Doe v. Lamb

235 Conn. App. 295

• Court: Connecticut Appellate Court
• Decided: September 23, 2025
• Docket: AC46466
• Status: Published

Opinion

************************************************ The “officially released” date that appears near the beginning of an opinion is the date the opinion will be published in the Connecticut Law Journal or the date it is released as a slip opinion. The operative date for the beginning of all time periods for the filing of postopin- ion motions and petitions for certification is the “offi- cially released” date appearing in the opinion. All opinions are subject to modification and technical correction prior to official publication in the Connecti- cut Law Journal and subsequently in the Connecticut Reports or Connecticut Appellate Reports. In the event of discrepancies between the advance release version of an opinion and the version appearing in the Connecti- cut Law Journal and subsequently in the Connecticut Reports or Connecticut Appellate Reports, the latest version is to be considered authoritative. The syllabus and procedural history accompanying an opinion that appear in the Connecticut Law Jour- nal and subsequently in the Connecticut Reports or Connecticut Appellate Reports are copyrighted by the Secretary of the State, State of Connecticut, and may not be reproduced or distributed without the express written permission of the Commission on Official Legal Publications, Judicial Branch, State of Connecticut. ************************************************ Page 0 CONNECTICUT LAW JOURNAL 0, 0

2 ,0 0 Conn. App. 1 Doe v. Lamb

JANE DOE 1 ET AL. v. CHRISTOPHER LAMB ET AL. (AC 46466) Elgo, Clark and Westbrook, Js.

Syllabus

The plaintiffs, victims of criminal computer hacking by the defendant L, appealed from the summary judgment rendered by the trial court in favor of L’s parent, the defendant J. The plaintiffs claimed that the court improperly granted summary judgment because J had voluntarily assumed a duty of care to them to monitor and supervise L’s Internet usage at J’s home or, in the alternative, J owed a general duty of care arising from her affirmative conduct, and J failed to prevent L, an adult, from hacking into the plaintiffs’ social media accounts to obtain and post on the Internet photographs of them in the nude. Held:

The trial court properly rendered summary judgment for J on the plaintiffs’ claims sounding in negligence, in which they alleged that J had voluntarily assumed a duty of care to them, as this court could not conclude that a reasonable person in J’s position could foresee that the mere act of providing a computer or Internet service to an adult child would result in the kind of harm the plaintiffs alleged, and, although J had made gratuitous, unsolicited email statements to the police representing what she had done and was intending to do to prevent future hacking attempts by L, there was no genuine issue of material fact that J did not learn that L had stolen the plaintiffs’ photographs and posted them online until after that conduct had ceased.

Furthermore, contrary to the plaintiffs’ claim, public policy considerations, under the circumstances at issue, did not compel the conclusion that J’s actions gave rise to a duty of care to the plaintiffs, as the parties’ normal expectations weighed against establishing such a duty, any benefit that might accrue from recognizing a public policy of encouraging parents to monitor their adult children’s Internet use could not be counterbalanced by the practical difficulties inherent in taking on such a task, the recognition of such a legal duty would increase litigation, and the decisions of courts in other jurisdictions informed this court’s determination that it could not conclude that J had taken on a policy of supervising L that was analogous to that of employers who undertake to supervise their employees.

The plaintiffs’ claim that J owed them and other similarly situated victims a general duty of care on the basis of her assurances to the police that she would supervise L’s computer related activities was unavailing, as this court was not convinced that J, in voluntarily undertaking to monitor L’s activities, increased the risk of harm to the plaintiffs, who provided no evidentiary 0, 0 CONNECTICUT LAW JOURNAL Page 1

0 Conn. App. 1 ,0 3 Doe v. Lamb basis for their assertion that, subsequent to her statements to the police, J knew that L would be tempted to engage in further misconduct or that no one else would assume the responsibility for preventing his misconduct, and the fact that the General Assembly has not expressed, by way of statute, a public policy interest supporting the imposition of third-party liability against those who provide Internet access to others weighed against creating a common-law duty of care in such circumstances.

Argued January 13—officially released September 23, 2025

Procedural History

Action to recover damages for, inter alia, intentional infliction of emotional distress, and for other relief, brought to the Superior Court in the judicial district of Windham at Putnam, where the court, Lynch, J., granted the motion for summary judgment filed by the defendant Matthew Lohbush; thereafter, the court, Lohr, J., granted the motion for summary judgment filed by the defendant JoAnn Lohbush as to the plaintiff Jane Doe 2; subsequently, the court, Lohr, J., granted the motion for summary judgment filed by the defen- dant JoAnn Lohbush as to the plaintiff Jane Doe 1 et al. and rendered judgment for the defendant JoAnn Lohbush, from which the plaintiffs appealed to this court. Affirmed.

James J. Healy, with whom was Christopher P. Anderson, for the appellants (plaintiffs). Stephanie M. Javarauckas, with whom, on the brief, was Edward W. Gasser, for the appellee (defendant JoAnn Lohbush).

Opinion

ELGO, J. This civil action concerns the criminal con- duct of the defendant Christopher Lamb, who, utilizing Internet services and computer devices provided by the defendant JoAnn Lohbush, hacked into the personal accounts of and harassed and exploited a number of Page 2 CONNECTICUT LAW JOURNAL 0, 0

4 ,0 0 Conn. App. 1 Doe v. Lamb

innocent victims. The plaintiffs—Jane Doe 1, Jane Doe 1

2, Jane Doe 3, and John Doe 1—jointly appeal from the partial summary judgment rendered in favor of the defendant.2 The plaintiffs claim that the trial court improperly rendered summary judgment in favor of the defendant because she voluntarily assumed a duty of care as to the plaintiffs or, in the alternative, that the defendant owed a general duty of care arising from her affirmative conduct.3 We affirm the judgment of the trial court. The record, viewed in the light most favorable to the plaintiffs as the nonmoving parties; see, e.g., Schilberg Integrated Metals Corp. v. Continental Casualty Co., 263 Conn. 245, 252, 819 A.2d 773 (2003); reveals the following relevant facts and procedural history. In the 1 Lohbush is the mother of Christopher Lamb. For clarity, we refer to Lohbush as the defendant and to Christopher Lamb by name in this appeal from the partial summary judgment rendered in favor of Lohbush. See Tryon v. North Branford, 58 Conn. App. 702, 703 n.1, 755 A.2d 317 (2000). Moreover, although Lamb’s stepfather, Matthew Lohbush, was originally named as a defendant in this action, the trial court rendered summary judgment in his favor without objection in June, 2021. In addition, we note that Lamb was an adult at all times relevant to this appeal and the events leading to his arrest. Following his arrest, Lamb pleaded guilty to various crimes related to his use of the Internet to hack into the plaintiffs’ personal accounts and to disseminate compromising personal photographs of the plaintiffs. He was sentenced to a twenty year term of incarceration, execution suspended after eight years, followed by thirty years of probation. In this opinion, all references to Lamb’s statements are from the transcript of a January 3, 2019 polygraph interview of him that was conducted as part of the criminal investigation into his activities. That transcript was submitted to the trial court in the present case as an exhibit to Jane Doe 2’s memorandum of law in opposition to the defendant’s motion for summary judgment. 2 Because the partial summary judgment disposed of all counts brought by the plaintiffs against the defendant, this appeal is properly before us. See Practice Book § 61-3. 3 In addition, the plaintiffs claim that, if the defendant owed a duty of care to them, the plaintiffs’ claims of negligent supervision also should not have been denied. Because we conclude that the defendant did not owe the plaintiffs a duty of care under either theory put forth by the plaintiffs, we do not reach this issue. 0, 0 CONNECTICUT LAW JOURNAL Page 3

0 Conn. App. 1 ,0 5 Doe v. Lamb

winter of 2012, Lamb, then twenty years of age, moved back home to live with the defendant and his stepfather in the town of Brooklyn. Having failed out of college, Lamb was, by his own account, ‘‘[r]eally depressed,’’ and he attempted suicide. Lamb ‘‘had way too much time’’ on his hands and, by some point in 2013, had ‘‘figured out’’ that he could break into people’s social media and cloud accounts4 because it was ‘‘exciting . . . .’’5 Although the effects of Lamb’s hacking were devastating, his methods were somewhat crude—he would change passwords to various accounts, e.g., iCloud, by answering the requisite security questions. Lamb would determine the answers to the security ques- tions by using Facebook or other social media to access various personal details, such as a pet’s name, a favorite food, or a first car. Locating the answers to these ‘‘fairly easy’’ questions was made possible by the fact that ‘‘everybody’’ in his age group has ‘‘a Facebook, and Instagram, a Twitter where they post all this informa- tion. . . . [A]nd, if you look for it, you could find pretty much . . . any kind of information.’’ After securing access to these accounts, he would then enlist the help 4 Cloud accounts are information storage and retrieval systems that are utilized by computers and cell phones, e.g., iCloud, Dropbox, Gmail, etc. Increasingly, ‘‘the data a user views on many modern cell phones may not in fact be stored on the device itself.’’ Riley v. California, 573 U.S. 373, 397, 134 S. Ct. 2473, 189 L. Ed. 2d 430 (2014). ‘‘Cloud computing is the capacity of Internet-connected devices to display data stored on remote servers rather than on the device itself. Cell phone users often may not know whether particular information is stored on the device or in the cloud, and it generally makes little difference.’’ Id. Gaining access to an individual’s cloud account, as occurred in the present case, can reveal immense amounts of personal and sensitive information. 5 Lamb’s behavior escalated over the course of several years. As he stated: ‘‘[A]s time went on, I kept on doing it more and more, and then it . . . wasn’t enough at some points. You know, it’s like breaking in and taking pictures wasn’t enough; so, I had to post the pictures or send it to them. And then I’d have to . . . almost start, like, shaming these girls . . . for no really apparent reason. It wasn’t like I had any grudges against them or anything like that. It was just something that gave me some type of excitement . . . .’’ Page 4 CONNECTICUT LAW JOURNAL 0, 0

6 ,0 0 Conn. App. 1 Doe v. Lamb

of anonymous individuals on a website called ‘‘Anon- IB’’ to extract all the data from them. Lamb would then harvest any compromising or otherwise explicit photographs, using those images as leverage to con- vince young women to send him more photographs. He conducted all of these activities through the Internet service provided by the defendant, and using an Internet protocol address (IP address) that, ultimately, was iden- tified by the police as the origination of his criminal activity.6

Although Lamb was ‘‘creating fake Facebook accounts and messaging all these girls and sending their pics and demanding more,’’ he was not ‘‘covering [his] tracks’’ and it was ‘‘fairly easy’’ to determine the origin of this activity.7 Lamb was ‘‘extremely scared’’ that he would get caught and tried to stop himself from continuing on this course of action. He nevertheless ‘‘couldn’t’’ stop and ‘‘just needed to do it.’’ Although Lamb did not sell any of the images that he obtained, he did broadly distribute them directly to the parents, friends, employ- ers, schoolteachers, and other contacts of the victims. Lamb estimated that he hacked between seventy and one hundred individuals and obtained sexual images from approximately twenty or twenty-five of them. All of this criminal activity was done through the Internet connection and devices that were provided to Lamb by 6 ‘‘All computers that connect to the Internet identify each other through a unique string of numbers known as an Internet protocol address . . . . In general, when a subscriber purchases Internet service from an Internet service provider (ISP), the ISP selects from a roster of IP addresses under its control and assigns a unique IP address to the subscriber at a particular physical address.’’ (Citation omitted.) Commonwealth v. Martinez, 476 Mass. 410, 410–11, 71 N.E.3d 105 (2017). 7 Lamb claimed that he tried, ‘‘[a] couple of times,’’ to hide the defendant’s IP address but that it was only ‘‘[l]ike, 25 percent of the time, maybe . . . .’’ Lamb also opined that what he had done was not ‘‘technically’’ hacking but was more akin to ‘‘social engineering’’ because he was not ‘‘breaking, like, any of the code or anything like that.’’ 0, 0 CONNECTICUT LAW JOURNAL Page 5

0 Conn. App. 1 ,0 7 Doe v. Lamb

the defendant, and which were completely under her control. In August, 2015, Trooper Matthew Pritchard of the Connecticut State Police visited the residence of the defendant while investigating hacking attempts that had originated from her home Internet connection. At that time, Pritchard informed the defendant that there had been an attempt to hack into a young woman’s Face- book account, that it ‘‘hadn’t been accessed,’’ and that the IP address of the hacker had been traced to the defendant’s home Internet service. The defendant sub- sequently engaged in an email correspondence with officers of the state police, in which she denied that any member of her family had been involved in hacking activity and promised to monitor the Internet traffic through her home. Initially ‘‘scared’’ by the visit by the state police, Lamb stopped hacking for ‘‘a few months . . . .’’ Following the visit by the state police, the defendant started ‘‘randomly going through the computers in the house’’ to look for anything ‘‘suspicious.’’ She took Lamb’s computer ‘‘a few times’’ to ‘‘look through it’’ to make sure he wasn’t ‘‘doing anything’’ improper, but the defendant ‘‘really didn’t know what [she] was sup- posed to be looking for . . . .’’8 At some point after this initial contact by the police, Lamb disclosed to the defendant that he was the person who had drawn their attention and that he had hacked ‘‘a few others’’ as well.9 At that time, Lamb did not inform the defendant 8 We note that Lamb’s brother, John Lamb, also resided at the Brooklyn home during this time period. In his deposition testimony, John Lamb stated that he could not recall any time, while he resided there, when the defendant examined his laptop or cell phone. 9 With respect to what the defendant knew, Lamb stated: ‘‘I didn’t . . . go into detail of what I was doing. . . . [The defendant] didn’t quite get what I was doing. I think that she thought, you know, I kind of tried to get into someone’s account for whatever reason or whatever, and then—you know, it’s like, you know, don’t do it again. . . . [Y]ou can get in a lot of trouble for that, whatever. I mean, [she was] clearly mad, disappointed at Page 6 CONNECTICUT LAW JOURNAL 0, 0

