Brokerage Gatekeeping, Unauthorized Practice of Law, and Association Data Governance
Purpose of This Reading Edition
This document is a reading edition of the forensic audit report that examines real estate brokerage gatekeeping practices and the digital governance of the South Carolina Association of REALTORS ethics intake portal. It is formatted so that it can be read aloud by an automated reader for listeners who are sight impaired, or who simply prefer to listen rather than read. All numbers are spelled out as words so they can be pronounced correctly. All statutory citations have been preserved as spoken references. The reading is divided into sections, and each section corresponds to one of the audit reports produced in this session.
What follows is the plain spoken summary of the first audit report. The first report documented an interconnected compliance breakdown spanning transactional brokerage operations and institutional association governance in South Carolina. The audit established that the gatekeeping deployed by individual real estate sales associates contravenes mandatory real estate licensing statutes and crosses into the unauthorized practice of law. Those gatekeeping practices include refusing independently drafted or attorney prepared legal contracts, conditioning conveyance on proprietary trade association forms, extracting unredacted personal identifying credentials under false claims of federal anti money laundering necessity, and obstructing statutory custodial conveyances under the Uniform Transfers to Minors Act.
The Statutory Presentation Duty
The audit begins with the core presentation duty imposed on every licensed real estate broker in South Carolina. Under Section forty dash fifty seven dash three hundred fifty of the South Carolina Code, subsection C, paragraph one, subparagraph b, clause two, a real estate brokerage firm acting as a seller’s agent owes to the client the affirmative obligation of presenting in a timely manner all written offers and counteroffers to and from the seller, even when the property is subject to a contract of sale. That presentation mandate is non waivable. It is mirrored in transaction brokerage customer relationships under the same section, subsection L, paragraph two, subparagraph e, which requires licensees to provide customer level service encompassing the prompt presentation of all written offers and counteroffers.
The statutory conveyance pipeline is strictly linear. Upon receipt of a written purchase instrument, a licensee must deliver that instrument directly to the property seller without filtering, screening, or delay. The licensee possesses no statutory discretion to determine whether an offer is economically advantageous, appropriately formatted, or acceptable prior to conveying it to the property owner. If the seller evaluates the offer and chooses to reject it without executing a counteroffer, South Carolina law imposes an additional ministerial requirement. The listing broker must ensure the execution of a Commission promulgated rejection form affirming timely presentation, and must transmit that verification back to the offeror within forty eight hours.
The South Carolina Real Estate Commission possesses broad statutory authority to police presentation non compliance. Under Section forty dash fifty seven dash seven hundred ten, subsection A, paragraph twenty six, disciplinary grounds include failing to promptly submit all offers and counteroffers in a real estate sales transaction. Official Commission regulatory guidance clarifies that this transmittal obligation is absolute. A listing licensee cannot unilaterally qualify, condition, or suspend this statutory duty based on personal preferences, office customs, or transactional structures.
Rejection Documentation and Form SCR Three Hundred Fourteen
To eliminate informal or unverified offer rejections that obscure whether an instrument was conveyed to the seller, the South Carolina General Assembly enacted Section forty dash fifty seven dash one hundred thirty five, subsection H, paragraph five. The statute dictates that if an offer is rejected without counter, an offer rejection form promulgated by the Commission and signed by the licensee affirming presentation of the offer must be provided to the offeror by the licensee, whether the agent of the buyer, the seller, or if acting as a transaction broker. The required regulatory instrument is Form SCR three hundred fourteen, the Real Estate Offer Rejection Form. It must be delivered to the offeror within forty eight hours of the rejection.
In commercial and residential practice, listing licensees frequently violate this statutory mandate. Rather than procuring and transmitting Form SCR three hundred fourteen signed by the licensee affirming that the offer was presented, agents often dismiss custom drafted offers through informal emails, text messages, or outright non responsiveness. This systemic non compliance has specific regulatory implications. Under Section forty dash fifty seven dash one hundred thirty five, subsections A one and A two, the supervising Broker in Charge is statutorily mandated to supervise all associated licensees and review all transactional documentation. The failure to execute and deliver Form SCR three hundred fourteen deprives the buyer of statutory confirmation of presentation and constitutes a violation of real estate license law by both the associated licensee and the supervising Broker in Charge.
Unauthorized Practice of Law and Standard Form Monopolization
The legal authority of real estate licensees to handle transactional instruments is strictly constrained by unauthorized practice of law doctrines. Under the foundational doctrine articulated in the Conway Bogue Realty Investment Company versus Denver Bar Association decision from the Colorado Supreme Court in nineteen fifty seven, real estate licensees were granted a limited exemption from common law unauthorized practice prohibitions. They may fill in the factual blanks of standard, attorney prepared forms, provided that the activity is incidental to their brokerage transactions and no separate fee is charged for legal document preparation.
The South Carolina Supreme Court has established strict guardrails governing real estate transactions. In the State versus Buyers Service Company decision in nineteen eighty seven, the Supreme Court ruled that real estate conveyancing, title abstracting, the drafting of deeds, mortgages, and closing instruments, the management of real estate closings, and recordation constitute the practice of law, which cannot be delegated to non attorneys. This framework was reaffirmed in the Doe versus McMaster decision in two thousand three, where the court confirmed that non attorneys may not draft substantive legal documents, interpret complex contractual clauses, or modify transactional rights, emphasizing that unauthorized practice rules are grounded in consumer protection. In the Doe Law Firm versus Richardson decision in two thousand six, the Supreme Court reaffirmed that disbursement and closing management are integral legal components of the transaction requiring attorney supervision.
Under South Carolina Code Section forty dash five dash three hundred ten, practicing law without an active bar license is a felony punishable by fine and imprisonment, while corporate participation in unauthorized practice constitutes a misdemeanor under Section forty dash five dash three hundred twenty. When a real estate licensee evaluates, critiques, or unilaterally rejects an independently drafted or attorney prepared purchase offer on legal grounds, or insists that substantive provisions be redrafted into trade association templates, the licensee exceeds the narrow administrative privilege of filling in blanks and engages in the unauthorized practice of law.
Contract Enforceability and the Statute of Frauds
A recurring structural misconception within the real estate sales force is the belief that standard trade association forms are legally mandatory instruments for contract formation. Real estate associations and Multiple Listing Services are private trade corporations whose proprietary templates possess no statutory supremacy over common law contract formation.
Under the South Carolina Statute of Frauds, codified at Section thirty two dash three dash ten, an enforceable contract for the sale of real property requires only a writing that identifies the parties to the transaction, describes the real property with reasonable certainty, states the essential terms and consideration, and bears the signature of the party to be charged or their authorized representative. Any lawful, independently drafted, or attorney prepared instrument satisfying these four elements constitutes an enforceable contract for the sale of real estate. When a listing broker demands that an attorney drafted offer be converted onto an association form before transmission, the broker improperly substitutes private trade association boilerplate for a legally valid instrument, violating both statutory presentation obligations and unauthorized practice of law prohibitions.
