Virtual child pornography -- the product?

Some may find this posting offensive or even disturbing.


I’m going to explore some scenarios that might ensue from the current state of U.S. law on child pornography.


I’m not arguing that these or any scenarios will come to pass . . . . I'm just working through the logical possibilities, based on the current state of U.S. law dealing with real and not-real child pornography.

As I explained in an earlier post, the U.S. Supreme Court has held:

• that the First Amendment does not preclude U.S. law’s criminalizing “real” child pornography, i.e., child pornography the creation of which involves the use of real children;
• that the First Amendment does bar U.S. law from criminalizing virtual child pornography, i.e., child pornography the creation of which does not involve the use of real children but is, instead, based on computer-generated images (CGIs).

The Supreme Court held that the First Amendment does not prevent U.S. law from criminalizing real child pornography, even though it qualifies as speech under the First Amendment, because its creation involves the victimization of children, both physically and emotionally. Real child pornography is essentially a product and a record of a crime, or crimes, against children. The Court also held that the First Amendment does prevent U.S. law from criminalizing virtual child pornography because it is speech and because no real person is “harmed” in its creation; unlike real child pornography, virtual child pornography is fantasy, not recorded reality.

We were covering this in my cyberspace law class, and I asked the students to think about where virtual child pornography’s protected status under the First Amendment might take us once computer technology evolves so it is possible to create virtual child pornography (or adult pornography or movies or any visual media) that are visually indistinguishable from the real thing. The question is, what might happen with virtual child pornography once the average person cannot tell it from child pornography the creation of which involved the use of real children? We came up with what I think are some interesting scenarios.

For one thing, it would not be illegal to possess this indistinguishable-from-the-real-thing virtual child pornography. That, alone, has several consequences. It could create real difficulties for law enforcement officers who are trying to find real child pornography and prosecute those to create, distribute and possess it. If a regular person cannot tell real from virtual child pornography by simply looking at a movie or other instance of child pornography, how are police involved in investigations supposed to know what they’re dealing with?

Another consequence could be that it becomes functionally impossible, or at least very difficult, for prosecutors to prove that someone being prosecuted for possessing real child pornography did so knowingly. The defendant could claim he or she believed the material he possessed was virtual, not real, child pornography. Since the prosecution has to prove the defendant “knowingly” possessed real child pornography beyond a reasonable doubt, it would presumably be difficult for prosecutors to win in cases like these (assuming the jurors followed the law and were not swayed by personal distaste for the defendant’s preferences in pornography).

Since U.S. jurisdictions cannot criminalize the possession and distribution of virtual child pornography, we might see the emergence of websites selling virtual child pornography. It would perfectly legal to sell the stuff in the U.S., to buy it or to possess it. Virtual child pornography would essentially have the same status as any other kind of fictive material; it is, after all, a fantasy, just as slasher movies or violent video games are fantasy.

To protect themselves and their clients, these hypothetical businesses might watermark the virtual child pornography they sold, to provide an easy way of proving that the stuff was virtual, not real. We talked a bit about this in my class. The watermark would have to be something that could withstand scrutiny and that would be valid, clearly credible evidence that child pornography was virtual, not real. Those who created and sold the stuff might be able to charge more if their watermark hit a gold standard – if it basically provided a guarantee that those who bought their product could not be successfully prosecuted for possessing child pornography.

The international repercussions of all this might be interesting; some countries, such as Germany, criminalize the creation, possession and distribution of all child pornography, real and virtual. The criminalization of all child pornography is the default standard under the Council of Europe’s Convention on Cybercrime, but the Convention allows parties to opt out of criminalizing virtual child pornography. So countries that take the same approach as the U.S. could also become purveyors of virtual child pornography. We could see a world in which virtual child pornography was illegal in some countries and for sale in others.

In analyzing where all of this might go, my students and I realized there could be one, really depressing implication of the commercialization of virtual child pornography: Real child pornography would probably become particularly valuable, because it would be the real thing.

Bonnie & Clyde and Cybercrime

I spoke at a conference in Italy last week; after I spoke I got a question from a member of the audience. His question, which went to how and why we in the U.S. federalize certain crimes, made me think about a part of our history in a way I had not done before.

His question basically went to why we make it a federal crime for someone to hack the computer system of a private company. He was coming from the very logical premise that hacking the system of a private company is an attack on private property, so he wondered why that should become a federal crime.

In answering him, I recapped the history of the increasing federalization of crime in the U.S., something I’m going to repeat here. After I do that, I want to offer a few thoughts on what that history may, or may not, suggest about how we can go about dealing with cybercrime.

Until early in the twentieth century, crime in the U.S. was proscribed and prosecuted almost exclusively at the state level. There were some federal crimes, such as counterfeiting and treason, but they tended to be the exception. The drafters of the U.S. Constitution intended that crime would be handled primarily at the local level; a few years ago, an American Bar Association study found that this was their intention, the theory being that it makes more sense for crime to be punished as close as possible to the local community.

This theory derives both from history (that’s the way it had always been done) and from the assumption that handling crime at the local level was the best way to deter crime and encourage people to follow the law. The notion is, essentially, that the closer we are to the process of prosecuting and punishing criminal behavior, the more likely we are to take the process seriously and see it as something that could affect us.

That was the way things worked until about the second decade of the twentieth century, when automobiles began to become more common in the U.S. As they became more common, motor vehicles began to influence how certain crimes were being committed.

One crime, arguably a “new” crime at the time, was automobile theft: Someone could steal a car in, say, Ohio and drive it into Indiana or Illinois or Texas . . . which would pretty much defeat the Ohio police’s efforts to find the car and prosecute the thief. In other words, car thieves pretty quickly figured out that they could exploit state borders to their advantage; they figured out that each state only had jurisdiction to investigate crime within its borders. There really was no effective way for, say, Ohio officers to pursue a car thief into Indiana and then Illinois and however many other states he took the car into.

This concept of using the mobility of motor vehicles to elude apprehension and prosecution then migrated into other areas, such as kidnapping and bank robbery. As those of us who’ve seen the movie “Bonnie & Clyde” know, the 1930’s say the rise of bank robbing gangs who used high-speed automobiles to rob a bank in one state and then flee to another, thereby avoiding the police. Indeed, according to one book I read, Clyde went so far as to send Henry Ford a letter, thanking Ford for making such fast cars; Clyde assured Ford that he always preferred using Fords in his car thefts, both because they were so fast and because they were so common it was easy to hide out in them.