8 ,0 0 Conn. App. 1 Doe v. Lamb

that, in addition to hacking into those personal accounts, he had stolen photographs of nude females from those accounts and posted them online. Shortly after this conversation with the defendant, Lamb dis- posed of his computer, which had been purchased for him by the defendant, in a commercial dumpster. Police officers returned to the defendant’s home with a search warrant in September, 2017. Lamb subse- quently received inpatient and outpatient care due to fears that he remained suicidal after having attempted to commit suicide several years previously. In March, 2018, Lamb surrendered himself to authorities when criminal charges were brought against him. The plaintiffs initiated this civil action against the defendant and Lamb in August, 2018. The operative complaint contained forty-eight counts—eight of which are relevant to this appeal. The plaintiffs alleged, inter alia, claims sounding in negligence and negligent super- vision against the defendant. For instance, the sixth count alleged that, with respect to Jane Doe 1, the defendant had provided unrestricted Internet access to Lamb even though she knew or should have known me and stuff, but . . . I didn’t really explain it very well.’’ When Lamb was asked more specifically what he had disclosed to the defendant, Lamb replied, ‘‘I never told her that I was, like, stealing naked pictures and posting them online . . . . I don’t know exactly how many I had gotten at that point but, you know, more than I mentioned.’’ Lamb further elaborated that, after this first conversation, ‘‘We never really talked about it again, not until obviously September when everything kind of blew up. . . . [J]ust because she figured they weren’t going to press any charges and stuff anyway that, you know, it’s done with. Just kind of sweep it under the rug and kind of move on type of thing, I guess . . . .’’ Lamb also stated: ‘‘I never specifically said, like, I stole these pictures and posted them online. I never brought my brother into this in any way or my friends . . . . I was ashamed. . . . I knew if something happened like this, they could get in trouble. . . . Maybe I feel that my parents not cracking down enough assisted me, I guess, in a way, by not taking my computer, not watching over me as closely, not getting me help and stuff . . . . [T]hey assisted me in pretty much letting me continue doing it even though they weren’t aware they were helping me.’’ 0, 0 CONNECTICUT LAW JOURNAL Page 7

0 Conn. App. 1 ,0 9 Doe v. Lamb

that Lamb had a ‘‘propensity’’ to engage in ‘‘hacking activities and/or to engage in the dissemination of defamatory material . . . .’’ The plaintiffs further alleged that the defendant’s ‘‘carelessness and negli- gence’’ in failing to supervise Lamb or monitor him ‘‘in any way’’ had caused injuries to the plaintiffs, including severe anxiety, nausea, panic attacks, high blood pres- sure, post-traumatic stress disorder, bullying and harassment.10 In November, 2021, the defendant moved for sum- mary judgment (first motion) with respect to the claims brought against her by Jane Doe 2. The defendant’s counsel argued, in relevant part, that Jane Doe 2’s claims of negligence ran afoul of the general prohibition against imposing a duty on individuals to control the conduct of others. More specifically, the defendant’s counsel argued that she did not owe a duty to prevent Lamb from using the Internet, to restrict his access to the Internet, or to supervise Lamb while he was on the Internet. Further, the defendant’s counsel argued that she had no special relationship with Lamb such that any duty to the plaintiffs would attach, and that the plaintiffs were alleging that the defendant should ‘‘antic- ipate, and therefore be liable for, [Lamb’s] actions sim- ply because she is his parent.’’ In July, 2022, Jane Doe 2 filed her opposition to the defendant’s motion for summary judgment. In relevant part, she argued that the defendant knew or should have known that Lamb was using the devices provided by her to ‘‘engage in an activity in such a manner as to create an unreasonable risk of harm to others’’ and that she ‘‘failed to prevent [Lamb] from having access to those devices.’’ Jane Doe 2 also argued that there was 10 The defendant’s answer to the plaintiffs’ complaint asserted special defenses that the plaintiffs’ claims were barred by the applicable statutes of limitations. See General Statutes §§ 52-577 and 52-584. Page 8 CONNECTICUT LAW JOURNAL 0, 0

10 ,0 0 Conn. App. 1 Doe v. Lamb

ample evidence, including the visit from the state police as well as Lamb’s polygraph examination; see footnote 1 of this opinion; that suggested that the defendant actually knew that Lamb was using her IP address to engage in such conduct. Last, drawing on a theory of social host liability, Jane Doe 2 argued that she had pleaded a cognizable claim of negligence because she had alleged that the defendant, in providing Lamb with Internet access, had assumed a duty to third parties. Jane Doe 2 posited that, like a social host who know- ingly provides alcohol to an individual who subse- quently injures third parties, Lamb’s tortious conduct was within the scope of the risk that the defendant knew or should have known that she was creating through her actions. Jane Doe 2 further argued that, after the 2015 visit by Pritchard, the defendant had failed to investigate the origin of the hacking attempts, had failed to notify the police of Lamb’s activities, and had failed to ‘‘avoid the probability of harm to the plaintiffs.’’ Nota- bly, Jane Doe 2 did not argue that the defendant’s emails to Pritchard constituted a voluntary assumption of a duty to her and the other plaintiffs. On August 22, 2022, the trial court heard argument on the first motion for summary judgment. The court began by inquiring as to what distinction existed between the defendant and her husband, who had been granted summary judgment without objection by the plaintiffs. See footnote 1 of this opinion. The court stated: ‘‘And so the question is as to his mother’s culpa- bility and . . . for her to say, yes, I paid the [Internet and cellular bills]. . . . [T]he argument is, well, if you did that then you are liable. You had control.’’ The court then asked the plaintiffs’ counsel to explain how a duty arises under the facts of this case, posing a hypothetical in which a person rents a room to a tenant, providing that tenant with Internet access. Counsel for the plaintiffs then argued that a party who 0, 0 CONNECTICUT LAW JOURNAL Page 9

0 Conn. App. 1 ,0 11 Doe v. Lamb

has control over the Internet and who knows or should have known that it is being used for criminal activity would have a special relationship with the tenant who was alleged to be engaged in criminal activity. The court then inquired as to the issue of an assumption of duty, pointing out the few steps that the defendant took after Pritchard’s visit, ‘‘she changed passwords, she looked into, you know, this or that . . . .’’ Counsel for the plaintiffs further argued that social host liability provided an analogous situation due to the ‘‘active participation’’ of the ‘‘person in control,’’ stating: ‘‘And the reason I say that [the defendant had a duty] is that it’s analogous to this situation because she had exclusive control over the IP address. Of the cellular service. She has years worth of knowledge of [Lamb] and whether she should supervise [Lamb] . . . .’’ In essence, the plaintiffs’ counsel argued that the duty to third parties arose as a result of the defendant’s special knowledge of and relationship to Lamb. When pressed by the court as to whether the analysis would change if Lamb were paying rent to the defendant, the plaintiffs’ counsel stated that it would not make any difference because ‘‘she knows that he doesn’t have a job, he never leaves the basement, he’s always on the computer . . . . But then the police come to [her] house and say something’s going on here. In the instru- mentality that [she] control[s].’’ The court then asked: ‘‘And she says, I know nothing about that. Maybe some- body’s hacking in. I’ll change the password. . . . [I]s she under a duty to do anything?’’ The plaintiffs’ counsel responded that, ‘‘under negligent supervision, I would say yes, she’s under a duty . . . to take reasonable steps to make sure that nothing likely to cause or possi- bly causing harm happens.’’ Encouraging the trial court to analogize the circum- stances at hand to social host liability, the plaintiffs’ counsel argued, inter alia, that the ‘‘distinction in all of Page 10 CONNECTICUT LAW JOURNAL 0, 0

12 ,0 0 Conn. App. 1 Doe v. Lamb

those lines of cases [discussing social host liability is] active involvement versus passive involvement. . . . She had exclusive control over the IP address [and] the cellular service. She has years worth of knowledge of [Lamb] and whether she [could] reasonably supervise [Lamb] over those periods of time.’’ The plaintiffs’ coun- sel further argued that, in light of the plaintiffs’ not opposing the granting of summary judgment in favor of Lamb’s stepfather; see footnote 1 of this opinion; the issue of the defendant’s control over the Internet and cellular service in the home was dispositive in that it created a ‘‘special relationship’’ between Lamb and his mother, the defendant, such that a duty to third parties should attach. Accordingly, the plaintiffs’ counsel argued that the defendant knew that she could be exposed to civil liability because, after the police visited her home in 2015 and Lamb had told her what he had done, the defendant had protected him from the state police for the next two years. The parties filed supplemental memoranda of law after the hearing on the first motion for summary judg- ment. In their supplemental memorandum of law, the plaintiffs argued, inter alia, that ‘‘[b]ecause the defen- dant . . . told the Connecticut State Police in 2015 that she had taken steps to [e]nsure that no one in her house with access to her IP address was using that IP address in an inappropriate manner, she voluntarily assumed a duty of reasonable care to make sure the family’s computer devices and cell phones were not being used to cause harm to [Jane Doe 2]. And as she voluntarily assumed a duty of reasonable care, there are genuine issues of material fact as to whether the defendant acted reasonably, or breached that duty,’’ thereby rendering summary judgment inappropriate.11 11 The emails between Pritchard and the defendant were not attached to the plaintiffs’ memoranda of law in opposition to either motion for summary judgment. Those emails were attached to Jane Doe 2’s September 21, 2022 supplemental memorandum of law in opposition to the first motion for summary judgment. 0, 0 CONNECTICUT LAW JOURNAL Page 11

0 Conn. App. 1 ,0 13 Doe v. Lamb

On February 8, 2023, the trial court granted the defen- dant’s first motion for summary judgment on the negli- gence, negligent entrustment, negligent supervision, and fraudulent transfer claims brought by Jane Doe 2 against the defendant.12 In its memorandum of decision, the court determined that no genuine issue of material fact existed as to whether the defendant had ‘‘owned, leased, rented, maintained, managed and/or controlled the home computer, laptop computers, and/or mobile smart phones’’ that were kept at her home, where Lamb resided, and that the defendant had provided the IP address and equipment necessary to access the Internet that Lamb had used to hack into the various ‘‘cloud based personal and social media accounts of various individuals, including [Jane Doe 2], where he gained access to, among other items, nude photographs of [Jane Doe 2].’’ The court also found that no genuine issue of material fact existed as to whether Lamb ‘‘posted these nude photographs of [Jane Doe 2] on the Internet and created an online forum for disparaging comments to be made about [Jane Doe 2]. Some of this material was electronically forwarded to [Jane Doe 2’s] contacts, parents, friends, teachers, school administra- tors and places of employment.’’ The court also found that there was no genuine issue of material fact that, after another individual who is not a party to this case filed a complaint, officers of the state police became aware that someone utilizing the defendant’s IP address had attempted to change passwords on multiple online accounts. In addition, there is no dispute that Pritchard traveled to the defendant’s home and spoke with her and her family regarding the use of their IP address to ‘‘change this individual’s passwords without her permis- sion’’ and that, at that time, all members of the defen- dant’s family, including Lamb, denied being the source of this hacking attempt. 12 Jane Doe 2 appealed from the summary judgment rendered by the trial court on February 8, 2023. This court dismissed the appeal on April 26, 2023, for lack of a final judgment. Page 12 CONNECTICUT LAW JOURNAL 0, 0

14 ,0 0 Conn. App. 1 Doe v. Lamb

With respect to Jane Doe 2’s negligence claim, the court concluded that General Statutes § 52-572 plainly did not apply in the present case, as it pertains solely to parental liability for the torts of their minor children. The court also noted that ‘‘it is not at all foreseeable that allowing a person to use one’s Internet services will lead to that individual hacking into another’s social media accounts in order to obtain intimate pictures to post on the Internet’’ and thus concluded that there was no genuine issue of material fact as to whether the defendant voluntarily assumed a duty to Jane Doe 2. With respect to Jane Doe 2’s negligent entrustment claim, the court stated in relevant part that she ‘‘has provided the court with numerous cases from different jurisdictions where courts have noted the potential dan- gers that lurk on the Internet. The court is certainly mindful of the myriad of negative activities that can occur online. Notably absent from [Jane Doe 2’s memo- randum of law] are cases in which courts have found that the Internet and/or associated devices that can be used to access it have been considered dangerous instrumentalities for the purpose of supporting a negli- gent entrustment cause of action. This court is disin- clined to break new ground in that regard.’’ (Emphasis in original.) Emphasizing that, ‘‘under the general law governing negligent entrustment claims, liability will exist only where the item at issue is obviously poten- tially dangerous,’’ the court concluded that no genuine issue of material fact existed as to whether the elec- tronic devices and Internet service provided by the defendant constituted ‘‘the types of dangerous instru- mentalities that can formulate the underlying basis of a negligent entrustment cause of action . . . .’’ With respect to Jane Doe 2’s negligent supervision claim, the court concluded that, ‘‘for all of the reasons stated in its discussion’’ of the negligence and negligent entrustment claims, no genuine issue of material fact 0, 0 CONNECTICUT LAW JOURNAL Page 13

0 Conn. App. 1 ,0 15 Doe v. Lamb

existed as to whether the defendant owed Jane Doe 2 a duty of care. As the court succinctly stated, ‘‘[t]he defendant simply did not have any legal obligation to supervise the conduct of her adult son.’’ For that reason, the court concluded that summary judgment was appro- priate on the negligent supervision claim. Last, with respect to Jane Doe 2’s fraudulent transfer claim, the court noted that the defendant had furnished a sworn affidavit, in which she attested to the fact that she had transferred title to her home to a limited liability company in an effort to protect her assets while pursu- ing a real estate venture. In that affidavit, the defendant further attested that, approximately ten months later, the limited liability company transferred title back to her and her husband. The court found that Jane Doe 2 ‘‘made no argument, nor offered any evidence, to contradict this assertion by the defendant.’’ Because Jane Doe 2 had failed to establish a factual predicate for her fraudulent transfer claim, the court concluded that summary judgment was warranted and rendered judgment accordingly. On March 3, 2023, the defendant filed a second motion for summary judgment as to the three remaining plain- tiffs (second motion), arguing that she lacked a duty to any of them and, therefore, could not be held liable for Lamb’s actions. Conceding that they were ‘‘identi- cally situated’’ to Jane Doe 2, the remaining plaintiffs nonetheless argued, in their memorandum of law in opposition to the second motion for summary judg- ment, that, because they suffered ‘‘harms individually,’’ the motion should be denied. On April 11, 2023, the trial court granted the second motion, thereby disposing of all remaining claims against the defendant, and this joint appeal followed. Following the commencement of this appeal, the plaintiffs moved for an articulation, pursuant to Prac- tice Book § 66-5, with respect to the trial court’s April Page 14 CONNECTICUT LAW JOURNAL 0, 0

16 ,0 0 Conn. App. 1 Doe v. Lamb

11, 2023 order granting the defendant’s second motion for summary judgment. On February 6, 2024, the court granted that motion and articulated its judgment with respect to the second motion for summary judgment. The court noted that the remaining plaintiffs’ claims were ‘‘substantially similar’’ to those raised by Jane Doe 2 in the first motion for summary judgment and that the court’s February, 2023 order and memorandum of decision applied ‘‘with equal force to all four plaintiffs.’’ The court reiterated that it had determined that the defendant ‘‘owed no legal duty to any of [the plaintiffs] for tortious acts allegedly committed against them by her adult son, [Lamb], while utilizing their shared home Internet service.’’13 The court concluded by stating that the defendant ‘‘owed no duty of care to any [of the plaintiffs], under any of the factual scenarios set forth in their respective claims against her, for Lamb’s alleged actions.’’ I On appeal, the plaintiffs first contend that the trial court improperly rendered summary judgment for the defendant on their claims sounding in negligence because the defendant voluntarily assumed a duty of care to the plaintiffs.14 According to the plaintiffs, the defendant assumed a duty of care to them because 13 The trial court also stated that, in granting the second motion, it had ‘‘implicitly’’ overruled the objections to the motion for summary judgment, thereby ‘‘resolving all claims in the case against [the defendant] in her favor.’’ 14 Specifically, the plaintiffs claim that the trial court improperly rendered summary judgment on counts six, eighteen, thirty, and forty-two of their amended complaint. The sixth count of the operative complaint alleges, inter alia, that the defendant acted negligently in providing Internet access to Lamb when she knew or should have known of his ‘‘propensity’’ to engage in ‘‘hacking activities’’ and that her failure to monitor or stop Lamb from performing these activities resulted in injury to Jane Doe 1. The eighteenth count alleges the same with regard to Jane Doe 2. The thirtieth count alleges the same with regard to Jane Doe 3, and the forty-second count alleges the same negligent actions with regard to John Doe 1. 0, 0 CONNECTICUT LAW JOURNAL Page 15