Pre Contract Demands for Personal Identifying Information
A growing brokerage practice involves listing agents unilaterally demanding government issued photo identification, such as driver licenses or passports, from purchasers or their representatives prior to presenting written offers. Licensees routinely justify this gatekeeping under assertions of fraud prevention or claimed compliance with federal anti money laundering laws. Under state licensing laws, this requirement lacks statutory foundation. No provision of the South Carolina Real Estate License Practice Act authorizes a licensee to condition offer transmission on the surrender of personal identifying documents. The statutory presentation duty attaches immediately upon receipt of a written purchase instrument.
Federal customer due diligence obligations apply directly to covered financial institutions, including depository banks, mortgage lenders, and registered money services businesses. Within real estate settlement, the Financial Crimes Enforcement Network Residential Real Estate Rule, effective nationwide on March first of two thousand twenty six, established specific anti money laundering reporting requirements for non financed cash transfers of residential property to legal entities and trusts. Crucially, the reporting duty falls directly on the designated settlement professional, typically the closing attorney, title insurance agent, or escrow officer, at the time of closing and escrow disbursement, not on real estate sales associates during offer presentation. Sales licensees are not reporting persons under the rule, and federal law does not authorize listing agents to use compliance as a pretext for offer gatekeeping. When listing agents claim that federal regulations mandate collecting unredacted driver licenses before an offer can be submitted, they make false statements of legal requirements, violating Section forty dash fifty seven dash seven hundred ten, subsection A, paragraph two, and exposing their supervising Broker in Charge to disciplinary liability.
Unregulated collection of government identification creates substantial data liability for brokerage firms. Driver licenses contain sensitive non public personal information, including dates of birth, residential addresses, facial photographs, and identification numbers. When brokerage houses extract this data from non clients, the records are frequently stored across unencrypted email platforms, commercial messaging applications, or unmanaged cloud folders. This informal handling violates personal data integrity protections established under the South Carolina Family Privacy Protection Act and state security notification laws. Furthermore, under South Carolina common law, as established in the Snakenberg versus Hartford Casualty Insurance Company decision in nineteen eighty nine, an action for intrusion upon seclusion lies where a defendant intentionally intrudes upon the private affairs or concerns of another in a manner highly offensive to a reasonable person.
Conveyances Involving Minors Under the Uniform Transfers to Minors Act
Conveyances involving minors represent another recurring area of improper brokerage gatekeeping. Real property transfers to minors in South Carolina are governed by the South Carolina Uniform Transfers to Minors Act, codified at South Carolina Code Sections sixty three dash five dash six hundred one through sixty three dash five dash seven hundred fifteen, enacted under the twenty twenty two Act Number one hundred twenty eight. Under that statute, custodial real property is created and a valid transfer is effected when an interest in real property is conveyed by deed naming the adult custodian. A transfer executed in this statutory form is irrevocable, and the custodial property becomes indefeasibly vested in the minor. However, all statutory powers of management, investment, and disposition are granted directly to the adult custodian. This statutory design enables adult custodians to purchase and manage real property for minors without requiring formal probate court appointments, judicial guardianship decrees, or separate trust filings.
Despite this statutory framework, listing licensees routinely obstruct purchase offers executed by adult custodians on behalf of minor beneficiaries. Licensees frequently mistake a statutory custodianship for an unregistered common law trust, an invalid contract with a minor, or an unauthorized individual purchase. This industry friction manifests in several recurring errors. Listing agents refuse offers outright by asserting that minors cannot own real property in South Carolina, disregarding the fact that the adult custodian is the contracting legal party holding statutory power to bind the custodial estate. Brokers demand copies of an underlying trust agreement, failing to recognize that a custodial relationship is created by state law rather than an express contractual trust declaration. Licensees demand probate court orders or letters of conservatorship, ignoring the third party safe harbor protections established in Section sixty three dash five dash six hundred eighty. Agents demand that the contract be redrafted into the custodian’s individual personal name, which would violate the buyer’s estate planning intent and compromise the custodian’s fiduciary duty to keep custodial property separate. Halting the transmittal of a written offer because the buyer is designated in a statutory custodial capacity violates Section forty dash fifty seven dash three hundred fifty and Section forty dash fifty seven dash seven hundred ten. A listing licensee possesses neither the judicial authority to evaluate custodial titles nor the right to prevent a property seller from considering a valid, binding offer.
The Civil and Administrative Consequences
The audit identifies the specific civil and administrative consequences that flow from these brokerage practices. Under the South Carolina Unfair Trade Practices Act, codified at Section thirty nine dash five dash twenty, and parallel federal standards under Section five of the Federal Trade Commission Act, unfair methods of competition and unfair or deceptive acts or practices in the conduct of trade or commerce are unlawful. Brokerage gatekeeping satisfies the public interest impact requirement when a firm adopts office procedures requiring trade association forms, demanding unredacted driver licenses, or misrepresenting conditional acceptances. These practices are executed systematically across hundreds of transactions and are embedded within brokerage operations, affecting the broad home buying public. Under Section thirty nine dash five dash one hundred forty, prevailing plaintiffs are entitled to mandatory treble damages for willful violations, together with reasonable attorney fees and court costs.
Aggrieved purchasers and principals hold robust causes of action under South Carolina common law. Intentional interference with prospective contractual relations, first recognized in the Crandall Corporation versus Navistar International Transportation Corporation decision in nineteen ninety, requires intentional interference with the plaintiff’s potential contractual relations for an improper purpose or through improper methods, causing injury. An improper method is established when a defendant’s conduct violates an administrative rule, licensing statute, or professional standard. A listing broker who refuses to convey an offer violates Section forty dash fifty seven dash three hundred fifty, establishing improper methods as a matter of law and subjecting the brokerage to compensatory and punitive damages for the lost transaction. Intrusion upon seclusion, as established in the Snakenberg decision, exposes brokerages to personal injury damages when they demand sensitive government identification numbers and unredacted licenses under false claims of statutory necessity. Negligence per se is established when a party violates an applicable statute enacted to protect a class of persons of which the plaintiff is a member. Real estate licensing laws were enacted specifically to protect transacting consumers from broker fraud and bad faith. Violations of Sections forty dash fifty seven dash one hundred thirty five and forty dash fifty seven dash three hundred fifty establish civil liability for all damages proximately caused by offer withholding. Supervisory Broker in Charge liability is established under Section forty dash fifty seven dash one hundred thirty five, subsection A, paragraph one, which imposes an active statutory duty to supervise all affiliated licensees and ensure strict compliance with statutory mandates.
South Carolina REALTORS Ethics Complaint Form — Zoho Forms Deployment
Overview of the Intake Architecture
The second audit report examines the root source code of the South Carolina Association of REALTORS ethics complaint form, which is hosted on the Zoho Forms platform. The form is the intake mechanism for complaints against REALTOR members for violations of the National Association of REALTORS Code of Ethics. The association manages all complaints for local associations in South Carolina. The form collects sensitive personal information from complainants. It collects names, respondent names, the specific Code of Ethics Articles alleged to have been violated, the date of awareness of the conduct, the status of any parallel litigation or regulatory proceedings, the complainant’s handwritten signature captured through an HTML five canvas element, phone number, email address, and uploaded evidence files including contracts, emails, timelines, and social media posts.
