Can Parents Be Liable for Negligently Entrusting Their Adult Children with Internet Service?

An excerpt from the very long Doe 1 v. Lamb, decided Tuesday by the Appellate Court of Connecticut, in an opinion by Judge Nina Elgo, joined by Judges Robert Clark and Dawne Westbrook:

This civil action concerns the criminal conduct of the defendant Christopher Lamb, who, utilizing Internet services and computer devices provided by the defendant [Lamb's mother], hacked into the personal accounts of and harassed and exploited a number of innocent victims….

The record, viewed in the light most favorable to the plaintiffs as the nonmoving parties, reveals the following …. In the winter of 2012, Lamb, then twenty years of age, moved back home to live with the defendant and his stepfather in the town of Brooklyn. Having failed out of college, Lamb was, by his own account, "[r]eally depressed," and he attempted suicide.

Lamb "had way too much time" on his hands and, by some point in 2013, had "figured out" that he could break into people's social media and cloud accounts because it was "exciting …." … Lamb would then harvest any compromising or otherwise explicit photographs, using those images as leverage to convince young women to send him more photographs. He conducted all of these activities through the Internet service provided by the defendant, and using an Internet protocol address (IP address) that, ultimately, was identified by the police as the origination of his criminal activity….

Although Lamb did not sell any of the images that he obtained, he did broadly distribute them directly to the parents, friends, employers, schoolteachers, and other contacts of the victims. Lamb estimated that he hacked between seventy and one hundred individuals and obtained sexual images from approximately twenty or twenty-five of them. All of this criminal activity was done through the Internet connection and devices that were provided to Lamb by the defendant, and which were completely under her control.

In August, 2015, Trooper Matthew Pritchard of the Connecticut State Police visited the residence of the defendant while investigating hacking attempts that had originated from her home Internet connection. At that time, Pritchard informed the defendant that there had been an attempt to hack into a young woman's Facebook account, that it "hadn't been accessed," and that the IP address of the hacker had been traced to the defendant's home Internet service…. Initially "scared" by the visit by the state police, Lamb stopped hacking for "a few months …."

Following the visit by the state police, the defendant started "randomly going through the computers in the house" to look for anything "suspicious." She took Lamb's computer "a few times" to "look through it" to make sure he wasn't "doing anything" improper, but the defendant "really didn't know what [she] was supposed to be looking for …."

At some point after this initial contact by the police, Lamb disclosed to the defendant that he was the person who had drawn their attention and that he had hacked "a few others" as well. At that time, Lamb did not inform the defendant that, in addition to hacking into those personal accounts, he had stolen photographs of nude females from those accounts and posted them online….

In September 2017, police officers searched defendant's home; Lamb was prosecuted and ultimately sentenced to serve, in effect, eight years in prison. Some of his victims sued his mother, on the theory that she acted negligently by providing him with Internet service even after she was on notice that he was committing crimes. No, said the court:

[W]e turn to the central question posed by the present appeal, namely, whether a parent who provides an adult child with unfettered access to electronic devices and Internet service, having some knowledge that such access is being used by the adult child for an illicit purpose and having made some assurances to law enforcement that she had taken certain precautions to prevent her family members from using her devices and Internet service for an improper purpose, owes a duty of care to third parties who are harmed by criminal activity perpetrated through the Internet.

In the present case, it is undisputed that the defendant provided a Mac computer and Internet service to her adult son after he moved back into the family home in 2012. It also is undisputed that, sometime in 2015 or 2016, the defendant learned that her son had utilized those instruments to engage in hacking activities but was not aware that he had stolen photographs of nude females or posted them online until after that conduct ceased. The question before us is whether these facts give rise to a duty under our laws. In answering that question, we begin with the issue of foreseeability, followed by an analysis of the various public policy considerations that inform our resolution of the plaintiffs' claims….