0 Conn. App. 1 ,0 17 Doe v. Lamb

she had knowledge that Lamb had used her Internet connection for an illicit purpose, exercised exclusive control over his access to the Internet, and attempted to ‘‘divert attention elsewhere’’ in order to shield Lamb from investigation. The plaintiffs argue that, under cer- tain provisions of the Restatement (Second) of Torts as well as under Connecticut case law, a duty emerged out of these circumstances when the defendant ‘‘volun- tarily undertook to supervise and monitor Lamb’s use of her Internet connection,’’ and did so in a manner that was ‘‘cursory, uninformed, and hopelessly defi- cient’’ even though she ‘‘should have known that she was utterly incapable’’ of monitoring Lamb’s activity. Further, the plaintiffs contend that the defendant had the power and ability to prevent Lamb from using her Internet connection to harm others, but, despite having voluntarily ‘‘pledged to supervise and monitor Lamb,’’ the result of her actions was to ‘‘put the victims in a far worse position.’’ The defendant counters that the court correctly determined that her statements to Pritchard were not ‘‘conceptually’’ the same as an assumption of duty.15 Further, the defendant argues that the court properly granted the motion for summary judgment because there is no genuine issue of material fact at issue, and the defendant did not, as a matter of law, owe a duty of care to the plaintiffs. The following additional, undisputed facts and proce- dural history are relevant to the plaintiffs’ claim. After 15 The defendant refers to comments made by the trial court during the August 22, 2022 hearing. The court analogized the present situation to a scenario in which a person jumps in the water to save another individual from drowning but then ceases the effort to save the drowning person: ‘‘The theory behind that . . . is that you’re causing others to not do something who might have [done something], right? You assumed a duty there. But . . . [t]his is [the defendant’s] Internet. And [the defendant’s] saying . . . maybe somebody’s hacking in . . . . Let’s change the passwords. [L]et’s do a few things here. And so, I . . . don’t see that conceptually [to be] the same as an assumption of the duty.’’ Page 16 CONNECTICUT LAW JOURNAL 0, 0

18 ,0 0 Conn. App. 1 Doe v. Lamb

the August, 2015 visit by the state police, the defendant engaged in an email correspondence with Pritchard. A copy of that correspondence, including an email sent on August 10, 2015, from the defendant to Pritchard, was attached to the plaintiffs’ supplemental memoran- dum of law objecting to the second motion for summary judgment. In that email, the defendant reported, inter alia, that she had not ‘‘seen any evidence that this inci- dent involved directly anyone in my household’’ and that she had determined that her sons had helped her father with a project in a different town during the days in which the alleged hacking attempt had taken place. She assured Pritchard that she knew from speaking ‘‘with someone who works on computers for their job’’ that ‘‘using someone else’s IP address is not that difficult especially if it is someone outside our household who has had any connection . . . through the web at any point with us’’ through her ‘‘fairly unsecured’’ Internet connection.16 She reported having changed the pass- word for her Internet service and having instructed her children not to disclose the new password to ‘‘friends who come visit.’’ She assured Pritchard that, ‘‘based on the times of the incidents,’’ she would be ‘‘pretty aware of any activity in the house whether it was my children or a friend.’’ Last, the defendant stated that she was ‘‘going to ask for advice’’ to make her Internet connec- tion ‘‘even more secure,’’ including possibly consulting with a man her daughter informed her ‘‘is involved in cyber safety.’’17 The defendant closed the email with 16 The defendant stated, in her deposition testimony, that she could not remember who the person was to whom she referred in her email to Pritch- ard, ‘‘but it was someone at the time that worked on repairing computers or worked on servicing computers or something’’ and that this person had explained to her that ‘‘you can access accounts if you’ve already had the password in the past.’’ 17 The defendant clarified, in her deposition testimony, that she knows personally an individual who is a state trooper involved in ‘‘cyber safety’’ but that she never followed through with consulting him because she had ‘‘looked into everything’’ Pritchard had told her to do, deciding ‘‘not to involve friends of the family in a family matter.’’ 0, 0 CONNECTICUT LAW JOURNAL Page 17

0 Conn. App. 1 ,0 19 Doe v. Lamb

‘‘[t]hank you for bringing this to my attention.’’ That correspondence indicates that, at that time, Pritchard was utilizing email simply to schedule visits with the family. On October 8, 2015, following a request from Pritch- ard to schedule another time to visit and speak with the defendant and her family, the defendant sent another email to Pritchard, stating, inter alia, that ‘‘I do want all involved to know that we have spoken severely to all our children about the dangers of using the Internet improperly and how important it is to keep our computers and our [Wi-Fi] secure from even friends.’’ The defendant also stated: ‘‘We want you to know that this situation has been monitored from our end and we have changed passwords etc. and are moni- toring our laptops including my children’s to be sure we are aware of all activity.’’ It is undisputed that the defendant continued to pay for and allow Lamb to access the Internet and devices in her home until his arrest on March 18, 2018. It also is undisputed that, sometime after the police visited the home in 2015, Lamb admitted to the defendant that he had utilized the Internet provided in the home to hack into the accounts of several individuals.18 In a statement provided to law enforcement on January 3, 2019, Lamb explained: ‘‘I didn’t . . . go into detail of what I was doing. I don’t think [the defendant] . . . she didn’t quite get what I was doing. I think she thought [that] I tried to get into someone’s account for whatever reason or whatever, and then [she said] don’t do it again. . . . [She was] clearly mad, disappointed at me . . . but I don’t think—because I didn’t really explain it very well.’’19 Lamb also told the police that, in retro- spect, he ‘‘could have said more, gone into detail a little 18 When asked specifically when he first admitted his hacking activities to the defendant, Lamb stated, ‘‘somewhere around’’ 2015 or 2016. 19 In her deposition testimony, the defendant similarly stated that, although the police informed her that hacking attempts had originated from her IP Page 18 CONNECTICUT LAW JOURNAL 0, 0

20 ,0 0 Conn. App. 1 Doe v. Lamb

bit more of what [he] was doing so [the defendant] had a better understanding that . . . this wasn’t, like, a small thing . . . .’’ When asked, ‘‘[w]hat specifically did you tell [the defendant],’’ Lamb stated that he admitted to hacking into ‘‘a couple of accounts’’ but that he ‘‘never told her that [he] was . . . stealing naked pictures and posting them online . . . .’’ Lamb also admitted that, after informing the defendant of his hacking activities, he ‘‘threw away’’ the Mac computer he had used for those activities in a trash can at the Home Depot store in Willimantic. Lamb stated that he did so ‘‘a few days after’’ admitting his hacking activities to the defendant. In ruling on the first motion for summary judgment, the trial court determined that, the arguments put for- ward by the plaintiffs notwithstanding, it was ‘‘not at all foreseeable that allowing a person to use one’s Internet services will lead to that individual hacking into anoth- er’s social media accounts in order to obtain intimate pictures to post on the Internet. The causal connection between those two activities is simply too attenuated for this court to determine that the defendant had a duty to protect [Jane Doe 2] from potential harm.’’ The court also rejected Jane Doe 2’s argument that the defendant had voluntarily assumed a duty to her. Inter- preting §§ 314 A and 324 of the Restatement (Second) of Torts, the court determined that these provisions apply ‘‘to individuals who voluntarily take the care, custody or control of people who are incapacitated or otherwise incapable of caring for themselves’’ and that they are, therefore, inapplicable to the actions under- taken by the defendant. Consequently, the court deter- mined that there was no legal duty on the part of the defendant to protect Jane Doe 2 from harm. That rea- soning was applied by the court ‘‘with equal force’’ to address in 2015, she did not learn that her Internet service had been used to steal photographs of nude females from personal accounts and post them online until the police executed a search warrant at her home in September, 2017. 0, 0 CONNECTICUT LAW JOURNAL Page 19

0 Conn. App. 1 ,0 21 Doe v. Lamb

the claims of the remaining plaintiffs. In sum, the court, having concluded that the defendant owed no legal duty to any of the plaintiffs for the tortious acts committed by Lamb, rendered summary judgment in favor of the defendant on all counts. On appeal, the plaintiffs chal- lenge the propriety of that determination. We begin with the relevant legal principles. ‘‘Sum- mary judgment is a method of resolving litigation when pleadings, affidavits, and any other proof submitted show that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law. . . . The motion for summary judg- ment is designed to eliminate the delay and expense of litigating an issue when there is no real issue to be tried.’’ (Internal quotation marks omitted.) Grenier v. Commissioner of Transportation, 306 Conn. 523, 534– 35, 51 A.3d 367 (2012). ‘‘Our review of the trial court’s decision to grant the defendant’s motion for summary judgment is plenary. . . . On appeal, we must deter- mine whether the legal conclusions reached by the trial court are legally and logically correct and whether they find support in the facts set out in the memorandum of decision of the trial court.’’ (Internal quotation marks omitted.) Hassiem v. O & G Industries, Inc., 197 Conn. App. 631, 635, 232 A.3d 1139, cert. denied, 335 Conn. 928, 235 A.3d 525 (2020). ‘‘Practice Book § 17-49 pro- vides that summary judgment shall be rendered forth- with if the pleadings, affidavits and any other proof submitted show that there is no genuine issue as to any material fact and that the moving party is entitled to judgment as a matter of law. . . . In deciding a motion for summary judgment, the trial court must view the evidence in the light most favorable to the nonmoving party. . . . The party seeking summary judgment has the burden of showing the absence of any genuine issue [of] material facts which, under the applicable princi- ples of substantive law, entitle him to a judgment as a Page 20 CONNECTICUT LAW JOURNAL 0, 0

22 ,0 0 Conn. App. 1 Doe v. Lamb

matter of law . . . and the party opposing such a motion must provide an evidentiary foundation to dem- onstrate the existence of a genuine issue of material fact. . . . A material fact is a fact that will make a difference in the result of the case. . . . It is not enough for the moving party merely to assert the absence of any disputed factual issue; the moving party is required to bring forward . . . evidentiary facts, or substantial evidence outside the pleadings to show the absence of any material dispute. . . . The party opposing sum- mary judgment must present a factual predicate for his argument to raise a genuine issue of fact. . . . Once raised, if it is not conclusively refuted by the moving party, a genuine issue of fact exists, and summary judg- ment is inappropriate.’’ (Citations omitted; internal quo- tation marks omitted.) Martinez v. Premier Mainte- nance, Inc., 185 Conn. App. 425, 434–35, 197 A.3d 919 (2018). We next set forth the relevant principles of negli- gence. ‘‘Issues of negligence are ordinarily not suscepti- ble of summary adjudication but should be resolved by trial in the ordinary manner. . . . Nevertheless, [t]he issue of whether a defendant owes a duty of care is an appropriate matter for summary judgment because the question is one of law.’’ (Citation omitted; internal quo- tation marks omitted.) Streifel v. Bulkley, 195 Conn. App. 294, 304, 224 A.3d 539, cert. denied, 335 Conn. 911, 228 A.3d 375 (2020). The establishment of a duty owed to the plaintiffs by the defendant is a threshold inquiry. ‘‘[A] cause of action in negligence is comprised of four elements: duty; breach of that duty; causation; and actual injury. . . . Whether a duty exists is a question of law for the court, and only if the court finds that such a duty exists does the trier of fact consider whether that duty was breached. . . . If a court determines, as a matter of law, that a defendant owes no duty to a plaintiff, the 0, 0 CONNECTICUT LAW JOURNAL Page 21

0 Conn. App. 1 ,0 23 Doe v. Lamb

plaintiff cannot recover in negligence from the defen- dant. . . . Duty is a legal conclusion about relation- ships between individuals, made after the fact, and imperative to a negligence cause of action. The nature of the duty, and the specific persons to whom it is owed, are determined by the circumstances surrounding the conduct of the individual. . . . Foreseeability is a criti- cal factor in the analysis, because no duty exists unless an ordinary person in the defendant’s position, knowing what the defendant knew or should have known, would anticipate that harm of the general nature of that suf- fered was likely to result . . . . Our law makes clear that foreseeability alone, however, does not automati- cally give rise to a duty of care . . . . A further inquiry must be made, for we recognize that duty is not sacro- sanct in itself . . . but is only an expression of the sum total of those considerations of policy [that] lead the law to say that the plaintiff is entitled to protection. . . . The final step in the duty inquiry, then, is to make a determination of the fundamental policy of the law, as to whether the defendant’s responsibility should extend to such results.’’ (Internal quotation marks omit- ted.) Roux v. Coffey, 230 Conn. App. 130, 139, 330 A.3d 253, cert. denied, 351 Conn. 915, 331 A.3d 1217 (2025). ‘‘Negligence, like risk, is thus a term of relation.’’ Pals- graf v. Long Island Railroad Co., 248 N.Y. 339, 345, 162 N.E. 99 (1928); see also Doe v. Cochran, 332 Conn. 325, 339, 210 A.3d 469 (2019) (‘‘Although it has been said that no universal test for [duty] ever has been formu- lated . . . our threshold inquiry has always been whether the specific harm alleged by the plaintiff was foreseeable to the defendant. The ultimate test of the existence of the duty to use care is found in the foresee- ability that harm may result if it is not exercised. . . . By that is not meant that one charged with negligence must be found actually to have foreseen the probability of harm or that the particular injury [that] resulted was Page 22 CONNECTICUT LAW JOURNAL 0, 0