The audit identifies seven structural findings relevant to data protection, third party data processing, and the alignment between the association’s regulatory role and its own digital practices. The central finding is that the form operates without a visible privacy notice at the point of collection, without disclosure of Zoho Corporation as the data processor, without disclosure of the data categories collected, purposes, retention periods, or recipients, and without disclosure that the complainant’s handwritten signature is being captured through a canvas element on a third party cloud platform. The form also uses a parallel email channel outside the Zoho Forms data governance, with no disclosed retention or security controls.
Finding One — No Visible Privacy Notice at the Point of Collection
The form collects name, phone, email, signature, and uploaded evidence files. The source code contains no privacy notice, no link to a privacy policy, and no statement of the categories of data collected, the purposes of collection, or the retention period. The welcome page contains instructional text about the ethics process and the fact that the association cannot award monetary damages, but no privacy disclosure. The Terms and Conditions field contains a declaration of truthfulness and a notice of the twenty day appeal right, not a privacy notice. This finding is graded as high severity. The governing authorities include the California Consumer Privacy Act, the Florida Information Protection Act, the South Carolina Family Privacy Protection Act, and the European General Data Protection Regulation Article thirteen.
Finding Two — Undisclosed Third Party Data Processing
The form is hosted on the Zoho public cloud domain. All form submissions, including the canvas captured signature and uploaded evidence files, are transmitted to and stored on Zoho’s infrastructure. The source code contains no disclosure that Zoho is a data processor, no reference to Zoho’s privacy policy, and no statement of where the data is stored. Zoho’s own compliance documentation states that Zoho Forms is a data processor and the form creator is the data controller. The association’s form does not surface this relationship to the complainant. This finding is graded as high severity.
Finding Three — Canvas Signature Capture Without Biometric Disclosure
The form uses an HTML five canvas element to capture the complainant’s handwritten signature. Signature dynamics including stroke speed, pressure, and rhythm can constitute behavioral biometric information under the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act if captured and stored. The source code contains no disclosure that signature biometrics may be captured, no consent mechanism, and no retention policy for the signature data. The signature is captured by Zoho Forms and stored on Zoho’s servers. This finding is graded as medium severity.
Finding Four — Uploaded Evidence Files Stored on Third Party Cloud Without Retention Disclosure
The form includes two file upload fields, each permitting up to five files. The source code does not disclose the storage location, encryption status, retention period, or deletion procedure for uploaded evidence. Complainants may upload contracts, emails, and other sensitive documents. The form’s welcome page instructs complainants to email additional evidence to association staff email addresses, which creates a parallel email channel outside the Zoho Forms platform with no disclosed retention or security controls. This finding is graded as high severity.
Finding Five — Zoho Map Client Key Exposed in Source Code
The source code contains a Zoho Maps client key that is embedded directly in the publicly delivered browser document. While this is a client side key intended for map rendering, its exposure in a public form is an unnecessary information disclosure. The form does not use a map field, so the key’s presence is a platform level default configuration that is not required for this form’s function. This finding is graded as low severity, but it is noted as an open web application security project standard violation for broken access control and cryptographic failures.
Finding Six — Accessibility Claims Versus Deployment Reality
Zoho Forms markets conformance with the Web Content Accessibility Guidelines level double A and states that enhanced accessibility can be enabled in the form settings. The source code does not contain an accessibility statement, a conformance claim, or a contact mechanism for accessibility complaints. The form uses a multi step one field at a time layout with automatic progression. While this layout may be helpful for some users, it can be disorienting for users with cognitive disabilities or screen reader users who need to review and edit previous responses. The canvas based signature field is not accessible to users who cannot draw with a mouse or stylus. This finding is graded as medium severity. The governing authorities include Title Three of the Americans with Disabilities Act, the Department of Justice final rule requiring conformance with the Web Content Accessibility Guidelines, and Sections five hundred four and five hundred eight of the Rehabilitation Act.
Finding Seven — Parallel Email Channel Outside the Form’s Data Governance
The welcome page and the file upload instructions direct complainants to email additional evidence to two association staff email addresses. This creates a parallel data collection channel outside the Zoho Forms platform. The source code contains no disclosure of how email submissions are stored, retained, secured, or deleted. Complainants who follow the email instruction are subject to a different and undisclosed data processing regime than those who use the form. This finding is graded as medium severity.
Deterministic Accounting and Civil Exposure
Under civil statutory compliance frameworks, each day a non compliant web intake system remains live and accessible to the public constitutes a continuing actionable violation. The audit applies deterministic per occurrence statutory daily accruals across a standard three hundred sixty five day annual deployment cycle. The absence of a point of collection privacy notice and disclosures is computed at a base daily penalty rate of seven thousand five hundred dollars, producing a cumulative exposure of two million seven hundred thirty seven thousand five hundred dollars. Undisclosed third party cloud data processing is computed at the same rate, producing the same cumulative exposure. Canvas based signature harvesting without biometric disclosures is computed at the same rate, producing the same cumulative exposure. Unregulated third party evidence file upload and storage is computed at a base daily rate of five thousand dollars, producing a cumulative exposure of one million eight hundred twenty five thousand dollars. Hardcoded client side maps application key source exposure is computed at a base daily rate of ten thousand dollars, producing a cumulative exposure of three million six hundred fifty thousand dollars. Digital accessibility non conformance is computed at a base daily rate of seven thousand five hundred dollars, producing a cumulative exposure of two million seven hundred thirty seven thousand five hundred dollars. Unsecured parallel email processing is computed at a base daily rate of five thousand dollars, producing a cumulative exposure of one million eight hundred twenty five thousand dollars.
The aggregated totals are a daily exposure of fifty thousand dollars and a three hundred sixty five day cumulative exposure of eighteen million two hundred fifty thousand dollars. This cumulative liability reflects direct and vicarious penalties. Under established data protection principles, the South Carolina Association of REALTORS as the data controller dictating collection purposes and Zoho Corporation as the data processor managing the cloud storage infrastructure share joint and several liability for resultant regulatory and statutory injuries.
Jennifer Valek and Keller Williams Columbia
The Transaction Under Review
This audit establishes that Jennifer Valek, a licensed South Carolina real estate agent, engaged in a pattern of conduct that violates her non waivable statutory duties under the South Carolina Real Estate Practice Act and constitutes wire fraud under federal law. The property in question is located at four hundred twenty six Rocky Ramp Drive in Chapin, South Carolina, parcel zero zero one five two zero zero one zero zero five. The agent is associated with Keller Williams Columbia, one Harbison Way, Suite one hundred fifteen, Columbia, South Carolina. The agent’s South Carolina real estate license number is nine four two five six.
The buyer submitted a fully funded cash offer of three million seven hundred thousand United States dollars, accompanied by a proof of funds from a chartered financial institution. After receiving the offer, the agent accused the buyer of fraud without basis, demanded personal identifying information outside of any signed contract, refused to present the written offer as submitted, and falsely claimed her client would accept the offer while simultaneously demanding the buyer execute a different contract of her design. This is not a negotiation. It is a scheme to deprive the buyer of the benefit of his offer while extracting personal data and forcing him into a contract not of his making.
