Intermediary liability » Digital Age Defense

Follow, not lead

Analysis/commentary, Intermediary liability, Privacy from government, Privacy from private parties, Unauthorized access No Responses »

Feb 202013

At an event on CFAA reform last night I heard Brewster Kahle say what to my ears sounded like, “Law that follows technology tends to be ok. Law that tries to lead it is not.”

His comment came after an earlier tweet I’d made:

I think we need a per se rule that any law governing technology that was enacted more than 10 years ago is inherently invalid.

In posting that tweet I was thinking about two horrible laws in particular, the Computer Fraud and Abuse Act (CFAA) and the Electronic Communications Privacy Act (ECPA). The former attempts to forbid “hacking,” and the second ostensibly tried to update 1968’s Wiretap Act to cover information technology. In both instances the laws as drafted generally incorporated the attitude that technology as understood then would be the technology the world would have forever hence, a prediction that has obviously been false. But we are nonetheless left with laws like these on the books, laws that hobble further innovation by how they’ve enshrined in our legal code what is right and wrong when it comes to our computer code, as we understood it in 1986, regardless of whether, if considered afresh and applied to today’s technology, we would still think so.

To my tweet a friend did challenge me, however, “What about Section 230? (47 U.S.C. § 230).” This is a law from 1996, and he has a point. Section 230 is a piece of legislation that largely immunizes Internet service providers for liability in content posted on their systems by their users – and let’s face it: the very operational essence of the Internet is all about people posting content on other people’s systems. However, unlike the CFAA and ECPA, Section 230 has enabled technology to flourish, mostly by purposefully getting the law itself out of the way of the technology.

The above are just a few examples of some laws that have either served technology well – or served to hamper it. There are certainly more, and some laws might ultimately do a bit of both. But the general point is sound: law that is too specific is often too stifling. Innovation needs to be able to happen however it needs to, without undue hindrance caused by legislators who could not even begin to imagine what that innovation might look like so many years before. After all, if they could imagine it then, it would not be so innovative now.

More like trespass than theft

Analysis/commentary, Criminal IP Enforcement, Intermediary liability No Responses »

Feb 092013

The following case, Twentieth Century Fox v. Harris, is not a criminal matter. But I want to include it here nonetheless in part because it’s important to talk about copyright policy generally, particularly given the increasing trend for it to be criminalized. And partly because, in this case, hardly two weeks after I asserted that copyright infringement analogized more to trespass than to theft, a court independently reached the same conclusion. Continue reading »

The PayPal Problem – a comment on intermediary liability

Analysis/commentary, Intermediary liability, Regulating speech 1 Response »

Feb 292012

PayPal recently made news for implementing a policy denying its payment processing services to publications including obscene content. There are several things objectionable about this policy, including the lack of any clear way of delineating what content would qualify as “obscene,” and its overall censorious impact.

But I’m not entirely sure that PayPal is necessarily the appropriate target for criticism of this policy. It may be, to the extent that it is a truly discretionary policy PayPal has voluntarily chosen to pursue. If it could just as easily chosen not to pursue it it can be fairly criticized for the choice it did make. For this policy is not as simple as banning certain objectively horrible content 100% of all people would agree should be stricken from the face of the earth. After all, there *is* no objectively horrible content 100% of all people would agree is objectionable. Instead this policy has the effect of denying market opportunities to all sorts of writers producing all sorts of valid content, even if some people may not happen to like it. And it does this not just by denying particular publications access to its services but by forcing electronic publishers to overcensor all the works they publish lest PayPal services be shut off to their entire businesses. Continue reading »

Roommates.com redux

Analysis/commentary, Intermediary liability No Responses »

Feb 062012

While I was working on this post Eric Goldman beat me to the punch and posted something similar. But great minds and all that… Intermediary liability is also such a crucial issue related to the criminalization of online content I want to make sure plenty of discussion on it takes place here.

In addition to the First Amendment, in the US free speech on the Internet is also advanced by 47 U.S.C. Section 230, an important law that generally serves to immunize web hosts for liability in user generated content. (See Section 230(c)(1): “No provider . . . of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”). Note that this law doesn’t absolve the content of any intrinsic liability; it just means that the host can’t be held liable for it. Only the user who posted it can be.

This small rule has a big impact: if hosts could be held liable for everything their users’ posted, they would be forced to police and censor it. True, the effect of this immunity means that sometimes some vile content can make its way online and linger there, potentially harmfully. But it also means that by not forcing hosts to be censorious middlemen, they are not finding themselves tempted to kill innocuous, or even abjectly good, content. As a result all sorts of vibrant communities and useful information have been able to take root on the Web.

But for this immunity to really be meaningful, it’s not enough that it protect the host from a final award on damages. It’s extremely expensive to have to be dragged into court at all. If hosts legitimately fear needing to go through the judicial process to answer for users’ content, they may find it more worth their while to become censorious middlemen with respect to that content, in order to ensure they never need go down this road.

Which brings us to Fair Housing Council of San Fernando v. Roommates.com, both its seminal piece of Section 230 jurisprudence and its more recent epilogue, each part of the attempted civil prosecution of a web host for fair housing act violations. Continue reading »

Korean online portals and game companies to stop asking for user data

Examples, Intermediary liability, Privacy from government No Responses »

Jan 232012

This article in the Korea Times reports that several large online presences in Korea have stopped asking for users’ resident registration numbers when subscribing to their sites. They began to ask in 2007 as a means of ensuring compliance with the government’s requirement that users provide their real names. However, the government had no means to enforce that rule on foreign websites, and it has led to instances of identity theft.

Nexon recently had the private data of 13 million users hacked. Nate and Cyworld, its sister social networking service, had 35 million users’ details compromised after being hacked. After a series of private information leaks at large businesses like Nate, Nexon, Auction, and Hyundai Capital, now virtually all the resident registration numbers of Koreans are available.

