31 March CMU Sustainable Computing Consortium, Tempe, Arizona Trust in Mobile & Context-Aware Computing: Legal Perspectives W. Scott Blackmer, Esq.

31 March 2003 CMU Sustainable Computing Consortium, Tempe, Arizona2 Legal Aspects of Trusted Computing Identification & Authentication –Who is responsible, for what messages or acts; appropriate levels of authentication and formality –Contracts, torts, defamation, IPR, criminal law Proof & Non-Repudiation –Evidence stored and protected, links to disclosures and terms, indication of assent Privacy & Security –Enforcing promises and mandatory standards –Often requires role-level access Protection of Consumers, Children –Disclosures, descriptions, warranties, and restrictions Jurisdiction –Context-aware systems may provide more certainty

31 March 2003 CMU Sustainable Computing Consortium, Tempe, Arizona3 Electronic Contracting The stage is set for m-commerce US federal E-SIGN (2000), UETA, UCC Art. 2, UCITA all recognize e-signatures, e-contracts, e-records, e-agents; technology-neutral Exceptions for certain transactions (land, wills, etc.) Consumer consent required for e-records E-records must be accurate, accessible Similar laws worldwide, based on UNCITRAL model law on e-commerce EU E-Signatures Directive (1999) adds legal presumptions for “advanced” e-sigs using an approved method or certification authority

31 March 2003 CMU Sustainable Computing Consortium, Tempe, Arizona4 Privacy & Security Increasingly mandatory US: Diverse federal and state laws –telecom and cable subscribers, telemarketing, fax ads, spam –intercepts and unauthorized access –financial and health records, children online –FTC, state, and private litigation on fraud, unfair practices EU: general and communications data protection directives; widely copied Context-awareness means more personal data, more risk of loss, theft, misuse: with greater knowledge comes greater responsibility Newer privacy laws, contracts include security obligations and standards

31 March 2003 CMU Sustainable Computing Consortium, Tempe, Arizona5 Location-Based Services & Surveillance The rules are not mature US e-911 mandate; Korea, etc. – beginning to see LBS issues on confidentiality, advertising, records EU Privacy and Electronic Communications Directive (effective Oct. 2003): –opt-in consent for ads and value-added mobile services –no surveillance beyond stated purposes or police powers New government surveillance powers in US, Europe; duty to cooperate and report Untested scope of US privacy torts, computer crimes Employer surveillance & monitoring unresolved RFID and GPS chips raise new issues of notice, consent, and purpose-limitation