Richmond Journal of Law and Technology

The first exclusively online law review.

It’s Time for Revenge Porn to Get a Taste of Its Own Medicine: An Argument for the Federal Criminalization of Revenge Porn

pdf_iconDownloadPDF

Cite as: Taylor Linkous, It’s Time for Revenge Porn to Get a Taste of Its Own Medicine: An Argument for the Federal Criminalization of Revenge Porn, 20 Rich. J.L. & Tech. 14 (2014), http://jolt.richmond.edu/v20i4/article14.pdf.

Taylor Linkous

I.  Introduction

[1]       Throughout history, pornography and technology have enjoyed a symbiotic relationship, each playing a significant role in the growth and widespread success of the other.  From the VCR and camcorders to the Polaroid camera and the Internet, the pornography industry has always accelerated the growth of new technologies, paving the way for these new services to be introduced into mainstream society.[1]  Most of these new technologies were appealing to creators and consumers of pornography because the new technologies brought an increased sense of privacy.[2]  For example, much of the success of the Polaroid camera is said to come from the fact that people felt they could take explicit photos without having to go to the store to get the film developed.[3]  Similarly, pornography and the promise of privacy helped drive the success of cable TV and the VCR.[4]  As Peter Johnson writes,

Videotape first emerged as a cheap and efficient alternative to film (later kinescope) for TV production.  Its development for home use owes its birth to Sony and Betamax but its maturity to porn.[5]

Correspondingly, with the introduction of these new technologies the porn industry has continually been able to grow and push the limits.  With the launch of the VCR, the porn industry gained a new audience of people willing to watch their films; “[i]nstead of travelling to a disreputable store, viewers could watch films at their convenience at home.”[6]  This audience has only continued to grow with the introduction of revolutionary technologies, especially the Internet, which have made pornography easy and cheap to produce by lowering the barriers to entry and transaction costs.[7]  As Coopersmith states, “[e]ssentially, cyberporn has become an economist’s ideal free good: pornography is easily accessible, incurs minimum transaction costs, and enjoys a large demand.” [8]  Thus, the relationship between technology and pornography has existed for some time now and the bond between the two seems unbreakable.

[2]       While this historical interdependence has clearly been mutually beneficial for the porn industry and new technologies, there has been collateral damage.  For example, the Internet has significantly exacerbated the distribution and viewing of child pornography, and the cell phone started a “sexting” craze among teens and adults.[9]  In recent years, this collateral damage has come in the form of harassment, humiliation, invasion of privacy, and loss of reputation with the rise of revenge porn.  With the growth and normalization of the camera/video phone and modern ease with which individuals can now create, manage, and navigate websites, has come the revenge porn phenomenon.  Just like Polaroid cameras, camera phones have given individuals a sense of privacy, making them feel comfortable taking and sending explicit pictures and videos.[10]  A survey conducted by Match.com in 2012 found that out of 5,000 adults, 57% of men and 45% of women had received an explicit photo on their phone and 38% of men and 35% of women had sent one.[11]  Unfortunately, the sense of privacy encouraging this behavior is false, because unlike Polaroid photographs, these pictures and videos can easily be uploaded to a revenge porn website by an ex-lover, “friend,” hacker, or anyone else who happens to come upon them.  Once this happens, those seemingly “private” pictures he or she probably thought only their boyfriend or girlfriend would view are then available for the world to see.

[3]       Currently, the act of posting revenge porn is a crime in only fourteen states—Arizona, California, Colorado, Delaware, Georgia, Hawaii, Idaho, Maryland, New Jersey, New York, Pennsylvania, Utah, Virginia, and Wisconsin.[12]  However, over the past year, as victims of revenge porn increasingly advocate for laws criminalizing revenge porn, many more states are considering such legislation.[13]  Legal scholars differ in their opinions on the best way to deal with revenge porn.  Some argue a criminal law is unnecessary as victims are already able to file civil suits against those who posted the pictures based on claims such as copyright infringement, intentional inflection of emotional distress, or defamation.[14]  Others argue revenge porn should be treated like other forms of online sexual harassment and many contend that there should be an amendment to § 230 of the Communications Decency Act (“CDA”) to allow victims to go after the revenge porn websites.[15]

[4]       This comment analyzes the various potential legal approaches to dealing with revenge porn and posits that a federal law criminalizing the dissemination of revenge porn is necessary to combat this growing trend.  Part II provides background information on revenge porn and further analyzes how the successful relationship between technology and pornography led to the rise of revenge porn.  Part III analyzes the different civil remedies currently available to revenge porn victims and argues these are not practicable solutions.  Part IV discusses the current state laws criminalizing revenge porn and the legal challenges faced by those affected by revenge porn and legislators seeking to tackle this problem.  Finally, Part V proposes that a federal law criminalizing revenge porn is the best solution to this unsettling new movement.

 

II.  Background Information on Revenge Porn and Its Rise to Recognition

[5]       As stated above, technology and pornography have lived symbiotically with each other for quite some time.  The introduction of the Internet made access to pornography easier and widened the audience by allowing people to view pornography in the comforts of their own home.  Moreover, the Internet and other new technologies, such as the Smartphone, have made it easy and more appealing for people to create and distribute Do-It-Yourself (“DIY”) pornography.  Below I will first provide background information on revenge porn and explain what this trend is all about.  Then, I will analyze how technological progress helped lead to the rise in revenge porn.

A.  What Is Revenge Porn?

[6]       Revenge porn is a nude picture or video that is publicly shared on the Internet, usually by an ex-lover, for the purpose of humiliation.[16]  Despite the relatively recent media attention, revenge porn has been around for years.  As far back as 2000, an Italian researcher identified a new genre of pornography where explicit pictures of ex-girlfriends were being shared in Usenet groups.[17]  Later, in 2008, the first websites and blogs completely dedicated to this type of porn started to pop up.[18]  Then in 2010, the first person went to prison for posting revenge porn in New Zealand.[19]  This person was Joshua Ashby and he was found guilty of distributing an “indecent model or object” to the public when he posted a picture of his naked ex-girlfriend on Facebook.[20]  That same year, Hunter Moore established one of the most popular revenge porn sites, IsAnyoneUp.com.[21]

[7]       Normally on revenge porn websites, the explicit images or videos are posted on the site and submitted with the victim’s name, a link to his or her Facebook, and other personal information.[22]  Citing Cyber Civil Rights Statistics on Revenge Porn from 2013, Danielle Keats Citron and Mary Anne Franks, law professors and anti-revenge porn advocates, stated, “[i]n a study of 1,244 individuals, over 50% reported that their naked photos appeared next to their full name and social network profile; over 20% reported that their e[-]mail addresses and telephone numbers appeared next to their naked photos.”[23]  On IsAnyoneUp.com, each submission to the website usually included a depiction of the man or woman’s Facebook or Twitter thumbnail, pictures of them clothed, and pictures of them “exposing their genitalia, or even in some cases, engaging in sexual acts.”[24]  Another revenge porn website, MyEx.com, also includes first and last names and links to social media information along with the images posted.  This site also charges victims upwards of $500 to remove the photographs.[25]  Posting personal information along with these images threatens the victim’s safety, enabling strangers to stalk and harass them.  Although the name “revenge porn” comes from the idea that these photos are posted by jilted ex-lovers, sometimes the pictures are reportedly acquired “through hacking, theft by repair people or false personal ads.”[26]

B.  Internet + Smartphones + DIY Porn = Revenge Porn

[8]       In 1995, when Congress took its first stab at regulating the Internet with the introduction of the CDA as part of the Telecommunications Act amendments,[27] less than 0.4% of the world’s population was using the Internet.[28]  Then, only two years after the CDA was passed, the Supreme Court held sections 223(a) and 223(d) unconstitutional in Reno v. ACLU,[29] essentially leaving the immature Internet “free to develop without government regulation of pornography.”[30]  With the ability to freely experiment and develop during this time of very little regulation, technology and pornography’s relationship thrived.

[9]       The Internet allowed the porn industry to bypass zoning laws, age restrictions, and postal regulations, while pornography aided the Internet’s quick development by constantly pushing the limits of new technologies.[31]  For example, “[i]n 2001, Blaise Cronin and Elisabeth Davenport stated, ‘It is universally acknowledged by information technology experts that the adult entertainment industry has been at the leading edge in terms of building high-performance Web sites with state-of-the-art features and functionality.’”[32]  So, with little government regulation over the past decade, the Internet and pornography have consistently matured and prospered.

[10]     New and improved technologies allowing pornographers to provide images and videos quicker, cheaper, and more efficiently have certainly turned pornography into a booming business.[33]  In 2006, there were about 4.2 million pornographic websites and the annual pornography revenue in the United States was over $13 billion.[34]  Additionally, easy access to these websites has increased the amount of viewers.[35]  The user-friendly nature of pornography on the Internet “means that many who would never have sought it out before consume it regularly.”[36]  Unfortunately, this class of people is likely largely made up of curious children, who have explicit, hard-core porn available at their fingertips, quite literally.[37]  The widespread use of Smartphones in recent years has made pornography even easier to access and has become the primary way people view pornography.  According to statistics report from PornHub, the majority of porn in the United States is now viewed using smartphones.[38]  The website reported that 52% of its content was being viewed on mobile devices, a 10% increase from 2012, when it was reported only 47% of the website’s content was being viewed on smartphones.[39]

[11]     Not only have the Internet and smartphones increased access for viewers, but both have also made it easy for amateur pornographers to distribute their work and encourage people to engage in “DIY porn.”[40]  Dr. Gail Salts, an Associate Professor of Psychiatry at New York Presbyterian Hospital, stated,

What’s new is technology at a very cheap cost, which allows you to do it and merchandize it in a greater way. . . .  You can do it yourself.  You can do it with a flip-cam.  You can do it with your phone and you can put it up with no effort.[41]

Thus, not only have advanced technologies made access to pornography very simple and increased the number of pornography consumers, they have also fostered more user-generated pornographic content.

[12]     I argue that the rise in revenge porn is a culmination of these technological advancements, easy accessibility, and the DIY porn trend, which are all a result of the lifelong partnership between technology and pornography.  The Internet and smartphones have made it extremely easy to create explicit photographs, send them to others, and upload them to websites.  Moreover, an increased sense of privacy and anonymity has encouraged more people to engage in this behavior.  All of these factors had a role in creating the perfect storm for revenge porn to catch on and begin ruining the lives of many victims.[42]

C.  The Negative Effects of Revenge Porn

[13]     While technology and pornography likely will continue to benefit from their advantageous relationship and look onwards to the next big development, the negative impact their recent revenge porn progeny has on its victims is significant and profound.  Holly Jacobs, a Florida woman who is now a strong advocate of strengthening laws against revenge porn and who founded the website End Revenge Porn, has been significantly affected by revenge porn.[43]  Jacobs found out from a friend that nude photos she had sent to her ex-boyfriend had been posted on her Facebook and then later to hundreds of revenge porn websites.[44]  Even more disturbing was that her name, e-mail address, and place of business were posted along with the pictures.[45]  As a result of victims’ personal information being posted with their pictures, 49% of the victims of revenge porn have said they have been harassed or stalked online by users who saw their material.[46]  Victims are extremely fearful of stalkers and often struggle with anxiety and panic attacks.[47]  More than 80% of revenge porn victims have experienced severe emotional distress.[48]  Unfortunately, researchers have found that this anxiety felt by victims of cyber harassment gets worse over time.[49]  In fact, some victims have committed suicide.[50]

[14]     This extreme anxiety is exacerbated by the detrimental effects revenge porn has on victims’ professional lives.  A simple search of a revenge porn victim’s name on the Internet quickly reveals these explicit pictures, costing many of them their jobs and preventing others from finding work.[51]  Moreover, once these images are on the Internet, it is next to impossible to have them removed.[52]  Another victim speaking under the pseudonym, Sarah, detailed her efforts to get her explicit photos removed from hundreds of revenge porn websites.[53]  Sarah could not afford filing a civil suit, so she filed a Digital Millennium Copyright Act (“DMCA”) takedown request, stating that her ex-boyfriend was engaging in copyright infringement.[54]  However, many of the websites hosting her pictures were located in foreign countries, and thus outside the United States’ jurisdiction.[55]  Sarah was unable to get the photos removed from the Internet, and ultimately changed her name.[56]

D.  A Brief Look at a Few Revenge Porn Websites and Their Notorious Operators

[15]     The extremely popular revenge porn website mentioned above, IsAnyoneUp.com, was run by Hunter Moore.  The site received 30 million page views a month and featured thousands of nude pictures.[57]  Moore stated he received 10,000 image submissions in three months and his site was generating $8,000 in advertising revenue per month.[58]  Not only did this site solicit for naked photos, but additionally the submission form asked for the person’s name, link to their Facebook or Twitter page, and other personal information.[59]  Moore shut down IsAnyoneUp.com in April 2012 due to legal pressures involving child pornography.[60]  Interestingly enough, Moore ultimately sold the website to James McGigney, owner of Bullyville, an anti-bullying site.[61]  However, Moore quickly launched a new site, HunterMoore.TV, which he bragged would still allow people to submit naked photos of exes but would also include “mapping stuff” allowing users to stalk those pictured.[62]  Although Moore later denied this statement and claimed HunterMoore.TV would not feature this “mapping stuff,” the idea is not too far off from his work in the past.[63]

[16]     Moore confidently argues he is shielded from liability by § 230 of the CDA, an issue that will be discussed further below.[64]  While § 230 of the CDA does state that websites are not liable for content submitted by their users, it does not protect Moore from liability for federal criminal charges, such as conspiracy.  In fact, in late January of 2014, Moore and alleged accomplice, Charles Evens, were indicted on fifteen counts.[65]  These counts included conspiracy, seven counts of unauthorized access to a protected computer to obtain information, and seven counts of aggravated identity theft.[66]  According to the indictment, Moore paid Evans several times to hack into victims’ e-mail accounts and steal naked pictures in order to post on his website, IsAnyoneUp.com.[67]  If he is convicted, Moore faces up to five years for the conspiracy charge and computer hacking counts, and up to two years for aggravated identity theft.[68]

[17]     Another fellow revenge porn proprietor, Kevin Christopher Bollaert was arrested on thirty-one counts of conspiracy, identity theft, and extortion in California for his role in creating the website, ugotposted.com.[69]  The site is no longer operating, but when it was, Bollaert took it a step further by charging victims from $250 to $350 to remove the images through another website, changemyreputation.com.[70]  Also, Bollaert went as far as to require that the victim be identified by name, age, and other information.[71]  Additionally, a federal district court judge in Ohio ordered Bollaert and his co-founder of ugotposted.com, Eric Chason, to pay a woman $385,000 for posting explicit photos of her on the website without her consent.  The woman filed suit in May 2013 after discovering explicit pictures of herself as a minor had been distributed on ugotposted.com without her knowledge or consent.[72]  The default judgment against Chason and Bollaert included $150,000 for several child pornography counts, $10,000 for a right of publicity count, and $75,000 in punitive damages.[73]

III.  Potential Civil Remedies Available to Revenge Porn Victims[74]

[18]     Some legal scholars argue there is no need for criminal statutes because victims are already able to file civil suits against the people who posted their pictures.[75]  For example, tort laws such as intentional infliction of emotional distress, public disclosure of private information, defamation, or invasion of privacy may be available for some victims of revenge porn.[76]  Aside from the fact that these lawsuits are expensive and do not deter people from posting the images, § 230 of the CDA shields revenge porn websites from tort liability.[77]

[19]     One way around § 230 of the CDA is for the victim to sue the website for copyright infringement.  However, this option is available only if the person took the photograph or video.  If the person took the photograph or video, then he or she owns the copyright and can send a takedown notice to the website under the DMCA.[78]  If the website refuses to comply with the takedown notice, then the person is able to sue the website for copyright infringement.  While these civil remedies are accessible to some revenge porn victims, they are expensive, inconsistent, inefficient, and do very little to discourage people from posting revenge porn in the first place.

A.  Tort Law Is Not the Best Answer

[20]     As stated, some victims are able to file civil suits under existing privacy law or torts such as intentional infliction of emotional distress, defamation, or public disclosure of private information.[79]  Some people argue that the tort of intentional infliction of emotional distress should be used to deal with revenge porn and other forms of online harassment because of its flexibility.[80]  Further, the common law tort of intentional infliction of emotional distress “reflects a desire to impose liability on both the first creator of the harm and the entity that enabled the harm.”[81]  Alternatively, there are several common law torts that are derived from the right to privacy and potentially available to victims of revenge porn: appropriation, false light, disclosure or wrongful publication of private facts, and intrusion.[82]  There is also defamation, which requires the plaintiff to show the defendant made a false and defamatory statement that harmed the plaintiff’s reputation.[83]

[21]     All of the above mentioned civil remedies are inadequate.  First of all, filing and litigating a civil suit takes lots of time and money that many victims of revenge porn do not have.  Revenge porn victims are most often private individuals who are not equipped with the necessary financial resources to litigate one of these suits.[84]  Additionally, it is very difficult to prove who actually posts revenge porn because people can easily submit photographs and videos anonymously.[85]  As discussed above, sometimes unknown hackers are the ones who submit these images.  While posters of revenge porn are able to remain anonymous, taking civil action means revenge porn victims likely will have to face more unwanted publicity.[86]

[22]     Moreover, for all of the money spent litigating such a suit, there is little reward.  Most of the time, people who post revenge porn will not be able to pay damages, even if revenge porn victims successfully litigate one of these cases.[87]  Even more concerning, the reality is that once these pictures are posted to a revenge porn website, even if the victim is able to legally force the user or website to take them down, the pictures are likely to spread all over the Internet and could easily pop back up again at any time.[88]  As Nancy Kim states, “[t]here is no combination injury in the offline world because there is no other method of distribution that is as inexpensive, accessible, widespread, and difficult—if not impossible—to retrieve.”[89]  Further, a civil suit may allow the victim to receive damages and could lead to the picture being taken down, but it does little to prevent this type of thing from happening in the future.  Thus, a civil suit is extremely costly, barely fixes the damage caused by revenge porn, and does not discourage people or websites from posting these images in the first place.

B.  Section 230 of the CDA

[23]     Civil remedies also are inadequate for a revenge porn victim because the actual websites posting their explicit photographs are likely protected from liability under § 230 of the CDA.  Section 230 protects website operators from liability stemming from its users’ posts, stating “[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”[90]  Section 230 was written as a way to combat novel legal issues arising from the widespread use of the Internet.[91]  While part of the CDA was struck down as unconstitutional, the defenses provided in § 230 endured.[92]

[24]     There are two defenses available for websites under § 230.  The first is one I have briefly touched on, which protects websites from being held liable as publishers of the content posted by their users, as long as the websites did not create it.[93]  The second defense protects providers of interactive computer services from liability on account of “any action voluntarily taken in good faith to restrict access to or availability of material that the provider considers obscene, lewd, harassing, or otherwise objectionable.”[94]  Section 230 of the CDA further states that the law will not have an effect on other federal criminal statutes, but “[n]o cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with this section.”[95]  Thus, criminal liability for such actions imposed under federal law is not covered by the CDA’s protections, but websites likely are immune from the torts previously discussed above.

[25]     While most of the cases applying § 230 of the CDA have held websites immune from liability, the Ninth Circuit recently held a website liable for the illegality of hosted content because it helped create the content.[96]  In this case, the Fair Housing Councils of San Fernando Valley and San Diego brought action against Roommates.com alleging the website violated the Fair Housing Act and state laws.[97]  The part of the website alleged to offend the Fair Housing Act and state laws was information provided by subscribers in response to questions written by Roommate.com.[98]  Thus, the court held this part of the website was actually developed by Roommate.com: “Roommate becomes much more than a passive transmitter of information provided by others; it becomes the developer, at least in part, of that information.”[99]  This case may be applicable to revenge porn websites.  While many of the websites claim they are shielded from civil liability by § 230, revenge porn victims could use Fair Housing Council to argue these revenge porn websites are more than “passive transmitter[s] of information provided by others” and are actually developers of content not entitled to protection under § 230.[100]

[26]     Section 230 of the CDA likely shields revenge porn websites from civil liability, thus proving another reason civil law is an inadequate solution for victims.  However, with the recent decision by the Ninth Circuit in Fair Housing. Council, courts may be more willing to find revenge porn websites are developers of the content on their sites and not protected by § 230.

C.  Copyright Law Is Not the Best Remedy

[27]     Some victims have opted for sending takedown notices to the websites under copyright law.[101]  If the picture posted was a “selfie,” then the victim owns the copyright and he or she can send takedown notices to the revenge porn websites under the DMCA.[102]  If the website refuses to remove the image, the person can then sue the website for copyright infringement.  Revenge porn websites are not shielded from liability for these copyright infringement claims because § 230 has an exception for copyright infringement which allows victims to hold websites liable for republishing their copyrighted photographs.[103]  However, in order to receive statutory damages for this tort, a victim must register their copyright within ninety days of when it is published.[104]  Although a victim may not receive damages, sending DMCA takedown notices is relatively simple, and may be successful in getting an injunction against websites for posting the images online.[105]

[28]     While sending these takedown notices is less costly because it does not require a lawyer, copyright law suffers from similar inadequacies as tort law.  The reality is, copyright law does not discourage people from engaging in this activity, especially when most of the time the person posting the pictures does not end up having to pay the victim damages.  Once images are posted to one website, they rapidly spread across the Internet.  So, while a victim may be successful at issuing a takedown notice for one website, she may “encounter the ‘whack-a-mole’ problem” where “[a]s soon as copyrighted content is removed from one place, it pops up in another.”[106]  Further, this legal avenue is only available to people who took the sexually explicit photograph or video of themselves.