The question the Italian gentleman asked me last week made me think about all of this a little more deeply. In answering him, I realized something I had already known, but hadn’t really thought about: What American bank robbers and kidnappers and car thieves were doing 70 and 80 years ago is functionally indistinguishable from what cybercriminals are doing today. Both use(d) then-current technology to exploit the fact that states (whether discrete states in a federal system like ours, or nation-states in our global system) have jurisdiction only within their own borders.

In the law, there are two fundamental principles governing a sovereign state’s exercise of jurisdiction in criminal cases: One is that a sovereign state has jurisdiction to adopt law criminalizing conduct occurring within its territory and to sanction those who violate that law. The other principle is that one state (Ohio or France) cannot enforce its laws inside the territory of another state (Indiana or Italy). So, criminals – who generally tend to be among the first adopters of new technologies -- can use those principles against sovereign states by committing a crime in one state and then fleeing to another state or, for cybercrime, by remotely committing a crime in another state.

Okay, none of this is new. What I realized last week goes not to the fact that all of this has happened and is happening. It goes, instead, to the strategy the U.S. used to deal with the motor vehicle as criminal tool issue. It occurred to me that the strategy might, or might not, be an instructive example for how we could deal with cybercrime.

The way the U.S. dealt with the motor vehicle as criminal tool issue was to enact federal laws that made it a crime to, for example, steal a motor vehicle in one state and take it across state lines for the purpose of evading apprehension and to kidnap someone in one state and take them across state lines for the same purpose. In other words, the U.S.’ approach was to move to a supra-state system of laws, a national set of laws. This meant that the criminals could no longer find a safe haven: Federal authorities could chase them from Ohio to Indiana to Illinois and all the way to Texas, if necessary.

I thought of this last week both because it was relevant in answering the gentleman’s question and because it perhaps suggests something about how we need to approach cybercrime.

Like the 1930’s bank robbers, cybercriminals are using new technology to exploit the jurisdictional limitations of specific sovereigns to their advantage. Everyone recognizes that. The question is, what do we do about this?

The Council of Europe’s Convention on Cybercrime attempts to deal with the problem by encouraging countries to adopt standardized, consistent laws that (i) criminalize certain activities (such as hacking, child pornography, etc.) and (ii) facilitate law enforcement cooperation with officers from other countries. The goal, in effect, is to achieve a voluntary, lateral solution to the problem. The notion is that if the various nation-states all have a core of consistent laws criminalizing behaviors and specifying what police can do in collecting and sharing information about cybercrimes, then this will make it much more difficult for cybercriminals to exploit the parochial jurisdictional capacities of the various nation-states.

I like that solution because it is voluntary, and because it is lateral. As we all know, cyberspace favors the lateral, rather than the hierarchical, organization of human behavior. So this seems a flexible, adaptive solution. My only concerns with it are that (i) it may take a very long time to achieve this consensus and (ii) it may prove difficult to achieve consensus in certain areas, because national laws are bound up with local culture. We in the U.S. are already outliers because of our First Amendment; it means that we can, indeed must, host content that is criminalized elsewhere, a circumstance that will not change unless and until we eliminate that aspect of the First Amendment (which is highly unlikely).

What about the alternative? . . . What about a solution analogous to what the U.S. did with motor vehicle-facilitated crime about 80 years ago? Could we somehow adopt a set of supranational laws targeting cybercrime and use that to defeat cybercriminals’ ability to evade and frustrate the application of national laws?

As a federal system, the U.S. was in a perfect position to move to the next level – to shift to a higher-tier, system-wide set of laws targeting motor vehicle-facilitated crime. We do not have a global federal system or any thing comparable. We therefore do not have a structure which could be used to implement a similar approach, however logical it might be.

This brings me back to the comments I made in my last post, “A law of cyberspace.” On the one hand, a global, over-arching network of cybercrime laws, with an accompanying, equally-global enforcement system, would clearly be the optimum way to address the exploitation of jurisdictional limits by cybercriminals.

The first problem with that strategy is that we do not have an institution capable of achieving this; the United Nations is the only possible candidate for the task but this really does not come within its charter. The other problem is, as I noted in my last post, that nation-states tend to be possessive of their territory and jealously protective of their own, idiosyncratic laws. I think it will be a long, long time before a global solution to the cybercrime jurisdictional law problems will be a possibility, assuming, of course, that such a solution is desirable.

A law of cyberspace

I’ve heard many people complain about the fact that law in cyberspace is a mess: different laws in different countries (and different laws in different parts of countries, as with the U.S. states), laws that conflict, laws that seem to make no sense when they are applied to online activity, etc., etc. And they’re right.

We’re clearly in some kind of transitional phase, at least as far as the law goes. Law has always been territorial and parochial: England had its unique set of laws, which applied only within the territory controlled by England; Japan had its unique set of laws, which applied only within the territory Japan controlled; Egypt had its unique set of laws, which applied only within the territory Egypt controlled, and so on.

This wasn’t a problem as long as people were pretty much parochial, i.e., pretty much stayed in the country in which they were born. It began to become a problem a hundred years or so ago, when international travel began to become easier and therefore more common. One downside of international travel’s becoming increasingly easier has been that the “bad guys,” the criminals can commit crimes in Country A and then go to another country, in an effort to avoid being apprehended and punished by Country A.

As I’ve written elsewhere, there is and has been a core of consistency in the laws of the various nation-states, because every state has to protect certain interests (e.g., property, matrimony, parentage) and prohibit certain types of conduct (e.g., murder, rape, theft). States may well go about protecting these interests and prohibiting conduct in different ways, but there has generally been a baseline of consistency in certain fundamental areas. That has made it possible – not necessarily easy, but possible – for countries to cooperate in bringing criminals to justice. As you probably know, modern states have extradition treaties which let Country B arrest the criminal I hypothesized above upon being requested by Country A; Country B returns him to Country A, where he can be tried, convicted and punished for crimes he committed against citizens of that country.

That system works pretty well in the real, physical world, though it has been facing more and more challenges as international travel becomes more common. It’s still, though, relatively easy to identity and apprehend a human being traveling from one country to another because actions in the physical world leave traces: A criminal who moves from Country A to Countries B and C can be identified by his appearance (unless he alters it substantially), by his fingerprints, by his passport, by his habits or other methods. The relatively cumbersome nature of real-world travel also contributes to the identification of criminals such as our hypothesized victimizer of Country A. It takes time and funds and arrangements (public arrangements) to go from Country A to Country B and then to Country C. Our perpetrator cannot move that quickly (unless he has his own private jet and other resources, which is possible but unlikely), and that, too, can facilitate his being identified, apprehended and returned to face justice in appropriate venues.

