Uncommon law | Murray, Plumb and Murray takes on an unprecedented data breach case

Peter Murray likes to think his Portland law firm does things a little differently, that it has a modus operandi to push the (legal-sized) envelope. A Harvard law professor, Murray uses a farm animal analogy, of all things, to describe the legal grounds for his firm’s most recent high-profile case, one that has the potential to redefine electronic commerce in the state and perhaps the nation. More on that later.

Evidence of the firm’s tendency towards the unorthodox is evident even in its founding. Murray, Plumb and Murray was established more than 30 years ago when Peter Murray, his colleague Peter Plumb and then-Assistant Attorney General E. Stephen Murray (no relation) met up in Portland’s Lincoln Park. The Peters, both working for Pierce Atwood, were arguing an environmental case against Stephen Murray in court. Despite their positions on opposite sides of the case, and coincidentally overlapping names, the conversation led the three men to start their own law firm.

Today, the offices of Murray, Plumb and Murray are located just down the street from that park. E. Stephen Murray has since died, but the other two founding partners remain. “We kind of like the cases that push the envelope, in what we know about the law and what we know about technology,” Murray says from his Pearl Street offices. The firm’s latest noteworthy case does both.

Murray, Plumb and Murray is representing the plaintiffs in the Hannaford Bros. data breach case, shoppers whose credit and debit card numbers were among the estimated 4 million exposed to computer hackers beginning in December 2007. It’s among the largest data breach cases in U.S. history.

The firm is representing both shoppers who lost money and those who didn’t but were affected by the inconvenience and hassle of having their financial information stolen. The 15-attorney outfit beat out other big-name firms with class action credentials to represent the plaintiffs, arguing that the case provided an opportunity to not only compensate the victims, but also to create new Maine law governing electronic commerce. The courtroom battle could go on for years. “It’s fortunate we have young lawyers around,” Murray quipped.

The Hannaford case

On March 17, 2008, Hannaford announced to the public that hackers had stolen credit and debit card numbers from its shoppers, beginning about three months earlier. At the time of the announcement, roughly 1,800 fraudulent charges had been made and more than 4 million card numbers exposed.

The Scarborough-based chain operates more than 200 supermarkets in New England, New York and Florida.

A Miami man and former informant for the U.S. Secret Service was indicted in August on charges that he and two unnamed foreign hackers broke into the computer networks of major U.S. retailers and financial institutions. Albert Gonzalez, 28, allegedly used sophisticated technology to steal data from 130 million cards, including those of some Hannaford customers.

Shoppers in several states filed civil suits against Hannaford for breaching an implied contract and for failing to secure their private financial information. The cases were consolidated into one case in Maine, where last May U.S. District Court Judge D. Brock Hornby rejected all but one of the complaints. Hornby ruled that no contract existed between the plaintiffs and Hannaford and that card-issuers’ policies protected consumers from actual losses. (He kept one suit involving a Vermont woman whose bank hadn’t refunded her losses, but she was later reimbursed).

Hornby also ruled that breach victims were not entitled to restitution from Hannaford, saying the inconvenience and time shoppers lost didn’t constitute actual financial losses. “Those are the ordinary frustrations and inconveniences that everyone confronts in daily life with or without fraud or negligence. Maine law requires that there be a way to attach a monetary value to a claimed loss. These fail that requirement,” Hornby wrote in his decision.

But now, the plaintiffs are back in the game. Hornby in October agreed to ask Maine’s highest court to rule on a legal question with no precedent in Maine that has implications for retailers statewide: “Do time and effort alone, spent in a reasonable effort to avert reasonably foreseeable harm, constitute a cognizable injury under Maine common law?” In other words, does the time consumers lose in dealing with the effects of a data breach constitute a loss worthy of compensation?

Peter Murray believes it does, which brings us back to the aforementioned farm animal analogy: Someone damages a fence around a pigpen. The pigs run out, and the farmer spends his own time and effort rounding them back up. Here, Hannaford is the fence breaker, shoppers are the farmer and the pigs are the financial institutions that shoppers had to chase down to handle the fraud’s fallout.

The effects range from fees for replacement cards to cancelled hotel reservations to lost airline miles. The firm wants to see those losses reimbursed, but Murray says it also wants Maine law to catch up to the new technology under its jurisdiction. “Unless lawyers are willing to forgo early settlements and let the judicial system do its work, we won’t get new law,” he says. In the case of TJX Cos. Inc., which experienced an even larger data breach in 2007, a nearly $10 million settlement was reached before such a legal quandary could be explored, Murray says.

“There have not been many opportunities for the high court in any state to consider what is clearly a cutting edge new issue,” says Mark Melodia, head of the global data security, privacy and management practice of Reed Smith, a global firm that has defended other companies affected by data breaches. Regardless of the high court’s decision in Maine, the case will be watched closely in coming years as those involved in such breaches attempt to determine the resulting “harm,” he says.

