Get tomorrow's brief in your inbox
Today: Supreme Court unanimously restricts federal criminal venue in document falsification cases (Abouammo v. United States). California advances legislation to ban surveillance pricing practices that use personal data to charge different customers different prices. Washington federal court rules that alleged spam violations alone can establish Article III standing without requiring proof of economic harm.
Flagstar Bank $31.5M Data Breach Settlement
Flagstar Bank reached a $31.5 million class action settlement for consumers whose personal information was compromised in 2021 data breaches. The settlement covers affected account holders and provides compensation for privacy violations and data exposure risks. Financial institutions facing similar breach litigation should note the settlement amount represents significant financial exposure for failure to adequately protect customer data.
Supreme Court Rules on Criminal Venue in Document Falsification Cases (Abouammo v. United States)
The Supreme Court unanimously ruled that federal prosecutors must try defendants for document falsification under 18 U.S.C. § 1519 only in the district where the falsification occurred, not where the investigation is located. In a decision by Justice Elena Kagan, the Court held that Ahmad Abouammo, who created a fake invoice in Seattle, could not be prosecuted in San Francisco where the FBI investigation was based. The Court emphasized that the Constitution's venue protections require prosecution where the crime's "essential conduct elements" occurred. For Section 1519, the essential conduct is the falsification itself, which is complete once the document is created with the requisite intent, regardless of where the investigation is located or where contemplated effects are felt.
Washington Anti-Spam Law Establishes Article III Standing Without Economic Harm
U.S. District Court for the Western District of Washington ruled in Liss et al. v. Skechers USA Inc. that plaintiffs alleging violations of Washington's Commercial Electronic Mail Act (CEMA) have Article III standing based on statutory violations alone, without proving economic harm. CEMA prohibits sending commercial emails to Washington residents with false or misleading subject lines. The court held that receiving misleading commercial emails constitutes a concrete injury-in-fact because it aligns with harms the Washington legislature sought to prevent, including wasted time and cluttered inboxes. The decision follows TransUnion LLC v. Ramirez and Spokeo, Inc. v. Robins by assessing whether alleged injury has a close relationship to traditionally recognized harms. Notably, plaintiffs did not need to allege they purchased products, relied on the emails, or suffered tangible economic loss.
Supreme Court Denies Alabama's Request to Execute Using Nitrogen Gas
The Supreme Court denied Alabama's request to allow the execution of Jeffery Lee using nitrogen hypoxia after lower courts found the method likely unconstitutional under the Eighth Amendment. The Eleventh Circuit reversed the district court and found "substantial risk of serious harm" from nitrogen hypoxia, which would cause one to three minutes of "severe air hunger and corresponding emotional distress, anxiety, physiological stress, and physical discomfort." The district court then determined a firing squad would be a safer alternative and prohibited the state from using nitrogen hypoxia. Three justices (Thomas, Alito, Gorsuch) indicated they would have granted the state's request.
FCC E-Rate Program Under Review for Content Filtering Requirements
FCC Chairman Brendan Carr announced he is examining the E-Rate program, which provides approximately $3 billion annually to bring affordable broadband to rural libraries, schools, and communities. Carr framed the review around concerns about student "screen time" but the examination may impose content filtering or censorship requirements on schools receiving E-Rate funding. This follows Carr's elimination of a separate FCC program that provided free Wi-Fi to rural school kids, which he claimed was "censoring Conservative viewpoints and content" despite the program's bipartisan support.
Senate Defense Bill Proposes Unified DoD Cyber Leadership
The Senate Armed Services Committee's fiscal 2027 National Defense Authorization Act would create a new Under Secretary of Defense for Cyber, Information, and Networks that is dual-hatted as the Pentagon's Chief Information Officer and the principal cyber advisor to the Secretary of Defense. The provision, taking effect in two years, addresses ongoing tensions between the CIO and the assistant secretary of defense for cyber policy over jurisdictional disputes regarding cyber operations versus cybersecurity responsibilities. The committee narrowly defeated (14-13) an amendment by Sen. Kirsten Gillibrand to create a separate U.S. Cyber Force as the seventh military branch.