Cyberspace of course changes all this. We can virtually “travel” the globe in instants, or less than instants. We can do so anonymously or pseudonymously. We can conceal where we are in the traditional, territorial sense, where we were and where we will be. Identity and actions disconnect from territory, which can also mean they disconnect from law, which still is territorial and parochial.

We’re not sure yet how to think about cyberspace. One option, which was long ago proposed by many other people, is to conceptualize it as a “place” in itself – a virtual “place.” That makes sense if you equate “place” with the context in which we carry on various activities; we buy things, sell things, communicate, do art, harass and annoy each other, commit crimes, make friends, form communities and do a host of other typically human things online. It would, therefore, be quite logical to conceptualize cyberspace as another “place,” something analogous to a new, as-yet unsettled country.

If we did that, we could develop cyberspace-specific laws. These laws would be laws that, like the nation-state laws I noted earlier, were unique and parochial -- specific to the territory within which they applied. That “territory” would be the ever-expanding confines of cyberspace. The cyberspace laws would therefore only apply when we were “in” cyberspace, i.e., only when we were online. Offline activities would continue to be governed by the unique, parochial laws of the nation-state whose territory we occupied while we were online.

I see two problems with this approach. One is devising cyberspace-specific laws: Who would do this? Would the countries of the world develop a code of laws for cyberspace? Would the UN do this, alone or in collaboration with these countries? Who would decide what law governs cyberspace?

Before I analyze that issue, I want to note the other problem, which I am not specifically going to address in this post. If we were to devise and implement a set of cyberspace-specific laws, who would enforce them? I think that if it ever happens, it will be a long time before the various countries of the world are wiling to let an independent entity (the Cyberspace Court? A UN Cyberspace Court?) exercise jurisdiction over their citizens with regard to their online activities.

Think what that would mean: I’m a U.S. citizen and I’m writing this from my home in Dayton, Ohio. Assume that what I’m writing somehow violates our hypothetical set of cyberspace laws, which would subject me to the efforts of the entity charged with enforcing those laws. That would mean, I assume, that I would somehow have to be extradited from Dayton/Ohio/USA to a cyberspace-jurisdiction to be tried, probably convicted and somehow punished. If the United States. or any other country were to allow that to happen to its citizens, it would be surrendering a measure of its national sovereignty. It would be conceding part of its authority to control its citizens’ behavior to another, albeit virtual, sovereign entity. That may happen someday, in a distant future in which the influence of nation-states has declined or disappeared, but it will not happen for a long time.

That problem, though, cannot arise unless and until there is a set of cyberspace-specific laws. Let’s go back to the first problem: Who would devise such laws?

Logically, the articulation of these laws can from either from sources outside cyberspace or from sources inside cyberspace. In the first alternative, we either (i) devise entirely new laws that are specific to cyberspace or (ii) extrapolate existing, external law to cyberspace. In the second alternative, we would “grow” cyberspace law in cyberspace. Let’s consider each alternative.

I do not think we will see an external effort to devise cyberspace-specific laws primarily because of the enforcement problem. By agreeing to the articulation of cyberspace-specific laws, countries would already be surrendering a measure of their sovereign authority, because the issue of enforcement is implicit in, and an inevitable consequence of, the articulation of such laws.

Another external approach – which the Council of Europe is pursuing on a limited basis – is to encourage the harmonization of national laws insofar as they impact on activities in cyberspace. The Council of Europe has promulgated a Convention on Cybercrime in an effort to do this for the laws that define certain type of cybercrime and govern what law enforcement can do in investigating online criminal activity. The Convention has been ratified by many European countries, plus the U.S.; it can also be signed and ratified by other non-European countries, but I suspect that will take a while if, indeed, it happens. I’m not going to go into detail on why I think that here, because it would be a digression; suffice it to say that the Convention is a very complex document, one that incorporates certain perspectives about law that may not be common in all countries. I’m not saying that harmonization is a bad idea or that it is impossible; I am saying that I think it will take a long time to break down the barriers that exist between the unique, parochial laws that are found in every modern nation-state.

We needn’t give up hope for cyberspace laws, though. There’s still the other alternative: growing cyberspace laws in cyberspace. While this might seem a peculiar approach, it actually has its roots in history.

A system of law known as the Lex Mercatoria developed in medieval Europe, beginning around the tenth and eleventh centuries. The Lex Mercatoria was, as Wikipedia explains, a

body of rules and principles laid down by merchants themselves to regulate their dealings. It consisted of usages and customs common to merchants . . . in Europe, with slightly local differences. It originated from the problem that civil law was not responsive enough to the growing demands of commerce: there was a need for quick and effective jurisdiction, administered by specialised courts. The guiding spirit of the merchant law was that it ought to evolve from commercial practice, respond to the needs of the merchants, and be comprehensible and acceptable to the merchants who submitted to it.

The Lex Mercatoria was the product of a world in which nation-states had yet to evolve. During this era, merchants did not operate from a single, fixed location, such as a shop. Instead, they traveled to sell goods they bought in one place at another. Because they were doing business in so many places, the merchants became frustrated at having to deal with a patchwork of parochial, often inconsistent and inadequate local laws. To remedy this, they developed their own laws, which evolved from their needs and from the nature of the transactions in which they engaged. (They also developed their own courts, to ensure that disputes could be settled quickly and fairly, but that’s another story.)

Many scholars have suggested that the solution for cyberspace is the evolution of a new, online Lex Mercatoria – a Lex Cyberspace. The Lex Cyberspace would be, like the Lex Mercatoria, a specialized set of laws that exist separate and apart from the general laws governing activities in the various countries of the world. And like the Lex Mercatoria, the Lex Cyberspace would apply only to those who participate in activities undertaken in a specialized context, the context being trade for the Lex Mercatoria and cyberspace for the Lex Cyberspace. The rationale for the two law codes would be essentially the same: specialized endeavors that transcend national boundaries and national cultures require their own laws.