In Connecticut, we "impose only a limited duty to take action to prevent injury to a third person. Our point of departure has been that absent a special relationship of custody or control, there is no duty to protect a third person from the conduct of another." "Thus, initially, if it is not foreseeable to a reasonable person in the defendant's position that harm of the type alleged would result from the defendant's actions to a particular plaintiff, the question of the existence of a duty to use due care is foreclosed, and no cause of action can be maintained by the plaintiff." However, "[as] long as harm of the general nature as that which occurred is foreseeable there is a basis for liability even though the manner in which the accident happens is unusual, bizarre or unforeseeable." …

[T]he [trial] court wrote that "it is not at all foreseeable that allowing a person to use one's Internet services will lead to that individual hacking into another's social media accounts in order to obtain intimate pictures to post on the Internet. The causal connection between those two activities is simply too attenuated for this court to determine that the defendant had a duty to protect [Jane Doe 2] from potential harm." Given the pertinent legal principles, applied to the factual scenario presented by this case, we agree with the court's determination that Lamb's actions were not reasonably foreseeable by the defendant….

The plaintiffs argue that "[c]onsiderations of public policy weigh strongly in favor of recognizing the defendant's duty in these circumstances" because there is a general interest in reporting and preventing criminal activity. Pointing to statutes that criminalize misuse of computers, as well as prohibitions against "cyberbullying," the plaintiffs urge us to expand our common-law framework, adapting it to the modern computer age. The plaintiffs further argue that the four factors we must deploy in analyzing the facts of this case—(1) the normal expectations of the participants in the activity under review; (2) the public policy of encouraging participation in the activity, while weighing the safety of the participants; (3) the avoidance of increased litigation; and (4) the decisions of courts in other jurisdictions—all weigh in favor of recognizing a duty on the part of the defendant in this case. The defendant counters that imposing a duty of care on her would violate public policy by "exposing individuals responsible for maintaining an Internet connection to liability for the intentional criminal conduct of one who uses an electronic device to access that Internet connection."

First, the normal expectations of the parties, under the facts of this case, weigh against establishing a duty of care. There are strong presumptions against imposing liability on a parent for an adult child's acts…. Few adults would likely expect to be held liable for such activity on the part of their adult child. Relatedly, there is a strong public policy interest in maintaining widespread access to the Internet. Requiring that a person who provides Internet service to other adults be held responsible for the criminal misuse of that service does not, it seems to us, fall within the normal expectations of individuals in Connecticut.

Second, any benefit that might accrue from recognizing a public policy of encouraging parents to monitor their adult children's Internet usage under such circumstances cannot be counterbalanced by the practical difficulties inherent in taking on such a task. For example, where a user of the Internet has more knowledge than the owner of the electronic devices or Internet service, hiding criminal activity is likely to be fairly simple, and detection unlikely.

Third, were we to conclude that there is a duty of care owed to the plaintiffs on the facts of this case, there can be little doubt that recognizing a duty under these circumstances would increase litigation…. As the defendant points out, and as we have already stated, the plaintiffs' argument leads to the possibility that anyone who purchases and controls an Internet connection could theoretically become liable for damages to a third party that are caused by the criminal activity of another person who uses that Internet access….

We acknowledge that the harm perpetrated on the plaintiffs in this case was extreme—but the gravity of the harm is not the only factor that we are required to consider. With respect to whether the defendant was aware of Lamb's "past conduct," the plaintiffs argue that, because Lamb had admitted to the defendant that he had engaged in hacking activities following the police visit in 2015, she therefore "easily was aware" that Lamb would have the "temptation [and] opportunity" to engage in the same behavior. Although it is true that Lamb admitted engaging in such conduct to the defendant, there also is no evidence in the materials submitted in connection with the motions for summary judgment that the defendant was aware that Lamb had stolen photographs of nude females from the hacked accounts or posted them online until after that conduct had ceased.

As Lamb stated in his January 3, 2019 statement to the police: "I didn't … go into detail of what I was doing. I don't think [the defendant] … she didn't quite get what I was doing. I think that she thought, you know, I kind of tried to get into someone's account for whatever reason or whatever, and then [she said] don't do it again…. [She was] clearly mad, disappointed at me … but I don't think—because I didn't really explain it very well." Lamb also told the police that, in retrospect, he "could have said more, gone into detail a little bit more of what [he] was doing so [the defendant] had a better understanding that … this wasn't, like, a small thing …." Under those particular facts, which the plaintiffs have provided no evidentiary basis to dispute, we reject the plaintiffs' contention that the defendant possessed knowledge that Lamb would be tempted or provided an opportunity for further misconduct of the kind that ultimately was discovered….

Stephanie M. Javarauckas and Edward W. Gasser represent the mother.