[29]     Thus, while there are currently existing laws that victims may use to sue the person who posted their picture, get an injunction, and possibly receive damages; these solutions are costly, not very effective, and none of them really get at the heart of the problem.

 

IV.  Current Criminal Laws Available and the Legal Challenges to Criminalizing Revenge Porn

[30]     While some victims have been successful in winning civil suits and some operators of these websites have been charged for federal crimes such as conspiracy and child pornography, there is still a legal grey area concerning whether the act of posting and distributing revenge porn should be a crime.  Federal and state cyberstalking laws might be an option for some revenge porn victims, but they are not ideal.  Also, some states already have laws seemingly broad enough to reach distributors of revenge porn.  However, many judges are reluctant to arbitrarily stretch laws past their plain language—regardless of how lewd or morally reprehensible an action may be.  This is illustrated by Massachusetts’ highest court’s recent holding that “upskirting” is legal as long as the person being photographed is not nude or partially nude.[107]  This understandable unwillingness of judges to broaden statutes beyond their plain language further highlights the need for specific laws targeting revenge porn.  A few states have recently introduced and passed legislation specifically aimed at criminalizing revenge porn.  I will analyze these statutes and also discuss the legal challenges legislators face in drafting these laws.

A.  Federal and State Criminal Laws

[31]     Federal and state cyberstalking laws may seem like the best approach to going after revenge porn distributors.  Typically, cyberstalking requires the defendant to have “engaged in behavior or a pattern of conduct with the intent to alarm, abuse, or frighten the victim.”[108]  The federal telecommunications statute, 47 U.S.C. § 223, that is aimed at cyberstalking, prohibits individuals from using any telecommunications to abuse, threaten, or harass any person without revealing their identity.[109]  Federal cyberstalking law is attractive because it prevents revenge porn websites from hiding behind § 230 of the CDA’s shield of protection.  Most states also have similar statutes prohibiting cyberstalking or cyber harassment.[110]  Cyber harassment generally “involves patterns of online behavior that are intended to inflict substantial emotional distress and would cause a reasonable person to suffer substantial emotional distress.”[111]  While some instances of revenge porn are included in this description, there may be substantial hurdles in proving a “pattern” of online behavior if the person only posted one picture and it may also be difficult to show the person posted it with the intent of causing emotional distress.[112]  Thus, while cyberstalking laws may apply in some situations, a criminal law specifically targeting revenge porn situations is better equipped.

[32]     As of 2013, the act of posting or distributing revenge porn was a crime in only two states: New Jersey and California.[113]  Also, Alaska and Texas currently have laws broad enough to apply to distribution of revenge porn; however, an appeals court declared the Texas law unconstitutional.[114]  Fortunately, this legal issue has quickly captured much attention over the past year. In 2014, twenty-seven states, the District of Columbia, and Puerto Rico had legislation addressing revenge porn either introduced or pending, and twelve states enacted laws criminalizing the act of posting revenge porn: Arizona, Colorado, Delaware, Georgia, Hawaii, Idaho, Maryland, New York, Pennsylvania, Utah, Virginia, and Wisconsin.[115]

[33]     New Jersey’s Title 2C: 14-9 is an invasion of privacy law which was originally directed at people who secretly photograph or videotape another person while they are naked or engaged in sexual activity without their consent.[116]  New Jersey’s law was intended to cover “video voyeurs” and was used to prosecute Rutgers University student Dharun Ravi in 2010.[117]  Ravi was found guilty under Title 2C: 14-9 after he secretly set up a webcam to spy on his roommate, Tyler Clementi and then live streamed the video.[118]  Clementi, who was only eighteen years old, committed suicide after finding out the video had been live streamed.[119]  The New Jersey statute reads:

An actor commits a crime of the third degree if, knowing that he is not licensed or privileged to do so, he discloses any photograph, film, videotape, recording or any other reproduction of the image of another person whose intimate parts are exposed or who is engaged in an act of sexual penetration or sexual contact, unless that person has consented to such disclosure.[120]

Although the law was not drafted with the criminalization of revenge porn in mind, it was written broad enough so that it does apply to most revenge porn situations.

[34]     In the fall of 2013, the California legislature passed SB 255, a revenge porn bill introduced by Senator Cannella.[121]  Governor Jerry Brown signed the bill into law on October 1, 2013 and it went into effect immediately.[122]  The law makes posting revenge porn a misdemeanor punishable by up to six months in jail and a $1,000 fine.[123]  It specifically provides that:

Except as provided in subdivision (l), every person who commits any of the following acts is guilty of disorderly conduct, a misdemeanor: . . . Any person who photographs or records by any means the image of the intimate body part of parts of another identifiable person, under circumstances where the parties agree or understand the image shall remain private, and the person subsequently distributes the image taken, with the intent to cause serious emotional distress, and the depicted person suffers serious emotional distress.[124]

As written, California’s law does not include pictures the victim took of him or herself, often called a “selfie.”[125]  California’s law contains other concerning loopholes, as well.  For instance, it does not cover anyone who might redistribute the photograph or recording after it has already been taken by someone else because it covers only the person who makes the photograph or recording.[126]  So, the law does not penalize people who steal explicit pictures from someone else’s phones or hackers who obtain these photos by hacking into the victim’s computer or phone.[127]  These situations are not out of the ordinary; when it comes to legal possibilities, California’s law likely will leave many revenge porn victims in the same helpless situation they were in before the bill was passed.  However, Senator Canella introduced a new bill, SB 1255, which broadened the law to include selfies as well.[128]

[35]     Idaho also passed House Bill 563 which amends provisions of Idaho’s existing law relating to the crime of video voyeurism to include the act of sharing pictures or videos of an intimate or private nature shared without consent for purposes other than sexual gratification, including revenge, extortion, or humiliation.[129]  Idaho’s video voyeurism law now states:

A person is guilty of video voyeurism when . . . [h]e either intentionally or with reckless disregard disseminates, publishes or sells or conspires to disseminate, publish or sell any image or images of the intimate areas of another person or persons without the consent of such other person or persons and he knows or reasonably should have known that one (1) or both parties agreed or understood that the images should remain private.[130]

House Bill 563 was reported signed by the Governor on March 19, 2014 and went into effect on July 1, 2014.[131]

[36]     Both Alaska and Texas have existing laws written broad enough to cover revenge porn situations.  Alaska’s existing cyber-harassment law is written broad enough to cover revenge porn situations and was used to charge Joshua P. Hoehne with second-degree harassment for downloading pictures from a former roommate’s computer without permission and creating fake social media accounts for a woman and her sister containing nude pictures of them and sexually explicit captions.[132]  Texas’s improper photography or visual recording law may be broad enough to include distributors of revenge porn; however, the Fourth Court of Appeals in San Antonia, Texas held the statute was unconstitutional in an opinion filed August 30, 2013.[133]

[37]     While fourteen states and arguably Alaska have laws currently criminalizing revenge porn, twenty-seven states, the District of Columbia, and Puerto Rico have considered similar legislation over the past few years.[134]  In 2013, Florida, the home state of Holly Jacobs,[135] tried and failed to pass a revenge porn law.[136]  Florida Representative Tom Goodson sponsored House Bill 787, “Computer or Electronic Device Harassment,” which would have made it illegal to post nude pictures of someone online and tag them with their personal information without their consent.[137]  The wording of this bill would only make it illegal to post the nude picture if the person posting it also tagged the victim.  Thus, the bill did not criminalize the act of posting the nude picture, generally.  However, in 2014, Florida Senator David Simmons introduced another revenge porn bill, Senate Bill 532, which does not include this tagging requirement.[138]  The bill unanimously passed the Senate, but unfortunately did not pass the House and died in committee on May 2, 2014.[139]

[38]     In Virginia, Delegate Robert P. Bell introduced House Bill 326 which, in relevant part, provides:

Any person who, with the intent to coerce, harass, or intimidate, maliciously disseminates or sells any videographic or still image created by any means whatsoever that depicts another person who is totally nude, or in a state of undress so as to expose the genitals, pubic area, buttocks, or female breast, where such person knows or has reason to know that he is not licensed or authorized to disseminate or sell such videographic or still image is guilty of a Class 1 misdemeanor.  However, if a person uses services of an Internet service provider, an electronic mail service provider, or any other information service, system, or access software provider that provides or enables computer access by multiple users to a computer server in committing acts prohibited under this section, such provider shall not be held responsible for violating this section for content provided by another person.[140]

House Bill 326 passed both the Senate and the House, was signed into law by Governor Terry McAuliffe on March 31, 2014, and became effective on July 1, 2014.[141]  Other states that have proposed similar legislation in 2014 include Alabama, Arizona, Colorado, Connecticut, Delaware, Georgia, Hawaii, Illinois, Kentucky, Maryland, Massachusetts, Missouri, New Mexico, New York, Pennsylvania, Rhode Island, South Carolina, Tennessee, Utah, Vermont, Washington, and Wisconsin.[142]

B.  Challenges for Getting Criminal Revenge Porn Laws Passed

[39]     Revenge porn advocates and legislators face many challenges in getting criminal revenge porn laws passed.  First, it is important these laws are not written too broadly, so they do not violate individuals’ right to free speech under the First Amendment.  On the other hand, it is difficult to write a law broad enough to encompass the majority of revenge porn victims that does not impose unnecessary hurdles regarding the burden of proof.

[40]     Many of the state laws and introduced legislation criminalizing revenge porn have been criticized for being written too broadly and abridging free speech in violation of the First Amendment.[143]  There was some opposition to California’s anti-revenge porn law by the Electronic Frontier Foundation (“EFF”) and the American Civil Liberties Union (“ACLU”) when the law was in its early stages.[144]  As an attorney for the EFF stated, “[f]requently, almost inevitably, statutes that try to do this type of thing overreach . . . [t]he concern is that they’re going to shrink the universe of speech that’s available online.”[145]  However, Mary Anne Franks argues that a carefully crafted revenge porn statute with certain exceptions for lawful activity does not offend the First Amendment.[146]  Further, she notes that laws criminalizing cyber-stalking have not been found to violate the First Amendment, so a well-written law criminalizing revenge porn should not cause problems either.[147]

[41]     Certain types of speech are not protected by the First Amendment and some speech can be regulated without violating the Constitution because it has the tendency to bring about serious harm which outweighs the right to freedom of speech.[148]  The constitutionality of revenge porn laws might be a moot point as some may argue that revenge porn is obscene and should not even qualify as protected speech within the scope of the First Amendment.  In Miller v. California, the guiding case on obscenity, the Court laid out the following test for determining whether material is obscene:

(a) whether “the average person, applying contemporary community standards” would find that the work, taken as a whole, appeals to the prurient interest . . . (b) whether the work depicts or describes, in a patently offensive way, sexual conduct specifically defined by the applicable state law; and (c) whether the work, taken as a whole, lacks serious literary, artistic, political, or scientific value.[149]

The application of this test in cases involving modern Internet pornography has proven difficult and controversial because it is unclear how courts should identify contemporary community standards.[150]  “Critics debate whether the courts should apply a national standard, a statewide standard, a standard based on smaller community units, an ‘average adult’ standard, or in Internet cases, a cyber-community standard.”[151]  Regardless of the difficulty in applying the Miller test in the age of Internet pornography, revenge porn could arguably qualify as obscenity.  Distributing sexually explicit pictures or videos of a person without their consent is “patently offensive” and many would argue revenge porn “lacks serious literary, artistic, political, or scientific value.”[152]  Thus, revenge porn may be considered obscene unprotected speech.

[42]     Even if revenge porn is not categorized as obscene, it may be considered “indecent” speech that is subject to a slightly lower scrutiny when being analyzed for constitutionality.[153]  In FCC v. Pacifica, the Court held that the content of Pacifica’s radio broadcast was “‘vulgar,’ ‘offensive,’ and ‘shocking’” and noted that “content of that character is not entitled to absolute constitutional protection under all circumstances.”[154]  The Court held the FCC was able to regulate the broadcast for largely two reasons: (1) the indecent material was invading individuals in the privacy of their own home “where the individual’s right to be left alone plainly outweighs the First Amendment rights of an intruder”; and (2) the broadcasting was easily accessible to children.[155]  A similar argument may be made for revenge porn, as these websites are easily accessible to children.  Although it might be difficult to argue these websites are confronting individuals in the privacy of their own home, they are seriously invading the privacy of those whose pictures are being distributed without their consent.

[43]     On the other end of the spectrum, some scholars have criticized California’s law and the proposed law in Florida for being too narrow.  As noted above, in its current form, California’s law does not cover “selfies” and there must be proof the person distributed the picture with the intent to cause serious emotional distress.[156]  Many argue the law takes it too far by requiring the prosecution to prove the defendant intended to inflict serious emotional distress.  Moreover, as previously discussed above, the California law does not reach third parties who did not take the explicit photograph or video themselves, but were still the ones to distribute it on the Internet.[157]  Further, Florida’s proposed legislation would have continued to permit people to post nude photographs without the depicted person’s consent as long as she was not tagged with personal identifying information.[158]  It has proven difficult for many states to strike the right balance between proper protection for the victims of revenge porn and a law that does not improperly restrict free speech.

 

V.  A Federal Law Criminalizing Revenge Porn is Necessary

[44]     The best way to attack revenge porn and prevent people from posting and distributing revenge porn is with a federal law criminalizing the act.[159]  Clearly, the existing civil remedies and criminal laws are inefficient.  Although it seems many states will continue to propose legislation criminalizing this activity, the most effectual way to put a stop to revenge porn would be for Congress to pass a uniform prohibition.  A federal criminal statute would ensure that victims in states that fail to pass such legislation are protected.[160]  Moreover, many revenge porn victims have trouble convincing law enforcement to help them, and a federal criminal law would make sure authorities understand this behavior is against the law and deserves attention.[161]  Additionally, a federal statute criminalizing revenge porn would prevent revenge porn websites from hiding behind the shield of liability provided by § 230 of the CDA.

[45]     Moreover, like most Internet activities, revenge porn often crosses jurisdictional boundaries and involves interstate or international communications.[162]  As Kevin V. Ryan and Mark L. Krotoski state, “The Internet provides the means to communicate with or access computers around the world in real-time, twenty-four hours a day seven days a week.  Taking advantage of the global reach of the Internet, perpetrators may be many time zones away in another jurisdiction or country.”[163]  Thus, although state criminal laws may help in addressing revenge porn, because this activity often involves interstate and international communications and crosses jurisdictional boundaries, a federal law is necessary and would be a more effective solution.

[46]     As discussed above, states have taken different approaches to the criminalization of revenge porn; some passing laws that are too narrow and others passing laws that are too broad.  A carefully crafted, uniform federal law should remedy this issue.  First, the law would need to be broad enough to cover both explicit pictures taken by another person and explicit “selfies.”  This federal law should not make the same mistake as California in leaving out pictures a victim took of him or herself.  Many revenge porn victims did take the pictures or videos of themselves, but did not consent to having them posted on the Internet for the world to access.  Thus, this federal law should prohibit a person from knowingly posting and distributing an explicit photograph or video on the Internet without the depicted person’s consent.  The intent requirement does not need to include intent to cause serious emotional distress, as long as the language clearly states the distributor knew or had reason to know the explicit images were meant to remain private.  There is no need for the federal statute to include proof of a pattern of harassing behavior.  However, in order to circumvent constitutional issues, the law likely should include a requirement of proof the victim suffered some emotional harm.

[47]     In March 2014, California Representative Jackie Speier announced she was preparing to introduce federal legislation criminalizing the distribution of revenge porn.[164]  Franks, who is helping Speier draft the legislation, has stated that the bill would look similar to this model statute:

Whoever knowingly discloses through the mails, or using any means of facility of interstate or foreign commerce or in or affecting interstate or foreign commerce by any means, including a computer, an image of another, identifiable person whose intimate parts are exposed or who is engaged in a sexual at, when the actor knows or should have known that the depicted person has not consented to such disclosure, shall be fined under this title or imprisoned not more than two years, or both.[165]

Representative Speier’s announcement of her plan to introduce this legislation is a step in the right direction.

[48]     A federal criminal ban on the distribution of revenge porn likely would serve as a deterrent and discourage people from posting these pictures in the first place.  If a person knows he could potentially face jail time or a heavy fine, he likely would not be as quick to engage in such an activity.  Further, being indicted on federal criminal charges rather than being sued by one individual likely will carry more weight and be taken more seriously by people engaging in this vindictive behavior.  Also, a federal law criminalizing this activity means victims are represented by the government.  Thus, victims would not have to pay to litigate these lawsuits and would not have to face as much publicity as they would when bringing a civil suit. More importantly, a federal criminal ban on revenge porn would trump § 230 of the CDA, allowing victims to go after the big fish, the revenge porn websites.  Thus, such a law would also discourage people from operating revenge porn websites, period; thus, truly getting at the heart of the problem.

 

VI.  Conclusion

[49]     As technology and pornography continue to mature and push the limits, both consistently present judges, legislators, and legal advocates with difficult legal questions.  The rapid growth of technology and pornography’s recent creation, revenge porn, has brought detrimental effects for many and highlighted a great need for legal action.  Although many states have begun to recognize the seriousness of this issue, and even though there are some existing civil laws that potentially address revenge porn, the most effective way to stop websites and users from posting revenge porn is for Congress to enact a federal criminal law.  A carefully crafted federal law would protect victims, deter violators, and allow victims to go after the actual revenge porn websites themselves, without offending the First Amendment.

 


[1] See Jonathan Coopersmith, Pornography, Technology and Progress, 4 ICON 94 (1998), available at http://berlin.robinperrey.com/imgpo/pornography-technology-and-progress.pdf.

[2] See id.

[3] See Christopher Bonanos, Before Sexting, There Was Polaroid, Atlantic (Oct. 1, 2012, 12:38 PM), http://www.theatlantic.com/technology/archive/2012/10/before-sexting-there-was-polaroid/263082/

[4] Coopersmith, supra note 1, at 102 (“Film did not die—7852 new pornographic films appeared in 1996 compared with 471 Hollywood films—but consumption had moved from adult theatres and sex stores to the more private environments provided by cable TV and the VCR.”).

[5] Peter Johnson, Pornography Drives Technology: Why Not to Censor the Internet, 49 Fed. Comm. L.J. 217, 222 (1996) (emphasis added).

[6] Coopersmith, supra note 1, at 104.

[7] Id.  “The Internet offers nearly free access to pornography uninhibited by previous barriers of time and space.”  Id. at 110.

[8] Id. at 110-11.

[9] See Katie Gant, Note, Crying Over the Cache: Why Technology Has Compromised the Uniform Application of Child Pornography Laws, 81 Fordham L. Rev. 319, 326 (2012) (noting that “[w]ith the advent of [I]nternet technology, child pornography became a new monster”); Nicole A. Poltash, Note, Snapchat and Sexting: A Snapshot of Baring Your Bare Essentials, 19 Rich. J.L. & Tech. 14, ¶ 5 (2013), http://jolt.richmond.edu/v19i4/article14.pdf.

[10] See Coopersmith, supra note 1, at 106 (“In an example of the true democratisation of technology, the development of the Polaroid instant camera and the camcorder allowed people to produce their own pornography free from anyone else seeing their work.”).

[11] More on Sexting and Texting from SIA 3, UptoDate (Feb. 5, 2013), http://blog.match.com/2013/02/05/more-on-sexting-and-texting-from-sia-3/.

[12] See Michelle Dean, The Case for Making Revenge Porn a Federal Crime, Gawker (Mar. 27, 2014, 2:45 PM), http://gawker.com/the-case-for-making-revenge-porn-a-federal-crime-1552861507; State ‘Revenge Porn’ Legislation, Nat’l Conf. St. Legis., http://www.ncsl.org/research/telecommunications-and-information-technology/state-revenge-porn-legislation.aspx (last visited Oct. 15, 2014).  Alaska and Texas also have statutes already on the books that may be broad enough to cover revenge porn situations.  See Dean, supra.  This will be discussed further below.

[13] Id. (noting that bills had been introduced or are pending in at least twenty seven states, the District of Columbia, and Puerto Rico in 2014).

[14] See Doe v. Hofstetter, No. 11-CV-02209-DME-MJW, 2012 U.S. Dist. LEXIS 82320 (D. Colo. June 13, 2012) (holding that defendant was guilty of intentional infliction of emotional distress, defamation, and public disclosure of private fact after he posted ex-girlfriend’s nude photographs on twenty-three adult websites with her contact information); Lorelei Laird, Victims Are Taking on ‘Revenge Porn’ Websites for Posting Photos They Didn’t Consent to, ABA J. (Nov. 1, 2013, 4:30 AM), http://www.abajournal.com/mobile/mag_article/victims_are_taking_on_revenge_porn_websites_for_posting_photos_they_didnt_c/ (noting that victims of revenge porn own the copyright of their photos were self-portraits and can send takedown notices under the Digital Millennium Copyright Act).

[15] See, e.g., Mary Anne Franks, Sexual Harassment 2.0, 71 Md. L. Rev. 655, 687-88 (2012); Danielle Citron, Revenge Porn and the Uphill Battle to Pierce Section 230 Immunity (Part II), Concurring Opinions (Jan. 25, 2013), http://www.concurringopinions.com/archives/2013/01/revenge-porn-and-the-uphill-battle-to-pierce-section-230-immunity-part-ii.html.