This approach could have certain advantages. Like the Lex Mercatoria, a consensually-evolved Lex Cyberspace should be uniquely tailored to the needs of the cyber-community, instead of a modified version of real-world law extrapolated online, where it may or may not be appropriate. And a Lex Cyberspace would be internally-derived, instead of than being imposed by an external entity (or entities). This aspect of a Lex Cyberspace has implicitly manifested itself in certain ways, one of which is a general sentiment to the effect that online communities should be self-policing, i.e., should develop and enforce their own standards and rules of behavior.

A Lex Cyberspace could, it seems, resolve both of the issues I noted above: developing laws governing online activity and enforcing those laws. The problem I see with the Lex Cyberspace solution is that nation-states are unlikely to be willing to surrender control to a body of online law-makers and law-enforcers. The demise of the Lex Mercatoria, after all, is attributed to the rise of nation-states, which were jealous of and insecure with this independent, transnational legal institution. Nation-states therefore assumed exclusive responsibility for making and enforcing law and, in so doing, subsumed the principles of the Lex Mercatoria into their own laws.

Perhaps there will someday be a Law of Cyberspace. It seems, though, that such a phenomenon cannot exist unless and until the influence of nation-states erodes or until the laws governing the territories claimed by the discrete nation-states coalesce into a single, consistent whole.

Envelopes and encryption

As I’ve mentioned, last June the U.S. Court of Appeals for the Sixth Circuit held, in United States v. Warshak, that Americans have a reasonable expectation of privacy in the contents of emails they have stored on an ISP’s servers.

(If the Warshak link doesn’t work, you can find it by going to http://www.ca6.uscourts.gov and searching for it in the opinions section either by name or by opinion # 07a0225p.06).

The Warshak opinion means that law enforcement can no longer use a court order, which issues without a showing of probable cause, to obtain the contents of emails someone has left stored with their ISP. They must, instead, obtain a search warrant, which does require them to show probable cause to believe that the emails contain or constitute evidence of a crime.

The opinion was, as is usual, issued by a panel of three of the Sixth Circuit judges; my understanding is that the federal government, which was the losing party in the case, is asking the entire Sixth Circuit to rehear this case en banc, i.e., to have all the judges on the Sixth Circuit sit as a panel and re-decide the case. If the Sixth Circuit does that, then the en banc panel can either agree with the three judges who said we have a Fourth Amendment expectation of privacy in our email, or disagree, and reject their conclusion. If the Sixth Circuit rehears the case en banc and agrees that we do have a reasonable expectation of privacy in stored emails, then I’d say there’s a good chance the case will go to the Supreme Court, because the effect of such a decision is to invalidate a federal statute law enforcement officers routinely use to obtain access to stored emails.

I don’t want to talk about the Warshak opinion, though. I want to talk about the larger issue – the question of whether we can reasonably expect the contents of our emails to be, and to remain, private. To do that, I need to review the standard courts apply when this issue comes up.

In 1877, the U.S. Supreme Court held, in Ex parte Jackson, that Americans have a Fourth Amendment expectation of privacy in the contents of sealed letters and packages they send through the U.S. mails (which was the default mail/delivery service at the time). The Jackson Court said “letters and sealed packages . . . in the mail are as fully guarded from examination and inspection, except as to their outward form and weight, as if they were retained by the parties forwarding them in their own domiciles.” The Court also held that anything we send that is not sealed – such as a postcard – is not encompassed by this rule because we have taken no steps to protect the privacy of its contents.

The Warshak court cited the Jackson decision, as well as the Supreme Court’s 1979 decision in Smith v. Maryland. In Smith, the Court said we do not have a Fourth Amendment expectation of privacy in the phone numbers we call, even from our homes, because by dialing those numbers we voluntarily convey that information to the phone company and, in so doing, surrender any privacy interest in it. I think the Smith decision was, and is, wrong, but that’s irrelevant.

In Warshak the government essentially argued that we have no Fourth Amendment expectation of privacy in emails we leave stored with an ISP because the ISP staff can read those emails, since we have not “sealed” them. Prosecutors often analogize email to a postcard: we send our emails through a system in which they are “visible” to other people without doing anything to shield their contents, to make them unreadable. The premise then is that the emails are like the phone numbers in Smith: We voluntarily share them, in the clear, with an entity whose staff can decipher the information they contain.

The Warshak court rejected that, essentially finding that we have an expectation of privacy if and when our ISP’s terms of service state that its staff either will not read our emails or will do so only under certain circumstances. That conclusion makes a certain amount of sense, but it really doesn’t resolve the Jackson-Smith problem, i.e., that the contents of stored emails CAN be read by ISP staff.

What I find interesting is that this controversy really does not need to arise. If we encrypted our emails, we would be “sealing” them, just as we seal the letters and other correspondence we send through the mails. If we “sealed” our emails, the Jackson rule would apply, even though we are sending emails via private carriers rather than through the U.S. mails. The Jackson Court’s point went not to the vehicle by which a message is being transmitted but to the steps taken to shield the contents of the message from the eyes of those involved in its transmission.

So why don’t we encrypt our emails? We were talking about this in my cyberspace law class yesterday, and one student pointed out that the general public doesn’t encrypt their emails because the process is too complex and/or too esoteric for them to use easily. I think she’s absolutely right. I think we are in a situation analogous to the situation letter writers were in until the mid-nineteenth century.

The adhesive envelope, which we assume has always been around, was not introduced until the mid-1800s. See Robert Ellis Smith, Ben Franklin's Web Site 56 (Providence RI: Privacy Journal 2000). Until then, people didn’t use envelopes; instead, they wrote their letters on a sheet of paper, which they folded and sealed with sealing wax, which was notoriously unreliable. See id. Letter writers knew the wax would probably fail, the letters would come unsealed and postal employees would probably read them. See id. Many, including Thomas Jefferson, wrote their letters in code – encrypted them -- to avoid this. See id. at 43. The adhesive envelope eliminated the need to encrypt letters because it was reliable AND easy to use. The Jackson Court’s holding was implicitly based on the impact adhesive envelopes had on securing the contents of written correspondence from prying eyes.

When it comes to email, our situation is, and is not, analogous to that of pre-adhesive envelope letter writers. Our situation is analogous because we have no simple way to “seal” our emails. Since we consequently do not “seal” our emails, it is, as a practical matter, difficult to argue that the contents of those emails are private. They really are postcards; their contents CAN (may not actually be, but CAN be) read by the staff of the entity involved in their transmission. Since they can be read by anyone who comes in contact with them, it is not, as a matter of common sense, reasonable for us to claim that their contents are private.