24 ,0 0 Conn. App. 1 Doe v. Lamb

foreseeable, but the test is, would the ordinary [person] in the [alleged tortfeasor’s] position, knowing what he knew or should have known, anticipate that harm of the general nature of that suffered was likely to result . . . .’’ (Internal quotation marks omitted.)); Jaworski v. Kiernan, 241 Conn. 399, 406, 696 A.2d 332 (1997) (‘‘A simple conclusion that the harm to the plaintiff was foreseeable, however, cannot by itself mandate a deter- mination that a legal duty exists. Many harms are quite literally foreseeable, yet for pragmatic reasons, no recovery is allowed.’’ (Internal quotation marks omit- ted.)). ‘‘Negligence is not actionable unless it involves the invasion of a legally protected interest, the violation of a right. ‘Proof of negligence in the air, so to speak, will not do.’ ’’ Palsgraf v. Long Island Railroad Co., supra, 341. There is a ‘‘general prohibition against imposing upon an individual a duty to control the conduct of a third party . . . .’’ (Internal quotation marks omitted.) Can- nizzaro v. Marinyak, 312 Conn. 361, 368, 93 A.3d 584 (2014). ‘‘The fact that the actor realizes or should realize that action on his part is necessary for another’s aid or protection does not of itself impose upon him a duty to take such action.’’ (Internal quotation marks omit- ted.) Id. With these principles in mind, we turn to the central question posed by the present appeal, namely, whether a parent who provides an adult child with unfettered access to electronic devices and Internet service, having some knowledge that such access is being used by the adult child for an illicit purpose and having made some assurances to law enforcement that she had taken cer- tain precautions to prevent her family members from using her devices and Internet service for an improper purpose, owes a duty of care to third parties who are harmed by criminal activity perpetrated through the 0, 0 CONNECTICUT LAW JOURNAL Page 23

0 Conn. App. 1 ,0 25 Doe v. Lamb

Internet. In the present case, it is undisputed that the 20

defendant provided a Mac computer and Internet ser- vice to her adult son after he moved back into the family home in 2012. It also is undisputed that, sometime in 2015 or 2016; see footnote 18 of this opinion; the defen- dant learned that her son had utilized those instruments to engage in hacking activities but was not aware that he had stolen photographs of nude females or posted them online until after that conduct ceased. The ques- tion before us is whether these facts give rise to a duty under our laws. In answering that question, we begin with the issue of foreseeability, followed by an analysis of the various public policy considerations that inform our resolution of the plaintiffs’ claims.21 20 The defendant, in her appellate brief, argues that the plaintiffs are asking this court for a ‘‘futile second bite at the apple’’ because she did not argue adequately to the trial court that her ‘‘representations to [Pritchard are] evidence of an assumption of a duty to the plaintiffs.’’ More specifically, the defendant contends that the plaintiffs did not argue to the trial court— until after oral arguments on the first motion for summary judgment, via supplemental briefing—that her emails to Pritchard constitute a voluntary assumption of a duty. Although it is true that the emails were not before the court until September, 2022, and, therefore, the August, 2022 hearing on the first motion for summary judgment did not address their role in the plaintiffs’ claim that the defendant had assumed a duty of care to the plain- tiffs, this argument is without merit. Our review of the record reveals that the plaintiffs argued to the court, by way of their supplemental memorandum of law in opposition to the second motion for summary judgment, that the defendant had voluntarily assumed a duty of reasonable care because she had ‘‘told the Connecticut State Police in 2015 that she had taken steps to [e]nsure that no one in her house with access to her IP address was using that IP address in an inappropriate manner’’ and that this duty of reasonable care extends to the plaintiffs. Moreover, our review of the court’s determina- tion that the defendant did not owe a duty of care to the plaintiffs is plenary. ‘‘Under Connecticut law, [t]he existence of a duty is a question of law . . . .’’ (Internal quotation marks omitted.) Demond v. Project Service, LLC, 331 Conn. 816, 834, 208 A.3d 626 (2019). Accordingly, there is no ‘‘futile second bite at the apple’’ under these circumstances, where both the requisite facts and legal argument were before the court. 21 We recognize, as our Supreme Court has in the past, ‘‘that the issue of foreseeability cannot be neatly compartmentalized and considered wholly separate from the policy issues that are central to our legal determination of duty.’’ Lodge v. Arett Sales Corp., 246 Conn. 563, 576, 717 A.2d 215 (1998). Page 24 CONNECTICUT LAW JOURNAL 0, 0

26 ,0 0 Conn. App. 1 Doe v. Lamb

A The plaintiffs argue that Lamb’s actions were foresee- able by the defendant. According to the plaintiffs, our Supreme Court has stated, in the context of §§ 323 and 324 A of the Restatement (Second) of Torts,22 that ‘‘a defendant who undertakes to act—even without an obli- gation to do so—is liable for any harm that flows from negligent conduct.’’ Because, the plaintiffs contend, the defendant had been alerted to Lamb’s hacking activities by law enforcement in 2015, her failure to monitor his computer usage or prevent him from accessing her devices and Internet service resulted in the foreseeable harm suffered by the plaintiffs.23 The defendant count- ers that, because the harm caused to the plaintiffs was Although we conclude that no duty exists because the plaintiffs fail to satisfy either prong of the analysis—foreseeability or public policy—we conduct both prongs of the analysis because it is impossible to ‘‘neatly’’ compartmen- talize these two prongs. 22 Section 323 of the Restatement (Second) of Torts, titled ‘‘Negligent Performance of Undertaking to Render Services,’’ states: ‘‘One who under- takes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of the other’s person or things, is subject to liability to the other for physical harm resulting from his failure to exercise reasonable care to perform his undertaking, if (a) his failure to exercise such care increases the risk of such harm, or (b) the harm is suffered because of the other’s reliance upon the undertaking.’’ 2 Restatement (Second), Torts § 323, p. 135 (1965). Section 324 A of the Restatement (Second) of Torts, titled ‘‘Liability to Third Person for Negligent Performance of Undertaking,’’ states: ‘‘One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertak- ing, if (a) his failure to exercise reasonable care increases the risk of such harm, or (b) he has undertaken to perform a duty owed by the other to the third person, or (c) the harm is suffered because of reliance of the other or the third person upon the undertaking.’’ 2 Restatement (Second), supra, § 324 A, p. 142. 23 The plaintiffs also argue that the defendant’s voluntary assumption of a duty to monitor and supervise Lamb’s computer activity ‘‘increased the harm to the plaintiffs . . . .’’ Our Supreme Court, for purposes of avoiding ‘‘analytical confusion,’’ made clear that there is a distinction between the establishment of a duty under § 324 A of the Restatement (Second) of Torts 0, 0 CONNECTICUT LAW JOURNAL Page 25

0 Conn. App. 1 ,0 27 Doe v. Lamb

not reasonably foreseeable, she owed no duty of care to the plaintiffs.24 Moreover, the defendant argues that, even if her actions gave rise to an assumption of a duty pursuant to § 324 A of the Restatement (Second), that duty was not intended to protect the plaintiffs and, therefore, the duty was not assumed in order to ‘‘render services to protect another.’’ (Emphasis omitted.) As such, the defendant argues that our Supreme Court’s precedents, generally, as well as § 324 A of the Restatement (Second), specifically, limit any such duty to the fore- seeable injuries suffered by persons intended to be ben- eficiaries, which does not include the plaintiffs. We agree with the defendant. The following principles of foreseeability are relevant to resolving the plaintiffs’ claim. ‘‘The default assump- tion of the common law . . . is that one owes a duty to exercise due care in one’s affirmative conduct with respect to all people, insofar as one’s negligent actions and the attaching of liability once that duty is found to exist. ‘‘If a duty is owed, liability under § 324A for breach of the duty is determined by reference to subsections (a), (b) and (c) of § 324A. But the duty question comes first under § 324A, the same as it does in other areas of tort law, and this threshold inquiry must not be overlooked in cases under § 324A in which the scope of that duty is disputed.’’ Demond v. Project Service, LLC, 331 Conn. 816, 835 n.12, 208 A.3d 626 (2019). Because we conclude that the defendant did not, as an initial matter, owe a duty to the plaintiffs, we need not address whether her actions gave rise to liability by increasing the risk of harm to the plaintiffs, under § 324 A (a). 24 The defendant also argues that Lamb’s actions were not foreseeable because the plaintiffs did not suffer any physical harm. In support of this argument, the defendant points to Liberty Ins. Corp. v. Lamb, United States District Court, Docket No. 3:19-cv-00005 (AWT) (D. Conn. September 10, 2021), a federal District Court decision in favor of Liberty Insurance Corpora- tion. In that action, Liberty Insurance Corporation sought a declaratory judgment that it did not owe a duty to defend or indemnify Lamb or the defendant in the plaintiffs’ state court action. During the proceedings, the District Court ruled that the plaintiffs had not suffered physical harm, as that term was defined ‘‘within the meaning of the insuring agreement’’ of the pertinent insurance policies. (Internal quotation marks omitted.) Because we conclude that the defendant did not owe a duty to the plaintiffs, the issue of harm is not before us. Accordingly, we decline to address this argument. Page 26 CONNECTICUT LAW JOURNAL 0, 0

28 ,0 0 Conn. App. 1 Doe v. Lamb

may foreseeably harm them.’’ Doe v. Cochran, supra, 332 Conn. 339. In Connecticut, we ‘‘impose only a lim- ited duty to take action to prevent injury to a third person. Our point of departure has been that absent a special relationship of custody or control, there is no duty to protect a third person from the conduct of another.’’ (Internal quotation marks omitted.) Fraser v. United States, 236 Conn. 625, 632, 674 A.2d 811 (1996). ‘‘Thus, initially, if it is not foreseeable to a reasonable person in the defendant’s position that harm of the type alleged would result from the defendant’s actions to a particular plaintiff, the question of the existence of a duty to use due care is foreclosed, and no cause of action can be maintained by the plaintiff.’’ (Internal quotation marks omitted.) Id., 633. However, ‘‘[as] long as harm of the general nature as that which occurred is foreseeable there is a basis for liability even though the manner in which the accident happens is unusual, bizarre or unforeseeable.’’ (Internal quotation marks omitted.) Ruiz v. Victory Properties, LLC, 315 Conn. 320, 335, 107 A.3d 381 (2015). In support of their assertion that the defendant owed a duty to them, the plaintiffs argue that the circum- stances of this case ‘‘align directly with Supreme Court precedent’’ because the defendant ‘‘ ‘gratuitously under- took’ ’’ to supervise Lamb’s activity on the Internet, thereby assuming ‘‘ ‘a duty to do so safely.’ ’’25 In support 25 The plaintiffs also baldly assert, as further support for their claim that the defendant owed a duty to them, that ‘‘the defendant also misled the state police into believing that the defendant was diligently monitoring her children in the manner that she had promised.’’ We do not construe that sentence in their principal appellate brief as a distinct claim regarding law enforcement’s reliance on the defendant’s representations but, rather, merely as further support for their duty of care claim. Moreover, the plaintiffs have neither cited to legal authority for nor provided any analysis of such a claim. Accordingly, we decline to consider that claim independent of the duty of care claim raised by the plaintiffs. See, e.g., Connecticut Coalition Against Millstone v. Connecticut Siting Council, 286 Conn. 57, 87, 942 A.2d 345 (2008) (when ‘‘an issue is merely mentioned, but not briefed beyond a bare assertion of the claim, it is deemed to have been waived’’ (internal 0, 0 CONNECTICUT LAW JOURNAL Page 27

0 Conn. App. 1 ,0 29 Doe v. Lamb

of this proposition, the plaintiffs cite to our Supreme Court’s decision in Grenier v. Commissioner of Trans- portation, supra, 306 Conn. 546–47, as well as this court’s decision in Coville v. Liberty Mutual Ins. Co., 57 Conn. App. 275, 282, 748 A.2d 875 (2000), cert. granted, 253 Conn. 919, 755 A.2d 213 (2000) (appeal withdrawn March 30, 2001). In Grenier, our Supreme Court concluded that a national organization owed a duty of care to a student member because the organization undertook to provide transportation from a mandatory event, despite being under no obligation to provide such transportation. See Grenier v. Commissioner of Transportation, supra, 306 Conn. 546–47. Grenier, then, stands for the proposi- tion that, under the specific facts of that case, the party who undertook to provide transportation from an event under its control assumed a duty to those to whom it offered transportation. Because there was no third- party duty at issue in Grenier, we conclude that it is inapposite. Coville is similarly inapt to the present case. In Coville, the defendant driver forced his girlfriend—inca- pacitated due to alcohol consumption—to ride in his car with him, refusing to let her out of the vehicle despite her repeated attempts to escape. Coville v. Lib- erty Mutual Ins. Co., supra, 57 Conn. App. 276–77. She subsequently fell out of the vehicle while still under the defendant driver’s custody or control, becoming injured in the process. Id. We determined that, under those factual circumstances, it was appropriate for the trial court to instruct the jury that, should it find that the plaintiff girlfriend was ‘‘helpless in that she was intoxi- cated to the point of being semiconscious and was quotation marks omitted)); State v. Nathaniel T., 230 Conn. App. 45, 52–53, 329 A.3d 285 (2024) (declining to review claim as inadequately briefed when defendant did not provide any analysis or citation to authority in support of claim). Page 28 CONNECTICUT LAW JOURNAL 0, 0

30 ,0 0 Conn. App. 1 Doe v. Lamb

unable to take care of herself,’’ this could be a basis, under provisions of the Restatement (Second) of Torts and consistent with Connecticut law, to conclude that the defendant driver had a specific ‘‘duty to secure [her] safety.’’ Id., 283. Coville thus stands for the proposition that a party can voluntarily assume a duty of care to a person who is under the custody or control of that party as a result of those voluntary actions. There is no such scenario present here, where the plaintiffs allege that a duty of care was owed to them as a result of the defendant’s voluntary actions with respect to Lamb, because the plaintiffs were not under the defen- dant’s custody or control. The plaintiffs also rely on Zatkin v. Katz, 126 Conn. 445, 450, 11 A.2d 843 (1940), a case that predates the Restatement (Second). More specifically, the plaintiffs argue that Coville, by citing to Zatkin, stands for the proposition that ‘‘[o]ne who gratuitously undertakes a service that he has no duty to perform must act with reasonable care in completing the task assumed.’’ Coville v. Liberty Mutual Ins. Co., supra, 57 Conn. App. 282. The plaintiffs cite this language in support of their argument that the defendant voluntarily assumed a duty to supervise Lamb’s use of the Internet. Zatkin, like Coville, addressed a challenge to jury instructions con- cerning claims of negligence against a wrecking com- pany that loaded a truck whose contents spilled onto a public road, causing injury. Zatkin v. Katz, supra, 447–48. In Zatkin, our Supreme Court concluded: ‘‘The jury should have been instructed that if the [wrecking company defendant], through its servants, loaded the truck in such manner knowing it was to be operated upon the highway, it was liable for any injuries of which its manner of loading was the proximate cause. It would not affect the liability of the [wrecking company defen- dant] whether this service was performed gratuitously or resulted from contract. If, through its servants, it 0, 0 CONNECTICUT LAW JOURNAL Page 29

