Driver Education for the Information Superhighway: The Law and Policy of the Internet Steven J. McDonald Associate Legal Counsel The Ohio State University 22nd Annual National Conference on Law and Higher Education

Agenda A brief overview of Internet law since 1728 Computer use policies: Do you really even need one? Liability for computer misconduct: What you don’t know probably won’t hurt you Meta-geography and cyber-jurisdiction Privacy in cyberspace (“Stalking 101”) Questions (and maybe even some answers)

Two Views on Internet Law “In the future, virtually all law will be Internet law in one way or another.” –George Gilder Internet law is all law, right now.

A Brief Overview of Internet Law Since 1728 In the beginning was the word....

What is the Internet? A bulletin board A printing press A library A bookstore A television set and a television station A telephone, with lots of party lines and unlimited conference calling A post office...

What is the Internet? A medium of communication

And that means that... Everyone with Internet access is potentially an international publisher and broadcaster –Including your five-year-old This has some fairly significant legal implications –The same laws that apply to the New York Times, NBC, and NPR apply to Internet users –Including your five-year-old

Three Key Misconceptions Cyberspace is a separate legal jurisdiction –In fact, conduct that is illegal or a violation of policy in the “offline” world is just as illegal or a violation of policy when it occurs online Free access = free speech = unfettered speech –In fact, even public institutions may limit the use of their computer resources to business-related purposes If it’s technically possible, it’s legal –In fact, the technology has some legal implications, but it does not define the outer limits of the law

One Key Point Internet law (and policy) existed long before the Internet: –The law of libel –The law of privacy –The law of copyright –Criminal law –Your sexual harassment policy, code of student conduct, workplace rules –...

And Two Key Implications Internet-specific rules aren’t necessary and may create problems –Except when there are unique issues that aren’t already covered by generally applicable laws and policies Education is critical

Driver Education for the Information Superhighway Ohio State: Virtual Legality – James Madison: Electronic Information Security User Education – Cornell: Travelers of the Electronic Highway –

New Whines and Old Battles It isn’t always immediately clear (surprise!) how the law applies to new situations For example, the law of libel developed long before there were Internet service providers So, are we liable for the libels that occur on our systems?

The Law of the Horse “This case requires the law to add another paragraph to the ‘rules of the road’ for the ‘information superhighway’ and cyberspace. It is yet another testimony to the resiliency and flexibility of the case-by- case incremental development concept we inherited from the Common Law, which emphasizes adherence to [precedent]. As our superior court noted in United States v. Maxwell, new technologies present new challenges, but they are met by adapting existing legal concepts to them.” United States v. Monroe (A.F.C.C.A. 1999)

Key Dates in the Development of the Law of ISP Liability The King v. Clerk Fogg v. Boston & Lowell RR. Co Layne v. The Tribune Co Hellar v. Bianco Anderson v. New York Telephone Spence v. Flynt

Who is responsible? Publishers –Create content and hold it forth as their own –Directly liable for the libels they disseminate Distributors –Don’t create, but choose to, and actively do, distribute –Liable only if they “knew or should have known” that what they are distributing is libelous –No duty to prescreen Conduits –Operate a system by which other people communicate –No liability for libel, regardless of knowledge

Key Dates in the Development of the Law of ISP Liability Cubby v. CompuServe Stratton Oakmont v. Prodigy The Communications Decency Act Zeran v. America Online Digital Millennium Copyright Act Lunney v. Prodigy

Whose law applies? Subject matter jurisdiction –Jurisdiction over the case Type of case Amount in dispute Personal jurisdiction –Jurisdiction over the parties Originally a matter of pure geography...

Judicial Geography

Internet Geography

Where do you want to be sued today?