[16] See, e.g., Revenge Porn, Urban Dictionary, http://www.urbandictionary.com/define.php?term=revenge%20porn (last visited June. 8, 2014).

[17] Alexa Tsoulis-Reay, A Brief History of Revenge Porn, N.Y. Mag. (July 21, 2013), http://nymag.com/news/features/sex/revenge-porn-2013-7/.

[18] Id.

[19] Id.

[20] Jonathan Barrett & Luke Strongman, The Internet, the Law, and Privacy in New Zealand: Dignity with Liberty?, 6 Int’l J. of Comm. 127, 136 (2012).

[21] See Tsoulis-Reay, supra note 17.

[22] See, e.g., Laird, supra note 14.

[23] Danielle Keats Citron & Mary Anne Franks, Criminalizing Revenge Porn, 49 Wake Forest L. Rev. 345, 350-51 (2014) (citation omitted).

[24] Is Anyone Up?, Wikipedia, http://en.wikipedia.org/wiki/Is_Anyone_Up%3F (last visited June 8, 2014).

[25] Matt Markovich, Revenge Porn Websites Taking Advantage of Weak Privacy Laws, KOMO News (Nov. 21, 2013, 11:53PM), http://www.komonews.com/news/local/Privacy-Laws-Weak-at-Protecting-Nude-Photos-on-Revenge-Porn-Websites-232935541.html.

[26] Laird, supra note 14 (noting that even revenge porn sites “have been accused of hacking victims’ computers or fishing for photos with false personal ads”).

[27] Communications Decency Act of 1996, 47 U.S.C. §§ 230, 560, 561 (1996).

[28] Cheryl B. Preston, What Ifs and Other Alternative Intellectual Property and Cyberlaw Story: The Internet and Pornography: What If Congress and the Supreme Court Had Been Comprised of Techies in 1995-1997?, 2008 Mich. St. L. Rev. 61, 62 (2008).

[29] Reno v. ACLU (Reno I), 521 U.S. 844 (1997) (holding that §§ 223(a) and 223(d) were overbroad and abridged the freedom of speech protected by the First Amendment).

[30] See Preston, supra note 28, at 64.

[31] See id. at 74.

[32] Jonathan Coopersmith, Does Your Mother Know What You Really Do?  The Changing Nature and Image of Computer-Based Pornography, 22 Hist. & Tech. 1, 2 (2006).

[33] Shannon Creasy, Note and Comment, Defending Against a Charge of Obscenity in the Internet Age: How Google Searches Can Illuminate Miller’s “Contemporary Community Standards”, 26 Ga. St. U.L. Rev. 1029, 1031 (2010).

[34] See id.

[35] See Preston, supra note 28, at 83 (reporting that in one month during 2005, over seventy-one million people—forty-two percent of the Internet audience—viewed Internet pornography).

[36] See Preston, supra note 28, at 85.

[37] See Preston, supra note 28, at 85.

[38] See Alex Saltarin, US Leads Smartphone Porn-watching Countries List, Tech Times (Dec.24, 2013, 11:21 AM), http://www.techtimes.com/articles/2229/20131224/us-leads-smartphone-porn-watching-countries-list.htm.

[39] See id.

[40] See Lauren Effron, The Appeal of Amateur Porn, ABC News (Oct. 14, 2011, 3:37 PM), http://abcnews.go.com/blogs/health/2011/10/14/the-appeal-of-amateur-porn/.

[41] Id.

[42] Obviously, there are other factors that aided in the rise of revenge porn such as the actual spitefulness of the jilted ex-lovers that decide to post the images, but this comment will not go into this aspect of the trend.

[43] See Patt Morrison, ‘Revenge Porn’ May Soon Be a Crime in California, L.A. Times (Aug. 26, 2013, 11:46 AM), http://www.latimes.com/opinion/opinion-la/la-ol-revenge-porn-should-it-be-a-crime-20130826,0,2875247.story.

[44] See id.

[45] See id.

[46] Natalie Webb, Revenge Porn by the Numbers, End Revenge Porn (Jan. 3, 2014),http://www.endrevengeporn.org/revenge-porn-infographic/.

[47] See Citron & Franks, supra note 23, at 351.

[48] See id..

[49] See id..

[50] Mary Anne Franks, Criminalizing Revenge Porn: A Quick Guide, End Revenge Porn, http://www.endrevengeporn.org/guide-to-legislation/ (last visited Apr. 26, 2014).

[51] See Citron & Franks, supra note 23, at 352.

[52] See, e.g., Jessica Roy, The Battle Over Revenge Porn: Can Hunter Moore, the Web’s Vilest Entrepreneur, Be Stopped?, BetaBeat (Dec. 4, 2012, 7:46 PM), http://betabeat.com/2012/12/the-battle-over-revenge-porn-can-hunter-moore-the-webs-vilest-entrepreneur-be-stopped/.

[53] See id.

[54] See id.

[55] See id.

[56] See id.

[57] See Memphis Barker, “Revenge Porn” Is No Longer a Niche Activity Which Victimises Only Celebrities—The Law Must Intervene, Indep. (May 19, 2013), http://www.independent.co.uk/voices/comment/revenge-porn-is-no-longer-a-niche-activity-which-victimises-only-celebrities–the-law-must-intervene-8622574.html.

[58] Kashmir Hill, Revenge Porn with a Facebook Twist, Forbes (July 6, 2011, 4:54 PM), http://www.forbes.com/sites/kashmirhill/2011/07/06/revenge-porn-with-a-facebook-twist/.

[59] See id.

[60] See Adrian Chen, Internet’s Sleaziest Pornographer Calls It Quits: ‘I’m Done with Looking at Little Kids Naked All Day’, Gawker (Apr. 19, 2012, 4:50 PM), http://gawker.com/5903486/internets-sleaziest-pornographer-calls-it-quits-im-done-with-looking-at-little-kids-naked-all-day/all.  In a phone interview, Moore talked about how the influx of child pornography submissions became too much with which for him to deal.  See also Drew Guarini, Hunter Moore, Is Anyone Up Founder, Says New Website Will Be ‘Scariest on the Internet’, Huffington Post (Aug. 24, 2012, 12:26 PM), http://www.huffingtonpost.com/2012/08/23/hated-internet-star-hunte_n_1826061.html.

[61] See Roy, supra note 52.

[62] See Abby Rogers, The Guy Behind Two “Revenge Porn” Sites Says the Government Protects His Work, Bus. Insider (Nov. 29, 2012, 4:43 PM), http://www.businessinsider.com/isanyoneupcom-naked-pictures-are-back-2012-11.

[63] See Roy, supra note 52.

[64] See Rogers, supra note 62.

[65] See Jessica Roy, Revenge-Porn King Hunter Moore Indicted on Federal Charges, Time (Jan. 23, 2014), http://time.com/1703/revenge-porn-king-hunter-moore-indicted-by-fbi/.

[66] See id.

[67] See id.

[68] See Kashmir Hill, How Revenge Porn King Hunter Moore Was Taken Down, Forbes (Jan. 24, 2014, 11:17 AM), http://www.forbes.com/sites/kashmirhill/2014/01/24/how-revenge-porn-king-hunter-moore-was-taken-down/.

[69] See The Associated Press, California: Man Is Charged in ‘Revenge Porn’ Case, N.Y. Times (Dec. 10, 2013), http://www.nytimes.com/2013/12/11/us/california-man-is-charged-in-revenge-porn-case.html?_r=0.

[70] See id.; “Revenge Porn” Website Gets Calif. Man Charged with Extortion, CBS News (Dec. 11, 2013, 4:49 PM), http://www.cbsnews.com/news/calif-man-charged-with-extortion-through-revenge-porn-website/.

[71] See Don Thompson, Court Date Set for Kevin Bollaert in Revenge Porn Website Case, Huffington Post (Dec. 12, 2013, 2:15 AM), http://www.huffingtonpost.com/2013/12/12/kevin-bollaert-revenge-porn_n_4432097.html.

[72] See id.

[73] Joe Silver, “Revenge Porn” Site Creators Hit With $385,000 Judgment, Ars Technica (Mar.19, 2014, 1:48 PM), http://arstechnica.com/tech-policy/2014/03/revenge-porn-site-creators-hit-with-385000-judgment/.

[74] Citron and Franks also give a detailed analysis of the insufficiency of civil actions in addressing revenge porn.  See Citron & Franks, supra note 23, at 357–61.

[75] See Sarah Jeong, Revenge Porn Is Bad.  Criminalizing It Is Worse, Wired (Oct. 28, 2013, 9:30 AM), http://www.wired.com/2013/10/why-criminalizing-revenge-porn-is-a-bad-idea/; Laird, supra note 14.

[76] See Jeong, supra note 75.

[77] See 47 U.S.C. § 230 (2006); Dean, supra note 12.

[78] See Digital Millennium Copyright Act, 17 U.S.C. § 512 (2012).

[79] See Doe v. Hofstetter, No. 11-CV-02209-DME-MJW, 2012 U.S. Dist. LEXIS 82320 (D. Colo. June 13, 2012).

[80] See, e.g., Daniel Zharkovsky, “If Man Will Strike, Strike Through the Mask”: Striking Through Section 230 Defenses Using the Tort of Intentional Infliction of Emotional Distress, 44 Colum. J. L. & Soc. Probs. 193, 227 (2010).

[81] See id. at 228.

[82] See Nancy S. Kim, Web Site Proprietorship and Online Harassment, 2009 Utah L. Rev. 993, 1006 (2009).

[83] See id. at 1007 (citing Restatement (Second) of Torts §§ 558–59 (1977)).

[84] See id. at 1008-09.

[85] See id. at 1010.

[86] See Citron & Franks, supra note 23, at 358.

[87] See Kim, supra note 82, at 1008.  “On the Internet, however, widespread distribution is available to those without substantial financial resources.  Consequently, even where a plaintiff prevails in a civil action against an online harasser, the odds are high that the plaintiff will not be able to recover significant damages.”  Id.

[88] See Derek E. Bambauer, Exposed 98 Minn. L. Rev. (forthcoming 2014) (manuscript at 4-5) (on file with Univ. of Ariz. James E. Rogers College of Law, Discussion Paper No. 13-39), available at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2315583.

[89] See Kim, supra note 82, at 1010.

[90] See 47 U.S.C. §230(c)(1) (2006).

[91] See Zharkovsky, supra note 80, at 198. “One such problem concerned whether a proprietor of an online message board could be liable for defamatory statements posted on the board, even though the statements were made by an independent third party.”  Id. at 197.

[92] See id. at 198-99.

[93] 47 U.S.C. § 230(c)(1).

[94] 47 U.S.C. § 230(c)(2)(A).

[95] 47 U.S.C. § 230(e)(1)-(3) (emphasis added).

[96] See Fair Hous. Council v. Roommates.com, LLC, 521 F.3d 1157, 1174-75 (9th Cir. 2008) (en banc).

[97] See id. at 1162.

[98] See id. at 1164.

[99] See id. at 1166.

[100] See id.

[101] See Laird, supra note 14.

[102] See 17 U.S.C. § 512; Laird, supra note 14.

[103] 47 U.S.C. § 230(e)(2).

[104] See Laird, supra note 14.

[105] See id.

[106] Amanda Levendowski, Our Best Weapon Against Revenge Porn: Copyright Law?, Atlantic (Feb. 4, 2014, 1:03PM), http://www.theatlantic.com/technology/archive/2014/02/our-best-weapon-against-revenge-porn-copyright-law/283564/.

[107] See Haimy Assefa, Massachusetts Court Says ‘Upskirt’ Photos Are Legal, CNN (Mar. 6, 2014, 7:33 AM), http://www.cnn.com/2014/03/05/us/massachusetts-upskirt-photography/.  The Massachusetts court held it was legal to secretly photographs underneath a person’s clothing when the person is not nude or partially nude.  See id.  The court ruled,

In sum, we interpret the phrase, “a person who is . . . partially nude,” in the same way that the defendant does, namely, to mean a person who is partially clothed but who has one or more of the private parts of body exposed in plain view at the time that the putative defendant secretly photographs her.

Commonwealth v. Robertson, 5 N.E.3d 522, 528 (Mass. 2014).

[108] See Kim, supra note 81, at 1008.

[109] See 47 U.S.C. § 223 (2006).

[110] State Cyberstalking and Cyberharassment Laws, Nat’l Conf. St. Legis. (Dec. 5, 2013), http://www.ncsl.org/research/telecommunications-and-information-technology/cyberstalking-and-cyberharassment-laws.aspx.

[111] David Gray et. al., Fighting Cybercrime After United States v. Jones, 103 J. Crim. L. & Criminology 745, 748 (2013).

[112] See Franks, supra note 50.

[113] State ‘Revenge Porn’ Legislation, supra note 12.

[114] See id.; Dean, supra note 12.

[115] See generally State ‘Revenge Porn’ Legislation, supra note 12.

[116] N.J. Stat. Ann. § 2C:14-9 (West 2014).

[117] See Suzanne Choney, ‘Revenge Porn’ Law in California Could Pave Way for Rest of Nation, NBC News (Sept. 3, 2013, 4:34 PM), http://www.nbcnews.com/tech/internet/revenge-porn-law-california-could-pave-way-rest-nation-f8C11022538.

[118] See id.

[119] See id.

[120] N.J. Stat. Ann. § 2C:14-9(c).

[121] S. 255, 2013-2014 Reg. Sess. (Cal. 2013) (enacted as Cal. Penal Code § 647(j)(4)(A)).

[122] See Jerry Brown Signs Anti-Revenge Porn Bill, Huffington Post (Oct. 2, 2013, 10:18 AM), http://www.huffingtonpost.com/2013/10/02/jerry-brown-revenge-porn_n_4030175.html.

[123] See id.

[124] § 647(j)(4)(A).

[125] See id.

[126] See § 647(j)(4)(A); Eric Goldman, California’s New Law Shows It’s Not Easy To Regulate Revenge Porn, Forbes (Oct. 8, 2013, 12:03 PM), http://www.forbes.com/sites/ericgoldman/2013/10/08/californias-new-law-shows-its-not-easy-to-regulate-revenge-porn/.

[127] See § 647(j)(4)(A); Goldman supra note 125.

[128] See S. 1255, 2013-2014 Reg. Sess. (Cal. 2014).

[129] H.R. 563, 2014 2d Reg. Sess. (Id. 2014), available at http://www.legislature.idaho.gov/legislation/2014/H0563.htm.

[130] Id.

[131] See id.

[132] Alaska Stat. § 11.61.120 (2013); Jerzy Shedlock, Anchorage Man Charged with Harassment After Creating Fake Facebook Accounts, Alaska Dispatch (Jan. 4, 2014), http://www.alaskadispatch.com/article/20140104/anchorage-man-charged-harassment-after-creating-fake-facebook-accounts.

[133] Tex. Penal Code Ann. § 21.15(b)(1) (West 2011); ex parte Thompson, 414 S.W.3d 872, 874 (Tex. App. 2013)  (holding section 21.15(b)(1) of the Texas Penal Code unconstitutional for restricting protected speech by regulating an individual’s right to photograph and to have certain thoughts).

[134] See supra text accompanying notes 112-114.

[135] See generally supra note 43 and accompanying text.

[136] See H.R. 787, 2013 Leg., Reg. Sess. (Fl. 2013), available at http://www.myfloridahouse.gov/Sections/Bills/billsdetail.aspx?BillId=50026.

[137] See id.

[138] See S. 532, 2014 Leg., Reg. Sess. (Fl. 2014), available at http://www.flsenate.gov/Session/Bill/2014/0532.

[139] See id.

[140] H.R. 326, 2014 Leg. Reg. Sess. (Va. 2014), available at http://lis.virginia.gov/cgi-bin/legp604.exe?141+sum+HB326.

[141] See id.

[142] See State ‘Revenge Porn’ Legislation, supra note 12.

[143] See Laird, supra note 14.

[144] See id.

[145] Steven Nelson, Federal ‘Revenge Porn’ Bill Will Seek to Shrivel Booming Internet Fad, US News (Mar. 26, 2014), http://www.usnews.com/news/articles/2014/03/26/federal-revenge-porn-bill-will-seek-to-shrivel-booming-internet-fad; Dean, supra note 12.

[146] See Franks, supra note 50, at 2.

[147] See Dean, supra note 12.

[148] See FCC v. Pacifica Found., 438 U.S. 726 (1978) (holding the Federal Communications Commission could regulate “indecent speech” on the radio during hours when children are likely listening); Cohen v. California, 403 U.S. 15, 19 (1971).  “[T]he First and Fourteenth Amendments have never been thought to give absolute protection to every individual to speak whenever or wherever he pleases or to use any form of address in any circumstances that he chooses.”  Id.

[149] Miller v. California, 413 U.S. 15, 24 (1973) (citation omitted).

[150] See Creasy, supra note 33 at 1033.

[151] See Creasy, supra note 33 at 1040.

[152] Miller, 413 U.S. at 24; Citron & Franks, supra note 23, at 35.

[153] Pacifica, 438 U.S. at 732.

[154] Id. at 747.

[155] Id. at 748; see also Rowan v. Post Office Dept., 397 U.S. 728 (1970).

[156] See Mark Melnicoe, California Crackdown on ‘Revenge Porn’ in Brown’s Hands, Bloomberg (Sep. 11, 2013, 2:55 PM), http://www.bloomberg.com/news/2013-09-11/california-crackdown-on-revenge-porn-in-brown-s-hands.html.

[157] See supra note 120-127 and accompanying text.

[158] See H.R. 787, 2013 Leg., Reg. Sess. (Fl. 2013).

[159] Citron and Franks also conclude that the criminalization of revenge porn is necessary; however, I am arguing specifically for a federal law criminalizing revenge porn.  See Citron & Franks, supra note 23, at 390.

[160] See Dean, supra note 12.

[161] See id.

[162] See Robert L. Ullmann and David L. Ferrera, Crime on the Internet, 42 B.B.J. 4, 4 (1998) (stating most Internet crime involves interstate or international communications); Anne E. Hawley, Taking Spam Out of Your Cyberspace Diet: Common Law Applied to Bulk Unsolicited Advertising Via Electronic Mail, 66 UMKC L. Rev. 381, 385 (1997) (discussing the inadequacy of state legislation in controlling spamming problems because Internet activities cross jurisdictional boundaries).

[163] Kevin V. Ryan & Mark L. Krotoski, Symposium, Big Brother in the 21st Century?: Reforming the Electronic Communications Privacy Act: Caution Advised: Avoid Undermining the Legitimate Needs of Law Enforcement to Solve Crimes Involving the Internet in Amending the Electronic Communications Act, 47 U.S. F. L. Rev. 291, 291–92 (2012).

[164] See Nelson, supra note 137.

[165] See Franks, supra note 50, at 4.

Blog: Twitter Fights for Its First Amendment Right

By: Andrea Mousouris, Associate Articles Editor

Whether we realize it or not, our online activity is being watched. And whether we like it or not, Twitter, among other tech giants, shares our personal data with the U.S. government. Should consumers be aware of what and how much the government asks for? Twitter thinks so.

Twitter is suing the U.S. government in an effort to relax federal restrictions on what the tech company can say publicly about the national security related requests.[1] Defending principles of free speech, Twitter believes the government is violating its First Amendment right by criminalizing the disclosure of the number and type of spying orders it receives.[2]

Consumer technology companies often hold data on suspects that agencies like the National Security Agency are tracking.[3] Many of these agencies routinely request user data from these companies as part of continuing investigations.[4] But for years, technology companies have been limited by the law as to how much they can publicly disclose to their users about these government requests.[5] That has put companies like Twitter, Facebook, and LinkedIn in the difficult position of not being able to let their users know when they hand over their data.

The legality of government spying itself is not at issue in this case; the suit is a dispute about disclosure. Other Internet companies have also protested these restrictions, and in January 2013 the U.S. Department of Justice gave permission to Facebook, Google, LinkedIn, Microsoft and Yahoo to publish the information in bands of 1,000, starting with 0-999.[6] But Twitter’s data requests are much smaller, and so they want the right to tell its users that their accounts do not undergo widespread government surveillance.

On the one side, Twitter’s complaint challenges the basis for adopting a “preapproved disclosure format”, one that constitutes “an unconstitutional prior restraint and content-based restriction on, and government viewpoint discrimination against, Twitter’s right to speak about information of national and global public concern.”[7] On the other side, the government argues that in the FBI and National Security Agency’s pursuit of defending the country from real security threats, the more that the world knows about their sources and methods, the greater the security risk.[8] The court will have to decide whether such a risk meets the level of legal scrutiny required to restrict a First Amendment right.

In the mean time, Twitter continues to hope for comprehensive reform from Congress of government surveillance powers.[9] The USA Freedom Act of 2014, introduced by Senate Judiciary Committee Chairman Patrick Leahy (D-VT), would allow companies like Twitter to provide more transparency to its users.[10] But until then, the suit will continue as part of a long battle between the U.S. government and the technology companies that hold information on billions of people.

 

[1] Eric Brader, Twitter Sues U.S. Government Over National Security Data, CNN.COM, http://www.cnn.com/2014/10/07/politics/twitter-sues-u-s-government/ (last updated Oct. 7, 2014).

[2] Id.

[3] Id.

[4] Id.