0 Conn. App. 1 ,0 31 Doe v. Lamb

caused the truck to be so loaded as to constitute a nuisance upon the highway, knowing that it was to be so operated, it could not escape liability for injuries to users of the highway caused thereby.’’ Id., 449–50. Although Zatkin establishes a duty to third parties as a result of the affirmative actions undertaken by a defen- dant company that created foreseeable risks of harm, it, too, is inapposite to the present case. Here, the defen- dant did not engage in any affirmative actions that cre- ated a reasonably foreseeable risk of harm to the plain- tiffs by emailing the state police, particularly since she was unaware of the extent of Lamb’s hacking activities at that time. See footnotes 18 and 19 of this opinion. Most pertinent to our analysis is the decision of our Supreme Court in Demond v. Project Service, LLC, 331 Conn. 816, 208 A.3d 626 (2019), wherein the court con- sidered the issue of third-party liability in relation to the Restatement (Second) of Torts and § 324 A, specifi- cally. In Demond, the defendant company had con- tracted with the Department of Transportation to main- tain a service plaza. Id., 820. When an individual, living out of his vehicle at the service plaza, consumed a large amount of alcohol and then caused a multivehicle crash on Interstate 395, the victims brought suit against the defendant company and other entities that had con- tracted to maintain and operate the service plaza. Id., 820, 824 and n.5. In that contract, the defendant com- pany had agreed not to allow the consumption of alco- hol or loitering at the service plaza. Id. The victims alleged, inter alia, that the defendant company had ‘‘breached a duty owed to passing motorists, arising under § 324A of the Restatement (Second), to protect them from the increased risk of harm created by the defendants’ failure to perform their contractual obliga- tions.’’ Id., 820–21. The defendant company argued that ‘‘[its] contractual undertaking to prohibit loitering and alcohol consumption at the service plaza did not create Page 30 CONNECTICUT LAW JOURNAL 0, 0

32 ,0 0 Conn. App. 1 Doe v. Lamb

a duty to third-party motorists injured off the service plaza premises by a drunk driver who became intoxi- cated at the service plaza . . . .’’ Id., 822. In determining whether the defendant company owed such a duty, our Supreme Court first noted the ‘‘estab- lished principl[e] of Connecticut negligence law’’ that ‘‘a person typically has no duty of care to protect third persons from harm caused by a primary tortfeasor, or to control the conduct of that tortfeasor, unless there is a special relationship between the defendant and either the third person or the tortfeasor, or other excep- tional circumstances exist.’’26 Id., 835–36. Reflecting on the nature of legal duty, generally, the court remarked that, ‘‘[d]ue to the increasingly interdependent nature of our social lives today, in which many institutional and other caretaking or custodial roles exist as a matter of course, relationships giving rise to such a duty of care are not uncommon, but it still is important to keep in mind that a duty of care does not exist in the air, and caution must be exercised to ensure that a special relationship or other factors give rise to such a duty before negligence liability can be imposed for harm caused to a third person.’’ Id., 836–37. In concluding that the defendant had no duty to third- party motorists, the court nevertheless rejected the defense theory that the duty arising out of § 324 A of the Restatement (Second) was strictly circumscribed by the terms of the underlying contract. Id., 842–43. The court, however, also rejected the ‘‘pure foreseeability’’ 26 As the court in Demond noted, there are situations in which our courts have recognized a special relationship that can give rise to a duty to third parties. See Demond v. Project Service, LLC, supra, 331 Conn. 836; see also, e.g., Doe v. Boy Scouts of America Corp., 323 Conn. 303, 323–25, 147 A.3d 104 (2016) (affirmative duty of care to protect minor participants from sexual abuse by patrol leader); Murdock v. Croughwell, 268 Conn. 559, 566, 848 A.2d 363 (2004) (special relationship of custody or control may give rise to duty to protect third person from conduct of another). 0, 0 CONNECTICUT LAW JOURNAL Page 31

0 Conn. App. 1 ,0 33 Doe v. Lamb

model advanced by the plaintiffs in Demond. Id., 844–45. It observed that the ‘‘foreseeability reference in § 324A is not free-floating but instead is anchored to the reason- able expectations of the undertaking party . . . . [T]he undertaking party not only will assume duties to third parties expressly set forth in the contract itself, as well as pass-through duties owed by the hiring party that are assigned or transferred to the undertaking party, but also will assume a duty of care to protect third parties from foreseeable, physical harm within the scope of the services to be performed.’’ (Citation omit- ted; emphasis altered.) Id., 845–46. Having circumscribed the pure foreseeability analysis with the requirement that foreseeable harm must be contemplated by the scope of services rendered, the court undertook a public policy analysis of the plaintiff’s claim. In so doing, it emphasized that ‘‘the duty analysis under § 324A of the Restatement (Second) remains sub- ject to policy based limitations.’’ Id., 848. The court then reasoned: ‘‘Because Connecticut common law clearly establishes a rule of nonliability in this context, the plaintiffs were required to demonstrate that the parties to the undertaking had an actual intention to protect motorists when they included the no alcohol/no loiter- ing provisions in the [contract]. On this record, no rea- sonable fact finder could conclude that the parties to the [contract] had such a specific intent.’’ Id., 853. Because its analysis of § 324 A of the Restatement (Second) focused on duty to third parties based on contract, rather than duty to third parties arising from a gratuitous promise, Demond affords limited guidance as applied to this case. While Demond recognized that § 324 A expressly contemplates gratuitous undertak- ings, it did not consider the applicability of the Restatement (Second) in the context of a general assurance made to law enforcement, as opposed to a specific promise that is commercial in nature. Because the plaintiffs have Page 32 CONNECTICUT LAW JOURNAL 0, 0

34 ,0 0 Conn. App. 1 Doe v. Lamb

provided us with no authority, nor have we found any, in which a court has applied § 324 A to such general assurances to law enforcement, we are not persuaded that the analysis in Demond should control.27 At the same time, we reiterate that Demond under- scored two principles that remain relevant to our analy- sis, irrespective of whether § 324 A of the Restatement (Second) applies; that is, foreseeability of harm and whether public policy countenances the expansion of liability to third parties under the circumstances of this case.28 We reiterate that, ‘‘if it is not foreseeable to a reasonable person in the defendant’s position that harm of the type alleged would result from the defendant’s actions to a particular plaintiff, the question of the exis- tence of a duty to use due care is foreclosed, and no cause of action can be maintained by the plaintiff.’’ (Internal quotation marks omitted.) Fraser v. United States, supra, 236 Conn. 633. Here, the defendant issued a gratuitous, unsolicited series of statements, via email, 27 See, e.g., Gazo v. Stamford, 255 Conn. 245, 250–51, 765 A.2d 505 (2001) (defendant company that contracted to remove snow had duty of care to pedestrian plaintiff injured due to negligent performance); Sweeney v. Friends of Hammonasset, 140 Conn. App. 40, 49, 58 A.3d 293 (2013) (‘‘[§] 324 A does not apply because . . . the plaintiff in the present action does not allege that the defendants owed him a duty based upon their arrangement with a third party to render certain services’’ (internal quotation marks omitted)); Carrico v. Mill Rock Leasing, LLC, 199 Conn. App. 252, 264–65, 235 A.3d 626 (2020) (holding that § 324 A imposed duty of care on defendant who rendered snow removal services to third party pursuant to agreement in commercial context); Clay Electric Cooperative, Inc. v. Johnson, 873 So. 2d 1182, 1186 (Fla. 2003) (under § 324 A, commercial electricity provider assumed duty of care with respect to plaintiffs killed as result of company’s negligent performance of contract to maintain streetlights). 28 We note that § 324 A of the Restatement (Second) contains two caveats, the first of which provides that the American Law Institute ‘‘expresses no opinion as to whether . . . (1) the making of a contract or a gratuitous promise, without in any way entering upon performance, is a sufficient undertaking to result in liability under the rule stated in this [s]ection . . . .’’ 2 Restatement (Second), supra, § 324 A, caveat (1), p. 142. At times, the plaintiffs seem to allege that the defendant made promises that she did not keep. 0, 0 CONNECTICUT LAW JOURNAL Page 33

0 Conn. App. 1 ,0 35 Doe v. Lamb

that represented to law enforcement both what she had already done as well as what she was intending to do in order to prevent future hacking attempts from occurring through her Internet service provider. We cannot conclude that a reasonable person in the defen- dant’s position could foresee that such activity, albeit inappropriate, would result in the kind of harm alleged here. Although the defendant admittedly provided Lamb with a Mac computer and Internet service at the family home beginning in 2012, there is no genuine issue of material fact that she did not learn of the defendant’s hacking activities until sometime in 2015 or 2016; see footnote 18 of this opinion; and did not learn that he had stolen photographs of nude females from the hacked accounts or posted them online until after that conduct had ceased. In our view, the mere act of providing a computer or Internet service to an adult child does not make such criminal conduct reasonably foreseeable. As the trial court stated at oral argument on the defendant’s first motion for summary judgment, ‘‘[i]f [a party such as the defendant] knows what [her son is] going to do, and . . . he says, I’m gonna go run some- body over, and she says, here, take the keys to my car. That’s easy, right? The law can reach out and touch her for that. But in this instance, she knows that somebody’s doing something potentially harmful to someone else. . . . [T]here’s a level of complicity that is lacking here.’’ Noting the contrast to the situation presented by this case, the court wrote that ‘‘it is not at all foreseeable that allowing a person to use one’s Internet services will lead to that individual hacking into another’s social media accounts in order to obtain intimate pictures to post on the Internet. The causal connection between those two activities is simply too attenuated for this court to determine that the defendant had a duty to protect [Jane Doe 2] from potential harm.’’ Given the Page 34 CONNECTICUT LAW JOURNAL 0, 0

36 ,0 0 Conn. App. 1 Doe v. Lamb

pertinent legal principles, applied to the factual sce- nario presented by this case, we agree with the court’s determination that Lamb’s actions were not reasonably foreseeable by the defendant. B We next consider whether public policy considera- tions compel the conclusion that the defendant’s actions in this case give rise to a duty of care to the plaintiffs. ‘‘With respect to the second inquiry, namely, the policy analysis, there generally is no duty that obli- gates one party to aid or to protect another party. . . . One exception to this general rule arises when a definite relationship between the parties is of such a character that public policy justifies the imposition of a duty to aid or to protect another.’’ (Citation omitted.) Ryan Transportation, Inc. v. M & G Associates, 266 Conn. 520, 526, 832 A.2d 1180 (2003). ‘‘In delineating more precisely the parameters of this limited exception to the general rule, [our Supreme Court] has concluded that, [in the absence of] a special relationship of cus- tody or control, there is no duty to protect a third person . . . .’’ (Emphasis in original; internal quotation marks omitted.) Grenier v. Commissioner of Transportation, supra, 306 Conn. 539–40. ‘‘[I]n considering whether public policy suggests the imposition of a duty, we . . . consider the following four factors: (1) the normal expectations of the partici- pants in the activity under review; (2) the public policy of encouraging participation in the activity, while weighing the safety of the participants; (3) the avoid- ance of increased litigation; and (4) the decisions of other jurisdictions.’’ (Internal quotation marks omitted.) Ruiz v. Victory Properties, LLC, supra, 315 Conn. 337. In Ryan Transportation, Inc., our Supreme Court rejected a theory that cotenants have a special relation- ship that gives rise to a duty to protect against injuries 0, 0 CONNECTICUT LAW JOURNAL Page 35

0 Conn. App. 1 ,0 37 Doe v. Lamb

to a fellow tenant, noting that, ‘‘under certain circum- stances, landlords may have a duty to take affirmative action to protect tenants and their guests from the crimi- nal conduct of third parties’’ but that this duty does not extend to cotenants. Ryan Transportation, Inc. v. M & G Associates, supra, 266 Conn. 527; id. (duty of landlord is ‘‘limited to areas of the leasehold over which the landlord has exclusive control or to situations in which the landlord has the exclusive ability to prevent the unlawful conduct’’). The scenario presented in Ryan Transportation, Inc., involved two commercial tenants of a property, one of which had knowledge of an arson attempt on the property the day before an unknown arsonist successfully destroyed the entire building. Id., 523. The court upheld the granting of summary judg- ment in that case, noting that there was nothing in the record to suggest that the party granted summary judgment exercised any control or superior ability to protect the other tenant of the property. See id., 528; see also Gomes v. Commercial Union Ins. Co., 258 Conn. 603, 616, 783 A.2d 462 (2001) (concluding that no duty existed where there was ‘‘no overriding public policy or statute that compels [the] court to extend liability based on the facts of the present case’’). The plaintiffs argue that ‘‘[c]onsiderations of public policy weigh strongly in favor of recognizing the defen- dant’s duty in these circumstances’’ because there is a general interest in reporting and preventing criminal activity. Pointing to statutes that criminalize misuse of computers, as well as prohibitions against ‘‘cyberbully- ing,’’ the plaintiffs urge us to expand our common-law framework, adapting it to the modern computer age. The plaintiffs further argue that the four factors we must deploy in analyzing the facts of this case—(1) the normal expectations of the participants in the activity under review; (2) the public policy of encouraging par- ticipation in the activity, while weighing the safety of Page 36 CONNECTICUT LAW JOURNAL 0, 0

38 ,0 0 Conn. App. 1 Doe v. Lamb

the participants; (3) the avoidance of increased litiga- tion; and (4) the decisions of courts in other jurisdic- tions—all weigh in favor of recognizing a duty on the part of the defendant in this case. The defendant count- ers that imposing a duty of care on her would violate public policy by ‘‘exposing individuals responsible for maintaining an Internet connection to liability for the intentional criminal conduct of one who uses an elec- tronic device to access that Internet connection.’’ First, the normal expectations of the parties, under the facts of this case, weigh against establishing a duty of care. There are strong presumptions against impos- ing liability on a parent for an adult child’s acts.29 ‘‘At common law, the torts of children do not impose vicari- ous liability upon parents qua parents, although paren- tal liability may be created by statute; see General Stat- utes § 52-572; or by independently negligent behavior on the part of parents.’’ (Footnote omitted.) Kaminski v. Fairfield, 216 Conn. 29, 34, 578 A.2d 1048 (1990); Adams v. Aircraft Spruce & Specialty Co., 215 Conn. App. 428, 442 n.9, 283 A.3d 42 (‘‘[a]lthough parents are deemed to have a special relationship with their minor children from which a duty of care to them and others may arise . . . with limited exceptions . . . no such duty exists between parents and their emancipated adult children’’ (citation omitted; emphasis in original)), cert. denied, 345 Conn. 970, 286 A.3d 448 (2022). Few adults would likely expect to be held liable for such activity on the part of their adult child. Relatedly, there is a strong public policy interest in maintaining wide- spread access to the Internet. Requiring that a person who provides Internet service to other adults be held responsible for the criminal misuse of that service does 29 We emphasize that the specific claim raised in this appeal is not confined to the familial context. Because the facts of this case arose in the context of a parental relationship, we simply note certain well established precepts regarding liability in that context. 0, 0 CONNECTICUT LAW JOURNAL Page 37