While the plaintiff’s counsel would likely view a decision to move forward as a victory, such a ruling could complicate the progression of class action suits, Melodia says. “That sort of a decision could also suggest that these types of events aren’t mass events that affect everyone the same,” he says. Then there are the practical implications, such as determining the amount of time consumers lost and whether it’s reasonable. “Is the supreme court also going to help judges consider how to apply that theory?” he questioned.

The most germane law on the books in Maine says that if an entity allows a customer’s name, address and other identifying information to be stolen, the customer must be notified. No statute exists that pertains specifically to credit card information, Murray says.

Development of e-commerce law in this fashion is nothing new. Murray again turns to a farm animal analogy to explain: Automobile liability laws grew out of rules involving horses, the forerunner of the car. If you hit someone with your horse, you had to pay up.

A ruling from the Maine Supreme Judicial Court on the data breach issue is not expected until next year. Lawyers involved in the TJX settlement jockeyed to be named to the Hannaford case, but Hornby opted for a smaller group of local attorneys, at least for the initial phases. Pierce Atwood is representing Hannaford.

For now, Murray, Plumb and Murray — along with Lewis Saul and Associates, which has offices in Portland — will serve as the plaintiffs’ interim counsel. Hornby has yet to certify the case as a class action, and if he does, he could decide that another firm better represents the class than Murray, Plumb and Murray. The firm, obviously, hopes the case proceeds and with them on board — they don’t get paid otherwise.

New pursuit

Peter Murray never wanted to work for a large law firm. When he started at Pierce Atwood, it was the state’s largest firm, with a whopping 13 lawyers. By the time he became a partner in 1972, it had climbed to 22. “I said to myself, ‘At some time during my lifetime, this firm could be 40 lawyers.’”

Pierce Atwood today boasts more than 125 attorneys in offices from Maine to Sweden. “My prediction was way off,” Murray says. Though he remembers his time there fondly, Murray says he knew a larger firm wouldn’t reflect his priorities and values. So, he and his two partners opened an office on the second and third floors of a deteriorating building on Exchange Street on May 1, 1973, a time when warehouses outnumbered boutiques in that part of the city. They moved to the Pearl Street office in the mid-1980s — another restoration job — and have been there ever since.

Leaving a position as partner at a prestigious law firm is not a decision many would make. Neither is Murray’s most recent life change. After 31 years teaching at Harvard Law School, his alma mater, Murray is resigning to teach at the newly established Husson University Law School in Bangor. Trading one two-hour commute for another, Murray says he’s excited about the opportunities and access the school will offer in northern Maine. “I think there’s a chance here to create a special kind of law school,” he says.

The first incoming class is expected to number only about 20, compared to Harvard’s 550-student entering class. “Usually law schools are creatures of scale,” he says. “The more the merrier.” Husson’s school also will stem the flow of lawyers-to-be from that region who leave to attend the University of Maine School of Law in Portland, and often never return, Murray says.

On Dec. 1, the school, represented by Murray, will petition the Maine Supreme Court to consider its renewed request to have its law graduates take the Maine bar exam. In 2008, the court unanimously rejected Husson’s first application because it didn’t plan to seek accreditation from the American Bar Association or hire full-time faculty. It has since hired Murray and two other experienced law school professors to oversee the process, and has committed to becoming ABA accredited by 2017. It’s also seeking accreditation from the New England Association of Schools and Colleges.

The school is currently accepting applications for the May 2010 class, but those are contingent on the court’s and NEASC’s approval.

As one of three core faculty members, Murray has been instrumental in addressing the law court’s concerns and in developing the educational program, according to Michael Mullane, dean of the school. “He has carried the laboring oar in many respects,” he says of Murray, a longtime personal friend. The two hit it off 22 years ago after Mullane called Murray with a question about the Maine Rules of Evidence, which Murray co-authored. Mullane has envied his friend’s talents ever since, he says. “Peter Murray is one of the last of the Renaissance people, as far as I’m concerned. He’s a superior lawyer, he is a great teacher and he is a wonderful legal scholar, not just regionally, but nationally and even internationally.”

Murray, jet-lagged from a recent academic trip to Japan, doesn’t have the haughty demeanor you might expect of a respected academic. Wearing a navy pinstriped suit and a lobster-bedecked tie, he has a folksiness that belies his intellectualism. He says he takes pride in his firm’s service to regular citizens, the everyday people up against utilities, developers and other institutions. One of his most memorable cases was the reorganization of Casco Bay Lines, which resulted in the formation of the resident-operated Casco Bay Island Transportation District.

Now, 35 years after setting out on his own, he still remembers the catch phrase he used when the firm first opened: “Honest lawyer, one flight up.”

Murray, Plumb and Murray
75 Pearl St., Portland
Managing partner: Drew Anderson
Founded: 1973
Attorneys: 15
Services: Administrative, business, emerging business, estate planning, land use, real estate and banking law, litigation and dispute resolution
Contact: 773-5651
www.mpmlaw.com  

Jackie Farwell, Mainebiz staff reporter, can be reached at jfarwell@mainebiz.biz