[5] Mike Isacc, Twitter Sues U.S. Government Over Data Disclosure Rules, NEW YORK TIMES.COM, http://bits.blogs.nytimes.com/2014/10/07/twitter-sues-u-s-government-over-data-disclosure-rules/ (last updated Oct. 7, 2014).

[6] Supra Note 1.

[7] Complaint at 47, Twitter Inc. v. The U.S. Government, (N.D. Cal. 2014)(No. 14-cv-4480).

[8] Supra Note 5.

[9] Ben Lee, Taking the Fight for #transparency to Court, Twitter Blog, https://blog.twitter.com/2014/taking-the-fight-for-transparency-to-court (Oct. 7. 2014).

[10] Id.

Blog: Virtual Adultery: The World of Cyber Cheating

By: Micala MacRae, Associate Notes & Comments Editor

A virtual adultery epidemic has swept the nation. Online chat rooms, Facebook, twitter and other forms of social media have enabled individuals to make virtual connections that some argue are grounds for divorce.  In 1996, a New Jersey man filed for divorce based on adultery after discovering that his wife had been carrying on a “virtual” affair with a man in North Carolina through online chat rooms.[1]  Although the wife never met her cyber-paramour in person the relationship began to take over their lives and she began to neglect her job, family, and marriage.[2]  In the United States the courts have refused to hold virtual relationships reach the level of intimacy necessary for adultery.  Adultery is defined as intimate sexual activity outside of marriage.  However, virtual infidelity has become an increasingly important issue in Family Law.

Virtual infidelity can eventually lead a party to act.  If a spouse travels to meet an online partner in person, courts may infer adultery without much difficulty.  Courts have taken into consideration parents’ excessive time spent online on interactive gaming websites when determining child custody.[3]  When parents are not providing adequate support and care for their children due to their exorbitant time online courts infer from this they have relinquished their parental responsibilities.[4]  Courts may eventually see virtual infidelity as a renouncement of parental duties in divorce proceedings awarding the spouse who did not participate in the virtual infidelity full custody of the children.

Though courts have held virtual infidelity does not satisfy grounds for divorce it may satisfy other requirements such as neglect or abandonment.[5]  The spouse carrying out a virtual relationship abandons the marital relationship and the family when he or she spends great periods of time pursing the virtual relationship.  Many courts are willing to accept that sexual activity that is not proven to rise to the level of intercourse can still constitute legal adultery.[6]  Some courts even disapprove of emotional affairs, which are almost analogous to virtual adultery.

Although virtual infidelity may never involve physical contact courts may rule these virtual relationships that lead to the degradation of the marital relationship are grounds for divorce.  Online infidelity may qualify as adultery when the conduct is a substantial factor in the breakdown of the marriage.  Courts may expand the definition of adultery to include virtual infidelity as a factor in determining whether a divorce should be granted.  The law is behind the pace of technology and the evolution of views on marriage and infidelity.  It may be time to expand the law of adultery to include virtual infidelity, so that relief can be afforded to the victims.

 

[1] Douglas E. Abrams et al., Contemporary Family Law (3rd ed. 2012)

[2] Id.

[3] Andrew Feldstein, Is Cybersex Grounds for Divorce?, Huffingtonpost.com, http://www.huffingtonpost.com/andrew-feldstein/is-cybersex-grounds-for-d_b_4555583.html (last updated Mar. 10, 2014).

[4] Id.

[5] Edward Nelson, Virtual Infidelity: A Ground for Divorce, Examiner.com, (Sept. 11, 2010, 4:18 PM), http://www.examiner.com/article/virtual-infidelity-a-ground-for-divorce.

[6] Id.

Blog: e-Vino Veritas: Archaic Wine Regulation in the Digital Age

By: Barry Gabay, Notes & Comments Editor

Amazon.com has completely transformed humans’ understanding of book availability. A book that may have eluded our grasp for months or even years can now be readily attained in a matter of seconds. We no longer have travel costs associated with visiting a book retailer, and we no longer experience the disappointment of the retailer being out of stock. There is no more stress or hassle in book shopping in the world of e-Commerce, as the world’s largest library is constantly at our fingertips. Now imagine the same phenomenon with wine.

In November 2012, Amazon, the world’s largest online retailer, launched a wine marketplace with over 1,000 domestic wines available.[1] Today, the portal offers more than 5,000 wines from some 700 merchants, 80 percent of which are from domestic brands.[2] The website facilitates “direct-to-consumer” transactions between wineries and consumers, whereby consumers are delivered bottles and cases of wine packaged and shipped directly from the winery.[3]

The marketplace’s potential is self-evident, as Amazon netted over $61 billion in sales in 2012, up more than 27 percent from the previous year.[4] On top of that, the United States is the world’s largest wine consumer; we drank 856 million gallons of wine in 2012, roughly 2.73 gallons per citizen, and spent nearly $35 billion on wine. [5] Further, of the roughly 7,500 wineries existing in the United States, the vast majority of are boutique wineries who do not market out of state.[6] Thus, with Amazon’s direct-to-consumer shipping, these small wineries will be able to sell to customers across the nation, and consumers across the country will be able to purchase premium wines with the click of a button from any winery who registers…in an ideal world.

Due to highly regulated interstate distribution laws, the Amazon marketplace, at present, only serves customers in 22 states and the District of Columbia.[7] The major impediment is the three-tier system of alcohol distribution, under which wine, distilled spirits, and beer producers (tier one), wholesalers (tier two) and retailers (tier three) are completely separated, and alcohol must pass through all three tiers before it reaches the consumer.[8] The system was adopted by many states after the passing of the Twenty-First Amendment, which effectively gave states absolute authority to control alcohol within their borders. It originally served to halt the future emergence of Prohibition-era criminal syndicates, run by the likes of George Remus and Al Capone who used vertical integration tactics in their control of the liquor industry. The system is now used in nearly every state in hopes of “promoting temperance, ensuring orderly market conditions and raising revenue.”[9]

The three-tier system has, remarkably, survived recent constitutional challenges under the Commerce Clause, notably in the 2005 decision of Granholm v. Heald.[10] But while countless articles and several courts have found the three-tier system to, by its very nature, discriminate against out-of-state producers and consumers and thus in violation of the Dormant Commerce Clause, the current rise in e-Commerce offers a yet another justification for loosening state regulations on alcohol distribution.[11] Wineries, like nearly every other industry, have identified the Internet as a gateway for national distribution and expansion. E-Commerce provides an outlet for small wineries to reach consumers they would otherwise never have access to; the growing popularity of boutique wineries makes this outlet even more valuable.

Today, 44 states and the District of Columbia allow the direct shipment of wine to the consumer in some capacity,[12] though more often than not, there are stiff regulatory issues the winery must comply with.[13] Direct-to-consumer shipments were worth more than $1.46 billion from in 2012, an eight percent increase during that time frame the year prior.[14] Yet, although we are the world’s largest wine consumer, we are well behind Europeans (eight to ten percent of their wine purchased online) and the Chinese (27 percent) in terms of direct-to-consumer wine sales.[15] A decade-old Federal Trade Commission report found that the single biggest factor inhibiting the rise of direct-to-consumer wine sales was the three-tier system.[16] When that report was filed, total American e-Commerce sales were around $58 billion. That number reached $259 billion last year.[17] Thus, the extent to which the three-tier system inhibits wine distribution is self-evident and simply staggering.

With the emergence of Amazon’s wine marketplace, the potential benefits of direct-to-consumer shipment are once again being discussed in state legislatures.[18] Greater market competition benefits consumer costs, as lower online wine prices would induce local wineries to take competitive action. Opening up the market to allow wineries to sell directly to retailers and consumers will benefit boutique wineries and consumers. Boutique wineries will be able to independently expand their distribution out of state, and consumers will have a lifetime of different wine from which to choose without increased wholesale markup. In the current shift toward a universal marketplace, our wine cellar could be infinite.  

 

 

[1] Mark Brohan, Amazon Sales Top $61 Billion in 2012, Internet Retailer (Jan. 29, 2013), http://www.internetretailer.com/2013/01/29/amazon-sales-top-61-billion-2012; Andrea Chang, Amazon Launches Online Wine Marketplace, L.A. Times (Nov. 9, 2012), http://articles.latimes.com/2012/nov/09/business/la-fi-amazon-wine-20121109.

[2] Lauren Indvik, Amazon Begins Shipping Wine to New York, Michigan, Mashable (Oct. 17, 2013), http://mashable.com/2013/10/17/amazon-wine-new-york/.

[3] Chang, supra note 1.

[4] Brohan, supra note 1.

[5] Table 6.1: World Wine Consumption, 2008-2011, % Change 2011/2008, and % of World Consumption-2011, The Wine Institute (2011), http://www.wineinstitute.org/files/World_Consumption_by_Country_2011.pdf; 2012 Wine Sales in U.S. Reach New Record: Record California Wine Crop to Meet Surging Demand, The Wine Institute (2013), http://www.wineinstitute.org/resources/pressroom/04082013.

[6] North American Winery Total passes 8,000, Wines & Vines (2013), http://www.winesandvines.com/template.cfm?section=news&content=111242; Devin McIntyre, Is Amazon Closer to Solving the Wine Shipping Puzzle?, The Wash. Post (2013), http://www.washingtonpost.com/lifestyle/food/is-amazon-closer-to-solving-the-wine-shipping-puzzle/2012/10/08/79b5353a-0da2-11e2-bd1a-b868e65d57eb_story.html.

[7] Amazon Wine States, http://www.amazon.com/gp/help/customer/display.html?nodeId=201020560 (last visited Feb. 1, 2014).

[8] Amy Murphy, Discarding the North Dakota Dictum, 110 Mich. L. Rev. 819, 824-25 (2012).

[9] Wine Country Gift Baskets.com v. Steen, 612 F.3d 809, 814 (5th Cir. 2
010) (citing North Dakota v. United States, 495 U.S. 423, 432 (1990) (plurality opinion) (internal citations omitted)).

[10] Granholm v. Heald, 544 U.S. 460, 463 (2005).

[11] See e.g. Murphy, supra note 8; Desireé C. Slaybaugh, A Twisted Vine: The Aftermath of Granholm v. Heald, 17. Tex. Wesleyan L. Rev. 265 (2011); Costco Wholesale Corp. v. Hoen, 407 F. Supp 2d. 1247 (W.D. Wash. 2005); Cherry Hill Vineyards LLC v. Lilly, 553 F.3d 423 (6th Cir. 2008); Family Winemakers of California v. Jenkins, 592 F.3d 1 (1st Cir. 2010).

[12] State Shipping Laws for Wineries (Jan. 24, 2014), http://wineinstitute.shipcompliant.com/Home.aspx; see e.g.

[13] See e.g. Ala. Code § 28-3-5 (1975): (“Any retail dealer of alcoholic beverages … purchasing or receiving such commodities from without the state … shall, within 12 hours of receipt of such alcoholic beverages, mail … a true duplicate invoice of all such purchases or receipts to the board at Montgomery, Alabama, said invoice carrying the name of the person or firm from whom or through whom such purchases or shipments of the alcoholic beverages were received and showing kinds and quantities.”); Ind. Code § 7.1-3-26-9 (2011) (“A direct wine seller’s permit entitles a seller to sell and ship wine to a consumer” provided that the customer purchases the wine “in an initial face-to-face transaction.”).

[14] Jeff Carroll, Pawel Smolarkiewicz & Lynne Skinner, Direct to Consumer Wine Shipping Report 2013, Wines & Vines, 1-2, http://www.winesandvines.com/pdf/2013Direct-to-Consumer-Shipping-Report.pdf.

[15] Rebecca Gibb, Internet Wine Sales Top $5 Billion, Wine-Searcher (June 18, 2013), http://www.wine-searcher.com/m/2013/06/internet-wine-sales-top-5-billion.

[16] Federal Trade Commission, supra note 7, at 3 (Note: The country’s two largest wine wholesalers, Southern Wine & Spirits and Republic National Distribution Company, generate revenues upwards of $13 billion, and the Wine & Spirit Wholesalers of America, the industry’s largest lobbying effort, spent $9.3 million in political action committee funds in the 2008 presidential election.).

[17] Allison Enright, U.S. e-Commerce Sales Could Top $434 billion in 2017, Internet Retailer (Apr. 25, 2013, 4:33 PM), http://www.internetretailer.com/2013/04/25/us-e-commerce-sales-could-top-434-billion-2017; U.S. Census Bureau, Quarterly Retail e-Commerce Sales: 3rd Quarter 2013 (2013), http://www.census.gov/retail/mrts/www/data/pdf/ec_current.pdf.

[18] See e.g. Steve Annear, Changes to Wine Direct Shipping Laws Are Fermenting on Beacon Hill, Boston Magazine (Nov. 11, 2013), http://www.bostonmagazine.com/news/blog/2013/11/11/massachusetts-wine-delivery-laws-free-the-grapes/.

Blog: Football Concussion Suits: Reasonable or Hard Headed?

By: Bradford Schulz, Associate Staff

Juries across the nation recently are being asked to determine reasonable standards for football concussion helmet suits.[1] In a trademark case this past summer, the NFL settled with thousands of former professional league football players in a concussion related claim class action suit.[2]  The total NFL payout is $870 million with $675 million awarded for compensatory claims, $75 million for testing, $10 million for medical research, and $112 million for lawyers’ fees.[3]  The final settlement has approximately three payout formula categories; (1) a young retiree with amyotrophic lateral sclerosis or Lou Gehrig’s disease will be awarded $5 million, (2) 50-year-old retires with Alzheimer’s disease could receive $1.6 million, and (3) 80-year-old retires with early dementia will be awarded $25,000.[4]  Just this month, a splinter group from the settlement launched and lost their bid for appellate intervention on the merits of the settlement.[5]  The goal for the Sean Morey Objectors was to establish a legal custom in defining what football organizations know or should know about concussion safety.[6]  Juries in football concussion suits are quickly recognizing that the absence of a reasonable custom is not the only issue that needs addressing.

Before juries can tackle the appropriate legal custom in concussion related tort actions, scientists need to first figure out what a concussion is. Doctors struggle with establishing parameters for diagnosing concussions because they are unsure what specifically causes concussions. “If you talk to any doctor out there, you’re going to get 14 different opinions on what causes a concussion . . . [w]e don’t know if it’s a big hit or if it’s a whole bunch of little hits.”[7]  It is known that helmets protect the player’s head and are able to absorb a hit’s energy; however, helmets do not protect the brain from the hit’s acceleration.[8]

Any hit will likely have a perpendicular component and an angular component. A perpendicular hit is aligned straight at the head, directed exactly at the brain’s center of gravity. Football helmets do a satisfactory job absorbing the energy from a perpendicular hit because the structure of the shell transfers the energy away from the impact. The helmet significantly reduces the force, i.e. acceleration, of the perpendicular hit felt by the brain. Whereas an angular hit is any hit not straight at the brain’s center of gravity. This angled hit creates a rotational force around the brain’s center of gravity causing the head to spin, twist, or rotate. The helmet provides little protection to stop this additional rotation, because after all, the player needs to turn his head to look around. Imagine wearing a helmet and having someone hit the crown with a hammer; the helmet may not break, but you will likely undergo whiplash. It is believed that this rotational acceleration is a major component in football concussions.[9]

There are efforts in the scientific community to analyze the forces felt from a football hit. Researchers at several universities have installed sensors within their school’s helmets to measure the forces felt during hits. For instance, the InSite software measures violent movement and impact duration, and then it transmits this data to training staff on the sideline.[10]  Another program monitors player’s change in molecular information throughout a season in order to identify possible blood-based molecular correlations with concussions.[11] Dr. Duma, a university researcher, has found that “routine” hits equate to 20-40 times the force of gravity and “violent collisions” equate to 120 times the force of gravity.[12] An imperfect comparison is to acknowledge that astronauts train at 9 times the force of gravity; however, the durations are significantly different.

Several manufactures, some of which were involved in the NFL settlement, are beginning to offer new helmet designs. One manufacture is adding bullet stopping Kevlar inside their helmets; another is changing its external design to incorporate rubber padded foam, while others have sensors that update training staff on possible concussion-causing hits.[13]

So how is this affecting tort law? Other than the typical safety advertising suit, the lack of information on football hit concussions is affecting the custom standards juries use in determining reasonable safety precautions and designs. The first affect is that players, especially high school youth, believe that helmets protect them from concussions. As such, juries are willing to protect these youth by awarding plaintiffs for inadequate helmet safety warnings.[14] The second affect is that juries are struggling in establishing a test for negligent design. It is clear that juries are unsatisfied by the common practice in helmet manufacturing[15], but until the scientific research catches up juries are unable to hold the football helmet design to a satisfactory reasonable standard. And after all, unpredictable juries make for nervous litigators. Until science catches up and litigators have a clear custom for helmet safety negligence, we may see more settlements like the NFL case this past summer.

[1] FORBES, Hard Knocks: Xenith’s Helmet Technology Stands Tall Amidst Football’s Concussion Crisis, Sept. 2014 (available http://www.forbes.com/sites/chrissmith/2014/08/20/hard-knocks-xeniths-helmet-technology-stands-tall-amidst-footballs-concussions-crisis/).

[2] Associated Press. Federal Judge Approves NFL Concussion Settlement, July 7, 2014 (last updated July 9, 2014) (available at http://www.nfl.com/news/story/0ap2000000363672/article/federal-judge-approves-nfl-concussion-settlement).

[3] Id.

[4] In re Nat’l Football League Players’ Concussion Injury Litig., 2:12-MD-02323-AB, 2014 WL 3054250 (E.D. Pa. July 7, 2014).

[5] Paul D. Anderson, Objectors Seek Potentially Damning Discovery, NFL CONCUSION LITIGATION, Sept. 2014 (available at http://nflconcussionlitigation.com/).

[6] Id.

[7] Gary Mihoces, More Padding the Issue of Concussions and Better Helmets; USA TODAY SPORTS, Aug. 2013.

[8] Jim Avila and Serena Marshall, Riddell Unveils Overhauled New Football Helmet SpeedFlex, GOOD MORNING AMERICA, Aug 2014 (available at http://abcnews.go.com/US/riddell-unveils-football-helmet-speedflex/story?id=25141779).
 
[9] Id.

[10] Chris Fuhrmeister, New Riddell SpeedFlex Football Helmet Pits Technology vs. Concussions, SB NATION, Mar. 2014 (available at http://www.sbnation.com/college-football/2014/3/28/5547618/riddell-speedflex-helmets-insite-technology).

[11] Hackney Publications, Riddell and TGen Team up with Arizona State University’s Football Program to Further Genetic Research into Athlete Concussion Detection and Treatment, Concussion Policy & the Law, August 2014 (available at http://concussionpolicyandthelaw.com/tag/helmet/).

[12] Gregg Easterbrook, Virginia Tech Helmet Research Crucial, July 2011 (available at http://sports.espn.go.com/espn/page2/story?page=easterbrook-110719_virginia_tech_helmet_study).

[13] Jim Avila and Serena Marshall, Riddell Unveils Overhauled New Football Helmet SpeedFlex, GOOD MORNING AMERICA, Aug 2014 (available at http://abcnews.go.com/US/riddell-unveils-football-helmet-speedflex/story?id=25141779); Gary Mihoces, More Padding the Issue of Concussions and Better Helmets; USA TODAY SPORTS, Aug. 2013.

[14] FORBES, Hard Knocks: Xenith’s Helmet Technology Stands Tall Amidst Football’s Concussion Crisis, Sept. 2014 (available http://www.forbes.com/sites/chrissmith/2014/08/20/hard-knocks-xeniths-helmet-technology-stands-tall-amidst-footballs-concussions-crisis/).

[15] Id.

Blog: Transparency in Law Enforcement: The Trend Towards Officer Body Cameras

by Eileen Waters, Associate Staff

 

The concept of body-mounted cameras worn by police officers is not brand new; in fact, police departments across the United States, England, Brazil, and Australia have been implementing systems with wearable cameras since the early 2000s. [1] Recently in the U.S., public interest has put a brighter spotlight on wearable cameras since an incident in Ferguson, Missouri, where an unarmed teenager named Michael Brown was shot by a police officer.[2] Confusion as to what actually happened when the incident occurred has led to debate and speculation about whether there would be less “civil unrest” if the officer who shot Michael Brown had worn a body camera.[3] In an effort to appease those who believe police cameras are the panacea for this subsequent civil unrest, police officers in Ferguson began wearing cameras earlier this month, having been donated by two private companies. [4] Locally, in “Henrico County [Virginia,] police officers will begin wearing body-mounted cameras this fall.”[5] With the acceleration of this trend, it is important to begin analyzing the pros and cons of police officers wearing body cameras.

The benefits of wearable cameras are numerous: the “potential to change the dynamics of police-citizen encounters, to either exonerate or implicate officers in wrongdoing, or provide evidence of citizen misconduct.”[6] “Body-worn cameras can increase accountability” not only for police officers, but also for the citizens they interact with.[7] The city of Rialto, California rolled out a camera program in 2012, and has since reported a 60% reduction in use-of-force incidents and an 88% reduction in filed citizen complaints, “when compared with the year prior to deployment.”[8] William Farrar, the police chief in Rialto, has spoken of cases where citizen have gone to their local police station to file a complaint “and the supervisor was able to retrieve and play on the spot the video of what transpired.”[9] Rialto is not the only city that has experienced a decrease in police-related issues and complaints since employing body cameras, many cities across the country are finding good results with such programs.[10]

Regardless of the benefits, there are also reasons to be wary of this new technology and approach the use of cameras with caution. Arguably, the most prevalent of which is that once a policy of camera-wearing is established by a law enforcement agency, “it will become increasingly difficult to have second thoughts or to scale back” such a program.[11] Many scholars have also strenuously noted privacy concerns that will arise with more camera usage.[12] “It takes little imagination to see how such cameras could augment already ubiquitous CCTV and facial recognition systems, allowing police to retroactively track and monitor innocent passersby.”[13] Proponents of body cameras should ask themselves if they are willing to give up much of their privacy for the program’s benefits. On top of these issues, cameras have a huge economic cost: “agencies that have deployed the cameras spent between $800 and $1,200 for each device.”[14] After the initial cost, it then becomes expensive to store the considerable amount of data created; the New Orleans Police Department will pay “an expected cost of $1.2 million over five years” for 350 body cameras. [15] Overall, there are appreciable costs to body camera programs that need to be weighed with the benefits when deciding whether a program should be implemented.