On the other hand, our situation differs from that of a pre-adhesive envelope letter writer in an important respect: We have tools available that will allow us to “seal” the contents of our emails. We do not use those tools because, as I said earlier, using them involves a lot more effort and expertise than simply sealing an adhesive envelope. I also think we don’t use these tools because most people, at least in this country, don’t realize that their emails are postcards, rather than letters. That is, I think most people in the U.S., anyway, don’t realize that the contents of their emails are not private.

All of this can, and probably will, change. Two things can transform the default status of email from that of postcard to that of sealed letter: One is for people to realize that they must “seal” their emails for them to be private. The other is the introduction of simpler, more intuitive encryption tools. I think the transformation will require the interaction of both factors: People will have to become receptive to the idea of encrypting emails, and the process of encrypting them will have to become at least a little more user-friendly.

If people begin to understand the utility of encrypting their emails, they will look for easy ways to do that. One way is, as I said, for developers to introduce new, user-friendly encryption tools. Another possibility is for ISPs to offer “one-click encryption” (if, in fact, that is a possibility), i.e., a system that automatically encrypts emails sent via that and compatible ISPs. I don’t know if this kind of one-click encryption is technically possible, and even if it is, I can see implementation problems. If I’m using a one-click encryption ISP, I assume I either can’t email people who don’t use my ISP or another, compatible one-click encryption ISP or if I can email them, I lose my encryption. But I assume the same kinds of problems will arise if and when our culture moves to one in which we seek to encrypt emails.

Encryption definitely is, and will probably continue to be, more challenging than an envelope.

Booze and bytes

We were talking in my cyberspace law class about the DMCA and the recording and movie industries’ war on file-sharing.

Specifically, we were talking about whether our current system for controlling the ownership and use of intellectual property makes sense in a world in which such property generally ceases to be tangible and instead becomes digital.

Tangible property can be duplicated to some extent – books can be copied and music can be taped, for example – but it tends to be much more difficult and time-consuming to do so than it is to duplicate digital property.

I read a law review article that explained how, and why, it was functionally impossible for regular people to duplicate or otherwise copy vinyl records when they were the only way in which music was distributed commercially. The article also said that while the introduction of taping devices gave people the ability to copy records and tape songs off the radio, the cumbersomeness of the process and the often erosion in quality meant that this did not become a huge problem for the record companies. And much the same is true for the movie industry; the introduction of video recording devices made it at least possible to record movies shown on television and, later, to copy tapes rented from a store or obtained otherwise. But it was still enough of a pain that it didn’t become a major problem.

As we all know, digital technology changes all that. Property moves from being tangible to becoming bytes, and bytes can be copied easily and quickly and without the erosion of quality you saw in older methods. And that, of course, causes major problems for the industries the existence of which is predicated on monopolizing the ability to distribute music, movies and other types of intellectual property.

And we all, I’m sure, know the approach these industries are taking to the problem of file-sharing: First, they’re encouraging the federal government to bring criminal copyright infringement suits against larger-scale file-sharing operations. Second, because there simply aren’t enough federal agents and federal prosecutors to go after a significant percentage of the people who are engaging in file-sharing, these industries – particularly the music industry – are using the threat of civil suits to deter individual file-sharers. The music industry has been sending offer to settle letters to students at many colleges and universities; they tell students they have been identified as having illegally downloaded copyrighted music and can either settle their liability by paying $3,000 or face a lawsuit seeking damages for the full amount, which can easily run into six figures.

We were talking about all this in class, and about whether it is a rational and/or effective way to deal with these issues. I said that what the music and movie industries are doing reminds me of the United States’ experiment with Alcohol Prohibition in the 1920s, but with one difference. The laws implementing Alcohol Prohibition in this country did not make it a crime to have or consumer alcohol; they only made it a crime to manufacture and/or distribute alcohol. Whoever drafted these laws apparently realized that it would be impossible to go after everyone in the United States who continued to buy and drink alcohol, so they tried to address the problem by cutting off the source of alcohol.

As we probably all know, that didn’t work either because alcohol could be manufactured pretty easily. Distilling alcohol is not, as they say, rocket science. I’ve never tried it, but I know people who’ve made their own wine and their own beer, and from what I’ve read online it’s really not that complicated . . . even in our contemporary, primarily urban environment. It would probably have been even easier in the 1920s, when the country was less urban and therefore more used to doing things from scratch.

My point is that Alcohol Prohibition failed because the government could not cut off the source of the prohibited item. That is, they could not prevent people from making and sharing alcohol. We all know about Al Capone and the infamous bootlegging mobs, but there was a lot of local, home-grown bootlegging, as well.

And that’s what I was mentioning in my class: I see some interesting parallels between our failed national experiment with Alcohol Prohibition and the mostly private effort that is currently underway to eliminate the digital distribution of unlicensed copies of music, movies, software, and whatever else industries are or will be concerned about.

The music and movie industries are in one sense making the mistake the architects of the Alcohol Prohibition laws avoided: They’re trying to go after the consumers of the product, the people who possess and use unlicensed digital copies of music or movies. The problem with that is scale: To do this effectively, the music and movie industries, alone and/or with the assistance of law enforcement, would have to continually track down and prosecute a segment of the domestic file-sharing market that is substantial enough to put the fear of God into everyone who might even consider file-sharing.

I don’t think that’s possible. Law enforcement, and especially federal law enforcement, has a number of other priorities it needs to attend to; so law enforcement can spare only a small part of its resources to assist in this effort. The civil suits are intended to act as a separate deterrent, but I’m not sure how effective they are going to be. Some colleges and universities are resisting the industries’ efforts to get them to provide the names of students linked to IP addresses used to illegally download files, and this trend might increase. The industries’ approach does put colleges and universities in something of an untenable position; their posture toward their students has traditionally been semi-parental, but this threatens to transform it into a more adversarial one. There’s also the issue of resources: Why should colleges and universities have to bear the added, extraordinary cost of identifying students and otherwise contributing to the industries’ effort to discourage illegal file-sharing?

There are other problems. The civil suit approach only works within a country; the music and recording industries cannot use the threat of civil suits hear to target file-sharers in other countries, even if they can identify them. They could transport the civil suit tactic abroad, and threaten to sue file-sharers in France and Pakistan and many, many other countries, but I suspect the cost of such an effort would soon become prohibitive. And, on another note, the technology of file-sharing may become more sophisticated and therefore more undetectable. If it becomes impossible, even extraordinarily difficult, to identify file-sharers, then this approach simply cannot be effective.