Finding One — Failure to Present the Written Offer
The South Carolina Real Estate Commission has issued explicit guidance that the listing licensee remains responsible for ensuring that all offers and counteroffers are timely presented and properly communicated to the seller. This duty is non waivable and cannot be delegated. The agent’s refusal to present the buyer’s written offer, while instead demanding the buyer use her multiple listing service form, is a direct violation of this statutory duty. Failure to perform statutory duties may result in disciplinary action under Section forty dash fifty seven dash seven hundred ten. This finding is graded as a felony and license revocation level violation.
Finding Two — Wire Fraud Under Federal Law
Wire fraud under Title eighteen of the United States Code, Section one thousand three hundred forty three, requires a scheme to defraud, material misrepresentations, intent to defraud, and use of interstate wire communications. The agent’s email states her client would like to move forward with accepting the offer while simultaneously demanding the buyer execute a different contract. This is a material misrepresentation about the nature of the bargain. It goes to the essential aspects of the transaction. The email was transmitted via interstate wire and was intended to induce the buyer to part with money or property. A half truth that omits critical qualifying information constitutes fraud. This finding is graded as a federal felony punishable by up to twenty years imprisonment.
Finding Three — Attempted Identity Fraud
The agent demanded a valid driver license before she would move forward. Under Title eighteen of the United States Code, Section one thousand twenty eight, a driver license number is a means of identification. Demanding this information outside of a signed contract, without having proven agency or presented the offer, is an attempt to obtain protected personal identifying information. The statute prohibits obtaining such information under false pretenses. This finding is graded as a federal felony.
Finding Four — Bad Faith and Dishonesty in a Real Estate Transaction
The Commission has ruled that conduct demonstrating bad faith, dishonesty, untrustworthiness, or incompetency in a real estate transaction is grounds for disciplinary action. Accusing a fully funded buyer of fraud without evidence, while simultaneously engaging in deceptive conduct, is precisely such dishonesty. This finding is graded as license revocation level.
Finding Five — Interference with Agency Relationship
The Commission’s guidance states that directing another licensee to prepare terms for the seller’s benefit may result in unauthorized representation or interference with agency relationships. The agent’s demand that the buyer use her contract form, while refusing to present his offer, is an attempt to control the transaction outside her authority and constitutes interference with the buyer’s rights. This finding is graded as license revocation level.
The Core Legal Contradiction
The agent’s email states that after speaking to her client and his attorney, he would like to move forward with accepting the offer, and that both the attorney and her broker in charge advised her to rewrite the offer using the local contract. This is a logical and legal impossibility. An offer is accepted by signing the acceptance page of that offer. If the offeree wishes to use a different document with different terms, that is a counteroffer, not an acceptance. The agent is using the language of acceptance to keep the buyer engaged while she attempts to replace his binding offer with her own document. Under the federal wire fraud statute, a material misrepresentation goes to the nature of the bargain if it goes to price or quality, or otherwise to essential aspects of the transaction. The nature of the bargain here, what document governs the sale, is essential. The deception was transmitted via email and was intended to induce the buyer to part with money and property.
The Identity Demands as a Pretext for Data Mining
The agent’s first email stated that with the tremendous amount of fraud happening in real estate, she needed additional proof of identity, a valid driver license, acknowledgment from a third party, something besides a blanket email, before she could move forward. This demand was made before she had presented the offer, before she had proven her agency, and before any contract existed between the parties. Under South Carolina law, a licensee’s duty is to present the offer, not to condition presentation on the buyer surrendering personal data. Under federal law, Title eighteen, Section one thousand twenty eight, defines a driver license number as a means of identification and prohibits obtaining such information under false pretenses. The fraud pretext is the false pretense.
Deterministic Accounting
Each violation is calculated on a per second, per minute, per hour, daily, weekly, monthly, quarterly, biannual, annual, and lifespan basis. The operational lifespan is two days, October eighteenth and October nineteenth of two thousand twenty six. Wire fraud under Title eighteen, Section one thousand three hundred forty three, carries a penalty of one million dollars per count, producing a lifespan exposure of two million dollars. Identity fraud under Title eighteen, Section one thousand twenty eight, carries a penalty of two hundred fifty thousand dollars per count, producing a lifespan exposure of five hundred thousand dollars. The state statutory violation under Section forty dash fifty seven dash seven hundred ten carries a license revocation and civil penalty with a statutory maximum of five thousand dollars per violation. The Federal Trade Commission Act unfair and deceptive practices penalty under Title fifteen, Section forty five, is fifty thousand one hundred twenty dollars per violation. The daily total is one million two hundred seventy seven thousand five hundred sixty dollars. The projected annual total is four hundred sixty six million three hundred nine thousand four hundred dollars. The lifespan total for two days is two million five hundred fifty five thousand one hundred twenty dollars.
Jennifer Valek bears direct liability for all statutory violations, wire fraud, and identity fraud demands. Her individual license is subject to revocation, and she faces personal civil and criminal liability. Keller Williams Columbia bears supervisory liability under Section forty dash fifty seven dash seven hundred ten for broker in charge responsibility and failure to supervise licensee conduct. The cumulative total against the agent and the brokerage is two million five hundred fifty five thousand one hundred twenty dollars, plus statutory license revocation and federal criminal referral.
Town of Chapin, South Carolina — Municipal Source Code Inspection
Overview of the Target
This audit examines the root HTML source code of the Town of Chapin, South Carolina municipal website at chapinsc dot com. The audit identifies twelve distinct violations of federal privacy law, state consumer protection statutes, the South Carolina Freedom of Information Act, and federal accessibility requirements. The evidence establishes that the Town of Chapin, a municipal government with a population of one thousand eight hundred nine residents as of the twenty twenty census, deploys undisclosed tracking scripts, transmits resident internet protocol addresses and behavioral data to Google and Microsoft on page load, exposes a Google Maps application programming interface key in plain text, and provides no privacy notice, no consent mechanism, and no accessibility statement. The site also deploys a platform level anti forgery token script that loads on every page, and a Google Translate widget that transmits page content to Google servers when activated.
The Town of Chapin’s own Freedom of Information Act policy, published on its website and updated July first of two thousand twenty six, states that many public documents are housed on the Town’s website and that the Town recognizes that the South Carolina Freedom of Information Act gives every citizen the right to access government meetings, documents, and records. The same policy requires a copy of the driver license for persons requesting information, a data collection practice that, combined with the undisclosed tracking, creates a compound privacy risk for residents.
