Bloggers Accused of Hacking for Opening Dropbox Link

A Californian city will pay $350,000 to two men it falsely accused of hacking its Dropbox account. Officials in Fullerton, California had actually sent a link that granted the access.

The case involves two bloggers, Joshua Ferguson and David Curlee, who wrote about local government and regularly requested documents under public record laws. As some of these files were very large, officials would often upload them to a Dropbox folder and provide a link granting access.

However, one such response in 2019 also mistakenly included a link giving access to a separate folder that included documents that were not meant to be released to the bloggers until a city attorney had reviewed whether they were necessary.

Files Unprotected

The Arstechnica site notes the folder was accessible by anyone with the link. It contained 19 Zip files of which five could be opened without a password. (Source: arstechnica.com)

The two bloggers then posted about the contents of these files, which included internal police investigations and claims of drunk-driving by a city employee. These had not been approved for release.

The city then launched a series of legal actions including a lawsuit that claimed the bloggers had breached both the federal Computer Fraud and Abuse Act and the state's Comprehensive Data Access and Fraud Act.

City Heading For Loss

The city also asked for restraining orders to stop further posting that referred to the contents of the files. These requests were granted and then overturned at several stages of the case moving through the court and appeal processes.

The case had yet to reach a final conclusion but it looked likely the city would eventually lose. The likeliest outcome seemed to be a ruling that somebody who receives a link to a folder can't be held legally responsible if the folder includes documents the sender didn't actually want them to see.

The city has agreed to pay $230,000 to cover the men's legal fees, give each of them $60,000 in damages, and post an apology on its website home page. As part of the deal the men will "return" the confidential documents, though that doesn't really have much meaning with digital files. (Source: ocregister.com)

What's Your Opinion?

Should the bloggers have used the material in the files? Was the city right to suggest they'd breached hacking laws? Should governments be using public software such as Dropbox to distribute documents?