What is the alternative? Well, we could continue our analogy to Alcohol Prohibition and argue that the music and movie industries should emulate the approach taken there by targeting not the consumers of the outlawed product but those who create and distribute the product.

I see two problems with that analogy: One is that with digital file-sharing the distinction between production and consumption arguably erodes; each file-sharer is, or can be, not only the recipient of shared files but also the distributor of shared files. So the industries might argue that the approach they are currently using is inevitable. I’m sure they would also point out that they, in cooperation with law enforcement, have also gone after the higher-level distributors in file-sharing operations. The RIAA got Napster shut down, and there have been prosecutions of software-sharing, warez sites.

That brings us to the other problem: Even if we assume that the music and movie industries and the laws they employing are analogous to the approach taken with Alcohol Prohibition, that approach did not work. It simply failed to cut off the supply of alcohol in this country, both because it could be imported from Canada and elsewhere and because it could be manufactured here. And manufacturing and distributing alcohol is a much more time-consuming and risky endeavor than digital file-sharing. The former takes place in the real-world, and is therefore a highly visible endeavor; you need space and materials and time and then you have to transport a very bulky, somewhat fragile product over highways or sea lanes or rail lines. All of that increases the chances you will be identified and apprehended. You run some of those risks with file-sharing, but they are much reduced, both because of the relative invisibility and ease of the process and because it is highly distributed. You’re no longer looking for Al Capone’s operation; you’re looking for, what, 10% of Illinois?

Like many others, I think our current approach to the protection of intellectual property rights is seriously flawed when it comes to dealing with distributed file-sharing. I will not attempt to outline the alternatives, because others who are far more knowledgeable than I have already done so.

My point is that the use of criminal and quasi-criminal sanctions cannot be effective when it is impossible to control the manufacture and distribution of a product and when the culture sees such control as illegitimate. When people in a culture see such control as illegitimate, and have access to the product, norms of evasion grow up. Compliance with the control system becomes the exception; the norm becomes the process of evading the system. During Alcohol Prohibition, alcohol use increased in this country, especially among women. There was a disconnect between what the law forbade and what people saw as appropriate.

We have something similar, albeit on a much smaller scale, with file-sharing. And it may be that the disconnect we see see between laws outlawing file-sharing and attitudes toward file-sharing in a segment of the populace are merely an indicator of what is to come. We may find that the approach our law has used to allocate and enforce tangible property rights is not a viable approach for intangible property rights.

GPS detectors, jammers & spoofers

On Friday, I spoke to a group of lawyers about various issues in criminal law and technology. One of the issues we talked about is the police's use of Global Positioning System (GPS) devices to track people’s movements. (GPS devices are used by private parties, as well, but my focus here is on criminal matters, so I’m only going to deal with the government’s use of them.)

This is really a follow-up to a post I did a while back, on Anti-GPS technology. Since I found the technology here is more complex that I realized, I thought I'd do a follow-up on the issue.
Under current law in the U.S., the Fourth Amendment’s prohibition on unreasonable searches and seizures are not implicated when the government installs a GPS device on someone’s vehicle and uses it to track their movements in public places. Courts have held that installing the device is not a seizure of your vehicle because it in no way interferes with your operation or use of the vehicle; you don’t even know the device is there (which is the point, after all). At least one state court has held that police do need a warrant, but that decision was made under state law and I’m focusing on the Fourth Amendment, because it is the default general national standard.

They have also cited a 1983 U.S. Supreme Court decision upholding the use of “beepers” to help police follow suspects in their vehicles for the proposition that it is not a search for the government to use a GPS device to track your movements in public places. (Courts say it is a search if police use GPS to track you into a private place, like your garage.) They have reached this conclusion even though a GPS device, unlike the beeper at issue in the Supreme Court case, substitutes for a police officer; the device tracks your movements without a police officer’s having to be assigned to follow you around. At least one state court has said that makes a difference under state law, because GPS lets police conduct surveillance on a larger scale than they could if they had to have officers follow people around; and the Seventh Circuit Court of Appeals noted that this might be a problem in the future, if police really begin to use GPS devices on a wide scale.

But, as of now, police do not have to get a search warrant to install and/or monitor a GPS device. Both activities are completely outside the Fourth Amendment, and that means police can install and monitor the device without your knowing anything about it (which, as I noted above, is the whole point). The basic practice when they have to get a warrant to do something is that they serve the warrant on you, then conduct a search of your home or other property, and then leave you with an inventory of what you took. That way, you know they were there, why they were there and what they took.

In the course of talking about this with the bar association on Friday, I suggested this might create a market for GPS detectors, and we talked about that a bit. One of the attorneys there, who has a good technical background, said there’s no way to use a detector to discover a passive GPS tracking device (GPS logger) that simply stores up information about your movements, but that a detector could be effective for an active device (GPS tracker) that transmits information periodically. So we talked about that a bit, and I joked as to how there could become a real market for these things.

I decided to see if GPS detectors are on the market and, yes, there are some. There are also GPS jamming devices and spoofers. I’ll talk a bit about each type of device, and then we’ll consider the legality of using any or all of them devices, now and in the future.

According to one site, it is possible to detect a GPS tracking device that transmits information by using a radio frequency detector/scanner. The problem, according to this site, is that the RF detector/scanner will only detect the transmissions of the GPS device when the device is actually transmitting. This site also notes that GPS devices use different technologies, which can also cause complications in detecting them. Another site follows up on that, explaining that some trackers do transmit a constant signal, which makes them easier to detect, and that the same is true of GPS devices that use cell phone connections. The site says ultimately the best way to find a GPS device is to use a combination of detection and “finger-tip searching.”

We, though, are interested in the use of technology to find GPS tracking devices, so we’ll stay with that. Before we consider the legality of using GPS detectors, I want to consider the second logical approach to dealing with a GPS tracking device: GPS jamming.

I found a website that advertises at least two different GPS jamming devices. Both plug into your vehicle’s cigarette lighter, and both jam a GPS device’s ability to collect and/or transmit location information. I also discovered that it is possible to spoof the signals sent to a GPS device, so the device thinks it is in Place A when it’s really in Place B.

As far as I can tell, there are no laws in the U.S. that criminalize the use of GPS detectors, jammers or spoofers. Since I can see objections being raised to the use of these devices if and when they become more popular, I want to speculate a bit as to whether the use of any of these devices could legitimately be outlawed.