0 Conn. App. 1 ,0 39 Doe v. Lamb

not, it seems to us, fall within the normal expectations of individuals in Connecticut. Second, any benefit that might accrue from recogniz- ing a public policy of encouraging parents to monitor their adult children’s Internet usage under such circum- stances cannot be counterbalanced by the practical dif- ficulties inherent in taking on such a task. For example, where a user of the Internet has more knowledge than the owner of the electronic devices or Internet service, hiding criminal activity is likely to be fairly simple, and detection unlikely. Third, were we to conclude that there is a duty of care owed to the plaintiffs on the facts of this case, there can be little doubt that recognizing a duty under these circumstances would increase litigation. The plaintiffs argue that they are seeking the ‘‘application of established legal principles’’ rather than novel causes of action. According to this logic, this case would not ‘‘open the door to an entirely new category of claims . . . .’’ (Internal quotation marks omitted.) We disagree with this assumption. As demonstrated by the foregoing discussion, the plaintiffs ask us to adapt common-law principles to a modern scenario—going beyond the cur- rent state of the law toward something new. The risk of creating additional litigation is very high in such an endeavor. As the defendant points out, and as we have already stated, the plaintiffs’ argument leads to the pos- sibility that anyone who purchases and controls an Internet connection could theoretically become liable for damages to a third party that are caused by the criminal activity of another person who uses that Internet access.30 30 The plaintiffs argue that the present matter is ‘‘sui generis’’ in that the ‘‘underlying conduct occurred nearly a decade ago, well before Wi-Fi Internet grew to become accessible in public places, including supermarkets, coffee shops, restaurants, arenas, theaters, and numerous other locations that are openly accessible. . . . Back then, Lamb was dependent upon both the defendant’s Internet connection, and the devices she controlled, in order to access the Internet and deploy the hacking scheme. . . . Because modern Page 38 CONNECTICUT LAW JOURNAL 0, 0

40 ,0 0 Conn. App. 1 Doe v. Lamb

Last, the decisions of courts in other jurisdictions also inform our analysis. The plaintiffs argue that New Jersey courts ‘‘recognized and applied a duty to monitor Internet usage’’ in Doe v. XYC Corp., 382 N.J. Super. 122, 887 A.2d 1156 (App. Div. 2005). XYC Corp. involved an employer that had actual or imputed knowledge that an employee was viewing child pornography material on his work computer. See id., 140. The Appellate Divi- sion of the Superior Court of New Jersey concluded that the employer had a duty to act by either terminating the employee or reporting his criminal activity to law enforcement—or both. See id. The court grounded its conclusion on public policy concerns. Under New Jer- sey law, whether public policy imposes a duty hinges on whether the imposition of a duty ‘‘satisfies an abiding sense of basic fairness under all of the circumstances in light of considerations of public policy.’’ Id., 140–41. Specifically, the public policy analysis involves, ‘‘identi- fying, weighing, and balancing several factors—the rela- tionship of the parties, the nature of the attendant risk, the opportunity and ability to exercise care, and the public interest in the proposed solution.’’ Id., 141. Not- ing the fact that public policy clearly favors exposing and penalizing crimes such as child pornography, the court also considered the Restatement (Second) of Torts. See id., 141–42. Because the matter involved an technology would allow for Internet access in numerous locations outside of one’s residence, the fact pattern presented in this case would not arise today. . . . Since the circumstances dictate that this is a singular case, no increased litigation will result from recognizing a duty in this specific instance.’’ (Citations omitted.) We disagree with that contention. Residential Internet service is commonplace in the United States. See, e.g., Ashcroft v. American Civil Liberties Union, 535 U.S. 564, 567, 122 S. Ct. 1700, 152 L. Ed. 2d 771 (2002) (‘‘access to the Internet is widely available in homes . . . across the country’’). The fact that ‘‘Internet access is [also] widely available at locations other than one’s home’’; United States v. Miller, 665 F.3d 114, 133 (5th Cir. 2011), cert. denied, 567 U.S. 918, 132 S. Ct. 2773, 183 L. Ed. 2d 643 (2012); does not convince us that criminal hacking activity like that at issue in this case is unlikely to occur through residential Internet service. 0, 0 CONNECTICUT LAW JOURNAL Page 39

0 Conn. App. 1 ,0 41 Doe v. Lamb

employer-employee relationship, the court relied in part on § 317 and determined that the employer had a duty, under that provision of the Restatement (Second) as well as under New Jersey law, to ‘‘control’’ its employee when that employee is ‘‘acting outside the scope of his employment’’ in order to ‘‘prevent the [employee] from intentionally harming others or from so conducting him- self as to create an unreasonable risk of bodily harm to [others].’’31 (Internal quotation marks omitted.) Id., 141.

XYC Corp. is thus readily distinguishable from the present scenario. The court in that case imposed a duty on an employer that had actual or imputed knowledge of an employee’s criminal conduct. The employer- employee relationship is a unique one—having roots in different areas of the common law and giving rise to different provisions of the Restatement (Second). Broadly, the plaintiffs are correct that XYC Corp. stands for the proposition that ‘‘a defendant can undertake an obligation to monitor the activities of another which will give rise to a duty to act to prevent harm to others.’’ We cannot, however, agree with the plaintiffs that the defendant in this case ‘‘took on a policy’’ of supervising Lamb that is analogous to an employer who undertakes to supervise employees while they perform their job duties. Put simply, there is no special relationship akin to that of employer-employee that would give rise to a similar duty under the facts of this case. 31 Section 317 of the Restatement (Second) of Torts provides: ‘‘A master is under a duty to exercise reasonable care so to control his servant while acting outside the scope of his employment as to prevent him from intention- ally harming others or from so conducting himself as to create an unreason- able risk of bodily harm to them, if (a) the servant (i) is upon the premises in possession of the master or upon which the servant is privileged to enter only as his servant, or (ii) is using a chattel of the master, and (b) the master (i) knows or has reason to know that he has the ability to control his servant, and (ii) knows or should know of the necessity and opportunity for exercising such control.’’ 2 Restatement (Second), supra, § 317, p. 125. Page 40 CONNECTICUT LAW JOURNAL 0, 0

42 ,0 0 Conn. App. 1 Doe v. Lamb

The plaintiffs also look to a California appellate court decision to buttress their argument that we should rec- ognize a duty arising out of the defendant’s conduct. In another tragic case, family members of the victims of a nineteen year old shooter who lived with his parents appealed from the granting of summary judgment ren- dered in favor of the parents in a negligence action the family members had brought against the parents. See Smith v. Freund, 192 Cal. App. 4th 466, 121 Cal. Rptr. 3d 427 (2011), review denied, California Supreme Court, Docket No. S191439 (May 11, 2011). The California Court of Appeal held that the parents did not owe a duty to third parties because the shooter’s violent acts were not foreseeable. Although the shooter had signifi- cant mental health related issues, he had no violent history toward third parties prior to the shooting. Id., 474–75. Noting that the family members had claimed that a special relationship between the parents and the shooter was the basis of the purported duty, the court stated that, ‘‘[w]hen deciding whether a duty of care arose from a special relationship, a court should con- sider pertinent factors, including foreseeability of harm to the plaintiff, the degree of certainty that the plaintiff suffered injury, the closeness of the connection between the defendant’s conduct and the injury suf- fered, the moral blame attached to the defendant’s con- duct, the policy of preventing future harm, the extent of the burden to the defendant and consequences to the community of imposing a duty to exercise care with resulting liability for breach, and the availability, cost, and prevalence of insurance for the risk involved.’’ (Internal quotation marks omitted.) Id., 473. The family members contended that the parents had undertaken a duty to monitor the shooter’s medication usage, in part, to protect third parties, under § 324 A of the Restatement (Second).32 Id., 473 n.4. 32 We note that the court in Freund concluded the public policy analysis by stating that ‘‘[a]ny connection between [the parents’] conduct and the shootings is speculative. [The parents’] conduct amounted to this: [T]hey 0, 0 CONNECTICUT LAW JOURNAL Page 41

0 Conn. App. 1 ,0 43 Doe v. Lamb

The plaintiffs argue that, unlike the parents of the shooter in Freund, the defendant had ‘‘learned directly from Lamb that he had engaged in multiple instances of illegal conduct that had been reported to the defen- dant by the state police.’’ Acknowledging that foresee- ability was absent in Freund, the plaintiffs argue that ‘‘the defendant had every reason to know that the moni- toring services she had agreed to perform were directly tailored to Lamb’s admitted misconduct and the harm that would result when he resumed hacking after realiz- ing that the defendant’s monitoring efforts were defi- cient.’’ Important to our analysis, however, is the fact that the plaintiffs, in opposing the motions for summary judgment, submitted no evidence indicating that the extent of Lamb’s activity, as well as its precise nature, was known to the defendant. See Smith v. Freund, supra, 192 Cal. App. 4th 473; see also Regions Bank v. Joyce Meyer Ministries, Inc., 15 N.E.3d 545, 549 (Ill. App.) (‘‘[i]n Illinois, [the voluntary undertaking excep- tion] has been narrowly construed and duty imposed is limited by the extent of the undertaking’’), appeal denied, 21 N.E.3d 718 (2014).

In light of the foregoing analysis as to the foreseeabil- ity of Lamb’s conduct, in combination with the public policy interests that weigh against the imposition of a legal duty, the plaintiffs’ claim that the defendant allowed [the shooter] to live in their home, attended therapy sessions with him, monitored his medicine compliance, and reported to the doctors as requested. To impose a duty of care on [the parents] could cause greater harm in future cases by encouraging parents to disassociate from their adult children with chronic serious problems.’’ Smith v. Freund, supra, 192 Cal. App. 4th 475. The defendant in the present case is similarly situated—having provided Internet access and food and lodging to her adult son who was clearly struggling. Although the defendant did have actual knowledge, at some point in 2015 or 2016; see footnote 18 of this opinion; that Lamb had engaged in ‘‘hacking,’’ the trial court concluded, and we agree, that such knowledge did not make the entirety of his subsequent criminal activity foreseeable. Page 42 CONNECTICUT LAW JOURNAL 0, 0

44 ,0 0 Conn. App. 1 Doe v. Lamb

voluntarily assumed a duty of care to the plaintiffs must fail. II The plaintiffs next claim that the defendant owed a general duty of care, ‘‘stemming from her affirmative conduct,’’ such that the trial court improperly granted the first and second motions for summary judgment. According to the plaintiffs, the defendant’s actions were an attempt at ‘‘placating law enforcement with promises of ongoing monitoring and supervision,’’ which she then followed through with ‘‘in a profoundly unsatisfactory way.’’33 Similar to the plaintiffs’ first claim discussed in part I of this opinion, the core guiding principle in a general duty analysis has always been whether the spe- cific harm alleged was foreseeable by the defendant. 33 Relatedly, the plaintiffs also argue that ‘‘[l]iability can be incurred where, as here, ‘the risk created by the defendant’s negligence included the hazard that the defendant’s conduct would induce a third party to commit such an act.’ See Snell v. Norwalk Yellow Cab, Inc., 332 Conn. 720, [760], 212 A.3d 646 (2019).’’ In Snell, our Supreme Court determined that the superseding cause doctrine applies to criminally reckless conduct, affirming this court’s determination that the trial court had correctly applied the doctrine of superseding cause. See id., 724. The facts in Snell were as follows: A taxicab driver left his keys in his unlocked vehicle, and two teenagers took the taxicab on a ‘‘ ‘joyride.’ ’’ The taxicab collided with another vehicle before striking and injuring the plaintiff, a pedestrian, after which the teenagers attempted to flee the scene. Id., 724–25. Our Supreme Court explained that ‘‘the superseding cause doctrine has been applied historically to any independent, intervening force that a defendant claims was the sole proxi- mate cause of a plaintiff’s injury.’’ Id., 753. In Snell, the parties did not dispute the existence of a duty, arguing only the issue of causality. Id., 743. As our Supreme Court explained, however, ‘‘when a defendant claims that an independent intervening force superseded his own negligence, the ques- tion of legal causation is practically indistinguishable from an analysis of the extent of the tortfeasor’s duty to the plaintiff.’’ (Internal quotation marks omitted.) Id., 743 n.9. In determining whether a duty exists, ‘‘our threshold inquiry has always been whether the specific harm alleged by the plaintiff was foreseeable to the defendant . . . which is the same inquiry a jury makes in deciding whether a defendant’s actions were the proximate cause of the harm.’’ (Citation omitted; internal quotation marks omitted.) Id. This argument, then, merges with the broader argument raised by the plaintiffs with respect to the issue of foreseeability. 0, 0 CONNECTICUT LAW JOURNAL Page 43

0 Conn. App. 1 ,0 45 Doe v. Lamb

In support of their contention that the defendant owed a general duty of care, the plaintiffs rely on §§ 302, 302 B and 449 of the Restatement (Second) of Torts, as well as Doe v. Saint Francis Hospital & Medical Center, 309 Conn. 146, 72 A.3d 929 (2013). The plaintiffs argue that the defendant’s affirmative actions ‘‘encouraged Lamb to resume this harmful conduct,’’ which brought the harms suffered by the plaintiffs within the scope of the risk created by the defendant’s negligent con- duct.34 The plaintiffs also contend that public policy demands accountability for the defendant’s actions ‘‘under the unique facts of this case.’’ The defendant does not address the plaintiffs’ argu- ment that §§ 302, 302 B and 449 of the Restatement (Second) are applicable to the facts of this case, nor does she argue the applicable case law with respect to these provisions. The defendant simply contends that the plaintiffs’ attempt to ‘‘extend a duty to a third party based on the intentional criminal acts of another’’ has ‘‘no basis in law or public policy . . . .’’ We agree with the defendant. As an initial matter, we note that the plaintiffs acknowledge that their argument, like their previous claim addressed in part I of this opinion, ‘‘is not suscep- tible to a universal test,’’ and the ‘‘primary consider- ation’’ is whether the specific harm alleged was foresee- able by the defendant with the ‘‘second’’ question being whether public policy should impose responsibility on the defendant for her allegedly negligent conduct. This claim, then, follows the same analytical framework as 34 The plaintiffs contend, more specifically, that the trial court improperly rendered summary judgment on counts ten, twenty-two, thirty-four, and forty-six of their operative complaint. These claims pertain to the defendant’s supervision of Lamb, alleging that the defendant knew or should have known that Lamb was engaged in hacking activities with respect to each of the plaintiffs, and that she knew or should have known that Lamb was not competent enough to be left unsupervised with access to the Internet. Page 44 CONNECTICUT LAW JOURNAL 0, 0