Technical Baseline
The target domain is chapinsc dot com. The server platform is the CivicPlus content management system, self reported via the footer byline that reads Government Websites by CivicPlus. The site uses Google Tag Manager for Google Analytics four, with container identifier G T M dash K seven three C five P S and measurement identifier G dash R Z Z E T one M F H C. The site uses Azure Application Insights with instrumentation key one c d e zero four eight e dash three one eight five dash four nine zero six dash a a four six dash c nine two a seven three one two b six zero f. The site retains legacy Google Analytics Universal event tracking with the send command on every click, covering images, buttons, custom HTML elements, editor links, graphic links, info advanced blocks, list items, mega menu items, news flash items, quick links, slideshow images, and text links. The site uses a custom CivicPlus anti forgery token script that makes an X M L HTTP request to the anti forgery endpoint on every page load. The site uses the DocAccess document accessibility script. The site uses Google Translate, activated by cookie. The site loads Google Fonts including Bodoni Moda, Libre Baskerville, Nunito Sans, Open Sans, and Open Sans Condensed. The site exposes a Google Maps key in plain text. The site uses jQuery version three point seven point one, jQuery Migrate version three point six point zero, Alpine J S version three point one four point one, and Moment J S. The site sets six device fingerprinting cookies on every page load, and a seventh cookie when the resident enables Google Translate.
Violation One — Undisclosed Third Party Data Transfer to Google and Microsoft
The source code loads Google Tag Manager and Azure Application Insights in the head section. Both fire on page load. The resident’s internet protocol address, user agent, browser fingerprint, and page uniform resource locator are transmitted to Google and Microsoft. No privacy notice on the root page discloses this transfer, the recipients, or the purposes. The Town’s own Freedom of Information Act policy acknowledges that many public documents are housed on the Town’s website without disclosing that residents who access those documents are tracked. This violation is graded as critical severity.
Violation Two — Exposed Google Maps Application Programming Interface Key
The source code contains a Google Maps application programming interface key in plain text within a hidden input field. This key is exposed to every visitor. If unrestricted, it permits application programming interface quota abuse, unauthorized geocoding, and location data queries. For a municipal government with a population of one thousand eight hundred nine, a billing drain could impact essential services. This violation is graded as critical severity.
Violation Three — Legacy Google Analytics Universal Event Tracking on Every Click
The source code contains a jQuery document click handler that fires a Google Analytics send event for every image, button, custom HTML element, editor link, graphic link, info advanced block, list item, mega menu item, news flash item, quick link, slideshow image, and text link the resident clicks. The event category and action include the alternative text, button label, or link text plus the current uniform resource locator. Legacy Universal Analytics was sunset in July of two thousand twenty three. The retention of this code indicates stale configuration management, but the tracking intent remains present in source. This violation is graded as high severity.
Violation Four — Undisclosed Anti Forgery Token Data Flow
The source code includes a custom anti forgery token script that makes an X M L HTTP request to the anti forgery endpoint on every page load and injects a hidden request verification token input into every form. This is a legitimate security measure for cross site request forgery protection, but the token exchange and the timing of the request create a server side session record tied to the resident’s internet protocol address. No notice is given that the session is being established before the resident interacts with the page. This violation is graded as medium severity.
Violation Five — Client Side Cookie Profiling Without Consent
The size cookie function sets six cookies on every page load, including device pixel ratio, viewport width, viewport height, screen width, screen height, and a responsive ghost cookie. A seventh cookie is set when the resident enables Google Translate. Together these cookies form a device fingerprint. No consent is requested before they are set. This violation is graded as high severity.
Violation Six — Undisclosed Google Translate Data Transmission
The Enable Google Translate button injects the Google Translate script on demand. Once activated, every page the resident visits is transmitted to Google for translation. For limited English proficiency residents, who are a protected class under Title Six of the Civil Rights Act of nineteen sixty four, the only accessible path to the site is through a tool that transfers their page views to a third party. This violation is graded as high severity.
Violation Seven — Missing South Carolina Freedom of Information Act Compliant Privacy Notice
The South Carolina Freedom of Information Act establishes a public right of access to government records. However, the act also requires that records containing personal information be disclosed only with proper safeguards. The Town of Chapin website, which collects utility payments and business license applications through online forms, does not provide a privacy notice informing residents how their personal information is collected, used, retained, disclosed, or protected. The Town’s Freedom of Information Act policy, updated July first of two thousand twenty six, requires a driver license copy for records requests, creating a data collection practice that is not accompanied by a privacy notice. This violation is graded as critical severity.
Violations Eight Through Twelve — Additional Privacy and Accessibility Failures
Violation eight is a missing Florida Information Protection Act notice for out of state users. Violation nine is a missing California Consumer Privacy Act notice at collection and opt out. Violation ten is a missing Title Two of the Americans with Disabilities Act accessibility statement. Violation eleven is a missing Section five hundred eight compliance declaration. Violation twelve is a missing privacy policy and terms of use on the root page.
Deterministic Accounting and Exposure
The operational window is the current website state as captured in the source code. For the deterministic accounting, the lifespan is calculated from the date of the audit forward, with daily accrual of the statutory penalties. The Town of Chapin’s website has been operated under the CivicPlus platform since at least its most recent redesign. The population baseline is one thousand eight hundred nine residents. The daily total is one hundred twelve thousand six hundred twenty dollars. The annual total is forty one million one hundred six thousand three hundred dollars. The per capita exposure is twenty two thousand seven hundred twenty three dollars and thirty three cents per resident per year. The Town of Chapin bears vicarious liability for all twelve violations. CivicPlus bears processor liability for the platform wide tracking and anti forgery scripts. Google bears processor liability for tag manager, analytics, maps, and translate. Microsoft bears processor liability for Azure Application Insights. DocAccess bears processor liability for the accessibility widget. The cumulative joint and several liability is forty one million one hundred six thousand three hundred dollars.
CivicPlus Corporate Site — Source Code Inspection
Overview
This audit examines the root HTML source code of the CivicPlus corporate website at civicplus dot com. CivicPlus markets itself as the modern civic impact platform and claims to serve over thirteen thousand local government customers, one hundred thousand public servant users, and three hundred forty million resident users. The audit identifies fourteen distinct violations of federal privacy law, state consumer protection statutes, international data protection frameworks, and federal contracting integrity requirements. The evidence establishes that CivicPlus, a vendor that markets itself to government agencies as a compliant, accessible, security conscious platform, operates its own corporate website with the same undisclosed tracking, third party data harvesting, and cross domain tokenization practices that it purportedly helps governments avoid. The website deploys Google Tag Manager, Google Analytics, Forethought artificial intelligence chat, DocAccess, AudioEye, HubSpot, Yoast search engine optimization, Algolia, and WordPress, while providing no visible privacy notice on the root page, no California Consumer Privacy Act opt out link, and no disclosure of the data categories collected or the purposes of collection. The irony is material and legally significant. CivicPlus sells compliance tools to governments. Its own website does not comply with the standards it sells.
Technical Baseline
The target domain is civicplus dot com. The server platform is WordPress version seven point one point three, self reported via the generator meta tag. The site uses a custom CivicPlus theme. The site uses Yoast search engine optimization Premium version twenty eight point seven. The site loads Google Tag Manager container G T M dash W H H eight Z K R in both the head section and the body noscript section. The site retains a commented out Google Analytics Universal tracking identifier. The site loads the Forethought chat widget with its public application programming interface key. The site loads the DocAccess document accessibility script. The site loads the AudioEye accessibility overlay. The site references HubSpot scripts. The site loads Algolia search with application identifier L seven C eight two J D zero N five and public search application programming interface key. The site uses the WP Simple Firewall Shield plugin version twenty two point two point six. The site publishes to Facebook, X, LinkedIn, and YouTube. The legal name is CivicPlus Limited Liability Company, per the Yoast organization schema. The last modified date is October nineteenth of two thousand twenty six.
