 2520; (g) The appropriate amount of costs and attorney fees that should be reimbursed

or paid to plaintiff and the class under 18 U.S.C. § 2520; (h) Page 9 Whether defendant's conduct violated of one or more of the provisions of 47

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

U.S.C. § 605 et seq.; (i) The appropriate amount of statutory damages necessary to compensate

plaintiff and class members under 47 U.S.C. § 605 (e)(3); (j) The appropriate amount of costs and attorney fees that should be reimbursed

or paid to plaintiff and the class under 47 U.S.C. § 605 (e)(3); (k) Whether plaintiff and the class members are entitled to injunctive relief

relating to the proper and appropriate time and manner of retention or destruction of the wireless data captured by defendant and belonging to plaintiff and the class members. (l) Whether plaintiff and the class members are entitled to injunctive relief

enjoining defendant from obtaining any particular class or type of wireless data from any wireless network or wireless AP within the state of Oregon. 37. This action involves questions of law and fact common to plaintiff Mertz and all

members of the Washington sub-Class which include: (a) Whether defendant has engaged in an unlawful invasion of plaintiff's and

class members' privacy interests; (b) The appropriate amount of nominal damages necessary to compensate

plaintiff and the class members for defendant's invasion of their privacy interests; (c) U.S.C. § 2511 et seq.; (d) The appropriate amount of statutory damages necessary to compensate Whether defendant's conduct violated of one or more of the provisions of 18

plaintiff and the class members under 18 U.S.C. § 2520; (e) The appropriate amount of punitive damages necessary to punish defendant

for its conduct, and prevent further, similar conduct, pursuant to 18 U.S.C. § 2520; Page 10 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

(f)

The appropriate amount of costs and attorney fees that should be reimbursed

or paid to plaintiff and the class under 18 U.S.C. § 2520; (g) U.S.C. § 605 et seq.; (h) The appropriate amount of statutory damages necessary to compensate Whether defendant's conduct violated of one or more of the provisions of 47

plaintiff and class members under 47 U.S.C. § 605 (e)(3); (i) The appropriate amount of costs and attorney fees that should be reimbursed

or paid to plaintiff and the class under 47 U.S.C. § 605 (e)(3); (j) Whether plaintiff and the class members are entitled to injunctive relief

relating to the proper and appropriate time and manner of retention or destruction of the wireless data captured by defendant and belonging to plaintiff and the class members. (k) Whether plaintiff and the class members are entitled to injunctive relief

enjoining defendant from obtaining any particular class or type of wireless data from any wireless network or wireless access point within the state of Oregon. 38. Plaintiff Van Valin's claims are typical of the claims of the members of the Oregon

sub-Class, and plaintiff Mertz's claims are typical of the claims of the members of the Washington sub-Class. 39. The named plaintiffs are willing and prepared to serve the Court and proposed sub-

Class in a representative capacity with all of the required material obligations and duties. Plaintiffs will fairly and adequately protect the interests of the Class and have no interests adverse to or which directly and irrevocably conflict with the other members of the Class. 40. The self-interests of the named Class representatives are co-extensive with, and not

antagonistic to those of the absent Class members. The proposed representative will represent and Page 11 AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

protect the the interests of the absent Class members. 41. The named plaintiffs have engaged the services of the counsel listed below. Counsel

are experienced in litigation, complex litigation, and will protect the rights of and otherwise effectively represent the named Class representatives and absent Class members. 42. A class action is superior to all other available methods for the fair and efficient

adjudication of this controversy because joinder of all parties is impracticable. The damages suffered by individual class members may be relatively small, the expense and burden of individual litigation makes it inefficient and ineffective for members of the Class to individually redress the wrongs done to them. There will be no difficulty in the management of this case as a class action. 43. The prosecution of separate actions by individual Class members would create a risk

of inconsistent or varying adjudications with respect to individual members, which would establish incompatible standards of conduct for defendant. Defendant has acted on grounds that apply generally to the Class, making equitable and monetary relief appropriate to the Class as a whole. FIRST CLAIM FOR RELIEF (Invasion of Legally Protected Privacy Interests - Oregon Sub-Class) 44. 45. Plaintiff Van Valin realleges paragraphs 1 through 43 and further alleges: Defendant's conduct was an intentional intrusion upon plaintiff's and class members'

private affairs or concerns, and would be offensive to a reasonable person. 46. Defendant's conduct constituted the tort of invasion of privacy with respect to

plaintiff and class members. 47. Plaintiff and class members are entitled to nominal damages to compensate for

defendant's invasion of their privacy. 48. Page 12 The Oregon sub-Class in entitled to recover punitive damages in an amount to be

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

determined by the jury, but sufficient to prevent the same or similar conduct by defendant and others in the future. SECOND CLAIM FOR RELIEF (Invasion of Privacy - Washington Sub-Class) 49. 50. Plaintiff Mertz realleges paragraphs 1 through 43 and further alleges: Defendant's conduct was an intentional intrusion upon plaintiff's and class members'

private affairs or concerns, and would be offensive to a reasonable person. 51. Defendant's conduct constituted the tort of invasion of privacy with respect to

plaintiff and class members. 52. Plaintiff and class members are entitled to nominal damages to compensate for

defendant's invasion of their privacy. THIRD CLAIM FOR RELIEF (18 U.S.C. § 2511 et seq.) 53. 54. 55. Plaintiffs reallege paragraphs 1 through 43, and further allege: Defendant's conduct was a violation of 18 U.S.C. § 2511. Pursuant to 18 U.S.C. § 2520, each of the plaintiffs and each class Member is

entitled to damages and relief as follows: (a) for each plaintiff and each class member, statutory damages of whichever is the greater of $100 each day that individual's data was obtained by defendant, or $10,000 per violation suffered by that individual; (b) punitive damages in an amount to be determined by the jury, but sufficient to prevent the same or similar conduct by defendant and others in the future; (c) Page 13 reasonable attorneys' fees and other litigation costs reasonably incurred.

AMENDED CLASS ACTION ALLEGATION COMPLAINT (Invasion of Privacy, 18 U.S.C. § 2511 et seq., 47 U.S.C. §605)

FOURTH CLAIM FOR RELIEF (47 U.S.C. § 605) 56. 57. Plaintiffs reallege paragraphs 1 through 43, and further allege: The wireless data and information transmitted by plaintiffs and class members

constituted interstate communications by wire or radio. 58. Google was not entitled to receive the payload data it captured from plaintiffs and

class members. After Google received, or assisted in receiving the intercepted communications and data, it us