46 ,0 0 Conn. App. 1 Doe v. Lamb

the first claim. Accordingly, we incorporate much of our analysis with respect to both the foreseeability of Lamb’s actions as well as the public policy interests at play in our evaluation of the propriety of expanding the law to create a novel duty. A We first consider the question of whether Lamb’s criminal actions were reasonably foreseeable by the defendant. The following legal principles are relevant to the plaintiffs’ claim. A general duty analysis begins with asking whether an ordinary person in the defen- dant’s position, knowing what the defendant knew or should have known, would anticipate that harm of the general nature as that suffered by the plaintiff was likely to result. See, e.g., Ruiz v. Victory Properties, LLC, supra, 315 Conn. 328–29. ‘‘The idea of risk in this context necessarily involves a recognizable danger, based upon some knowledge of the existing facts, and some reason- able belief that harm may possibly follow. . . . Accord- ingly, the fact finder must consider whether the defen- dant knew, or should have known, that the situation at hand would obviously and naturally, even though not necessarily, expose [the plaintiff] to probable injury unless preventive measures were taken.’’ (Citations omitted; internal quotation marks omitted.) LePage v. Horne, 262 Conn. 116, 124, 809 A.2d 505 (2002). Titled ‘‘risk of direct or indirect harm,’’ § 302 of the Restatement (Second) provides that ‘‘[a] negligent act or omission may be one which involves an unreasonable risk of harm to another through either (a) the continu- ous operation of a force started or continued by the act or omission, or (b) the foreseeable action of the other, a third person, an animal, or a force of nature.’’ 2 Restatement (Second), supra, § 302, p. 82. As its com- mentary makes clear, this section is ‘‘concerned only with the negligent character of the actor’s conduct, and 0, 0 CONNECTICUT LAW JOURNAL Page 45

0 Conn. App. 1 ,0 47 Doe v. Lamb

not with his duty to avoid the unreasonable risk.’’ Id., comment (a). Most importantly, ‘‘[i]f the actor is under no duty to the other to act, his failure to do so may be negligent conduct within the rule stated in this [s]ection, but it does not subject him to liability, because of the absence of duty.’’ Id. Section 302 B provides that ‘‘[a]n act or an omission may be negligent if the actor realizes or should realize that it involves an unreasonable risk of harm to another through the conduct of the other or a third person which is intended to cause harm, even though such conduct is criminal.’’ 2 Restatement (Second), supra, § 302 B, p. 88. As comment (d) to § 302 B explains, ‘‘[n]ormally the actor has much less reason to anticipate intentional misconduct than he has to anticipate negligence. In the ordinary case he may reasonably proceed upon the assumption that others will not interfere in a manner intended to cause harm to anyone. This is true particu- larly where the intentional conduct is a crime, since under ordinary circumstances it may reasonably be assumed that no one will violate the criminal law. Even where there is a recognizable possibility of the inten- tional interference, the possibility may be so slight, or there may be so slight a risk of foreseeable harm to another as a result of the interference, that a reasonable man in the position of the actor would disregard it.’’35 Id., comment (d), p. 89. The plaintiffs also rely on § 449, which provides, ‘‘[i]f the likelihood that a third person may act in a particular 35 As our Supreme Court has stated, ‘‘[b]ecause §§ 302 B and 449 of the Restatement (Second) are closely related, the comments to § 449 expressly direct that that section is to be read in conjunction with § 302 B. See 2 Restatement (Second), supra, § 449, comment (a), p. 482 (‘[t]his [s]ection should be read together with § 302 B, and the [c]omments to that [s]ection, which deal with the foreseeable likelihood of the intentional or even criminal misconduct of a third person as a hazard which makes the actor’s conduct negligent’).’’ Doe v. Saint Francis Hospital & Medical Center, supra, 309 Conn. 175 n.21. Page 46 CONNECTICUT LAW JOURNAL 0, 0

48 ,0 0 Conn. App. 1 Doe v. Lamb

manner is the hazard or one of the hazards which makes the actor negligent, such an act whether innocent, negli- gent, intentionally tortious, or criminal does not prevent the actor from being liable for harm caused thereby.’’ 2 Restatement (Second), supra, § 449, p. 482. As comment (a) to § 449 makes clear, ‘‘[t]his [s]ection should be read together with § 302 B, and the [c]omments to that [s]ection, which deal with the foreseeable likelihood of the intentional or even criminal misconduct of a third person as a hazard which makes the actor’s conduct negligent. As is there stated, the mere possibility or even likelihood that there may be such misconduct is not in all cases sufficient to characterize the actor’s conduct as negligence. It is only where the actor is under a duty to the other, because of some relation between them, to protect him against such misconduct, or where the actor has undertaken the obligation of doing so, or his conduct has created or increased the risk of harm through the misconduct, that he becomes negligent.’’ (Emphasis added.) Id., comment (a), pp. 482–83.36 As our Supreme Court has observed, ‘‘[a]n exception to the general rule that one has no legal obligation to 36 As the commentary to these two rules makes clear, the rules are focused on the negligent character of an actor’s conduct—not the duty to avoid unreasonable risk. Comment (a) to § 302 provides, additionally, that, ‘‘[i]n general, anyone who does an affirmative act is under a duty to others to exercise the care of a reasonable man to protect them against an unreason- able risk of harm to them arising out of the act. The duties of one who merely omits to act are more restricted, and in general are confined to situations where there is a special relation between the actor and the other which gives rise to the duty. As to the distinction between act and omission, or ‘misfeasance’ and ‘non-feasance,’ see § 314 and [c]omments. If the actor is under no duty to the other to act, his failure to do so may be negligent conduct within the rule stated in this [s]ection, but it does not subject him to liability, because of the absence of duty.’’ 2 Restatement (Second), supra, § 302, comment (a), p. 82. The commentary to § 302 B similarly notes that ‘‘[t]his section is a special application of the rule stated in [c]lause (b) of § 302. Comment [(a)] to that [s]ection is equally applicable here.’’ 2 Restatement (Second), supra, § 302 B, comment (a), p. 89. 0, 0 CONNECTICUT LAW JOURNAL Page 47

0 Conn. App. 1 ,0 49 Doe v. Lamb

protect another may arise when the defendant’s own conduct creates or increases the foreseeable risk that such other person will be harmed by the conduct of a third party, including the foreseeable criminal conduct of that third party. . . . [T]his exception . . . is set forth in §§ 302 B and 449 of the Restatement (Second) [of Torts] . . . .’’ (Footnote omitted.) Doe v. Saint Francis Hospital & Medical Center, supra, 309 Conn. 175–76. The issue in that case was the duty that a hospi- tal undertakes with regard to children who are under its care. Our Supreme Court explained that, as a general matter, Connecticut law does not require a defendant to ‘‘anticipat[e] the intentional misconduct of a third party . . . unless the defendant knows or has reason to know of the third party’s criminal propensity. The criminal misconduct of a third party may be foreseeable under the facts of a particular case, however, without a showing that the defendant had such actual or con- structive knowledge of the third party’s criminal pro- pensity. . . . [W]hen a defendant’s conduct creates or increases the risk of a particular harm and is a substan- tial factor in causing that harm, or when the defendant otherwise has a legally cognizable duty to aid or protect another person, the fact that the harm is brought about by the actions of a third party does not relieve the defendant of liability, even though the third party’s conduct is criminal, if the harm that occurred is within the scope of the risk created by the defendant’s conduct or reasonably could have been anticipated in light of the defendant’s duty to protect. Thus, when the harm resulting from the criminal misconduct of a third party is foreseeable in view of the facts and circumstances presented, there is no reason why the injured party should nevertheless be required to establish that the defendant had actual or constructive knowledge of the third party’s criminal propensity.’’ (Citation omitted; emphasis in original.) Id., 172–73. In other words, ‘‘proof Page 48 CONNECTICUT LAW JOURNAL 0, 0

50 ,0 0 Conn. App. 1 Doe v. Lamb

of actual or constructive knowledge of propensity is but one way to establish that the criminal misconduct of the third party was foreseeable.’’ Id., 173; see also Doe v. Hartford Roman Catholic Diocesan Corp., 317 Conn. 357, 379, 119 A.3d 462 (2015) (upholding jury verdict finding that religious organization negligently supervised priest who had known propensity to engage in molestation of children).37 The plaintiffs argue that there is at least a genuine issue of material fact with respect to whether the defen- dant had actual or constructive knowledge of the partic- ular conduct at issue here, specifically the full scope of Lamb’s criminal activity against these particular plaintiffs. They contend that the defendant’s own affir- mative conduct created or increased the risk of the particular harms that they suffered, and that the defen- dant’s conduct was a substantial factor in causing that harm. The plaintiffs argue that the defendant’s ‘‘affirma- tive acts’’ in the aftermath of the state police visit to her home—namely, her assurance to the police that she would supervise Lamb’s use of electronic devices and Internet services—gave rise to a duty of care that she owed to the plaintiffs and other similarly situated vic- tims.38 37 Our Supreme Court has addressed whether a psychotherapist has a duty to exercise control to prevent an outpatient—who was known to be dangerous—from ‘‘inflicting bodily harm on a victim who was neither readily identifiable nor within a foreseeable class of victims.’’ Fraser v. United States, supra, 236 Conn. 630. In concluding that the psychotherapist did not have a duty to exercise control over the outpatient, the court offered four reasons for this conclusion: (1) precedent did not establish a duty to unidenti- fiable victims; (2) related areas of the common law did not impose a duty to unidentifiable victims; (3) policy reasons specific to the relationship between a therapist and a patient cautioned against imposing such a duty of control; (4) the decisions of courts in other jurisdictions have declined to extend such a duty to unidentifiable third parties. See id., 632. Much of the reasoning of Fraser applies to the present case as well, because the plaintiffs were not identifiable to the defendant. 38 The plaintiffs argue that the trial court’s determination that the defendant and Lamb did not have a special relationship that would support the imposi- tion of a duty ‘‘misses the reality that the defendant owed a duty of care 0, 0 CONNECTICUT LAW JOURNAL Page 49

0 Conn. App. 1 ,0 51 Doe v. Lamb

In support of these contentions, the plaintiffs point to comment (f) to § 302 B of the Restatement (Second) of Torts. Comment (f) provides: ‘‘It is not possible to state definite rules as to when the actor is required to take precautions against intentional or criminal miscon- duct. As in other cases of negligence . . . it is a matter of balancing the magnitude of the risk against the utility of the actor’s conduct. Factors to be considered are the known character, past conduct, and tendencies of the person whose intentional conduct causes the harm, the temptation or opportunity which the situation may afford him for such misconduct, the gravity of the harm which may result, and the possibility that some other person will assume the responsibility for preventing the conduct or the harm, together with the burden of the precautions which the actor would be required to take. Where the risk is relatively slight in comparison with the utility of the actor’s conduct, he may be under no obligation to protect the other against it.’’ (Citation omitted.) 2 Restatement (Second), supra, § 302 B, com- ment (f), p. 93. We acknowledge that the harm perpetrated on the plaintiffs in this case was extreme—but the gravity of the harm is not the only factor that we are required to consider. With respect to whether the defendant was aware of Lamb’s ‘‘ ‘past conduct,’ ’’ the plaintiffs argue that, because Lamb had admitted to the defendant that he had engaged in hacking activities following the police visit in 2015, she therefore ‘‘easily was aware’’ that Lamb would have the ‘‘ ‘temptation [and] opportunity’ ’’ to resulting from her own ‘affirmative conduct’ in hiding Lamb’s illegal hacking under the guise of her ongoing monitoring and supervision.’’ Citing to the various provisions of the Restatement discussed previously in part II of this opinion, the plaintiffs then argue that the defendant ‘‘may be liable for the intentional conduct of a third person when such acts are ‘within the scope of the risk created by the [defendant’s] conduct.’ ’’ The plaintiffs further reference Doe v. Saint Francis Hospital & Medical Center, supra, 309 Conn. 146, in support of this proposition. Page 50 CONNECTICUT LAW JOURNAL 0, 0

52 ,0 0 Conn. App. 1 Doe v. Lamb

engage in the same behavior. Although it is true that Lamb admitted engaging in such conduct to the defen- dant, there also is no evidence in the materials submit- ted in connection with the motions for summary judg- ment that the defendant was aware that Lamb had stolen photographs of nude females from the hacked accounts or posted them online until after that conduct had ceased.39 As Lamb stated in his January 3, 2019 statement to the police: ‘‘I didn’t . . . go into detail of what I was doing. I don’t think [the defendant] . . . she didn’t quite get what I was doing. I think that she thought, you know, I kind of tried to get into someone’s account for whatever reason or whatever, and then [she said] don’t do it again. . . . [She was] clearly mad, disappointed at me . . . but I don’t think—because I didn’t really explain it very well.’’ Lamb also told the police that, in retrospect, he ‘‘could have said more, gone into detail a little bit more of what [he] was doing so [the defendant] had a better understanding that . . . this wasn’t, like, a small thing . . . .’’ Under those par- ticular facts, which the plaintiffs have provided no evi- dentiary basis to dispute, we reject the plaintiffs’ con- tention that the defendant possessed knowledge that Lamb would be tempted or provided an opportunity for further misconduct of the kind that ultimately was discovered. The plaintiffs also argue that the defendant ‘‘knew that no other party would assume the responsibility for preventing the misconduct.’’ We cannot agree that the defendant knew that no one else would assume the responsibility for preventing Lamb’s misconduct when her home had been visited by the state police—who 39 Lamb stated that he did not tell the defendant that he needed help ‘‘because she didn’t quite get what I was doing. I think that she thought, you know, I kind of tried to get into someone’s account for whatever reason . . . . [I]t’s like, you know, don’t do it again. . . . [The defendant was] clearly mad, disappointed at me and stuff . . . .’’ 0, 0 CONNECTICUT LAW JOURNAL Page 51

0 Conn. App. 1 ,0 53 Doe v. Lamb

were investigating the misconduct. Under these circum- stances, and in the absence of any evidence that the defendant knew that Lamb had a known history of criminal computer use, we are not convinced that the defendant owed a duty to the plaintiffs under comment (f) to § 302 B of the Restatement (Second) of Torts. We also are not persuaded that the defendant, in voluntarily undertaking to monitor Lamb’s computer related activities, increased the likelihood of harm to the plaintiffs. As the Supreme Court of Alabama stated when interpreting the scope of § 324 A of the Restatement (Second), the ‘‘test is not whether the risk was increased over what it would have been if the defendant had not been negligent. Rather, a duty is imposed only if the risk is increased over what it would have been had the defendant not engaged in the undertaking at all. . . . Liability can be imposed on one who voluntarily under- took the duty to act only where the actor affirmatively either made, or caused to be made, a change in the conditions which change created or increased the risk of harm to the plaintiff. . . . See also Patentas v. United States, 687 F.2d 707, 717 (3d Cir. 1982) (. . . comment [c] to section 324A makes clear that increased risk means some physical change to the environment or some other material alteration of circumstances . . .).’’ (Citations omitted; internal quotation marks omitted.) Yanmar America Corp. v. Nichols, 166 So. 3d 70, 84–85 (Ala. 2014). In Yanmar America Corp., the Alabama Supreme Court held that a company that had issued nonspecific safety warnings had not increased the risk to the operators of a defective tractor because the warn- ings by the company, even if deficient, never actually reached the operators. Id., 85–86; see also Thompson v. Bohlken, 312 N.W.2d 501, 508 (Iowa 1981) (gratuitously inspecting premises and failing to note hazardous condi- tions did not impose liability under § 324 A because such conduct did not increase risk to injured parties). Page 52 CONNECTICUT LAW JOURNAL 0, 0

