9th Circuit Finds Investor May Have Claim Against AT&T in CPNI Case

information (CPNI) under Section 222 of the Communications Act. The 9th Circuit considered a case Terpin brought after a teenage perpetrator, Ellis Pinsky, allegedly bribed an employee at an AT&T authorized retailer to bypass the carrier’s security measures and “swap” Terpin’s phone number for a SIM Pinsky controlled. Pinsky was then able to find a document that contained Terpin’s cryptocurrency access credentials and use them to steal $24 million in cryptocurrency in 2017, the court said (docket 23-55375). “AT&T maintains that Section 222 protects only CPNI, not a broader category of customers’ ‘proprietary information,’” said the opinion by Judge Roopali Desai. Terpin “created a triable issue over whether, through the fraudulent SIM swap, AT&T gave hackers access to information protected” under the Communications Act, she wrote. Adopting AT&T’s “constrained view of CPNI would lead to absurd results,” the court found. “If Pinsky had walked into the AT&T affiliate store, asked" Jahmil Smith, an employee at an AT&T authorized retailer, "to print Terpin’s recent call log, and looked at the call log, AT&T would not dispute that Pinsky had access to CPNI,” Desai wrote: “Yet under AT&T’s view, Pinsky had no access to CPNI when he walked into the store, updated Terpin’s account to change the SIM associated with Terpin’s phone number, gained control over all incoming communications with Terpin’s phone number, and received confidential password reset messages sent to Terpin’s phone number.” Judges Richard Clifton and Holly Thomas also heard the case.