A Really Big Shoe “[D]ue process requires only that in order to subject a defendant to a judgment in personam, if he be not present within the territory of the forum, he have certain minimum contacts with it such that the maintenance of the suit does not offend ‘traditional notions of fair play and substantial justice.’” International Shoe Co. v. Washington (U.S. 1945)

And Another “ We find that Sullivan, as the producer and master of ceremonies of ‘The Ed Sullivan Show,’ entered Arizona by producing the play entitled ‘A Case of Libel’ in New York City.... [T] he telecast of the show... in Arizona [was] voluntary, purposeful, reasonably foreseeable and calculated to have effect in Arizona....” Pegler v. Sullivan (Ariz. Ct. App. 1967)

Zippo Dee Doo Dah “If a defendant enters into contracts with residents of a foreign jurisdiction that involved the knowing and repeated transmission of computer files over the Internet, personal jurisdiction is proper.” “A passive Web site that does little more than make information available to those who are interested in it is not grounds for the exercise [of] personal jurisdiction.” “The middle ground is occupied by interactive Web sites where a user can exchange information with the host computer. In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the Web site.” Zippo Mfg. Co. v. Zippo Dot Com, Inc. (W.D. Pa. 1997)

So, what does that mean for us? “Under the facts presented here, the court finds that while there has been no showing that contracts are entered into over the Johns Hopkins' website, the website is more than passive advertisement. It offers a means of transferring information, recruiting students, receiving donations from alumni, and soliciting and conducting business. As such, the Johns Hopkins' website has a sufficient level of interactivity and commercial nature to place it in the middle range of the sliding scale....” Peyman v. Johns Hopkins University (E.D. La. 2000)

International Jurisdiction Within the U.S., the law usually doesn’t vary much from state to state But the Internet doesn’t stop at national borders, either “In the information age, the whole planet is just a click away. So, unfortunately, are all the lawyers.” -- University Business “In cyberspace, the First Amendment is just a local ordinance.” -- variously attributed

The Key to Handling Online Privacy Issues Successfully Ignore the law

I know what you did last summer AnyWho – Lucas County Property Records – DejaNews – Privacy.net – Caches, History Files, Log Files, and more

What is Privacy? “[T]he right to be let alone -- the most comprehensive of rights, and the right most valued by civilized men.” Justice Louis Brandeis Olmstead v. U.S. (1928)

The Legal Basis for Privacy: A Patchwork Quilt U.S. and State Constitutions –But no explicit reference in U.S. Constitution –Fourth Amendment (and State versions) Statutory Privacy –Electronic Communications Privacy Act (and State versions) –But also FERPA, State open records laws, and discovery rules –And much, much more The Common Law of Privacy

One Slight Problem: No One Understands This Stuff The Fifth Circuit on the Electronic Communications Privacy Act: –“[A] statute... which is famous (if not infamous) for its lack of clarity” -- Steve Jackson Games, Inc. v. United States Secret Service The Ninth Circuit on the Fifth Circuit: –“[T]he Fifth Circuit... might have put the matter too mildly.” -- U.S. v. Smith

The Fourth Amendment in Cyberspace Who owns the system? Who has access to the system? How does the system work? How is the system used? Is the system password-protected? What policies apply to the system? What is the ordinary practice?

Law Enforcement Access Under ECPA Voluntary or at government request? Obtained inadvertently or intentionally? In transmission or in storage? –In storage more than 180 days? Contents or log files? With consent of user or without? With notice to user or without?

Untangling the Privacy Mess Ignore the law Establish -- and follow -- a policy –Decide what expectations are reasonable –Obtain consent, explicitly or implicitly Options: –No privacy –Total privacy –Somewhere in between

OSU’s Computer Use Policy: Privacy Use of university-provided computing resources is not completely private But we don’t monitor individual use routinely But we may monitor individual use when we suspect misconduct or misuse But any such monitoring must be pre- approved by the CIO or the CIO’s designee

Finally: Top Five Tips for Success 1. Forget about computers 2. Treat pornography as you would the Bible 3. Even publics should be private 4. Don’t go looking for trouble 5. Teach your children well