Driver Education for theInformation Superhighway:

The Law and Policy of the Internet

Steven J. McDonald

Associate Legal Counsel

The Ohio State University

22nd Annual National Conference on Law and Higher Education

Agenda

• A brief overview of Internet law since 1728

• Computer use policies: Do you really even need one?

• Liability for computer misconduct: What you don’t know probably won’t hurt you

• Meta-geography and cyber-jurisdiction

• Privacy in cyberspace (“Stalking 101”)

• Questions (and maybe even some answers)

Two Views on Internet Law

• “In the future, virtually all law will be Internet law in one way or another.”

– George Gilder

• Internet law is all law, right now.

A Brief Overview of Internet Law Since 1728

In the beginning was the word . . . .

What is the Internet?

• A bulletin board• A printing press• A library• A bookstore• A television set and a television station• A telephone, with lots of party lines and unlimited

conference calling• A post office• . . .

What is the Internet?

A medium of communication

And that means that . . .

• Everyone with Internet access is potentially an international publisher and broadcaster – Including your five-year-old

• This has some fairly significant legal implications– The same laws that apply to the New York

Times, NBC, and NPR apply to Internet users– Including your five-year-old

Three Key Misconceptions

• Cyberspace is a separate legal jurisdiction– In fact, conduct that is illegal or a violation of policy in

the “offline” world is just as illegal or a violation of policy when it occurs online

• Free access = free speech = unfettered speech– In fact, even public institutions may limit the use of their

computer resources to business-related purposes

• If it’s technically possible, it’s legal– In fact, the technology has some legal implications, but it

does not define the outer limits of the law

One Key Point

• Internet law (and policy) existed long before the Internet:– The law of libel– The law of privacy– The law of copyright– Criminal law– Your sexual harassment policy, code of student

conduct, workplace rules– . . .

And Two Key Implications

• Internet-specific rules aren’t necessary and may create problems– Except when there are unique issues that aren’t

already covered by generally applicable laws and policies

• Education is critical

Driver Education for the Information Superhighway

• Ohio State: Virtual Legality– http://www.cio.ohio-state.edu/policies/legality.html

• James Madison: Electronic Information Security User Education– https://secureweb.jmu.edu/cgi-bin/chpasswd.secaware.fpl

• Cornell: Travelers of the Electronic Highway– http://www.cit.cornell.edu/training/teh/teh.html

New Whines and Old Battles

• It isn’t always immediately clear (surprise!) how the law applies to new situations

• For example, the law of libel developed long before there were Internet service providers

• So, are we liable for the libels that occur on our systems?

The Law of the Horse

“This case requires the law to add another paragraph to the ‘rules of the road’ for the ‘information superhighway’ and cyberspace. It is yet another testimony to the resiliency and flexibility of the case-by-case incremental development concept we inherited from the Common Law, which emphasizes adherence to [precedent]. As our superior court noted in United States v. Maxwell, new technologies present new challenges, but they are met by adapting existing legal concepts to them.”

United States v. Monroe (A.F.C.C.A. 1999)

Key Dates in the Developmentof the Law of ISP Liability

• 1728 -- The King v. Clerk

• 1889 -- Fogg v. Boston & Lowell RR. Co.

• 1933 -- Layne v. The Tribune Co.

• 1952 -- Hellar v. Bianco

• 1973 -- Anderson v. New York Telephone

• 1986 -- Spence v. Flynt

Who is responsible?

• Publishers– Create content and hold it forth as their own– Directly liable for the libels they disseminate

• Distributors– Don’t create, but choose to, and actively do, distribute– Liable only if they “knew or should have known” that

what they are distributing is libelous– No duty to prescreen

• Conduits– Operate a system by which other people communicate– No liability for libel, regardless of knowledge

Key Dates in the Developmentof the Law of ISP Liability

• 1991 -- Cubby v. CompuServe

• 1995 -- Stratton Oakmont v. Prodigy

• 1996 -- The Communications Decency Act

• 1997 -- Zeran v. America Online

• 1998 -- Digital Millennium Copyright Act

• 1999 -- Lunney v. Prodigy

Whose law applies?

• Subject matter jurisdiction– Jurisdiction over the case

• Type of case

• Amount in dispute

• Personal jurisdiction– Jurisdiction over the parties

• Originally a matter of pure geography . . .