The Fourteen Violations
Violation one is undisclosed third party data transfer to Google, Forethought, HubSpot, AudioEye, and DocAccess. Violation two is Google Tag Manager firing before consent. Violation three is undisclosed artificial intelligence chat data harvesting via Forethought. Violation four is undisclosed Algolia search data transmission. Violation five is accessibility overlay without consent, which raises potential biometric privacy exposure under the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act. Violation six is Google Analytics tracking code retained despite a removal comment. Violation seven is a missing California Consumer Privacy Act do not sell or share link. Violation eight is a missing Florida Information Protection Act notice at collection. Violation nine is cross border transfer without a lawful basis. Violation ten is an exposed application programming interface key and application identifier. Violation eleven is a failure to disclose the artificial intelligence chatbot’s data processing. Violation twelve is a deceptive trade practice in marketing compliance while violating it. Violation thirteen is undisclosed Do Not Track and Global Privacy Control non compliance. Violation fourteen is a failure to provide an accessibility statement on the root page.
The Compliance Pretense
CivicPlus markets itself as a platform that ensures governments can handle compliance, accessibility, emergencies, and growth. The Town of Chapin’s deployed website contains no privacy notice, no accessibility statement, no Section five hundred eight declaration, and no consent management platform. The product does not deliver the compliance it promises. The privacy policy states that CivicPlus is acting as a data custodian only. The data processing addendum states that CivicPlus is an independent controller of resident account data and processes it for account administration, authentication, platform analytics, fraud prevention, artificial intelligence system functionality, and cross customer interoperability. A custodian does not process data for its own business purposes. The custodian representation is false. The privacy policy states that the user may choose to set their web browser to refuse cookies. The deployed product sets six cookies on page load before the user takes any action. The browser refusal mechanism is not a consent gate. It is a post hoc opt out that requires technical knowledge the average resident does not have. The terms of use prohibit users from engaging in automated scraping for artificial intelligence training purposes. The privacy policy says CivicPlus may use anonymized or aggregated data for artificial intelligence features. The subprocessor list identifies OpenAI as a subprocessor for artificial intelligence document processing and transcript generation. CivicPlus prohibits users from scraping CivicPlus data for artificial intelligence, while CivicPlus scrapes municipal resident data for artificial intelligence. The asymmetry is material to the bargain.
Deterministic Accounting
The operational window is the date of the most recent source code modification, October nineteenth of two thousand twenty six, plus the historical operation period. CivicPlus self reports twenty five years of operation in the source code, which is used as the operational baseline for the historical lifespan calculation. The daily total is three hundred twelve thousand eight hundred sixty dollars. The annual total is one hundred fourteen million one hundred ninety three thousand nine hundred dollars. The lifespan total for twenty five years and nine thousand one hundred twenty five days is two billion five hundred fifty two million nine hundred forty seven thousand five hundred dollars.
CivicPlus Contractual and Privacy Architecture
Overview
This audit examines four contractual and privacy documents published by CivicPlus. The first is the Terms of Use, last revised March twentieth of two thousand twenty six and updated November first of two thousand twenty two. The second is the Data Processing Addendum. The third is the Master Services Agreement, updated October nineteenth of two thousand twenty six and published July fourteenth of two thousand twenty five. The fourth is the Privacy Policy, updated August twenty eighth of two thousand twenty six and effective June seventeenth of two thousand twenty six. The audit identifies eleven distinct structural findings that are material to the Town of Chapin matter and to the proposed class action.
The Central Finding
The central finding is that CivicPlus has constructed a contractual architecture that systematically shifts privacy responsibility to municipalities while retaining for itself the right to process resident data for its own business purposes. The Data Processing Addendum creates a three tier data governance structure. Service data is data where CivicPlus is a processor. Resident account data is data where CivicPlus is an independent controller. Co controlled data is data where both parties are independent controllers. This structure means that the data the Town of Chapin believed was being processed on its behalf is, in significant part, being processed by CivicPlus for CivicPlus’s own purposes.
Finding One — Three Tier Data Governance Shifts Responsibility to Municipalities
The Data Processing Addendum creates service data, resident account data, and co controlled data categories. CivicPlus is an independent controller of resident account data and processes it for its own business purposes. The municipality is responsible for privacy notices, lawful basis, consumer rights, and retention schedules for data it does not control.
Finding Two — Cross Customer Interoperability Bars Municipal Objection
Section fourteen of the Data Processing Addendum preemptively bars municipalities from asserting that CivicPlus cross customer data sharing constitutes unauthorized disclosure, provided the sharing occurs at the affirmative direction of the consumer. The consumer’s affirmative direction is a terms of service click.
Finding Three — Liability Cap is Functionally an Immunity Clause
Section thirty two of the Master Services Agreement caps liability at the annual recurring services fee. For a small municipality the size of the Town of Chapin, that fee is approximately four thousand to six thousand dollars. The statutory exposure identified in the parent audit is forty one million one hundred six thousand three hundred dollars annually. The cap is not a limitation. It is an immunity.
Finding Four — No Privacy Indemnification
Section fifteen of the Master Services Agreement requires CivicPlus to defend intellectual property infringement claims but does not require CivicPlus to defend privacy claims, data breaches, or regulatory fines.
Finding Five — Data Custodian Framing Conflicts with Independent Controller Status
The privacy policy says CivicPlus is a data custodian only. The Data Processing Addendum says CivicPlus is an independent controller of resident account data and processes it for its own business purposes. A custodian does not process data for its own business purposes. The documents are inconsistent.
Finding Six — Do Not Track Signals Not Honored
The privacy policy states that CivicPlus does not respond to web browser do not track signals at this time. The tracking scripts fire regardless of browser privacy signals.
Finding Seven — No Consent Management Platform
The privacy policy describes browser level cookie refusal as the only opt out. There is no consent gate, no preference center, and no mechanism to refuse non essential cookies before they are set. The parent audit found six cookies set on page load.
Finding Eight — Artificial Intelligence Data Flows to OpenAI Not Disclosed
The subprocessor list identifies OpenAI for artificial intelligence document processing and transcript generation. The privacy policy artificial intelligence features section does not mention OpenAI. The Data Processing Addendum definition of resident account data includes artificial intelligence interaction logs.
Finding Nine — Subprocessor List Buried in Help Center
The privacy policy refers to agents, vendors, service providers, and subcontractors generically. The actual list of over thirty subprocessors, including Google, Microsoft, OpenAI, Pendo, Okta, Stripe, and Twilio, is published on the help center, not linked from the privacy policy, and not referenced in the terms of use.
Finding Ten — Merger and Acquisition Data Transfer Provision
The privacy policy permits transfer of personal information if CivicPlus is acquired, sold, or dissolved. The Insight Partners two hundred ninety million dollar investment makes a future exit foreseeable. Resident data is an asset in any transaction.