Currently, public interest seems to be in favor of wearable cameras. This has prompted Congressman Al Green to propose a federal bill last week that would require any “state or local law enforcement agency that receives Federal funds” to use those funds to purchase “body cameras for use by the law enforcement officers employed by that enforcement agency.”[16] On a state level, New Jersey Senator Donald Nocross announced that he is “drafting legislation that would require all police officers to wear body cameras while on patrol.”[17] Lawmakers, perhaps reacting to public opinion, are in the beginning stages of legislating for mandatory use of police body cameras. Now is the time where engaged citizens need to decide if these programs should be implemented nation-wide or not. As this post suggests, the issue is not black and white, and should be discussed and critiqued before concrete legislation is enacted.


 

[1] Joshua Kopstein, Police Cameras are No Cure-all After Ferguson, Aljazeera America (Aug. 29, 2014, 6:00AM), http://america.aljazeera.com/opinions/2014/8/ferguson-race-policesurveillancetechnology.html.

[2] Id.

[3] Justin T. Ready & Jacob T.N. Young, Three Myths About Police Body Cams, Slate (Sept. 2, 2014 12:54AM), http://www.slate.com/articles/technology/future_tense/2014/09/ferguson_body_cams_myths_about_police_body_worn_recorders.html.

[4] William Cummings, Ferguson Police Begin Using Body Cameras, USA Today (Sept. 1, 2014 1:43AM), http://www.usatoday.com/story/news/nation/2014/09/01/ferguson-police-cameras/14920587/.

[5] Ted Strong & Brandon Shulleeta, Henrico Police to Roll Out Body Cameras for Officers, Richmond Times Disptach (Sept. 14, 2014), http://www.timesdispatch.com/news/local/henrico/henrico-police-to-roll-out-body-cameras-for-officers/article_1fe0fb5e-8752-573f-85e2-07ff33bf562b.html.

[6] Bryce Clayton Newell, Crossing Lenses: Policing’s New Visibility and the Role of “Smartphone Journalism” as a Form of Freedom-Preserving Reciprocal Surveillance, 14 U. Ill. L. Tech. & Pol’y 59, 82 (2014).

[7] Kevin Johnson, Police Body Cameras Offer Benefits, Require Training, USA Today (Sept. 12, 2014 6:21 PM), http://www.usatoday.com/story/news/nation/2014/09/12/police-body-cameras/15522059/.

[8] Id.

[9] Randall Stross, Wearing a Badge, and a Video Camera, The New York Times (Apr. 6, 2014), http://www.nytimes.com/2013/04/07/business/wearable-video-cameras-for-police-officers.html?_r=2&.

[10] Id.

[11] Johnson, supra note 6.

[12] Kopstein, supra note 1.

[13] Id.

[14] Johnson, supra note 6.

[15] Id.

[16] Transparency in Policing Act of 2014, H.R. 5407, 113th Cong. (2014).

[17] New Jersey Senator Proposes Bill Requiring Mandatory Body Cams for Police, Police State Daily (Sept. 11, 2014), http://policestatedaily.com/new-jersey-senator-proposes-bill-requiring-mandatory-body-cams-police/.

Homer Simpson May Be Headed to Court…D’Oh!

by Megan Carboni, Associate Staff

 

            Earlier this August, patent rights’ holder Alki David, owner of Hologram USA, filed suit against The Simpsons’ broadcaster, 20th Century Fox, for alleged patent rights infringements.[1] David asserts infringement of his acquired hologram technology used to bring Homer Simpson to life at this year’s Comic-Con convention in San Diego.[2] Oddly enough, Homer Simpson is not the only celebrity in hot water over alleged unauthorized use of David’s patented technology. Michael Jackson’s estate and Pulse Evolution are also being sued for the unauthorized use of David’s hologram technology to bring Michael Jackson back to life at the Billboard Music Awards.[3] Adding more fuel to the fire is Pulse’s cross complaint stating that David is “falsely claim[ing] credit for creating and developing the visual effects spectacle [of Jackson] in a nationally-televised interview on CNN, in press releases, and on his various websites […].”[4]

            So, where did this all begin? Stepping back in time, back to 1862, a stage trick for magic shows was developed by two magicians called “Pepper’s Ghost.”[5] “Pepper’s Ghost” was a lifelike illusion technique that has currently been popularized in movie special effects, concerts, and amusement park rides.[6] Most recently, “Pepper’s Ghost” inspired the hologram technology behind Tupac Shakur’s resurrection at the 2012 Coachella Music Festival, whose patent rights were acquired by David and Hologram USA in February 2013.[7] Unfortunately for the late Michael Jackson and the animated Homer Simpson, neither Pulse nor Fox obtained any licensing rights to use the same hologram technology to create their holograms before they were publicly debuted. [8] Thus, enter the multimillion-dollar patent infringement suits brought by David. David’s attorneys representing him in the Jackson lawsuit state that Pulse, and now Fox, “have created significant confusion in the marketplace [and] diluted the value of the Hologram USA brand.”[9]

            But were Simpson and Jackson holograms made with the same technology? Of course, patent experts in this field will have to weigh in to determine if any of David’s claims of stolen holograms have any weight to them. The accused parties have publicly disavowed David’s allegations, with Fox saying “[t]his filing is totally without merit […] except to say […] Mr. David has demonstrated his insatiable need to stay relevant.”[10] Pulse adds in their own suit against the Hologram USA owner that David is merely “divert[ing] public and industry attention away from Pulse Entertainment,” asserting claims against David of unfair business competition practices and trade libel.[11] Pulse further asserts that the “mischaracterization of the [Michael Jackson] animation as a hologram highlights David’s complete lack of technical expertise….[This] was not a hologram at all, rather, it was an animation projected onto a screen.”[12]

            Will the courts find for David in his patent infringement claims? Or will they find that there is little substance to his allegations? Does the industry need the distinction between each of the types of technology and animation to continue to bring this type of entertainment to the masses? Is it also coincidence that Fox successfully sued one of David’s media companies for copyright infringement in 2012?[13] Time, or a hefty settlement (D’Oh!), will tell who has the future rights to collect off of celebrity holograms/animations technology.

 



 

 

[1] Homer Simpson Duffed With Patent Lawsuit, WORLD INTELL. PROP. REV. (Aug. 18, 2014), http://www.worldipreview.com/news/homer-duffed-with-patent-lawsuit-7050.html.

[2] Id.

[3] Id.

[4] Eriq Gardner, Michael Jackson ‘Hologram’ Show Sparks New Legal Crossfire (Exclusive), THE HOLLYWOOD REP. (June 19, 2014, 12:11 PM), http://www.hollywoodreporter.com/thr-esq/michael-jackson-hologram-show-sparks-713109.html.

[5] Eriq Gardner, Homer Simpson Hologram at Comic-Con Draws Patent Lawsuit (Exclusive), THE HOLLYWOOD REP. (Aug. 15, 2014, 12:54 PM), http://hollywoodreporter.com/thr-esq/homer-simpson-hologram-at-comic-725830.html.

[6] Amended Complaint and Demand for Jury Trial at 2, Hologram USA, Inc. et al. v. Pulse Evolution Corp. et al. (D. Nev. May 29, 2014) (No. 2:14-cv-00772).

[7] Eriq Gardner, Homer Simpson Hologram at Comic-Con Draws Patent Lawsuit (Exclusive), THE HOLLYWOOD REP. (Aug. 15, 2014, 12:54 PM), http://hollywoodreporter.com/thr-esq/homer-simpson-hologram-at-comic-725830.html.

[8] Id.

[9] Eriq Gardner, Michael Jackson ‘Hologram’ Show Sparks New Legal Crossfire (Exclusive), THE HOLLYWOOD REP. (June 19, 2014, 12:11 PM), http://www.hollywoodreporter.com/thr-esq/michael-jackson-hologram-show-sparks-713109.html.

[10] Gardner, supra note 6.

[11] Eriq Gardner, Michael Jackson ‘Hologram’ Show Sparks New Legal Crossfire, THE HOLLYWOOD REP. (June 19, 2014, 12:11 PM), http://www.hollywoodreporter.com/thr-esq/michael-jackson-hologram-show-sparks-713109.html.

[12] Id.

[13] See WORLD INTELL. PROP. REV., supra note 1.

Cyber Security Active Defense: Playing with Fire or Sound Risk Management?

pdf_iconDownloadPDF

Cite as: Sean L. Harrington, Cyber Security Active Defense: Playing with Fire or Sound Risk Management?, 20 Rich. J.L. & Tech. 12 (2014), http://jolt.richmond.edu/v20i4/article12.pdf.

 Sean L. Harrington*

Trying to change its program

Trying to change the mode . . . crack the code

Images conflicting into data overload[1]

 I. Introduction

[1]        “Banks Remain the Top Target for Hackers, Report Says,” is the title of an April 2013 American Banker article.[2] Yet, no new comprehensive U.S. cyber legislation has been enacted since 2002,[3] and neither legislative history nor the statutory language of the Computer Fraud and Abuse Act (CFAA) or Electronic Communications Privacy Act (ECPA) make reference to the Internet.[4] Courts have nevertheless filled in the gaps—sometimes with surprising results.

[2]        Because state law, federal legislative proposals, and case law all are in a continuing state of flux, practitioners have found it necessary to follow these developments carefully, forecast, and adapt to them, all of which has proved quite challenging. As the title of this Comment suggests, deploying sound cyber security practices is not only equally as challenging, but also “risky,” which may seem counterintuitive in light of the fact that intent of cyber security programs is to manage risk, not create it.[5]

[3]        Cyber security risks concern exploits made possible by technological advances, some of which are styled with familiar catch-phrases: “e-Discovery,” “social media,” “cloud computing,” “Crowdsourcing,” and “big data,” to name a few. Yet, long before the term “cloud computing” became part of contemporary parlance, Picasa used to store photos in the cloud (where the “cloud” is a metaphor for the Internet).[6] This author has been using Hotmail since 1997 (another form of cloud computing). As the foregoing examples illustrate, the neologisms were long predated by their underlying concepts.

[4]        One of the latest techno-phrases du jour is “hack back.”[7] The concept isn’t new, and the term has been “common” parlance at least as far back as 2003.[8] “Hack back”—sometimes termed “active defense,” “back hacking,” “retaliatory hacking,” or “offensive countermeasures” (“OCM”)—has been defined as the

“process of identifying attacks on a system and, if possible, identifying the origin of the attacks.” Back hacking can be thought of as a kind of reverse engineering of hacking efforts, where security consultants and other professionals try to anticipate attacks and work on adequate responses.”[9]

A more accurate and concise definition might be “turning the tables on a cyberhacking assailant: thwarting or stopping the crime, or perhaps even trying to steal back what was taken.”[10] One private security firm, renowned for its relevant specialization, defines active defense, in pertinent part, as “deception, containment, tying up adversary resources, and creating doubt and confusion while denying them the benefits of their operations.”[11] Some have proposed—or carried out—additional measures, such as “photographing the hacker using his own system’s camera, implanting malware in the hacker’s network, or even physically disabling or destroying the hacker’s own computer or network.”[12]

[5]        Back hacking has been a top-trending technology topic over the past year, prompted in part by the controversial Report of the Commission on the Theft of American Intellectual Property (“IP Commission Report”),[13] and has been debated on blogs, symposium panels, editorials, and news media forums by information security professionals and lawyers alike. One with the potential to grab practitioners’ attention was a panel of attorneys David Navetta and Ron Raether—both well regarded in the information security community—discussing the utility and propriety of such practices. One opined that, if the circumstance is exigent enough, a company may take “measures into [its] own hands,” and that it would, “not likely be prosecuted under the CFAA, depending on the exigency of the circumstances.”[14] The other reasoned that hack back “technically violates the law, but is anyone going to prosecute you for that? Unlikely.”[15] He noted, “[i]t provides a treasure trove of forensic information that you can use,” and continued, “[w]ith respect to the more extreme end of hack back, where you are actually going to shut down servers, I think there is a necessity element to it—an exigency: if someone’s life is threatened, if it appears that there is going to be a monumental effect on the company, then it might be justified.”[16] In 2014 at the most recent RSA conference, where the “hackback” debate continued, the presentation was billed, in part, with the proposition, “[a]ctive defense should be viewed as a diverse set of techniques along a spectrum of varying risk and legality.”[17] And, other commentators have urged that “offensive operations must be considered as a possible device in the cyber toolkit.” [18]

[6]        Most commentators and scholars, however, seem to agree that “hack back” is not only “risky,” but is also not a viable option for a variety of reasons.[19] Hack backs and other surreptitious cyber acts incur the risks of criminal liability, civil liability, regulatory liability, professional discipline, compromise of corporate ethics, injury to brand image, and escalation. One practitioner quoted by the LA Times exclaimed, “[i]t’s not only legally wrong, it’s morally wrong.”[20] James Andrew Lewis, a senior fellow at the Center for Strategic and International Studies, characterized hacking back as “a remarkably bad idea that would harm the national interest.”[21] The Cyber Intelligence Sharing and Protection Act, a major cybersecurity bill passed by the House in April 2013, contained an amendment that specifically provided that the bill did not permit hacking back.[22] Representative Jim Langevin (RI-D), who authored the amendment, explained, “[w]ithout this clear restriction, there is simply too much risk of potentially dangerous misattribution or misunderstanding of any hack-back actions.”[23] Further, the private security firm renowned for its active defense strategies, mentioned ante, has attempted to distance itself from the phrases such as “hack back” and “retaliatory hacking,” preferring instead the broader phrase “active defense.”[24] Another example of the importance of subtleties in word choice may be “Countermeasure,” where some appear to have conflated the word with the concept of active defense.[25]

II. Active Defense Approaches

[7]        Self-defense is not an abstraction created by civilization, but a law spawned by nature itself, and has been justified since antiquity.[26] It has been regarded since the early modern period as available to redress injuries against a state’s sovereign rights.[27] There is little question cyber-attacks against a designated critical infrastructure are attacks against a state’s sovereign rights,[28] because much of civilian infrastructure is both a military and national asset.[29] Accordingly, the focus of 2014 NATO International Conference on Cyber Conflict (“CyCon”) is active cyber defense, including implications for critical infrastructure.[30] Likewise, a project sponsored by NATO’s Cooperative Cyber Defense Centre of Excellence is set to publish a report in 2016 that establishes acceptable responses to pedestrian or quotidian cyber-attacks against nations, whereas its predecessor, regarded as an academic text, focused on cyber-attacks against a country that are physically disruptive or injurious to people and possible responses under the UN charter and military rules.[31] Both works are based on the concepts of self-defense and, under certain circumstances, preemptive “anticipatory self-defense.”[32]

[8]        The questions that scholars, policymakers, information security experts, and corporate executives have struggled with, however, is at what threshold do such attacks warrant the protection of the state,[33] whether a private corporation may respond in lieu of or in concert with protection by the state, and to what extent such collusion constitutes excessive entanglement between the private and public sector. Implicit in these questions is whether the government is willing and able to develop a modern and adaptable regulatory and criminal law framework and to allocate adequate law enforcement resources to confront the problem.[34] Because, at the time of this writing, it is widely perceived that the government is not yet willing and able,[35] victims often do not report suspected or actual cyber-attacks, and have resorted to inappropriate self-help, deploying their own means of investigating and punishing transgressors.[36] As one commentator posits,

With regard to computer crime, some might argue that the entire investigative process be outsourced to the business community. Historically, the privatization of investigations has assisted public law enforcement by allowing them to concentrate on other responsibilities, and has prevented their resources from being allocated in too sparse a manner to be useful.” [37]

Awaiting the ultimate resolution of these questions, American corporations have developed an array of active defense tactics. Below are a few of the more common examples of those, and the corresponding challenges:

 A. Beaconing

[9]        Beaconing is one of the most cited active defense techniques, and one mentioned in the IP Commission Report (along with “meta-tagging,” and “watermarking”) as a way to enhance electronic files to “allow for awareness of whether protected information has left an authorized network and can potentially identify the location of files in the event that they are stolen.”[38] A benign version of beaconing is the use of so-called Web bugs.[39] A Web bug is a link—a surreptitious file object—commonly used by spammers and placed in an e-mail message or e-mail attachment, which, when opened, will cause the e-mail client or program will attempt to retrieve an image file object from a remote Web server and, in the process, transmit information that includes the user’s IP address and other information.[40] This transmission is not possible “if the user did not preconfigure the e-mail client or program to refrain from retrieving images or HTML content from the Internet,” or if the user’s e-mail client blocks externally-hosted images by default.[41] “This information becomes available to the sender either through an automated report service (e.g., ReadNotify.com) or simply by monitoring traffic to the Web server.”[42] In one project demonstrating the use advocated by the IP Commission Report, researchers employed such technology in decoy documents to track possible misuse of confidential documents.[43] So, is beaconing legal?

[10]      The Wall Street Journal (the “Journal”) quoted Drexel University law professor Harvey Rishikof—who also is co-chairman of the American Bar Association’s Cybersecurity Legal Task Force—as saying the legality of beaconing is not entirely clear.[44] Rishikof is quoted as saying, “‘[t]here’s the black-letter law, and there’s the gray area. . . . Can you put a beacon on your data? Another level is, could you put something on your data that would perform a more aggressive action if the data was taken?’”[45] The article went on to suggest more aggressive strategies such as “inserting code that would cause stolen data to self-destruct or inserting a program in the data that would allow a company to seize control of any cameras on the computers where the data were being stored.”[46] The Journal, citing an anonymous Justice Department source, further reported that, “[i]n certain circumstances beaconing could be legal, as long as the concealed software wouldn’t do other things like allow a company to access information on the system where the stolen data were stored.”[47]

[11]      Another important consideration is the fact that beaconing may fall within one of the active defense definitions (supra) as “deception.”[48] Although deception is recognized as both a common and effective investigative technique,[49] the problem is the possibility that the activities of the investigator could be imputed under Model Rule of Professional Conduct 5.3 to one or more attorneys responsible for directing or approving of those activities.[50] Under Model Rule 8.4(c), neither an attorney nor an attorney’s agent under his or her direction or control may “engage in conduct involving dishonesty, fraud, deceit, or misrepresentation.”[51] Although the question of whether deception, as contemplated in Rule 8.4, exists in the context of incident response or network forensics investigations is not well settled,[52] most states have held “[t]here are circumstances where failure to make a disclosure is the equivalent of an affirmative misrepresentation.”[53] A few state bar associations have already addressed similar technology-related ethical pitfalls. The Philadelphia Bar Association Professional Guidance Committee advised in Opinion 2009–02 that an attorney who asks an agent (such as an investigator) to “friend” a party in Facebook in order to obtain access to that party’s non-public information, would violate, among others, Rule 5.3 of the Pennsylvania Rules of Professional Conduct.[54] Likewise, the Association of the Bar of the City of New York Committee on Professional and Judicial Ethics issued Formal Opinion 2010–2, which provides that a lawyer violates, among others, New York Rules of Professional Conduct Rule 5.3, if an attorney employs an agent to engage in the deception of “friending” a party under false pretenses to obtain evidence from a social networking website.[55]

B. Threat Counter-Intelligence Gathering

[12]      One of the most seemingly-innocuous active defense activities is intelligence gathering. Security analyst David Bianco defines threat intelligence as “[c]onsuming information about adversaries, tools or techniques and applying this to incoming data to identify malicious activity.”[56] Threat intelligence gathering ranges from everything from reverse malware analysis and attribution to monitoring inbound and outbound corporate e-mail to more risky endeavors.[57] Some security experts claim to frequent “Internet store fronts” for malware, “after carefully cloaking [their] identity to remain anonymous.”[58] The reality, however, is that gaining access to and remaining on these black market fora requires the surreptitious visitor either to: (1) participate (“pay to play”); (2) to have developed a reputation over months or years, or founded the underground forum ab initio;or (3) to have befriended or been extended a personal invitation by an established member. The first two of these three activities implies that the participant would have co-conspirator or accomplice liability in the underlying crimes. Another risk is, if the site is reputed to also purvey child pornography, a court may find that the site visitor acquired possession (even as temporary Internet cache) of the contraband knowingly, even if the true intent of lurking was to gather intelligence.[59] Another obvious risk is that surreptitious monitoring of hacker sites using false credentials or representations is an act of deception which, for the reasons more fully set forth above, could create disciplinary liability for any attorneys who are involved or acquiesce to the activity.

