The city of Fullerton, California, has agreed to pay $350,000 to settle a lawsuit it brought against two bloggers it accused of hacking the city’s Dropbox account.
Joshua Ferguson and David Curlee frequently made public record requests in the course of covering city government for a local blog, Friends for Fullerton’s Future. The city used Dropbox to fulfill large file requests, and in response to a June 6, 2019, request for records related to police misconduct, Ferguson and Curlee were sent a link to a Dropbox folder containing a password-protected zip file.
But a city employee also sent them a link to a more general “Outbox” shared folder that contained potential records request documents that had not yet been reviewed by the city attorney. The folder wasn’t password protected or access restricted. At the time, there were 19 zip files in the outbox, five of which were not password protected.
The bloggers downloaded the files related to their records request and the 19 zip files in the outbox link. In the unprotected files, Ferguson and Curlee found emails relating to police internal affairs investigations and an insurance claim regarding an automobile crash involving an allegedly drunk city employee, among others. Throughout June 2019, the bloggers published posts using the documents as source material.
The city sent two cease and desist letters to Ferguson and Curlee, claiming that the files were confidential and had not been intended for either blogger. On October 24, 2019, the city also filed a restraining order, asking the court to order the bloggers to stop further publication of the documents. The city also sought the return of the documents and requested that a third-party forensic firm be allowed to search the bloggers’ computers.