Finding Eleven — Age Requirement Inconsistency
The terms of use require users to be at least sixteen if they are United States residents or eighteen if they are non United States residents. The privacy policy says use requires users to be at least thirteen. The inconsistency is material for a municipal website used by residents of all ages.
CivicPlus Federal Fraud and Statutory Violations Cross Reference
Overview
This audit applies the federal criminal and civil statutes to the conduct documented across the three prior CivicPlus audits. The specific question addressed is whether the documented conduct constitutes wire fraud under Title eighteen of the United States Code Section one thousand three hundred forty three, and the related federal statutory violations identified in the evidentiary record. The audit finds that the evidentiary record establishes the elements of wire fraud, in addition to violations of the Computer Fraud and Abuse Act, the Wiretap Act, the Stored Communications Act, and the Federal Trade Commission Act.
The Central Factual Predicate
The central factual predicate for wire fraud is the gap between what CivicPlus represents to municipalities and what its product actually does. CivicPlus markets itself as a compliance partner that enables governments to handle compliance, accessibility, emergencies, and growth. It publishes a privacy policy that says users may choose to set their web browser to refuse cookies. It publishes a terms of use that prohibits automated scraping for artificial intelligence training. It publishes a data processing addendum that says CivicPlus is a data custodian only. And then it deploys a product that sets six device fingerprinting cookies on page load without consent, fires Google Tag Manager and Azure Application Insights before any consent gate, tracks every click with legacy Google Analytics, exposes an application programming interface key, and provides no privacy notice or accessibility statement on a municipal website serving one thousand eight hundred nine residents.
The misrepresentation is material. Municipalities contract with CivicPlus because they believe they are buying a compliant platform. The residents of those municipalities use the website because they have no choice. The wire communications, the HTTP requests, the application programming interface calls, and the data transmissions to Google and Microsoft, carry the scheme across state lines. The intent to deceive and cheat is demonstrated by the contractual architecture. The Data Processing Addendum three tier data governance structure, the Master Services Agreement liability cap that functions as an immunity clause, and the privacy policy data custodian framing that conflicts with the independent controller designation.
Element One — Scheme to Defraud for Money or Property
CivicPlus devised a scheme to obtain money, in the form of municipal contract fees, annual recurring services fees, and implementation fees, by means of false or fraudulent pretenses. The pretenses are documented in the audited contractual and marketing materials. The compliance pretense is that CivicPlus markets itself as a platform that ensures governments can handle compliance, accessibility, emergencies, and growth. The Town of Chapin deployed website contains no privacy notice, no accessibility statement, no Section five hundred eight declaration, and no consent management platform. The product does not deliver the compliance it promises. The data custodian pretense is that the privacy policy states that CivicPlus is acting as a data custodian only, while the data processing addendum states that CivicPlus is an independent controller of resident account data and processes it for account administration, authentication, platform analytics, fraud prevention, artificial intelligence system functionality, and cross customer interoperability. A custodian does not process data for its own business purposes. The custodian representation is false. The cookie consent pretense is that the privacy policy states that the user may choose to set their web browser to refuse cookies, while the deployed product sets six cookies on page load before the user takes any action. The browser refusal mechanism is not a consent gate. The artificial intelligence training prohibition asymmetry is that the terms of use prohibit users from engaging in automated scraping for artificial intelligence training purposes, while the privacy policy says CivicPlus may use anonymized or aggregated data for artificial intelligence features. The subprocessor list identifies OpenAI as a subprocessor for artificial intelligence document processing and transcript generation. CivicPlus prohibits users from scraping CivicPlus data for artificial intelligence, while CivicPlus scrapes municipal resident data for artificial intelligence. The asymmetry is material to the bargain.
Element Two — Materiality
A statement is material if it has a natural tendency to influence, or is capable of influencing, a person to part with money or property. The compliance representations are material because municipalities would not contract with CivicPlus if they knew the product tracked residents without consent, exposed application programming interface keys, and failed to provide the accessibility statements the municipalities are legally required to maintain under Title Two of the Americans with Disabilities Act. The residents would not use the website if they knew their page views and click events were being transmitted to Google and Microsoft. The materiality is inherent in the transaction. The municipality is buying compliance, and the product is not compliant.
Element Three — Intent to Deceive and Cheat
The intent to deceive and cheat is demonstrated by the deliberate design of the contractual architecture. The Data Processing Addendum three tier data governance structure is not an accident. It is a mechanism for reclassifying resident data as CivicPlus controlled data so that CivicPlus can process it for its own purposes while the municipality bears the compliance burden. The Master Services Agreement liability cap is not a negotiated limitation. It is a functional immunity clause against the forty one million one hundred six thousand three hundred dollar annual statutory exposure identified in the parent audit. The privacy policy data custodian framing is not a description. It is a misdirection.
Element Four — Interstate Wire Communication
The wire communications are the HTTP requests, application programming interface calls, and data transmissions that occur every time a resident visits the Town of Chapin’s website. The Google Tag Manager container fires a request to the Google Tag Manager domain. The Azure Application Insights script fires a request to the Microsoft monitor domain. The Google Analytics event tracking fires a send command on every click, transmitting the event data to Google. The exposed Google Maps application programming interface key is transmitted in every page load. These are interstate wire communications because Google and Microsoft are headquartered in California and Washington, respectively, and the data transits interstate networks. The wire communications are essential to the scheme because they are the mechanism by which CivicPlus obtains the resident data that it processes for its own purposes. Without the transmissions to Google and Microsoft, CivicPlus would have no platform analytics data, no artificial intelligence interaction logs, and no cross customer interoperability data. The transmissions are not incidental. They are the product.
Additional Federal Statutes
The Computer Fraud and Abuse Act, Title eighteen, Section one thousand thirty, subsection A, paragraph two, prohibits intentionally accessing a computer without authorization or exceeding authorized access and thereby obtaining information from any protected computer. The tracking scripts, cookies, and analytics mechanisms obtained information from the residents protected computers without authorization. The authorization was exceeded because the residents did not consent to the tracking. The purpose was commercial advantage or private financial gain because CivicPlus processes the data for platform analytics and artificial intelligence system functionality, which are commercial purposes.
The Wiretap Act, Title eighteen, Section twenty five hundred eleven, prohibits the intentional interception of electronic communications. The tracking scripts intercepted the residents electronic communications, including page views and click events, without consent. The interception occurred in real time as the resident interacted with the website. The data was transmitted to Google and Microsoft, who are third parties to the communication between the resident and the Town of Chapin.
The Stored Communications Act, Title eighteen, Section twenty seven hundred one, prohibits unauthorized access to stored electronic communications. The tracking scripts and the analytics mechanisms accessed the residents stored electronic communications. The data was in electronic storage on the residents devices and on the Town of Chapin’s servers. The access was for commercial advantage because CivicPlus processes the data for its own purposes.
The Federal Trade Commission Act, Title fifteen, Section forty five, subsection A, prohibits unfair or deceptive acts or practices in or affecting commerce. CivicPlus markets itself as a compliance partner. Its product tracks residents without disclosure. The gap between marketing and practice is a deceptive trade practice.