As they hold the key to entering Internet sites, criminals can collect almost anyone’s details by collecting information from two or three websites, acquiring names, phone numbers, email addresses, home addresses, office addresses, shopping records, bank account numbers and even blood types.

Some victims submitted a petition to the court last month, requesting they be allowed to change their registration number. “We are on the verge of suffering from more damage as we are forced to continuously use our leaked registration numbers with no countermeasures being taken so far,” the complainants said in their suit.

The Korea Communications Commission is now planning regulation preventing resident numbers from being held online.

India continues to flirt with web censorship

Examples, Intermediary liability, Regulating speech No Responses »

Jan 132012

Last month Kapil Sibal, acting telecommunications minister for India, floated the proposition that social networks actively filter all content appearing on their systems. Now comes news that a judge in New Delhi also thinks web censorship appropriate. From the New York Times:

The comments of the judge, Suresh Kait, came in response to a lawsuit, filed by a private citizen in the capital, New Delhi. The suit demands that Internet companies screen content before it is posted on sites like Facebook, Google or Yahoo, that might offend the religious sentiments of Indians. A related criminal case accuses the companies — 21 in all — of violating an Indian law that applies to books, pamphlets and other material that is deemed to “deprave or corrupt.”

A trial court in New Delhi on Friday ordered that summons be served in the criminal case to officials at all 21 companies at their foreign headquarters’ addresses.

…

Google and Facebook refused to comment on the case, except to say they had filed a motion in the New Delhi High Court to dismiss the criminal case.

Their motion will be considered on Monday. Continue reading »

Belgian ISP censorship

Criminal IP Enforcement, Examples, Intermediary liability No Responses »

Dec 112011

The EFF has a report of a case involving Belgium ISPs.

Last September, in a case initiated by the Belgian Anti-Piracy Federation (BAF), an Antwerp Court of Appeals ordered two major fixed broadband providers (Telenet and Belgacom) to block access to the Pirate Bay at the DNS level. In November, the BAF sent a letter to other Belgian ISPs, threatening legal action unless they also blocked access to the Pirate Bay.

Earlier this week, a Belgian Internet watchdog group (NURPA) reported that one of the three major mobile Internet providers in Belgium, Base, complied with the letter and voluntarily started blocking access to the Pirate Bay.1 Base denies these reports, but users who try to access the Pirate Bay are served a “stop page” with the following text, in Dutch, French, German, and English: “You have been redirected to this stop page because the website you are trying to visit offers content that is considered illegal according to Belgian legislation.” The only way offered for the owner or administrator of the website to object is via fax.

The EFF points out that the ruling in this Belgium case would appear to conflict with the European Court of Justice ruling in Scarlet v. Sabam, a case that also originated in Belgium. In that case the ECJ ruled that “requiring ISPs to filter traffic over their network violates users’ privacy and their freedom to receive and impart information.” Although the final judgment in this case came after the Belgian ruling, there had already been an opinion by the Advocate General reflecting it.

The Belgian judge, though, deemed the case before the ECJ irrelevant, making a distinction between filtering and blocking. These two types of censorship often appear identical to the end user, but the court argued that they are different technically and legally. Filtering implies the monitoring of traffic in order to remove specific content. Blocking, on the other hand, would only require indiscriminately restricting access to a given domain. The Belgian (Pirate Bay) case concerned (DNS) blocking, whereas the European case concerned filtering. According to the Belgian judge, DNS blocking would not constrain fundamental liberties. But while blocking does not raise as many privacy concerns as filtering does, all other concerns remain very relevant. Without even going in to the dangers of interfering in such an essential component of the Internet, (DNS) blocking access to a website as a whole violates individual freedom to impart and receive information. It also ignores the fact that copyright is not an absolute right and is subject to important exceptions.

In other words, it appears the Belgium court only considered filtering and blocking as potential violations to fundamental freedoms vis a vis the potential privacy problems involved with monitoring traffic for the purposes of censoring, and not with the censorship itself.

(The EFF article also notes that Dutch parent company, KPN, has already admitted that it monitored its customer’s traffic through deep packet inspection (DPI).)

India asks social media sites to filter content

Examples, Intermediary liability, Regulating speech No Responses »

Dec 052011

From the NY Times, news that Kapil Sibal, acting telecommunications minister, has been meeting with executives from Google, Microsoft, Facebook, and Yahoo to tell them to prescreen user content from India and censor that which is deemed disparaging, inflammatory, or defamatory.

About six weeks ago, Mr. Sibal called legal representatives from the top Internet service providers and Facebook into his New Delhi office, said one of the executives who was briefed on the meeting.

At the meeting, Mr. Sibal showed attendees a Facebook page that maligned the Congress Party’s president, Sonia Gandhi. “This is unacceptable,” he told attendees, the executive said, and he asked them to find a way to monitor what is posted on their sites.

In the second meeting with the same executives in late November, Mr. Sibal told them that he expected them to use human beings to screen content, not technology, the executive said.

The three executives said Mr. Sibal has told these companies that he expects them to set up a proactive prescreening system, with staffers looking for objectionable content and deleting it before it is posted.

…

The demand is the Indian government’s latest attempt to monitor and control electronic information. In April, the ministry issued rules demanding Internet service providers delete information posted on Web sites that officials or private citizens deemed disparaging or harassing. Last year, the government battled with Blackberry’s manufacturer, Research In Motion, threatening to shut the company’s service off in India if it did not allow government officials greater access to users’ messages.

The Indian government also plans to set up its own unit to monitor information posted on Web sites and social media sites, executives said, which will report to Gulshan Rai, the director general of India’s cyber-security monitor. Continue reading »