C. Sinkholing

[13]      Sinkholing is the impersonation of a botnet command-and-control server in order to intercept and receive malicious traffic from its clients.[60] To accomplish this, either the domain registrar must redirect the domain name to the investigator’s machine (which only works when the connection is based on a DNS name), or the Internet Service Provider (ISP) must redirect an existing IP address to the investigator’s machine (possible only if the investigator’s machine is located in the IP range of the same provider), or the ISP must redirect all traffic destined for an IP address to the investigator’s machine, instead (the “walled garden” approach).[61]

[14]      Sinkholing involves the same issues of deception discussed ante, but also relies on the domain registrar’s willingness and legal ability to assist. As Link and Sancho point out in their paper Lessons Learned While Sinkholing Botnets—Not as Easy as it Looks!,“[u]nless there is a court order that compels them to comply with such a request, without the explicit consent of the owner/end-user of the domain, the registrar is unable to grant such requests.”[62] Doubtless they were referring to the Wiretap Act (Title 1 of the Electronic Communications Privacy Act), which generally prohibits unconsented interception (contemporaneous with transmission), disclosure, or use of electronic communications.[63] Further, a federal district court recently ruled that intentionally circumventing an IP address blacklist in order to crawl an otherwise-publicly available website constitutes “access without authorization” under the CFAA.[64] Link and Sancho continue that registrars have little incentive to assist because it does not generate revenue, and note that sinkholing invites distributed denial of service (“DDoS”) retaliation which could affect other customers of a cloud-provided broadband connection.[65] Finally, sinkholing is likely to collect significant amounts of data, including personally identifiable information (“PII”). The entity collecting PII is likely to be subject to the data privacy, handling, and disclosure laws of all the jurisdictions whence the data came.

D. Honeypots

[15]      A honeypot is defined as “a computer system on the Internet that is expressly set up to attract and ‘trap’ people who attempt to penetrate other people’s computer systems.”[66] It may be best thought of as “an information system resource whose value lies in unauthorized or illicit use of that resource.”[67] Honeypots do arguably involve deception, but have been in use for a comparatively long time, and are generally accepted as a valid information security tactic (therefore, relatively free from controversy). The legal risks, historically, have been identified as: (1) potential violations of the ECPA;[68] and (2) possibly creating an entrapment defense for the intruder.[69] Neither of these is applicable here, because, respectively: (1) the context of the deployment discussed herein is the corporate entity as the honeypot owner (thus, a party to the wire communication); and (2) the corporate entity is not an agent of law enforcement, and, further, the entrapment defense is only available when defendant was not predisposed to commit the crime (here, a hacker intruding into a honeypot is predisposed).[70] Nevertheless, Justice Department attorney Richard Salgado, speaking at the Black Hat Briefings, did reportedly warn that the law regarding honeypots is “untested” and that entities implementing devices or networks designed to attract hackers could face such legal issues as liability for an attack launched from a compromised honeypot.[71] This possibility was discussed six years ago:

If a hacker compromises a system in which the owner has not taken reasonable care to secure and uses it to launch an attack against a third party, the owner of that system may be liable to the third party for negligence. Experts refer to this scenario as “downstream liability.” Although a case has yet to arise in the courts, honeypot operators may be especially vulnerable to downstream liability claims since it is highly foreseeable that such a system be misused in this manner.[72]

Another honeypot risk is the unintended consequence of becoming a directed target because the honeypot provoked or attracted hackers to the company that deployed it, which hackers might otherwise have moved on to easier targets. Another is that an improperly configured honeypot could ensnare an innocent third party or customer and collect legally-protected information (such as PII). If that information is not handled according to applicable law, the owner of the honeypot could incur statutory liabilities therefor.[73] And yet another scenario is one that, perhaps, only a lawyer would recognize as a risk: “[i]f you have a honeypot and do learn a lot from it but don’t remedy or correct it, then there’s a record that is discoverable and that you knew you had a problem and didn’t [timely] fix it.”[74]

[16]      Finally, there are uses for honeypots which, when regarded as a source of revenue by its owners, have the potential to cause substantial injury to brand image and reputation, and possibly court sanctions: one law firm has been accused of seeding the very copyrighted content it was retained to protect, which the firm used as evidence in copyright suits it prosecuted.[75] Because of these alleged activities, the firm has been labelled a “copyright troll.”[76] The allegations, if proved true, also appear to involve acts of deception, discussed ante, which may subject the firm’s attorneys to attorney disciplinary proceedings.[77] Further, the firm’s attorneys may incur other possible liabilities, such as vexatious and frivolous filing sanctions, abuse of process, barratry, or champerty.[78]

E. Retaliatory Hacking

[17]      A common belief for why corporations have little to fear in the way of prosecution for retaliatory hacking is, “criminals don’t call the cops.”[79] Nevertheless, there is little debate that affirmative retaliatory hacking is unlawful,[80] even if done in the interests of national security.[81] Although there may be “little debate,” there is debate.[82]The views of many passionate information security analysts could be summed up by authors John Strand and Paul Asadoorian, who argue, “[c]urrently, our only defense tools are the same tools we have had for the past 10+ years, and they are failing.”[83] David Willson, the owner and president of Titan Info Security Group, and a retired Army JAG, contends that using “automated tools outside of your own network to defend against attacks by innocent but compromised machines” is not gaining unauthorized access or a computer trespass, and he asks, “[i]f it is, how is it different from the adware, spam, cookies, or others that load on your machine without your knowledge, or at least with passive consent?”[84] Willson provides a typical scenario and then examines the statutory language of the CFAA and offers some possible arguments—but notes his arguments bear stretch marks (and he makes no offer of indemnification should practitioners decide to use them).[85]

[18]      Willson is not alone in searching for leeway within the CFAA. Stewart Baker, former NSA general counsel, argues on his blog,

Does the CFAA, prohibit counterhacking? The use of the words “may be illegal,” and “should not” are a clue that the law is at best ambiguous. . . . [V]iolations of the CFAA depend on “authorization.” If you have authorization, it’s nearly impossible to violate the CFAA . . . [b]ut the CFAA doesn’t define “authorization.” . . . The more difficult question is whether you’re “authorized” to hack into the attacker’s machine to extract information about him and to trace your files. As far as I know, that question has never been litigated, and Congress’s silence on the meaning of “authorization” allows both sides to make very different arguments. . . . [C]omputer hackers won’t be bringing many lawsuits against their victims. The real question is whether victims can be criminally prosecuted for breaking into their attacker’s machine.[86]

Other theories —and assorted arguments bearing stretch marks— analogize retaliatory hacking as subject to the recapture of chattels privilege,[87] entry upon land to remove chattels,[88] private necessity,[89] or even the castle doctrine.[90] Jassandra K. Nanini, a cybersecurity law specialist, suggests applying the “security guard doctrine” as an analogy.[91] She posits that, if private actors act independently of law enforcement and have a valid purpose for their security activities that remains separate from law enforcement, then incidental use of evidence gained through those activities by law enforcement is permissible, even if the security guard acted unreasonably (as long as he remained within the confines of the purpose of his employer’s interests).[92] As applied, Nanini explains the analogy as follows:

If digital property were considered the same as physical, cyber security       guards could “patrol” client networks in search of intruder footprints, and based on sufficient evidence of a breach by a particular hacker, perhaps indicated by the user’s ISP, initiate a breach of the invader’s network in order to search for compromised data and disable its further use. Even more aggressive attacks designed to plant malware in hacker networks could be considered seizure of an offensive weapon, comparable to a school security guard seizing a handgun from a malicious party. Such proactive defense could use the hacker’s own malware to corrupt his systems when he attempts to retrieve the data from the company’s system. Certainly all of these activities are within the scope of the company’s valid interest, which include maintaining data integrity, preventing use of stolen data, and disabling further attack. . . . Similarly, companies may wholly lack any consideration of collecting evidence for legal recourse, keeping in step with the private interest requirement of the private security guard doctrine in general. All hack-backs could be executed without any support or direction from law enforcement, opening the door to utilization       of evidence in a future prosecution against the hacker. [93]

The foregoing theories notwithstanding, what is clear is that obtaining evidence by use of a keylogger, spyware, or persistent cookies likely is violative of state and federal laws, such asthe CFAA or ECPA.[94] The CFAA, last amended in 2008, criminalizes anyone who commits, attempts to commit, or conspires to commit an offense under the Act, including offenses such as knowingly accessing without authorization a protected computer (for delineated purposes) or intentionally accessing a computer without authorization (for separately delineated purposes).[95] Relevant statutory phrases, such as “without authorization” and “access,” have been the continuing subject of appellate review.[96] One federal court, referring to both the ECPA and CFAA, pointed out that “the histories of these statutes reveal specific Congressional goals—punishing destructive hacking, preventing wiretapping for criminal or tortious purposes, securing the operations of electronic communication service providers—that are carefully embodied in these criminal statutes and their corresponding civil rights of action.”[97] At least one court has held that the use of persistent tracking cookies is a violation of the Electronic Communications Privacy Act.[98] Congress is currently considering reform to the CFAA, as well as comprehensive privacy legislation that would, in some circumstances, afford a private right of action to consumers whose personal information is collected without their consent. [99]

[19]      Regardless of the frequency with which retaliatory hacking charges have been brought, one issue that has not yet been included in the debate involves illegally obtained evidence that is inadmissible. This matters because bringing suit under the CFAA or ECPA is a remedy that corporate victims have recently invoked increasingly.[100]

[20]      Another liability —the one most frequently cited— is that of misattribution and collateral damage:

[E]ncouraging digital vigilantes will only make the mayhem worse. Hackers like to cover their tracks by routing attacks through other people’s computers, without the owners’ knowledge. That raises the alarming prospect of collateral damage to an innocent bystander’s systems: imagine the possible consequences if the unwitting host of a battle between hackers and counter-hackers were a hospital’s computer.[101]

Likewise, Representative Mike Rogers (R-MI), sponsor for the Cyber Intelligence Sharing and Protection Act (CISPA) and Chair of the House Permanent Select Committee on Intelligence, warned private corporations against going on the offensive as part of their cyber security programs: “You don’t want to attack the wrong place or disrupt the wrong place for somebody who didn’t perpetrate a crime.”[102] Contemplate the civil liabilities that one could incur if, in an effort to take down a botnet through self-help and vigilantism, the damaged computers belonged to customers, competitors, or competitors’ customers. Aside from the financial losses and injury to brand reputation and goodwill, implicated financial institutions could expect increased regulatory scrutiny and could compromise government contracts subject to FISMA.

[21]      Yet another frequently discussed liability is that of escalation: cybercrime is perpetrated by many different attacker profiles of persons and entities, including cyber-terrorists, cyber-spies, cyber-thieves, cyber-warriors, and cyber-hactivists.[103] Because the purported motivation of a cyber-hactivist is principle, retaliation by the corporate victim may be received as an invitation to return fire and escalate. Similarly, “[e]ncouraging corporations to compete with the Russian mafia or Chinese military hackers to see who can go further in violating the law . . . is not a contest American companies can win.”[104] Conversely, the motivation of a cyber-thief is principal and interest, so retaliation by the target might be taken as a suggestion to move on to an easier target. Because the perpetrators are usually anonymous, the corporate victim has no way to make a risk-based and proportional response premised upon the classification of the attacker as nation-state, thief, or hactivist.

[I]n cyberspace attribution is a little harder. On the playground you can see the person who hit you . . . well, almost always[,] . . . in cyberspace we can track IP addresses and TTPs from specific threat actors, which smart analysts and researchers tell us is a viable way to perform attribution. I agree with them, largely, but there’s a fault there. An IP address belonging to China SQL injecting your enterprise applications is hardly a smoking gun that Chinese APTs are after you. Attackers have been using others’ modus operandi to mask their identities for as long as spy games have been played. Attackers have been known to use compromised machines and proxies in hostile countries for as long as I can remember caring—to “bounce through” to attack you. Heck, many of the attacks that appear to be originating from nation-states that we suspect are hacking us may very well be coming from a hacker at the coffee house next door to your office, using multiple proxies to mask their true origin. This is just good OpSec, and attackers use this method all the time, let’s not kid ourselves.[105]

If, without conclusive attribution and intelligence, the corporate victim is unable to make a risk-based and proportional response, it may be reasonable to question whether retaliatory hacking is abandoning the risk-based approach to business problems exhorted by FFIEC,[106]PCI,[107]and the NIST Cybersecurity Framework?[108] “If we start using those sort of [cyber weapons], it doesn’t take much to turn them against us, and we are tremendously vulnerable,” said Howard Schmidt, a former White House cyber security coordinator.[109]

[22]      Then there is the often overlooked issue of professional ethics—not for the attorneybut for the information security professional.“Ethics,” a term derived from the ancient Greek ethikos (ἠθικός), has been defined as “a custom or usage.”[110] Modernly, ethics is understood to be “[professional] norms shared by a group on a basis of mutual and usually reciprocal recognition.”[111] The codes of ethics provide articulable principles against which one’s decision-making is objectively measured, and serve other important interests, including presenting an image of prestige and credibility for the organization and the profession,[112] eliminating unfair competition,[113] and fostering cooperation among professionals.[114]

[23]      Many information security professionals are certified by the International Information Systems Security Certification Consortium ((ISC)). The (ISC) Committee has recognized its responsibility to provide guidance for “resolving good versus good, and bad versus bad, dilemmas,” and “to encourage right behavior.”[115] The Committee also has the responsibility to discourage certain behaviors, such as raising unnecessary alarm, fear, uncertainty, or doubt; giving unwarranted comfort or reassurance; consenting to bad practice; attaching weak systems to the public network; professional association with non-professionals; professional recognition of, or association with, amateurs; or associating or appearing to associate with criminals or criminal behavior.[116] Therefore, an information security professional bound by this code who undertakes active defense activities that he or she knows or should know are unlawful, or proceeds where the legality of such behavior not clear, may be in violation the Code.

[24]      It would stand to reason that, an organization that empowers, directs, or acquiesces to conduct by its employees that violates the (ISC)Code of Ethics may violate its own corporate ethics or otherwise compromise its ethical standing in the corporate community—or not: when Google launched a “secret counter-offensive” and “managed to gain access to a computer in Taiwan that it suspected of being the source of the attacks,”[117] tech sources praised Google’s bold action.[118]

[25]      Nevertheless, corporate ethics is an indispensable consideration in the hack back debate. The code of ethics and business conduct for financial institutions should reflect and reinforce corporate values, including uncompromising integrity, respect, responsibility and good citizenship. As noted above, retaliatory hacking is deceptive and has been characterized as reckless, and even Web bugs are commonly associated with spammers. Corporate management must consider whether resorting to techniques pioneered by and associated with criminals or spammers has the potential to compromise brand image in the eyes of existing and prospective customers. Similarly, to the extent that financial corporations are engaging in active defense covertly,[119] corporate management must consider whether customers’ confidence in the security of their data and investments could be shaken when such activities are uncovered. Will customers wonder whether their data has been placed at risk because of escalation? Will shareholders question whether such practices are within the scope of good corporate stewardship?

III. Alternatives to Retaliatory Hacking

[26]      The obvious argument in support of active defense is that the law and governments are doing little to protect private corporations and persons from cybercrime, which has inexorably resulted in resort to self-help,[120] and those who vociferously counsel to refrain from active defense often have little advice on alternatives. At the risk of pointing out the obvious, one counsels, “‘when you look at active defense, we need to focus on reducing our vulnerabilities.’”[121]

[27]      Alternatives to hacking back are evolving, and one of the more promising is the pioneering threat intelligence gathering and sharing from the Financial Services Information Sharing and Analysis Center (“FS-ISAC”), which collects information about threats and vulnerabilities from its 4,400 FI members, government partners, and special relationships with Microsoft®, iSIGHT PartnersSM, Secunia, et al., anonymizes the data, and distributes it back to members.[122] In addition to e-mail alerts and a Web portal, FS-ISAC holds regular tele-conferences during which vulnerability and threat information is discussed, and during which presentations on current topics are given.[123] The FS-ISAC recently launched a security automation project to eliminate manual processes to collect and distribute cyber threat information, according to Bill Nelson, the Center’s director.[124] The objective of the project is to significantly reduce operating costs and lower fraud losses for financial institutions, by consuming threat information on a real-time basis.[125]

[28]      Although, as American Banker wryly observes, “[b]ankers have never been too keen on sharing secrets with one another,”[126] dire circumstances have catalyzed a new era of cooperation, paving the way for the success of the cooperative model developed by the FS-ISAC—even before its current ambitious automation project, which has resulted in successful botnet takedown operations.[127] An illustrative example is the Citadel malware botnet takedown, where Microsoft’s Digital Crimes Unit, in collaboration with the FS-ISAC, the Federal Bureau of Investigation, the American Bankers Association, NACHA—The Electronic Payments Association, and others, executed a simultaneous operation to disrupt more than 1,400 Citadel botnets reportedly responsible for over half a billion dollars in losses worldwide.[128] With the assistance of U.S. Marshals, data and evidence, including servers, were seized from data hosting facilities in New Jersey and Pennsylvania, and was made possible by a court ordered civil seizure warrant from a U.S. federal court.[129] Microsoft also reported that it shared information about the botnets’ operations with international Computer Emergency Response Teams, which can deal with elements of the botnets outside U.S. jurisdiction, and the FBI informed enforcement agencies in those countries.[130] Similar, more recent, operations include one characterized as “major takedown of the Shylock Trojan botnet,” which botnet is described as “an advanced cybercriminal infrastructure attacking online banking systems around the world,” that reportedly was coordinated by the UK National Crime Agency (NCA), and included Europol, the FBI, BAE Systems Applied Intelligence, Dell SecureWorks, Kaspersky Lab and the UK’s GCHQ,[131] and another takedown operation that targeted the much-feared Cryptolocker.[132]   Following the FS-ISAC model, the retail sector has taken the “historic decision” to share data on cyber-threats for the first time through a newly-formed Retail Cyber Intelligence Sharing Center (R-CISC),[133] and the financial services and retail sectors formed a cross-partnership.[134]

[29]      Finally, at the time of this publication, a draft Cybersecurity Information-Sharing Act of 2014, advanced by Chairman Dianne Feinstein (D-CA) and ranking member Saxby Chambliss (R-GA), was passed out of the Senate Intelligence on a 12-3 vote, and is expected to be put to a vote in the full Senate.[135] The bill is designed to enhance and provide liability protections for information sharing between private corporate entities, between private corporate entities and the Government, and between Government agencies.

[30]      Yet another promising option is the partnership that critical infrastructure institutions have formed, or should investigate forming, with ISPs. For example, ISPs currently provide DDoS mitigation services that, although not particularly effective in application vulnerability (OSI model layer 7) attacks, are very capable in responding to volume-based attacks.[136] One senior ISP executive proposed to this author, under the Chatham House Rule,[137] the possibility that ISPs may be able to provide aggregated threat intelligence information, including attribution, based upon monitoring of the entirety of its networks (not merely the network traffic to and from an individual corporate client).

[31]      ISPs’ capabilities are, however, subject both to statutory and regulatory limitations, including, for example, the Cable Act,[138] and proposed rules that would restrict the blocking of “lawful content, applications, services, or non-harmful devices,” that may appear to implicate liability-incurring discretion.[139]

[32]      Nevertheless, several researchers urge that ISPs should assume a “larger security role,” and are in a good position “to cost-effectively prevent certain types of malicious cyber behavior, such as the operation of botnets on home users’ and small businesses’ computers.”[140] Likewise, the Federal Communications Commission has defined “legitimate network management” as including “ensuring network security and integrity” and managing traffic unwanted by end users:

In the context of broadband Internet access services, techniques to ensure network security and integrity are designed to protect the access network and the Internet against actions by malicious or compromised end systems. Examples include spam, botnets, and distributed denial of service attacks. Unwanted traffic includes worms, malware, and virus that exploit end-user system vulnerabilities; denial of service attacks; and spam.[141]

N.B., a 2010 study found that just ten ISPs accounted for 30 percent of IP addresses sending out spam worldwide.[142] And, in 2011, it was reported that over 80% of infected machines were located within networks of ISPs, and that fifty ISPs control about 50% of all botnet infected machines worldwide.[143]

[33]      Other options that some companies have pursued as alternatives to the pitfalls of inherently risky threat counter-intelligence gathering discussed above include risk transfer or automated monitoring, both of which rely on outside vendors or subscription services.

[34]      Under the risk transfer approach, a corporate entity may choose to rely on the findings of a private contractor or company without undue concern for how the contractor or firm acquired the information. U.S. companies already outsource threat intelligence gathering to firms who employ operatives in Israel, such as IBM-Trusteer and RSA,[144] ostensibly because these operatives are able to effectively obtain information without running afoul of U.S. law. For legal scholars, perhaps a case to help justify this approach might be that of the famous Pentagon Papers (New York Times v. United States), in which the Supreme Court held that the public’s right to know was superior to the Government’s need to maintain secrecy of the information, notwithstanding that the leaked documents were obtained unlawfully (i.e.,in alleged violation of § 793 of the Espionage Act).[145] Yet, a corporate entity that knowingly—or with blissful ignorance—retains the services resulting from unethical conduct or conduct that would be criminal if undertaken in the U.S. may nevertheless suffer injury to the brand resulting from revelations of the vendor’s actions.

[35]      Under the automated monitoring approach, corporate entities rely on vendor subscription services, such as Internet Identity (IID™), that use automated software to monitor various fora or social media sites for the occurrence of keywords, concepts, or sentiment, and then alert the customer. Variations of these technologies are in use for high frequency stock trading and e-Discovery. An example might be detecting the offering for sale on a site of primary account numbers and related information by a cyberthief, and providing real-time notification to the merchant so that the accounts can be disabled.

