LinkedIn Wins “BrowserGate” Case Over Scanning Browser Extensions

Federal judge Vince Chhabria of the Northern District of California granted a motion by LinkedIn (owned by Microsoft) to dismiss two class-action lawsuits concerning its practice of scanning the browser extensions installed on users' machines. The reason: the plaintiffs failed to establish grounds for a claim — neither of them alleged that they had installed extensions that passed any private information to LinkedIn.

The judge granted the claimants leave to amend their suits, but voiced doubts about their prospects. Because users voluntarily download extensions that by their very nature intentionally disclose data to websites, Chhabria noted, the plaintiffs are unlikely to be able to allege a privacy violation at all, let alone win the case.

Where “BrowserGate” Came From

California residents Nicholas Farrell and Jeff Ganan filed their suits in April, following the publication of a report claiming that “LinkedIn is illegally searching your computer.” LinkedIn did not deny that it scans browsers to detect extensions, and had stated in advance in its privacy policy that it collects information about the browser and its add-ons.

The report, titled “BrowserGate,” was released by the German organization Fairlinked, which describes itself as an association of LinkedIn's commercial users. According to LinkedIn, behind it stand the same people as behind the Estonian company Teamfluence, whose CEO was banned from the social network. Teamfluence promotes a Chrome plugin that promises to “identify 100% of your LinkedIn traffic” — that is, it engages in exactly the kind of scraping the platform prohibits. A German court had previously found that Teamfluence's software violates the user agreement and that the account bans were justified.

In court, LinkedIn described what was happening in blunt terms: a founder caught scraping, found to have violated the terms of service, had launched an international revenge campaign by fabricating a “fake privacy scandal.” Notably, Ganan's attorney, J.R. Howell, simultaneously represents Fairlinked's interests in the United States.

The Court: No Concrete Harm

Chhabria pointed out that neither Farrell nor Ganan alleged that their own extensions had passed along private data. Ganan did not even mention having anything installed. Farrell claimed that he had “long kept several extensions” and that extensions “often reveal sensitive information,” but he did not cite a single concrete instance involving his own data. Listing categories of information that could hypothetically have been disclosed is not enough for a claim — the harm must be concrete and tied to the plaintiff's own circumstances.

Ganan insisted that the harm was “the unauthorized probe itself, not its catch,” but the judge responded that a plaintiff is obliged to identify the “embarrassing, invasive, or otherwise private information” that the defendant collected.

Attorney Howell stressed that the court did not rule on the legality of LinkedIn's practices, but merely found that it lacked jurisdiction, and that the decision “is not a vindication of a mass surveillance program.” He is considering filing suit in a California state court, where the requirements for grounds of a claim are more lenient, or appealing the decision to the Ninth Circuit Court of Appeals.

Source: Ars Technica