The obvious source of analogy here is radar detectors. Like GPS detectors, jammers and spoofers, radar detectors allow those who use them to evade police surveillance technology.

A very few US states outlaw radar detectors. Virginia, for example, has a statute that makes it unlawful “to operate a motor vehicle on the highways of the Commonwealth when such vehicle is equipped with any device . . . to detect or purposefully interfere with . . . the measurement capabilities of any radar, laser, or other device . . . employed by law-enforcement personnel to measure the speed of motor vehicles on the highways”. Virginia Code section 46.2-1079(A).

In 1987, a bill was introduced in Congress that would have made it a federal crime to manufacture, sell or possess a radar detector, but the bill languished and finally disappeared. See H.R. 2102, 100th Congress, 1st Session (1987). There was apparently little support for such a measure because, as one author notes, “the nationwide criminalization of a segment of the electronics industry and its consumers is arguably unjustifiable and implicates questions of federalism. Proponents of federalism allege that the issue is best left to state legislatures.” Nikolaus Schandlbauer, Busting the “Fuzzbuster:” Rethinking Bans on Radar Detectors, 94 Dickinson Law Review 783, 789 (1990).

There seems to be no reason why states cannot outlaw radar detectors. A federal court of appeals upheld the constitutionality of the Virginia ban, agreeing with the district court that it “furthers a significant state interest in the health or safety of Virginia’s motorists”. Bryant Radio Supply, Inc. v. Slane, 507 F. Supp. 1325 (District Court of Virginia 1981), affirmed 669 F.2d 921 (Fourth Circuit Court of Appeals 1982). Notwithstanding that, most states have chosen not to outlaw them, presumably because they do not feel the evasion of law at issue here warrants such a punitive measure.

What about GPS detectors, jammers and spoofers? Can they legitimately be outlawed? Should they be outlawed?

In answering those questions, there may be some reason to differentiate between (a) detectors and jammers and (b) spoofers. From my brief research online, it seems that spoofers can be used by thieves who want to hijack cargo being moved by trucks; the thieves can apparently use the spoofed GPS signals to disguise the fact that a truck is deviating from its authorized route, a deviation which is leading up to the theft of its cargo. So, spoofing can be used to commit distinct, freestanding crimes as well as to frustrate law enforcement surveillance. While the same might be true of the other two types of GPS countermeasures, I am going to assume they only frustrate surveillance, and so am going to treat them differently.

As to spoofers, the answers to the questions I posed above are “yes,” in both instances. If spoofers can be used to set up cargo thefts and other crimes, then they are analogous to burglar’s tools. As I have explained before, many states outlaw the mere possession of burglar’s tools (which are usually defined as items that, in isolation or when collected together, clearly have no purpose other than illegal break-ins). The justification for these statutes is that they outlaw a type of attempted crime; in other words, there is no reason to possess burglar’s tools except to use them in a burglary. Spoofers are, I think more ambiguous: I am not sure they have any legitimate purpose, but they can be used either to (a) frustrate law enforcement surveillance or (b) to facilitate cargo thefts and maybe other types of crimes, as well. To the extent they fall into category (a), they should be encompassed by my analysis of the legality of outlawing jammers and detectors, which we’ll get to in a moment. To the extent they fall into category (b), they can be outlawed if they are truly analogous to burglar’s tools, i.e., if they have no independent legitimate use.

As to detectors and jammers, we need to analyze each of them separately. It seems to me that GPS detectors are very much analogous to radar detectors, in that they do not interfere with the functioning of law enforcement surveillance technology; they simply alert the target of the surveillance so that he or she can take appropriate measures to frustrate the surveillance. One could, therefore, argue that there is no more reason to outlaw GPS detectors than there is to outlaw radar detectors. The problem I see with this argument is that radar detectors are used only to detect a very low level of criminal activity, but GPS devices are usually used in investigating more serious crimes. That could make a real difference in how states answer the two questions I posed above. Because these detectors frustrate surveillance in investigations targeting more serious crimes, they could be seen as an effort to obstruct justice. (The same is true of radar detectors, but here the frustration is at a very low level, given the minor criminal activity at issue.) Indeed, one can argue that this is their whole purpose. If you accept that view of GPS detectors, the answers to the two questions I posed above are, again, “yes.”

What about GPS jammers? The analysis I went through in the paragraph above seems to apply to them, too. And there is an aggravating factor here. According to what I read on several websites, jamming GPS signals can create a safety hazard for ground vehicles and/or for aircraft. If that is true, then the use of these devices creates a new, distinct hazard to public safety, and the creation of such a hazard is a matter the criminal law can legitimately address. I suspect, then, that if GPS jammers begin to be used with any frequency, we will see efforts to outlaw their use at the state and/or federal level. I understand that their use is already illegal in European Union countries.

Fourth Amendment privacy: IP addresses & URLs

In United States v. Forrester, 2007 WL 2120271 (9th Circuit 2007), the Ninth Circuit Court of Appeals considered whether a defendant had a Fourth Amendment expectation of privacy in the “to and from addresses” of his email messages, the addresses of the websites he visited and the “total amount of data transmitted to or from” his Internet account. Dennis Alba, a defendant in this case, argued that the government violated his Fourth Amendment right to privacy when it used “computer surveillance” techniques to obtain this information.

As I explained in my previous post, a Fourth Amendment “search” occurs if and only if you had a “reasonable expectation of privacy” in the place or thing searched. If you had such an expectation of privacy, the government must have had either a search warrant or a valid exception to the search warrant that justified the search for it to have been “reasonable.” If they had neither, then the search was “unreasonable,” and violates the Constitution, which means the defendant can have the evidence suppressed.

This is how the opinion describes the surveillance Alba was challenging:

During its investigation of Forrester and Alba's Ecstasy-manufacturing operation, the government employed various computer surveillance techniques to monitor Alba's e-mail and Internet activity. The surveillance began in May 2001 after the government applied for and received court permission to install a pen register analogue known as a `mirror port’ on Alba's account with PacBell Internet. The mirror port was installed at PacBell's connection facility in San Diego, and enabled the government to learn the to/from addresses of Alba's e-mail messages, the IP addresses of the websites that Alba visited and the total volume of information sent to or from his account.

United States v. Forrester, supra.