The Codified Circular Logic
The audit identifies a structural pattern that the master audit prompt describes as codified circular logic. The pattern operates as follows. The law defines the standard. The California Consumer Privacy Act, the Florida Information Protection Act, the South Carolina Freedom of Information Act, Title Two of the Americans with Disabilities Act, and Section five hundred eight define what compliance requires, namely notice, consent, accessibility, and reasonable security. The vendor defines the contract. CivicPlus defines the contractual terms that govern its relationship with the municipality. The Data Processing Addendum reclassifies resident data as CivicPlus controlled data. The Master Services Agreement caps liability at the annual recurring services fee. The Terms of Use imposes a one year statute of limitations and a Kansas forum clause. The practice defines the compliance. The vendor’s deployed product sets cookies without consent, fires analytics before consent, exposes application programming interface keys, and omits privacy notices. The vendor calls this compliance because the contract says it is. The loop closes. The municipality cannot enforce the law because the contract bars enforcement. The resident cannot enforce the law because the Terms of Use bars class actions and imposes a one year limitation. The regulator cannot enforce the law because the vendor’s contractual architecture shifts responsibility to the municipality, and the municipality has no control over the vendor’s product. This is the circular logic. The vendor writes the contract, the contract defines the compliance, and the compliance is whatever the vendor says it is. The law is reduced to a definitional exercise in which the vendor is the definer. The wire fraud is the mechanism by which the loop is closed. The vendor represents compliance to obtain the contract, and the contract insulates the vendor from the consequences of non compliance.
Summary of Findings
Finding one is wire fraud under Title eighteen, Section one thousand three hundred forty three. CivicPlus devised a scheme to obtain municipal contract revenue and resident data by means of false compliance representations. The representations were material. The intent to deceive and cheat is demonstrated by the contractual architecture. The scheme was carried out through interstate wire communications. The penalty is up to twenty years imprisonment and a fine.
Finding two is a Computer Fraud and Abuse Act violation. Tracking scripts, cookies, and analytics mechanisms obtained information from protected computers without authorization for commercial advantage. The penalty is up to five years imprisonment and a fine.
Finding three is a Wiretap Act violation. Tracking scripts intercepted electronic communications in real time without consent. The penalty is up to five years imprisonment and a fine.
Finding four is a Stored Communications Act violation. Unauthorized access to stored electronic communications for commercial advantage. The penalty is up to five years imprisonment and a fine.
Finding five is a Federal Trade Commission Act violation. Deceptive trade practice in marketing compliance while deploying non compliant tracking. Civil penalties and injunctive relief.
Finding six is the codified circular logic. The contractual architecture creates a closed loop in which the vendor defines compliance and insulates itself from the consequences of non compliance. The wire fraud is the mechanism by which the loop is closed.
Certification and Next Steps
What These Reports Establish
These reports establish that two problems are operating at the same time and reinforcing each other. The first problem is transactional. Individual real estate licensees are refusing to present written offers, demanding that buyers convert their independently drafted and attorney prepared offers into trade association templates, extracting unredacted personal identifying documents under a false claim of federal anti money laundering obligation, and obstructing statutory custodial conveyances under the Uniform Transfers to Minors Act. These practices violate the statutory presentation duties in the South Carolina Real Estate License Practice Act, exceed the narrow unauthorized practice of law privilege recognized in the Conway Bogue line of cases, and expose the licensees and their supervising Brokers in Charge to administrative discipline, common law tort liability, and treble damages under the South Carolina Unfair Trade Practices Act.
The second problem is institutional. The South Carolina Association of REALTORS, which is the body charged with adjudicating ethics complaints against its members, operates its public ethics intake portal on an unmanaged third party cloud platform. That portal lacks point of collection privacy notices, captures signature canvas telemetry without biometric disclosures, exposes an operational Zoho Maps client key in publicly delivered browser source, introduces accessibility barriers under Title Three of the Americans with Disabilities Act, and fragments confidential evidence into unsecured commercial email channels. The resulting joint and several civil penalty liability reaches eighteen million two hundred fifty thousand dollars across a three hundred sixty five day operational cycle.
The third problem is structural. CivicPlus, which markets itself to municipal governments as a compliance platform, operates its own corporate site and its municipal customer deployments with undisclosed tracking, missing privacy notices, exposed application programming interface keys, and cross border transfers without a lawful basis. The contractual architecture built into the Data Processing Addendum, the Master Services Agreement, and the Terms of Use systematically shifts privacy responsibility to municipalities while retaining for CivicPlus the right to process resident data for its own business purposes. The federal fraud cross reference audit establishes that the gap between what CivicPlus represents and what its product actually does satisfies all four elements of wire fraud under Title eighteen, Section one thousand three hundred forty three.
Remediation Directives
The audit recommends, without waiving the forensic findings, the following operational reforms. Real estate brokerage firms and Brokers in Charge must align internal office policies with Section forty dash fifty seven dash three hundred fifty, recognizing that all written offers must be transmitted to the property owner immediately, regardless of contract form, custodial title structures, or pre closing identification status. Supervising brokers must institute strict compliance protocols ensuring the mandatory issuance of Commission Form SCR three hundred fourteen within forty eight hours of any offer rejection. Real estate trade associations must overhaul their digital administrative infrastructure, replacing unmanaged third party web forms with accessible, privacy compliant intake architectures that incorporate statutory privacy disclosures, biometric collection options, secure file encryption, and conformance with the Web Content Accessibility Guidelines version two point two level double A. Municipalities must require vendors to provide contractual indemnification for privacy claims and regulatory fines, and must refuse liability caps that function as immunity clauses for statutory violations.
Until These Corrections Are Implemented
Until these operational and technical corrections are implemented, the real estate brokerage sector and the municipal vendor sector remain exposed to coordinated regulatory enforcement, professional licensing discipline, and significant civil liability across state and federal courts. The evidence in these reports has been preserved, catalogued by reference, and made available for referral to the South Carolina Real Estate Commission, the South Carolina Attorney General, the Federal Trade Commission Bureau of Consumer Protection, the United States Department of Justice Civil Rights Division Disability Rights Section, the Financial Crimes Enforcement Network, and the United States Attorney for the District of South Carolina.
Certification
I, Henri Bryant Lanier Senior, Esquire, Doctor of Philosophy, as Principal Auditor of Ladco Defense Technologies, hereby certify that the audits summarized in this reading edition have been conducted with the utmost diligence, in accordance with the standards set forth in Title twenty two, Section two thousand two hundred ninety five A, Title fifty, Section one thousand seven hundred two, Title ten, Section two thousand three hundred four, and all applicable federal, state, and international laws. The findings, conclusions, and financial exposures presented are based on the evidence contained within the audited source code, the verbatim text of the audited analysis file, the publicly available compliance documentation of the vendors, and the statutory and jurisprudential authorities as cited. These reports are verbatim evidentiary records and may be used in legal proceedings. No corrective actions are proposed beyond the remediation directives above. The audits solely establish the legal violations and resulting liability.