[36]      Other promising options include “big data” approach, which is to employ data scientists and software and hardware automation in-house to draw more meaningful inferences from the data and evidence already legally within the company’s custody and control. For example, David Bianco, a “network hunter” for security firm FireEye, suggests allocating resources for detecting, evaluating, and treating threat indicators according to their value to the attacker, which he represents in his so-called “Pyramid of Pain.”[146] Under this model, remediation efforts are directed toward those indicators that are costly (in time or resources) to the attacker, requiring the attacker to change strategy or incur more costs.[147] Bianco proposed this model after concluding that organizations seem to blindly collect and aggregate indicators, without making the best use of them.[148] Vendors, such as Guardian Analytics,[149] FireEye’s Threat Analytics Program,[150] CrowdStrike’s Falcon platform,[151] and HP’s Autonomy IDOL[152] (intelligent data operating layer) are endeavoring to bring real-time threat intelligence parsing or information sharing tools and services to the marketplace

 

III. Conclusion

[37]      Hack back or active defense, depending on how one defines each—and everything in between—consists of activities that are both lawful and unlawful, and which carry all the business and professional risks associated with deceptive practices, misattribution, and escalation. To urge a risk-based approach to using even lawful active defense tactics would be to state the obvious, and the use of certain types of active defense where misattribution is possible, may be to entirely abandon the risk-based approach to problem solving. Moreover, at the time of this writing, a qualified privilege to hack back through legislative reform seems unlikely, and would be difficult because the holder of such a privilege would not only have to establish proper intent, but also attribution. However, the tools, technologies, partnerships, and information sharing between corporations, governments, vendors, and trade associations are promising; they have already proven effective, and are steadily improving.

 


 

* The author is a cyber-security policy analyst in the banking industry and a digital forensics examiner in private practice. Mr. Harrington is a graduate with honors from Taft Law School, and holds the CCFP, MCSE, CISSP, CHFI, and CSOXP certifications. He has served on the board of the Minnesota Chapter of the High Technology Crime Investigation Association, is a current member of Infragard, the Financial Services Roundtable’s legislative and regulatory working groups, FS-ISAC, the U.S. Chamber of Commerce “Cyber Working Group,” the Fourth District Ethics Committee in Minnesota, and is a council member of the Minnesota State Bar Association’s Computer & Technology Law Section. Mr. Harrington teaches computer forensics for Century College in Minnesota, and recently contributed a chapter on the Code of Ethics for the forthcoming Official (ISC)²® Guide to the Cyber Forensics Certified Professional CBK®. He is also an instructor for the CCFP certification.

 

[1] Rush, The Body Electric, on Grace under Pressure (Mercury Records 1984).

[2] Sean Sposito, Banks Remain the Top Target for Hackers, Report Says, Am. Banker (April 23, 2013, 10:04 AM), http://www.americanbanker.com/issues/178_78/banks-remain-the-top-target-for-hackers-report-says-1058543-1.html.

[3] Eric A. Fisher, Cong. Research Serv., R 42114, Federal Laws Relating to Cybersecurity: Overview and Discussion of Proposed Revisions 3 (2013), available at http://fas.org/sgp/crs/natsec/R42114.pdf (discussing, for example, the Federal Information Security Management Act).

[4] See Yonatan Lupu, The Wiretap Act and Web Monitoring: A Breakthrough for Privacy Rights?, 9 Va. J.L. & Tech. 3, ¶¶ 7, 9 (2004) (discussing the use of the ECPA and the lack of words such as “Internet,” “World Wide Web,” and “e-commerce” in the text or legislative history); see also Eric C. Bosset et al., Private Actions Challenging Online Data Collection Practices Are Increasing: Assessing the Legal Landscape, Intell. Prop. & Tech. L.J., Feb. 2011, at 3 (“[F]ederal statutes such as the Electronic Communications Privacy Act (ECPA) and the Computer Fraud and Abuse Act (CFAA) . . . were drafted long before today’s online environment could be envisioned . . . .”); Miguel Helft & Claire Cain Miller, 1986 Privacy Law Is Outrun by the Web,N.Y. TIMES (Jan. 9, 2011), http://www.nytimes.com/2011/01/10/technology/10privacy.html?pagewanted=all&_r=1& (noting that Congress enacted the ECPA before the World Wide Web or widespread use of e-mail); Orin S. Kerr, The Future of Internet Surveillance Law: A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208, 1208, 1213-14, 1229-30 (2004); see generally The Electronic Communications Privacy Act: Government Perspectives on Privacy in the Digital Age: Hearing Before the S. Comm. on the Judiciary, 112th Cong. 1-2(2011) (statement of Sen. Patrick Leahy, Chairman, S. Comm. on the Judiciary), available at http://fas.org/irp/congress/2011_hr/ecpa.pdf (“[D]etermining how best to bring this privacy law into the Digital Age will be one of Congress’s greatest challenges. . . . [The] ECPA is a law that is hampered by conflicting standards that cause confusion for law enforcement, the business community, and American consumers alike.”).

[5] See generally Nat’l Inst. of Standards & Tech., Framework for Improving Critical Infrastructure Cybersecurity 4 (Version 1.0, 2014) available at http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214-final.pdf (describing The Framework as “a risk-based approach to managing cybersecurity risk”).

[6] See, Eric Griffith, What is Cloud Computing?, PC Magazine (May 13, 2013) http://www.pcmag.com/article2/0,2817,2372163,00.asp.

[7] See, e.g., Ken Dilanian, A New Brand of Cyber Security: Hacking the Hackers, L.A. Times (Dec. 4, 2012), http://articles.latimes.com/2012/dec/04/business/la-fi-cyber-defense-20121204/2 (proposing that “companies should be able to ‘hack back’ by, for example, disabling servers that host cyber attacks”).

[8] See, e.g., Scott Carle, Crossing the Line: Ethics for the Security Professional,SANS Inst. (2003), http://www.sans.org/reading-room/whitepapers/hackers/crossing-line-ethics-security-professional-890. Readers, doubtless, will know of earlier references.

[9] Techopedia, http://www.techopedia.com/definition/23172/back-hack (last visited June 28, 2014); see also NetLingo, http://www.netlingo.com/word/back-hack.php (last visited June 28, 2014)(“[Back-hack is t]he reverse process of finding out who is hacking into a system. Attacks can usually be traced back to a computer or pieced together from ‘electronic bread crumbs’ unknowingly left behind by a cracker.”).

[10] Melissa Riofrio, Hacking Back: Digital Revenge Is Sweet but Risky, PCWorld (May 9, 2013, 3:00 AM), http://www.pcworld.com/article/2038226/hacking-back-digital-revenge-is-sweet-but-risky.html.

[11] Dmitri Alperovitch, Active Defense: Time for a New Security Strategy, Crowdstrike (Feb. 25, 2013),http://www.crowdstrike.com/blog/active-defense-time-new-security-strategy/.

[12] Comm’n on the Theft of Am. Intellectual Prop., The IP Commission Report 81 (2013) [hereinafter The IP Commission Report], available at http://ipcommission.org/report/IP_Commission_Report_052213.pdf; see also Sam Cook, Georgia Outs Russian Hacker, Takes Photo with His Own Webcam, Geek (Oct. 31, 2012, 4:28 PM), http://www.geek.com/news/georgia-outs-russian-hacker-takes-photo-with-his-own-webcam-1525485/. See Jay P. Kesan & Carol M. Hayes, Thinking Through Active Defense in Cyberspace, in Proceedings of a Workshop on Deterring Cyberattacks: Informing Strategies and Developing Options for U.S. Policy

327, 328 (The National Academies Press ed., 2010) (“Counterstrikes of this nature have already been occurring on the Internet over the last decade, by both government and private actors, and full software packages designed to enable counterstriking have also been made commercially available, even though such counterstrikes are of questionable legality”).

[13] See The IP Commission Report, supra note 12.

[14] Tom Fields, To ‘Hack Back’ or Not?, BankInfoSecurity(Feb. 27, 2013), http://www.bankinfosecurity.com/to-hack-back-or-not-a-5545.

[15] Id.

[16] Id.

[17] Hackback? Claptrap!—An Active Defense Continuum for the Private Sector, RSA Conf. (Feb. 27, 2014, 9:20 AM), http://www.rsaconference.com/events/us14/agenda/sessions/1146/hackback-claptrap-an-active-defense-continuum-for.

[18] Shane McGee, Randy V. Sabett, & Anand Shah, Adequate Attribution: A Framework for Developing a National Policy for Private Sector Use of Active Defense, 8 J. Bus. & Tech. L. 1 (2013) Available at: http://digitalcommons.law.umaryland.edu/jbtl/vol8/iss1/3

[19] See, e.g., Rafal Los, Another Reason Hacking Back Is Probably a Bad Idea, InfosecIsland (June 20, 2013), http://www.infosecisland.com/blogview/23228-Another-Reason-Hacking-Back-is-Probably-a-Bad-Idea.html; Riofrio, supra note 10.

[20] Dilanian, supra note 7;see also William Jackson, The Hack-Back vs. The Rule of Law: Who Wins?, Cybereye, (May 31, 2013, 9:39 AM) http://gcn.com/blogs/cybereye/2013/00/hacking-back-vs-the-rule-of-law.aspx (stating “[i]n the face of increasing cyber threats there is an understandable pent-up desire for an active response, but this response should not cross legal thresholds. In the end, we either have the rule of law or we don’t. That others do not respect this rule does not excuse us from observing it. Admittedly this puts public- and private-sector organizations and individuals at a short-term disadvantage while correcting the situation, but it’s a pill we will have to swallow.”).

[21] James Andrew Lewis, Private Retaliation in Cyberspace,Center for Strategic & Int’l Studies (May 22, 2013), http://csis.org/publication/private-retaliation-cyberspace.

[22] See Cyber Intelligence Sharing and Protection Act, H.R. 624, 113th Cong. (2013).

[23] Christopher M. Matthews, Support Grows to Let Cybertheft Victims ‘Hack Back’, Wall St. J. (June 2, 2013, 9:33 PM), http://online.wsj.com/news/articles/SB10001424127887324682204578517374103394466.

[24] See Alperovitch, supra note 11. The firm’s online marketing literature includes the following: “Active Defense is NOT about ‘hack-back,’ retaliation, or vigilantism . . . we are fundamentally against these tactics and believe they can be counterproductive, as well as potentially illegal.” Id.; see also Paul Roberts, Don’t Call It a Hack Back: Crowdstrike Unveils Falcon Platform, Security Ledger (June 19, 2013, 11:47 AM), https://securityledger.com/2013/06/dont-call-it-a-hack-back-crowdstrike-unveils-falcon-platform/.

[25] Charlie Mitchell, Senate Judiciary Panel Will Examine Stronger Penalties for Cyber Crimes and Espionage, Inside Cybersecurity (May 9, 2014) http://insidecybersecurity.com/Cyber-Daily-News/Daily-News/senate-judiciary-panel-will-examine-stronger-penalties-for-cyber-crimes-and-espionage/menu-id-1075.html (stating “[a]uthorization for so-called countermeasures is included in the draft cyber information-sharing and liability protection bill . . . White House and Department of Homeland Security officials . . . declined to discuss the administration’s view of deterrence issues such as active defense.”). To be distinguished from OCM, “countermeasure” is defined in the draft Cybersecurity Information-Sharing Act of 2014 as “an action, device, procedure, technique, or other measure applied to an information system or information that is stored on, processed by, or transiting an information system that prevents or mitigates a known or suspected cybersecurity threat or security vulnerability.” See H.R. 624.

[26] See, e.g.,Marcus Tullius Cicero, The Speech of M.T. Cicero in Defence of Titus Annius Milo, in The Orations of Marcus Tullius Cicero 390, 392-393 (C.D. Yonge trans., 1913).

[27] Sheng Li, Note, When Does Internet Denial Trigger the Right of Armed Self-Defense?, 38 Yale J. Int’l L. 179, 182 (2013).

[28] See, e.g., Walter Gary Sharp Sr., Cyberspace and the Use of Force 129-31 (1999).

[29] See U.S. Dep’t. of Def., Conduct of the Persian Gulf War: Final Report to Congress Pursuant to Title V of the Persian Gulf Conflict Supplemental Authorization and Personnel Benefits Act of 1991 (Public Law 102-25) N-1 (1992) (“Civilian employees, despite seemingly insurmountable logistical problems, unrelenting pressure, and severe time constraints, successfully accomplished what this nation asked of them in a manner consistent with the highest standards of excellence and professionalism.”).

[30] See CyCon, http://ccdcoe.org/cycon/index.html (last visited July 16, 2014).

[31] See NATO Coop. Cyber Defence Ctr. of Excellence, Tallinn Manual on the International Law Applicable to Cyber Warfare 4 (Michael N. Schmitt ed., 2013); see also U.N. Charter art. 2, para. 4 & art. 51 (governing the modern law of self-defense).

[32] See, e.g., Keiko Kono, Briefing Memo: Cyber Security and the Tallinn Manual, Nat’l Inst. For Def. Studies News, Oct. 2013, at 2, available at www.nids.go.jp/english/publication/briefing/pdf/2013/briefing_e180.pdf.

[33] See, e.g.,Siobhan Gorman & Danny Yadron, Banks Seek U.S. Help on Iran Cyberattacks, Wall St. J. (June 16, 2013, 12:01 AM), http://online.wsj.com/news/articles/SB10001424127887324734904578244302923178548; Christopher J. Castelli, DOJ Official Urges Public-Private Cybersecurity Partnership Amid Legal Questions,Inside Cybersecurity (April 1, 2014), http://insidecybersecurity.com/Cyber-Daily-News/Daily-News/doj-official-urges-public-private-cybersecurity-partnership-amid-legal-questions/menu-id-1075.html.

[34] One such example is the “Computer Trespasser” exception added by Congress to the Wiretap Act, which allows law enforcement officials to monitor the activities of hackers when (1) the owner or operator of the network authorizes the interception; (2) law enforcement is engaged in a lawful investigation; (3) law enforcement has reasonable grounds to believe the contents of the communications will be relevant to that investigation; and (4) such interception does not acquire communications other than those transmitted to or from the hacker. See 18 U.S.C. § 2511(2)(i)(I)-(IV) (2012); see also Bradley J. Schaufenbuel, The Legality of Honeypots, ISSA J., April 2008, at 16, 19, available at http://www.jdsupra.com/legalnews/the-legality-of-honeypots-50070/.

[35] See, e.g., David E. Sanger, White House Details Thinking on Cybersecurity Flaws, New York Times, (April 28, 2014) (discussing the Government’s admission that it refrains from disclosing major computer sercurity vulnerabilities that could be useful to “thwart a terrorist attack, stop the theft of our nation’s intellectual property, or even discover more dangerous vulnerabilities that are being used by hackers or other adversaries to exploit our networks.”)

[36] See Sameer Hinduja, Computer Crime Investigations in the United States: Leveraging Knowledge from the Past to Address the Future, 1 Int’l J. Cyber Criminology 1, 16 (2007) (citation omitted).

[37] Id. at 19. But see Kesan & Hayes, supra, note 12 at 33 (“there is a more significant downside of entrusting active defense to private firms. Our model addressing the optimal use of active defense emphasizes that there are threshold points where permitting counterstrikes would be the socially optimal solution. However, it does not define these thresholds, and determining these thresholds requires some sort of standardization. It would be unwise to allow individual companies to make these decisions on a case by case basis.”)

 

[38] The IP Commission Report, supra note 12, at 81. See also Joseph Menn, Hacked Companies Fight Back With Controversial Steps, Reuters, June 18, 2012, available at http://www.reuters.com/article/2012/06/18/us-media-tech-summit-cyber-strikeback-idUSBRE85G07S20120618

[39] See Stephanie Olsen, Nearly Undetectable Tracking Device Raises Concerns, CNET(July 12, 2000), http://news.cnet.com/2100-1017-243077.html.

[40] See id. See also John Gilroy, Ask The Computer Guy, Wash. Post, Jan. 27, 2002, at H07 (describing web bugs in lay parlance).

[41] Sean L. Harrington, Collaborating with a Digital Forensics Expert: Ultimate Tag Team or Disastrous Duo?, 38 Wm. Mitchell L. Rev. 353, 363 (2011), available at http://www.wmitchell.edu/lawreview/Volume38/documents/7.Harrington.pdf.

[42] Id.

[43] See generallyBrian M. Bowen et al., Baiting Inside Attackers Using Decoy Documents, Colum. Univ. Dep’t of Computer Sci. (2009), available at http://www.cs.columbia.edu/~angelos/Papers/2009/DecoyDocumentsSECCOM09.pdf (last visited May 13, 2014) (introducing and discussing properties of decoys as a guide to design “trap-based defenses” to better detect the likelihood of insider attacks).

[44] See Matthews, supra note 23.

[45] Id.

[46] Id.

[47] Id.

[48] See Harrington, supra note 41, at 362-64.

[49]The Supreme Court has tacitly approved deception as a valid law enforcement technique in investigations and interrogations. See Illinois v. Perkins,496 U.S. 292, 297 (1990) (“Miranda forbids coercion, not mere strategic deception . . .”); United States v. Russell, 411 U.S. 423, 434 (1973) (“Criminal activity is such that stealth and strategy are necessary weapons in the arsenal of the police officer.”); Allan Lengel, Fed Agents Going Undercover on Social Networks Like Facebook, AOLNews (Mar. 28, 2010, 5:55 PM), http://www.ticklethewire.com/2010/03/28/fed-agents-going-undercover-on-social-networks-like-facebook/.

[50] See Model Rules of Prof’l Conduct R. 5.3 (2013).

[51] Model Rules of Prof’l Conduct r. 8.4(c); see, e.g., In re Disciplinary Action Against Carlson, No. A13-1091 (Minn. July 11, 2013)(public reprimand for “falsely posing as a former client of opposing counsel and posting a negative review about opposing counsel on a website, in violation of Minn. R. Prof. Conduct 4.4(a) and 8.4(c)”); In re Pautler, 47 P.3d 1175, 1176 (Colo. 2002) (disciplining a prosecutor, who impersonated a public defender in an attempt to induce the surrender of a murder suspect, for an act of deception that violated the Rules of Professional Conduct).

[52] See Sharon D. Nelson & John W. Simek, Muddy Waters: Spyware’s Legal and Ethical Implications, GPSolo Mag., Jan.-Feb. 2006, http://www.americanbar.org/newsletter/publications/gp_solo_magazine_home/gp_solo_magazine_index/spywarelegalethicalimplications.html (“The legality of spyware is murky, at best. The courts have spoken of it only infrequently, so there is precious little guidance.”).

[53] In re Disciplinary Action Against Zotaley, 546 N.W.2d 16, 19 (Minn. 1996) (quoting Minn. R. Prof’l Conduct 3.3 cmt. 3 (2005)).

[54]See Phila. Bar Ass’n Prof’l Guidance Comm., Op. 2009-02, at 1-2 (2009), available at http://www.philadelphiabar.org/WebObjects/PBAReadOnly.woa/Contents/WebServerResources/CMSResources/Opinion_2009-2.pdf.

[55] See N.Y.C. Bar Ass’n Prof’l & Judicial Ethics Comm., Formal Op. 2010-2 (2010), available at http://www2.nycbar.org/Publications/reports/show_html.php?rid=1134; cf. Justin P. Murphy & Adrian Fontecilla, Social Media Evidence in Government Investigations and Criminal Proceedings: A Frontier of New Legal Issues, 19 Rich. J.L. & Tech. 11, ¶ 21 n.76 (2013) (citing similar ethics opinions rendered by bar committees in New York State and San Diego County).

[56] David Bianco, Use of the Term “Intelligence” in the RSA 2014 Expo, Enterprise Detection & Response (Feb. 28, 2014) http://detect-respond.blogspot.com/#!/2014/03/use-of-term-intelligence-at-rsa.html.

[57] See Sameer, supra note 36, at 15 (citing A. Meehan, G. Manes, L. Davis, J. Hale & S. Shenoi, Packet Sniffing for Automated Chat Room Monitoring and Evidence Preservation, in Proceedings of the 2001 IEEE Workshop on Information Assurance and Security 285, 285 (2001))(“[T]he monitoring of bulletin-boards and chat-rooms by investigators has led to the detection and apprehension of those who participate in sex crimes against children.”), available at http://index-of.es/Sniffers/Sniffers_pdf/52463601-packet-sniffing-for-automated-chat-room-74909.pdf; see, e.g., Kimberly J. Mitchell, Janis Wolak & David Finkelhor, Police Posing as Juveniles Online to Catch Sex Offenders: Is It Working?, 17 Sexual Abuse: J. Res. & Treatment 241 (2005); Lyta Penna, Andrew Clark & George Mohay, Challenges of Automating the Detection of Paedophile Activity on the Internet, in Proceedings of the First International Workshop on Systematic Approaches to Digital Forensic Engineering (2005), available at http://eprints.qut.edu.au/20860/1/penna2005sadfe.pdf.

[58] Martin Moylan, Target’s Data Breach Link to ‘the Amazon of Stolen Credit Card Information’,MPRnews (February 3, 2014), http://www.mprnews.org/story/2014/02/02/stolen-credit-and-debit-card-numbers-are-just-a-few-clicks-away.