Judicial Geography

h ttp ://www .law .em ory.ed u /FE DCTS

Internet Geography

h ttp ://www .cyb e rge o g ra p h y.o rg /a tlas /g eo g rap h ic .h tm l

Where do you want to be sued today?

h ttp ://w ww .cybe rg e og ra ph y.o rg /a tla s /rou te s.h tm l

A Really Big Shoe

“[D]ue process requires only that in order to subject a defendant to a judgment in personam, if he be not present within the territory of the forum, he have certain minimum contacts with it such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’”

International Shoe Co. v. Washington (U.S. 1945)

And Another

“We find that Sullivan, as the producer and master of ceremonies of ‘The Ed Sullivan Show,’ entered Arizona by producing the play entitled ‘A Case of Libel’ in New York City. . . . [T]he telecast of the show . . . in Arizona [was] voluntary, purposeful, reasonably foreseeable and calculated to have effect in Arizona . . . .”

Pegler v. Sullivan (Ariz. Ct. App. 1967)

Zippo Dee Doo Dah• “If a defendant enters into contracts with residents of a foreign

jurisdiction that involved the knowing and repeated transmission of computer files over the Internet, personal jurisdiction is proper.”

• “A passive Web site that does little more than make information available to those who are interested in it is not grounds for the exercise [of] personal jurisdiction.”

• “The middle ground is occupied by interactive Web sites where a user can exchange information with the host computer. In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the Web site.”

Zippo Mfg. Co. v. Zippo Dot Com, Inc. (W.D. Pa. 1997)

So, what does that mean for us?“Under the facts presented here, the court finds that while there has been no showing that contracts are entered into over the Johns Hopkins' website, the website is more than passive advertisement. It offers a means of transferring information, recruiting students, receiving donations from alumni, and soliciting and conducting business. As such, the Johns Hopkins' website has a sufficient level of interactivity and commercial nature to place it in the middle range of the sliding scale . . . .”

Peyman v. Johns Hopkins University (E.D. La. 2000)

International Jurisdiction

• Within the U.S., the law usually doesn’t vary much from state to state

• But the Internet doesn’t stop at national borders, either

• “In the information age, the whole planet is just a click away. So, unfortunately, are all the lawyers.” -- University Business

• “In cyberspace, the First Amendment is just a local ordinance.” -- variously attributed

The Key to Handling Online Privacy Issues Successfully

Ignore the law

I know what you did last summer

• AnyWho– http://www.anywho.com

• Lucas County Property Records– http://www.co.lucas.oh.us/Real_Estate

• DejaNews– http://www.deja.com/usenet

• Privacy.net– http://www.privacy.net/analyze

• Caches, History Files, Log Files, and more

What is Privacy?

“[T]he right to be let alone -- the most comprehensive of rights, and the right most valued by civilized men.”

Justice Louis BrandeisOlmstead v. U.S. (1928)

The Legal Basis for Privacy:A Patchwork Quilt

• U.S. and State Constitutions– But no explicit reference in U.S. Constitution– Fourth Amendment (and State versions)

• Statutory Privacy– Electronic Communications Privacy Act (and

State versions)– But also FERPA, State open records laws, and

discovery rules– And much, much more

• The Common Law of Privacy

One Slight Problem:No One Understands This Stuff

• The Fifth Circuit on the Electronic Communications Privacy Act:– “[A] statute . . . which is famous (if not

infamous) for its lack of clarity” -- Steve Jackson Games, Inc. v. United States Secret Service

• The Ninth Circuit on the Fifth Circuit:– “[T]he Fifth Circuit . . . might have put the

matter too mildly.” -- U.S. v. Smith

The Fourth Amendmentin Cyberspace

• Who owns the system?

• Who has access to the system?

• How does the system work?

• How is the system used?

• Is the system password-protected?

• What policies apply to the system?

• What is the ordinary practice?

Law Enforcement AccessUnder ECPA

• Voluntary or at government request?

• Obtained inadvertently or intentionally?

• In transmission or in storage?

– In storage more than 180 days?

• Contents or log files?

• With consent of user or without?

• With notice to user or without?

Untangling the Privacy Mess

• Ignore the law• Establish -- and follow -- a policy

– Decide what expectations are reasonable– Obtain consent, explicitly or implicitly

• Options:– No privacy– Total privacy– Somewhere in between

OSU’s Computer Use Policy: Privacy

• Use of university-provided computing resources is not completely private

• But we don’t monitor individual use routinely

• But we may monitor individual use when we suspect misconduct or misuse

• But any such monitoring must be pre-approved by the CIO or the CIO’s designee

Finally: Top Five Tips for Success

1. Forget about computers

2. Treat pornography as you would the Bible

3. Even publics should be private

4. Don’t go looking for trouble

5. Teach your children well