54 ,0 0 Conn. App. 1 Doe v. Lamb

Here, the plaintiffs were not in a worse position by virtue of the mere fact that the defendant sent various emails to Pritchard. Although Pritchard informed the defendant in 2015 that hacking attempts had originated from her home Internet service and Lamb subsequently admitted to her that he had engaged in hacking activi- ties, it also is undisputed that the defendant did not learn of Lamb’s criminal activity in stealing photographs of nude females and posting them online until the police executed a search warrant in September, 2017. See foot- note 19 of this opinion. Moreover, following the defen- dant’s email correspondence with Pritchard, Lamb ceased his activities for ‘‘a few months . . . .’’ When he later resumed his hacking activities, Lamb went right back to doing what he had been doing—but he did not increase the harm caused to the plaintiffs because of any actions on the part of the defendant. As a result, we do not agree that the defendant’s conduct, by itself, increased the risk of the harm endured by the plaintiffs in this case. Our Supreme Court wrestled with the issue of fore- seeability in Lodge v. Arett Sales Corp., 246 Conn. 563, 717 A.2d 215 (1998). The court was confronted with a case involving a negligently caused fire alarm. Id., 567– 68. Responding to that alarm, two firefighters were killed and others suffered injuries when the braking mechanism failed on the fire truck in which they were traveling. Id., 567. The parties argued for differing inter- pretations of what the scope of foreseeability means in negligence actions. Id., 573–74. Writing for the majority, Chief Justice Callahan stated that ‘‘[w]e agree with the defendants that the analysis of foreseeability logically cannot be extended so far that the term ‘general harm’ incorporates any accident involving a fire engine responding to a false alarm with no consideration given to the direct cause of the accident. It is impractical, if not impossible, to separate the question of duty from 0, 0 CONNECTICUT LAW JOURNAL Page 53

0 Conn. App. 1 ,0 55 Doe v. Lamb

an analysis of the cause of the harm when the duty is asserted against one who is not the direct cause of the harm.’’ Id., 574. The court also cited approvingly to a popular treatise, noting that ‘‘ ‘[t]he question whether there is a duty has most often seemed helpful in cases where the only issue is in reality whether the defendant stands in any such relation to the plaintiff as to create any legally recognized obligation of conduct for the plaintiff’s benefit. Or, reverting again to the starting point, whether the interests of the plaintiff are entitled to legal protection at the defendant’s hands against the invasion which has in fact occurred. Or, again reverting, whether the conduct is the ‘proximate cause’ of the result. The circumlocution is unavoidable, since all of these questions are, in reality, one and the same.’ ’’ Id., 574–75 n.9, citing W. Keeton et al., Prosser and Keeton on the Law of Torts (5th Ed. 1984) § 42, p. 274. Although the plaintiffs do not rely on § 442 B of the Restatement (Second) of Torts in support of their claim that the defendant owed a general duty of care as a result of her affirmative conduct, that provision is instructive on the issue of intentional conduct by a third party.40 In Snell v. Norwalk Yellow Cab, Inc., 332 Conn. 720, 759 n.18, 212 A.3d 646 (2019), our Supreme Court summarized the factual scenario present in Ruiz v. Vic- tory Properties, LLC, supra, 315 Conn. 320, as an ‘‘apt example’’ of the principle set forth in § 442 B: ‘‘In Ruiz, a small child was injured when an older child uninten- tionally dropped a piece of concrete on her head from 40 There is a strong relationship between various provisions of the Restatement (Second). As our Supreme Court has iterated: ‘‘[A]lthough §§ 302 B, 448 and 449 of the Restatement (Second) delineate when a defen- dant may be liable for a third party’s intentionally harmful acts, those sections merely reiterate the principle set forth in §§ 442 B and 435 (1), which is the same principle that governs every section of the Restatement (Second) of Torts relating to proximate causation: liability will attach if the defendant knew or should have known that his conduct created or increased the risk that the third party would act in such a manner.’’ Snell v. Norwalk Yellow Cab, Inc., 332 Conn. 720, 761, 212 A.3d 646 (2019). Page 54 CONNECTICUT LAW JOURNAL 0, 0

56 ,0 0 Conn. App. 1 Doe v. Lamb

the third floor landing of the apartment building where the children resided. . . . The older child had obtained the concrete from the backyard of that apartment build- ing, where he and the victim had been playing. . . . The trial court granted the defendant landlord’s motion for summary judgment, concluding that the defendant owed the victim no duty of care because no reasonable juror could find that her injuries were a foreseeable consequence of the defendant’s [failure to maintain the property in a clean and safe condition by leaving loose pieces of concrete in the backyard] and because impos- ing liability on the defendant would be contrary to over- riding public policy considerations. . . . The Appellate Court reversed the judgment of the trial court, and we affirmed the Appellate Court’s judgment . . . explaining that the defendant does not dispute that the risk of harm created by its failure to remove the buckets, trash, broken concrete pieces and other debris from the backyard was that children playing in the area might trip on them or throw them at other children. The types of injuries one would expect to result from this type of behavior run the gamut from cuts and bruises to broken bones, concussions and even fractured skulls. [The child’s] injuries, although severe, fall squarely along this continuum of harm. That they occurred in an unusual manner, namely, by a child dropping a piece of concrete into the backyard playground from a third floor balcony instead of throwing it while in the back- yard, does not alter this fundamental fact. We therefore agree with the Appellate Court that [the child’s] injuries were sufficiently foreseeable that it was inappropriate for the trial court to foreclose the foreseeability ques- tion as a matter of law.’’ (Citations omitted; internal quotation marks omitted.) Snell v. Norwalk Yellow Cab, Inc., supra, 759 n.18. As our Supreme Court concluded, ‘‘[a]s § 442 B of the Restatement (Second) of Torts indicates, however, 0, 0 CONNECTICUT LAW JOURNAL Page 55

0 Conn. App. 1 ,0 57 Doe v. Lamb

if all of the facts were the same except that an adult intentionally had dropped the concrete on the child’s head, the defendant’s liability would turn on whether an adult committing such an act was within the scope of the risk created by the defendant’s failure to remove the accumulated debris from its property. Such a case undoubtedly would be resolved in the defendant’s favor on a motion for summary judgment because it seems clear that a jury reasonably could not find that such an act was a foreseeable risk of the defendant’s negligence.’’ (Emphasis added.) Id. As the foregoing discussion makes clear, the fact that Lamb was an adult at the time of these criminal actions is dispositive. The scope of the risk created by the defendant’s actions simply does not encompass crimi- nal activity of the kind that was perpetrated by Lamb. The defendant’s actions, likewise, did not increase the risk of harm to the plaintiffs. The rendering of summary judgment in favor of the defendant was not improper because no jury could reasonably conclude that Lamb’s criminal activity was reasonably foreseeable by the defendant. Accordingly, the plaintiffs’ claim must fail. As we discussed in part I of this opinion, we nonetheless proceed with the public policy analysis because these issues are so deeply intertwined. See footnote 21 of this opinion. B Next, we consider whether the various public policy interests at play dictate that we conclude that the defen- dant owed a duty of care to the plaintiffs. Our discussion of the various public policy interests at play in part I B of this opinion is equally applicable here.41 We will 41 As detailed in part I B of this opinion, the public policy analysis is a multifactorial one. See Murillo v. Seymour Ambulance Assn., Inc., 264 Conn. 474, 480, 823 A.2d 1202 (2003) (determining that there are ‘‘four factors to be considered in determining the extent of a legal duty as a matter of public policy: (1) the normal expectations of the participants in the activity under review; (2) the public policy of encouraging participation in the activity, Page 56 CONNECTICUT LAW JOURNAL 0, 0

58 ,0 0 Conn. App. 1 Doe v. Lamb

not repeat the analysis in part I B, but we will expand briefly on it. At the outset, we note that it is the legislature ‘‘which has the ‘primary responsibility for formulating public policy’ . . . .’’ Sic v. Nunan, 307 Conn. 399, 410, 54 A.3d 553 (2012); see also Jarmie v. Troncale, 306 Conn. 578, 622, 50 A.3d 802 (2012) (declining to expand duty of care due to potential unintended consequences and because it is ‘‘the legislature rather than the courts [that is] the proper forum for resolving this issue, as it has done in similar situations’’). Connecticut does mandate certain forms of liability for parents of minor children, in addition to whatever other liabilities exist at law. See General Statutes § 52-572.42 In granting the first motion for summary judgment, the trial court specifi- cally noted that § 52-572 could not provide the basis for imposing liability on the defendant, given that Lamb was an adult during the applicable time period alleged in the complaint.43 Moreover, as the defendant aptly while weighing the safety of the participants; (3) the avoidance of increased litigation; and (4) the decisions of other jurisdictions’’). ‘‘In every case in which a defendant’s negligent conduct may be remotely related to a plaintiff’s harm, the courts must draw a line, beyond which the law will not impose legal liability.’’ Lodge v. Arett Sales Corp., supra, 246 Conn. 578. 42 General Statutes § 52-572 provides: ‘‘(a) The parent or parents or guard- ian, other than a temporary guardian appointed pursuant to section 45a- 622, of any unemancipated minor or minors, which minor or minors wilfully or maliciously cause damage to any property or injury to any person, or, having taken a motor vehicle without the permission of the owner thereof, cause damage to the motor vehicle, shall be jointly and severally liable with the minor or minors for the damage or injury to an amount not exceeding five thousand dollars, if the minor or minors would have been liable for the damage or injury if they had been adults. ‘‘(b) This section shall not be construed to relieve the minor or minors from personal liability for the damage or injury. ‘‘(c) The liability provided for in this section shall be in addition to and not in lieu of any other liability which may exist at law. ‘‘(d) As used in this section, ‘damage’ shall include depriving the owner of his property or motor vehicle or of the use, possession or enjoyment thereof.’’ 43 The trial court also found the plaintiffs’ argument that this case is analogous to the social host line of cases to be ‘‘unpersuasive.’’ The court contrasted the scenario presented in Craig v. Driscoll, 262 Conn. 312, 813 0, 0 CONNECTICUT LAW JOURNAL Page 57

0 Conn. App. 1 ,0 59 Doe v. Lamb

notes, the legislature has enacted laws that specifically provide for the filing of civil lawsuits against those who engage in computer crimes. See General Statutes §§ 53a-251 and 53a-254.44 As this court has previously stated, § 53a-251 (b) ‘‘evinces a well defined public pol- icy disallowing knowingly unauthorized access to com- puter systems . . . .’’ (Emphasis in original.) Brantley v. New Haven, 100 Conn. App. 853, 861, 920 A.2d 331 (2007). Those statutes, however, do not contemplate the extension of a duty to anyone who provides Internet A.2d 1003 (2003), with that presented here, noting that furnishing alcohol to minors may be a proximate cause of the injuries sustained by a third party because ‘‘the consumption, resulting intoxication, and injury-produc- ing conduct are foreseeable intervening causes, or at least the injury-produc- ing conduct is one of the hazards which make such furnishing [of alcohol] negligent.’’ (Internal quotation marks omitted.) Id., 335; cf. Demond v. Project Service, LLC, supra, 331 Conn. 837 (owner or possessor of property in this state generally cannot be held liable in negligence for harms caused by adults who consume alcohol on that property but cause injury only after leaving to drive on public roads even when playing active role in creating risk by serving alcohol). 44 General Statutes § 53a-251 sets forth various ways an individual can be charged with computer related crimes, all involving unauthorized access to computers and computer systems. Subsection (b), for example, provides: ‘‘Unauthorized access to a computer system. (1) A person is guilty of the computer crime of unauthorized access to a computer system when, knowing that he is not authorized to do so, he accesses or causes to be accessed any computer system without authorization. ‘‘(2) It shall be an affirmative defense to a prosecution for unauthorized access to a computer system that: (A) The person reasonably believed that the owner of the computer system, or a person empowered to license access thereto, had authorized him to access; (B) the person reasonably believed that the owner of the computer system, or a person empowered to license access thereto, would have authorized him to access without payment of any consideration; or (C) the person reasonably could not have known that his access was unauthorized.’’ General Statutes § 53a-251 (b). General Statutes § 53a-254 provides: ‘‘(a) A person is guilty of computer crime in the third degree when he commits computer crime as defined in section 53a-251 and (1) the damage to or the value of the property or computer services exceeds one thousand dollars or (2) he recklessly engages in conduct which creates a risk of serious physical injury to another person. ‘‘(b) Computer crime in the third degree is a class D felony.’’ Lamb pleaded guilty to, inter alia, twenty counts of computer crime in the third degree under § 53a-254. Page 58 CONNECTICUT LAW JOURNAL 0, 0

60 ,0 0 Conn. App. 1 Doe v. Lamb

service to an individual who conducts criminal activity by means of computers. In ‘‘analyzing the relevant fac- tors in determining whether recognizing a duty in a particular instance is inconsistent with public policy . . . our statutes themselves are a source of public policy, and may militate in favor of recognizing a com- mon-law duty of care when doing so advances the gen- eral policies and objectives of the statute. . . . Thus, in determining the normal expectations of the parties, our appellate courts have often looked to Connecticut’s existing body of common law and statutory law relating to th[e] issue.’’ (Internal quotation marks omitted.) Streifel v. Bulkley, supra, 195 Conn. App. 315. The legis- lature has not seen fit to enact any statutes requiring individuals to monitor or supervise another person’s use of the Internet, and our common law ought not be deployed to expand liability beyond the statutorily defined contours of public policy. The fact that the General Assembly has not expressed, by way of statute, a public policy interest supporting the imposition of third-party liability against those who provide Internet access to others weighs against creat- ing a common-law duty of care in such circumstances. Courts must be extraordinarily careful in determining that public policy interests demand expanding a duty of care because of the widespread implications such precedent would create: ‘‘[I]t is well established that Connecticut courts will not impose a duty of care on [a defendant] if doing so would be inconsistent with public policy.’’ (Internal quotation marks omitted.) Id., 307. We also must consider the implications of our deci- sion in terms of future litigation. See, e.g., Jaworski v. Kiernan, supra, 241 Conn. 409 (evaluating as public policy concern ‘‘desire to stem the possible flood of litigation that might result from adopting simple negli- gence as the standard of care to be utilized in athletic 0, 0 CONNECTICUT LAW JOURNAL Page 59

0 Conn. App. 1 ,0 61 Doe v. Lamb

contests’’). It is the role of the legislature, and not the judiciary, to evaluate and weigh the widespread implica- tions of making individuals liable for the criminal Internet activity of another person. Given the ubiquity of the Internet, subjecting the defendant to liability for the criminal actions perpetrated by Lamb could, and likely would, open the proverbial floodgates of litiga- tion. See also part I B of this opinion. We conclude that the trial court properly determined that there was no genuine issue of material fact as to whether the defendant owed a legal duty to the plain- tiffs. The court, therefore, properly rendered summary judgment in favor of the defendant. The judgment is affirmed. In this opinion the other judges concurred.