[59] See “Investigating the Dark Web — The Challenges of Online Anonymity for Digital Forensics Examiners,” Forensic Focus (July 28, 2014) (“It is certainly easier to access indecent images of children and similar content on the dark net.”) Available at http://articles.forensicfocus.com/2014/07/28/investigating-the-dark-web-the-challenges-of-online-anonymity-for-digital-forensics-examiners/. And see, e.g., Minn. Stat. § 617.247 subd. 4(a) (2013) (criminalizing possession of “a pornographic work [involving minors] or a computer disk or computer or other electronic, magnetic, or optical storage system or a storage system of any other type, containing a pornographic work, knowing or with reason to know its content and character”).

[60] See Rainer Link & David Sancho, Lessons Learned While Sinkholing Botnets—Not As Easy As It Looks!, in Proceedings of the Virus Bulletin Conference 106, 106 (2011), available at http://www.trendmicro.com/media/misc/lessons-learned-virusbulletin-conf-en.pdf.

[61] Id.

[62] Id.at 107.

[63] “[C]onsent may be demonstrated through evidence of appropriate notice to users through service terms, privacy policies or similar disclosures that inform users of the potential for monitoring.” Bosset et.al, supra note 4 (citing Mortensen v. Bresnan Commc’ns, LLC, No. CV 10-13-BLG-RFC, 2010 WL 5140454, at *3-5 (D. Mont. Dec. 13, 2010)).

[64] See Craigslist Inc. v. 3Taps Inc., 964 F. Supp. 2d 1178, 1182-83 (N.D. Cal. 2013).

[65] See Link & Sancho, supra note 60, at 107-08.

[66] Honeypot, SearchSecurity, http://searchsecurity.techtarget.com/definition/honey-pot (last visited June 29, 2014).

[67] Eric Cole & Stephen Northcutt, Honeypots: A Security Manager’s Guide to Honeypots, SANS Inst., http://www.sans.edu/research/security-laboratory/article/honeypots-guide (last visited May 13, 2014).

[68] See, e.g., Jerome Radcliffe, CyberLaw 101: A Primer on US Laws Related to Honeypot Deployments 6-9 (2007), available at http://www.sans.org/reading-room/whitepapers/legal/cyberlaw-101-primer-laws-related-honeypot-deployments-1746.

[69] See id. at 14-17.

[70] See Schaufenbuel, supra note 34, at 16-17 (“Because a hacker finds a honeypot by actively searching the Internet for vulnerable hosts, and then attacks it without active encouragement by law enforcement officials, the defense of entrapment is not likely to be helpful to a hacker.”).

[71] See Cole & Northcutt, supra note 67.

[72] Schaufenbuel, supra note 34, at 19.

[73] See generally id. (stating that the best way for a honeypot owner to avoid downstream liability is to configure the honeypot to prohibit or limit outbound connections to third parties).

[74] Scott L. Vernick, To Catch a Hacker, Companies Start to Think Like One, Fox Rothschild, LLP (Feb. 15, 2013), http://www.foxrothschild.com/print/convertToPDF.aspx?path=/newspubs/newspubsprint.aspx&parms=id|15032388757.

[75] See Kevin Parrish, Copyright Troll Busted for Seeding on The Pirate Bay,tom’s GUIDE (Aug. 19, 2013, 2:00 PM), http://www.tomsguide.com/us/torrent-pirate-bay-copyright-troll-prenda-law-honeypot,news-17391.html#torrent-pirate-bay-copyright-troll-prenda-law-honeypot%2Cnews-17391.html?&_suid=1396370990577022740795081848747.

[76] Id.

[77] See id.

[78] See, e.g., Sean L. Harrington, Rule 11, Barratry, Champerty, and “Inline Links”, Minn. St. Bar Ass’n Computer & Tech. L. Sec. (Jan. 27, 2011, 11:42 PM), http://mntech.typepad.com/msba/2011/01/rule-11-barratry-champerty-and-inline-links.html (discussing the vexatious litigation tactics of Righthaven, LLC).

[79] See Scott Cohn, Companies Battle Cyberattacks Using ‘Hack Back’, CNBC (June 04, 2013, 1:00 PM), http://www.cnbc.com/id/100788881 (“[L]aw enforcement is unlikely to detect or prosecute a hack back. ‘If the only organization that gets harmed is a number of criminals’ computers, I don’t think it would be of great interest to law enforcement.”); Aarti Shahani, Tech Debate: Can Companies Hack Back?, Al Jazeera Am. (Sept. 18, 2013, 5:57 PM), http://america.aljazeera.com/articles/2013/9/18/tech-debate-can-companieshackback.html (“The Justice Department has not prosecuted any firm for hacking back and, as a matter of policy, will not say if any criminal investigations are pending”).

[80] See Cohn, supra note 79 (statement of Professor Joel Reidenberg) (“‘Reverse hacking is a felony in the United States, just as the initial hacking was. It’s sort of like, if someone steals your phone, it doesn’t mean you’re allowed to break into their house and take it back.’”); Shahani, supra note 79 (statement of David Wilson) (“‘No, it’s not legal, not unless the blackmailer gave permission. . . . But who’s going to report it? Not the bad guy.’”).

[81] See, e.g.,Nathan Thornburgh, The Invasion of the Chinese Cyberspies (and the Man Who Tried to Stop Them),TIME (Sept. 5, 2005), http://courses.cs.washington.edu/courses/csep590/05au/readings/titan.rain.htm (discussing the “rogue” counter-hacking activities of Shawn Carpenter, who was working with the FBI and for whose activities Carpenter claimed the FBI considered prosecuting him).

[82] See Dilanian, supra note 7 (“Others, including Stewart Baker, former NSA general counsel, said the law does allow hacking back in self-defense. A company that saw its stolen data on a foreign server was allowed to retrieve it, Baker argued.”) (In preparation for this comment, the author asked Mr. Baker about the interview, and he replied, “[T]he LA Times interview didn’t involve me talking about a particular case where retrieving data was legal. I was arguing that it should be legal.”).

[83] John Strand et al., Offensive Countermeasures: The Art of Active Defense 207 (2013).

[84] David Willson, Hacking Back in Self Defense: Is It Legal; Should It Be?, Global Knowledge (Jan. 6, 2012), http://blog.globalknowledge.com/technology/security/hacking-cybercrime/hacking-back-in-self-defense-is-it-legal-should-it-be/.

[85] See id.

[86] Stewart Baker, The Hack Back Debate (Nov. 02, 2012) http://www.steptoecyberblog.com/2012/11/02/the-hackback-debate/.

[87] See W. Page Keeton et al., Prosser & Keeton on the Law of Torts § 22 (5th ed. 1984).

[88] See id.

[89] See id. at§ 24.

[90] See id. at§ 21. And see McGee, Sabett, & Shah, supra, note 18 (“Reaching consensus on applying the concepts of self-defense to the cyber domain has proven to be a difficult task, though not for the lack of trying”).

[91] See Jassandra Nanini, China, Google, and Private Security: Can Hack-Backs Provide the Missing Defense in Cybersecurity, (forthcoming 2015) (manuscript at 14-15) (on file with author).

[92] See id. (manuscript at 14).

[93] Id. (manuscript at 15-16).

[94] See Sean Harrington, Why Divorce Lawyers Should Get Up to Speed on CyberCrime Law, Minn. St. B. Ass’n Computer & Tech. L. Sec. (Mar. 24, 2010, 9:40 PM), http://mntech.typepad.com/msba/2010/03/why-divorce-lawyers-should-get-up-to-speed-on-cybercrime-law.html (collecting cases regarding unauthorized computer access).

[95] 18 U.S.C. § 1030 (2012); see Clements-Jeffrey v. Springfield, 810 F. Supp. 2d 857, 874 (S.D. Ohio 2011) (“It is one thing to cause a stolen computer to report its IP address or its geographical location in an effort to track it down. It is something entirely different to violate federal wiretapping laws by intercepting the electronic communications of the person using the stolen laptop.”).

[96] See generally Orin S. Kerr, Cybercrime’s Scope: Interpreting “Access” and “Authorization” in Computer Misuse Statutes, 78 N.Y.U. L. Rev. 1596, 1624–42 (2003) (showing how and why courts have construed unauthorized access statutes in an overly broad manner that threatens to criminalize a surprising range of innocuous conduct involving computers).

[97] In re DoubleClick Privacy Litig., 154 F. Supp. 2d 497, 526 (S.D.N.Y. 2001) (emphasis added).

[98] See In re Pharmatrak, Inc. Privacy Litig., 329 F.3d 9, 13 & 21-22 (1st Cir. 2003) (holding use of tracking cookies to intercept electronic communications was within the meaning of the ECPA, because the acquisition occurred simultaneously with the communication).

[99] See Peter J. Toren, Amending the Computer Fraud and Abuse Act,BNA (Apr. 9, 2013), http://about.bloomberglaw.com/practitioner-contributions/amending-the-computer-fraud-and-abuse-act/.

[100] See, e.g., Holly R. Rogers & Katharine V. Hartman, The Computer Fraud and Abuse Act: A Weapon Against Employees Who Steal Trade Secrets,BNA (June 21, 2011) (“[E]mployers are increasingly using this cause of action to go after former employees who steal trade secrets from their company-issued computers.”).

[101] A Byte for a Byte,Economist (Aug. 10, 2013), available at http://www.economist.com/node/21583268/; see also Lewis, supra note 21 (“There is also considerable risk that amateur cyber warriors will lack the skills or the judgment to avoid collateral damage. A careless attack could put more than the intended target at risk. A nation has sovereign privileges in the use of force. Companies do not.”); John Reed, The Cyber Security Recommendations of Blair and Huntsman’s Report on Chinese IP Theft, Complex Foreign Pol’y (May 22, 2012), http://complex.foreignpolicy.com/posts/2013/05/22/the_cyber_security_recomendations_of_blair_and huntsman_report_on_chinese_ip_theft (“While it may be nice to punch back at a hacker and take down his or her networks or even computers, there’s a big potential for collateral damage, especially if the hackers are using hijacked computers belonging to innocent bystanders.”).

[102] John Reed, Mike Rogers: Cool It with Offensive Cyber Ops, Complex Foreign Pol’y (Dec. 14, 2012, 5:07 PM), http:/complex.foreignpolicy.com/posts/2012/12/14/mike_rogers_cool_it_with_offensive_cyber_ops (audio recording of full speech available at http://www.c-span.org/video?314114-1/rep-rogers-rmi-addresses-cyber-threats-economy). But see See McGee, Sabett, & Shah, supra, note 18 (urging the adoption of a “Framework for ‘good enough’ attribution”).

[103] For definitions and discussion of these terms, seeEric A. Fischer et al., Cong. Research Serv., R42984, The 2013 Cybersecurity Executive Order: Overview and Considerations for Congress2-4,(2013), available at http://www.fas.org/sgp/crs/misc/R42984.pdf.

[104] Max Fisher, Should the U.S. Allow Companies to ‘Hack Back’ Against Foreign Cyber Spies?, Wash. Post (May 23, 2013, 10:43 AM), http://www.washingtonpost.com/blogs/worldviews/wp/2013/05/23/should-the-u-s-allow-companies-to-hack-back-against-foreign-cyber-spies/ (quoting Lewis, supra, note 21).

[105] Los, supra note 19.

[106] See Fahmida Y. Rashid, Layered Security Essential Tactic of Latest FFIEC Banking Guidelines,eWeek (June 30, 2011), http://www.eweek.com/c/a/IT-Infrastructure/Layered-Security-Essential-Tactic-of-Latest-FFIEC-Banking-Guidelines-557743/ (“Banks must adopt a layered approach to security in order to combat highly sophisticated cyber-attacks, the Federal Financial Institutions Examination Council said in a supplement released June 28. The new rules update the 2005 ‘Authentication in an Internet Banking Environment’ guidance to reflect new security measures banks need to fend off increasingly sophisticated attacks. . . . The guidance . . . emphasized a risk-based approach in which controls are strengthened as risks increase.”).

[107] See PCI 2.0 Encourages Risk-Based Process: Three Things You Need to Know, ITGRC (Aug. 23, 2010), http://itgrcblog.com/2010/08/23/pci-2-0-encourages-risk-based-process-three-things-you-need-to-know/.

[108] See Lee Vorthman, IT Security: NIST’s Cybersecurity Framework, NetApp (July 16, 2013, 6:01 AM), https://communities.netapp.com/community/netapp-blogs/government-gurus/blog/2013/07/16/it-security-nists-cybersecurity-framework) (“It is widely anticipated that the Cybersecurity Framework will improve upon the current shortcomings of FISMA by adopting several controls for continuous monitoring and by allowing agencies to move away from compliance-based assessments towards a real-time risk-based approach.”).

[109] Reed, supra note 102.

[110] Geoffrey C. Hazard, Jr., Law, Morals, and Ethics, 19 S. Ill. U. L.J. 447, 453 (1995), available at http://repository.uchastings.edu/faculty_scholarship/252.

[111] Id.

[112] See generally Heinz C. Luegenbiehl & Michael Davis, Engineering Codes of Ethics: Analysis and Applications 10 (1986) (referring to the “Contract with society” theory on the relation between professions and codes of ethics).

According to this approach, a code of ethics is one of those things a group must have before society will recognize it as a profession. The contents of the code are settled by considering what society would accept in exchange for such benefits of professionalism as high income and high prestige. A code is a way to win the advantages society grants only to those imposing certain restraints on themselves.

[113] See, e.g., Official (ISC)2 Guide to the CISSP CBK 1214 (Steven Hernandez ed., 3d ed. 2013) (“The code helps to protect professionals from certain stresses and pressures (such as the pressure to cut corners with information security to save money) by making it reasonably likely that most other members of the profession will not take advantage of the resulting conduct of such pressures. An ethics code also protects members of a profession from certain consequences of competition, and encourages cooperation and support among the professionals.”).

[114] See id.

[115] (ISC)2, (ISC)2 Overview: Evolving in Today’s Complex Security Landscape 4 (2013), available at www.infosec.co.uk/_novadocuments/47180?v=635294483175930000.

[116] See id.

[117] David E. Sanger & John Markoff, After Google’s Stand on China, U.S. Treads Lightly,N.Y. Times (Jan. 15, 2010), http://www.nytimes.com/2010/01/15/world/asia/15diplo.html?_r=0.

[118] See, e.g.,Skipper Eye, Google Gives Chinese Hackers a Tit for Tat, Redmond Pie (Jan. 16, 2010), available at http://www.redmondpie.com/google-gives-chinese-hackers-a-tit-for-tat-9140352/.

[119] See Shelley Boose, Black Hat Survey: 36% of Information Security Professionals Have Engaged in Retaliatory Hacking, BusinessWire(June 26, 2012, 11:00 AM), http://www.businesswire.com/news/home/20120726006045/en/Black-Hat-Survey-36-Information-Security-Professionals (“When asked ‘Have you ever engaged in retaliatory hacking?’ 64% said ‘never,’ 23% said ‘once,’ and 13% said ‘frequently”. . . . [W]e should take these survey results with a grain of salt . . . . It’s safe to assume some respondents don’t want to admit they use retaliatory tactics.”).

[120] Lewis, supra note 21 (“Another argument is that governments are not taking action, and therefore private actors must step in.”).

[121] Reed, supra note 102.

[122] See About FS-ISAC, Fin. Serv.: Info. Sharing & Analysis Center, https://www.fsisac.com/about (last visited June 9, 2014). Launched in 1999, FS-ISAC was established by the financial services sector in response to 1998’s Presidential Directive 63. That directive ― later updated by 2003’s Homeland Security Presidential Directive 7 ― mandated that the public and private sectors share information about physical and cyber security threats and vulnerabilities to help protect the U.S. critical infrastructure. See id.

[123] See id.

[124] FS-ISAC Security Automation Working Group Continues to Mature Automated Threat Intelligence Strategy, Deliver on Multi-Year Roadmap, Fin. Serv.: Info. Sharing & Analysis Center (Feb. 26, 2014), https://www.fsisac.com/sites/default/files/news/FSISAC_PR_SAWG_Feb19-2014v1AH%20-%20DHE-ALL-EDITS-FINAL2%20EG.pdf.

[125] See id.

[126] Sean Sposito, In Cyber Security Fight, Collaboration Is Key: Guardian Analytics, Am. Banker (Oct. 08. 2013, 2:01 PM), http://www.americanbanker.com/issues/178_195/in-cyber-security-fight-collaboration-is-key-guardian-analytics-1062688-1.html.

[127] See generally, Taking Down Botnets: Public and Private Efforts to Disrupt and Dismantle Cybercriminal Networks: Hearing Before the S. Comm. on the Judiciary, 113th Cong. (July 15, 2014) http://www.judiciary.senate.gov/meetings/taking-down-botnets_public-and-private-efforts-to-disrupt-and-dismantle-cybercriminal-networks (providing access to testimony from the hearing).

[128] See Tracy Kitten, Microsoft, FBI Take Down Citadel Botnets, Bank Info Security (June 6, 2013), http://www.bankinfosecurity.com/microsoft-fbi-takedown-citadel-botnets-a-5819/op-1.

[129] See id.

[130] See id.

[131] See NCA Leads Global Shylock Malware Takedown, infosecurity (July 12, 2014) http://www.infosecurity-magazine.com/view/39289/nca-leads-global-shylock-malware-takedown/.

[132] See Gregg Keizer, Massive Botnet Takedown Stops Spread of Cryptolocker Ransomware,ComputerWorld (June 5, 2014 02:15 PM), http://www.computerworld.com/s/article/9248872/Massive_botnet_takedown_stops_spread_of_Cryptolocker_ransomware.

[133] John E. Dunn, Worried US Retailers Battle Cyber-attacks Through New Intelligence-Sharing Body, TechWorld (May 16, 2014, 6:29 PM), http://news.techworld.com/security/3517094/worried-us-retailers-battle-cyber-attacks-through-new-inte/.

[134] See, e.g.,Dan Dupont Retail, Financial Sectors Form Cybersecurity Partnership in Wake of Data Breaches (March 13, 2014), http://insidecybersecurity.com/Cyber-Daily-News/Daily-News/retail-financial-sectors-form-cybersecurity-partnership-in-wake-of-data-breaches/menu-id-1075.html.

[135] See Press Release, Dianne Feinstein, Senate Intelligence Committee Approves Cyber Security Bill (July 8, 2014) available at http://www.feinstein.senate.gov/public/index.cfm/2014/7/senate-intelligence-committee-approves-cybersecurity-bill.

[136]See Brent Rowe et al., The Role of Internet Service Providers in Cyber Security 7 (2011), available at http://sites.duke.edu/ihss/files/2011/12/ISP-Provided_Security-Research-Brief_Rowe.pdf.

[137] See, generally, Chatham House Rule, Chatham House; The Royal Institute of International Affairs http://www.chathamhouse.org/about/chatham-house-rule (explaining the Chatham House Rule).

[138] Section 631 of the Cable Communications Policy Act of 1984, 47 U.S.C. §§ 521, et seq. The Cable Act prohibits cable systems’ disclosure of personally identifiable subscriber information without the subscriber’s prior consent; requires the operator to destroy information that is no longer necessary for the purpose it was collected, to notify subscribers of system data collection, retention and disclosure practices and to afford subscribers access to information pertaining to them; provides certain exceptions to the disclosure restrictions, such as permission for the cable operator to disclose “if necessary to conduct a legitimate business activity related to a cable service or other service” provided to the subscriber, and disclosure of subscriber names and addresses (but not phone numbers), subject to an “opt out” right for the subscriber. Congress expanded, as part of the Cable Television Consumer Protection and Competition Act of 1992, the privacy provision of the Communications Act to cover interactive services provided by cable operators. Id.

[139] Protecting and Promoting the Open Internet, GN Docket No. 14-28, at App’x A, §§ 8.5, 8.11 (May 15, 2015).

[140] Id. at 1-2.

[141] Preserving the Open Internet, 76 Fed. Reg. 59192, 59209 n.102 (Sept. 23, 2011).

[142] Michel Van Eeten et al., The Role of Internet Service Providers in Botnet Mitigation: An Empirical Analysis Based on Spam Data 1 (2010), available at http://weis2010.econinfosec.org/papers/session4/weis2010_vaneeten.pdf.

[143] Rowe et al., supra note 136.

[144] See, e.g., Meir Orbach, Israeli Cyber Tech Companies on Rise in US Market, Al Monitor (Jan. 23, 2014) http://www.al-monitor.com/pulse/business/2014/01/us-cyber-security-market-israeli-companies.html.

[145] See New York Times Co. v. United States, 403 U.S. 713, 714 (1971).

[146] See David Bianco, The Pyramid of Pain, Enterprise detection & Response Blog(Mar. 1, 2014), http://detect-respond.blogspot.com/#!/2013/03/the-pyramid-of-pain.html.

[147] See id.

[148] See id.

[149] See Sposito, supra note 126.

[150] See FireEye Threat Analytics Platform, FireEye,http://www.fireeye.com/products-and-solutions/threat-analytics-platform.htm (last visited June 9, 2014).

[151] See Tim Wilson, CrowdStrike Turns Security Fight Toward Attacker, Dark Reading (June 25, 2013, 9:18 AM), http://www.darkreading.com/analytics/threat-intelligence/crowdstrike-turns-security-fight-toward-attacker/d/d-id/1139998?.

[152] See HP IDOL,HP Autonomy,www.autonomy.com/products/idol (last visited June 9, 2014).

 

Virtual Currencies; Bitcoin & What Now After Liberty Reserve, Silk Road, and Mt. Gox?

Page 74 of 84

Powered by WordPress & Theme by Anders Norén