California Bill S.B. 2564 Would Ban Surveillance Pricing
California legislation S.B. 2564 would prohibit "surveillance pricing," the practice of offering different customers different prices for identical products based on analysis of personal data including browsing history, physical location, shopping transaction history, demographics, and mouse movements. A 2025 FTC report found that surveillance pricing services draw upon customer data from vendors, service providers, and third-party data brokers to sort customers into groups for targeted pricing. Research has documented discriminatory pricing impacts, including higher prices charged to Asian customers for test prep services (Princeton Review), higher ride prices for trips ending in non-white neighborhoods (Uber and Lyft), and age-based pricing discrimination (Tinder charging users aged 30-49 more than users aged 18-29). California Attorney General has initiated an investigation of surveillance pricing practices.
License Plate Readers to Add Bluetooth Device Tracking
Surveillance company Leonardo plans to add Bluetooth sensors to automatic license plate readers (ALPRs) through technology called SignalTrace. The enhanced devices would capture not only vehicle license plates but also unique identifiers of mobile phones, wearables, and other Bluetooth-enabled devices in passing vehicles, allowing law enforcement to identify specific drivers or passengers. The technology would transform ALPRs from vehicle-tracking devices to person-tracking surveillance infrastructure. ALPRs are already widely deployed across the United States.
University of Nottingham Confirms Data Breach Affecting 455,000 Individuals
University of Nottingham confirmed a cyber incident involving "significant amount" of data affecting current and former students. The ShinyHunters cybercrime group claimed to have obtained over 40GB of data including credit card and payment details. Analysis by HaveIBeenPwned indicates approximately 455,000 unique email addresses along with names, addresses, phone numbers, ethnicities, disabilities, passport numbers, and information relating to academic enrollments and fee payments. The university notified affected individuals that accessed data may include contact information, university-related details, financial information, and personal information including national insurance numbers and protected characteristics. The university is conducting a forensic investigation to verify the exact scope of data accessed.
Trump Administration Policies Drive Academic Research Disruption and Self-Censorship
Survey of 280 academic scientists from 131 universities conducted by Arizona State University's SciOPS panel found that just over half reported overall funding declines since January 2025, with approximately one-quarter reporting declines in state, local, and university internal funding. More than half reported that international students or postdocs have expressed concerns about deportation. Over 80% reported that graduate students or postdocs on their research teams have increased concerns about future job prospects. Over two-thirds reported increased work-related stress and almost half reported increased workloads since January 2025. The survey documented self-censorship actions by scientists in response to Trump administration policies affecting funding, visa restrictions, and diversity, equity, and inclusion programs.
Review email marketing subject lines for Washington CEMA compliance. The Skechers decision establishes that misleading promotional subject lines (such as false urgency about expiring discounts) create Article III standing without requiring proof of economic harm or reliance. Email campaigns targeting Washington residents face increased litigation risk.
Audit pricing algorithms for surveillance pricing practices ahead of potential California S.B. 2564 requirements. Document legitimate pricing variations based on costs, competitive positioning, or inventory management rather than personal data profiling. California Attorney General investigation is already active.
Document investigation locations for potential document falsification matters. Abouammo establishes that venue for 18 U.S.C. § 1519 prosecutions lies where the falsification occurred, not where investigations are based or effects are felt. Internal investigation protocols should capture location information for future venue determinations.
Prepare for E-Rate program changes that may impose content filtering requirements. Educational institutions receiving E-Rate funding should monitor FCC rulemaking and assess operational impacts of potential content restriction mandates.
Minimize student data collection following University of Nottingham breach affecting 455,000 individuals with sensitive personal information including passport numbers, disabilities, and protected characteristics. Review what data is strictly necessary for educational operations and verify encryption of payment card and identity document information.