In ruling on Alba’s motion to suppress, the Ninth Circuit applied the Supreme Court’s ruling in Smith v. Maryland, 442 U.S. 735 (1979). In Smith, the government put a pen register, a device that captures the numbers dialed on a telephone, on Smith’s home phone. They were investigating him for making harassing calls, and used the data collected by the pen register against him in a prosecution for doing so.

Smith argued that the use of the pen register was a “search” because he had a reasonable expectation of privacy in the numbers he dialed from his home phone. The Supreme Court, in an opinion I think was wrongly decided, said he did not. The Court said he assumed the risk (read my prior post) by giving that information to a third party. The Supreme Court said that Smith (a) could not have had a subjective expectation of privacy in that data because he knew he was giving it to the phone company and (b) even if he had such an expectation, it is not one society would accept as objectively reasonable because, the Court said, we all know that if we give information to a third party it is no longer private. It’s the assumption of risk concept I noted in my prior post.

The Forrester court noted that the issue Alba was raising had not been addressed by any other federal court of appeals, so this was an issue of “first impression.” Alba lost, but the court did reserve an issue which may prove interesting in the future.

Let’s begin with why he lost. This is the court’s explanation:

We conclude that these surveillance techniques are constitutionally indistinguishable from the use of a pen register that the Court approved in Smith. First, e-mail and Internet users, like the telephone users in Smith, rely on third-party equipment in order to engage in communication. Smith based its holding that telephone users have no expectation of privacy in the numbers they dial on the users' imputed knowledge that their calls are completed through telephone company switching equipment. . . . Analogously, e-mail and Internet users have no expectation of privacy in the to/from addresses of their messages or the IP addresses of the websites they visit because they should know that these messages are sent and these IP addresses are accessed through the equipment of their Internet service provider and other third parties. Communication by both Internet and telephone requires people to “voluntarily turn[ ] over [information] to third parties.” [Smith, supra]

Second, e-mail to/from addresses and IP addresses constitute addressing information and reveal no more about the underlying contents of communication than do phone numbers. When the government learns the phone numbers a person has dialed, it may be able to determine the persons or entities to which the numbers correspond, but it does not know what was said in the actual conversations. Similarly, when the government obtains the to/from addresses of a person's e-mails or the IP addresses of websites visited, it does not find out the contents of the messages or the particular pages on the websites the person viewed. At best, the government may make educated guesses about what was said in the messages or viewed on the websites based on its knowledge of the e-mail to/from addresses and IP addresses-but this is no different from speculation about the contents of a phone conversation on the basis of the identity of the person or entity that was dialed. The distinction between mere addressing and more content-rich information drawn by the Court in Smith and Katz is thus preserved, because the computer surveillance techniques at issue here enable only the discovery of addressing information.

United States v. Forrester, supra. (In Katz v. United States, 389 U.S. 247 (1967), the Supreme Court held that we do have a Fourth Amendment expectation of privacy in the content of our phone calls.)

The Forrester court also reserved an issue: whether we have a Fourth Amendment expectation of privacy in the URLs of the pages we access. As the Forrester court explained,

Surveillance techniques that enable the government to determine not only the IP addresses that a person accesses but also the uniform resource locators (`URL’) of the pages visited might be more constitutionally problematic. A URL, unlike an IP address, identifies the particular document within a website that a person views and thus reveals much more information about the person's Internet activity. For instance, a surveillance technique that captures IP addresses would show only that a person visited the New York Times' website at http://www.nytimes.com, whereas a technique that captures URLs would also divulge the particular articles the person viewed. See Pen Register Application, 396 F.Supp.2d at 49 (`[I]f the user then enters a search phrase [in the Google search engine], that search phrase would appear in the URL after the first forward slash. This would reveal content. . . .’).

Fourth amendment privacy and websites

In United States v. D’Andrea, 497 F. Supp. 117 (D. Mass. 2007), a federal district court was asked to decide if the police's accessing a password-protected website was a “search” under the Fourth Amendment.

Under the Fourth Amendment, police must have either a search warrant or an exception to the warrant requirement, such as consent of someone with authority to allow the search, for a search to be “reasonable” under the Constitution. If a search is not “reasonable,” then it is unconstitutional and the evidence obtained can’t be used in court.

In D’Andrea, an anonymous caller reported that

Jane Doe [a pseudonym] the eight-year old daughter of defendant Kendra D'Andrea, was being sexually abused by her mother and the mother's live-in boyfriend, defendant Willie Jordan. The caller also stated that pictures of Jordan performing oral sex on the girl had been posted on a Sprint PCS website. The caller provided the address of D'Andrea's apartment . . ., the log-in name and password for the website, and the number of a cellular telephone used by defendants.

United States v. D’Andrea, supra.

An investigator accessed the website, using the login information provided by the caller. The investigator downloaded images of the child being abused, and police used the tip by the informant plus the photos to obtain a search warrant. The warrant was executed at D’Andrea’s home, where they found other images and further evidence.

D’Andrea and Jordan were charged with child abuse and moved to suppress the downloaded images police used to obtain the search warrant plus the evidence seized pursuant to the warrant. If the investigator conducted a Fourth Amendment search by accessing the website and downloading the photos, then the search warrant would be invalid and all the evidence would be suppressed.

So, the critical question is, was it a Fourth Amendment search for the investigator to access the website? As I’ve noted before, a search under the Fourth Amendment is police conduct that violates violates a “reasonable expectation of privacy.” To have a reasonable expectation of privacy in a place or thing, you have to believe that place or thing is private and your belief has to be one society accepts as objectively reasonable. So, if I say I thought my actions in my unfenced front yard were “private”, I would lose; I might be able to convince a court I really believed that, but the court would say my belief was not objectively reasonable, since we all know what we do in public, as in my front yard, is not “private.” Anyone can observe what I’m doing. Conversely, what I do in my own home with the shades drawn is private because no one can observe me.

That brings us to the website. According to the court, D’Andrea and Jordan argued that because the website

was password-protected, they believed that what was posted on the site was a private matter that was exclusively theirs to share, and that they therefore had a subjective expectation of privacy in the website's contents. Assuming that this is true -- it would be somewhat astonishing if it were not -- the question still remains whether this expectation is one that society would recognize as reasonable.

United States v. D’Andrea, supra. D’Andrea and Jordan lost.

`It is well-settled that when an individual reveals private information to another, he assumes the risk that his confidant will reveal that information to the authorities, and if that occurs the Fourth Amendment does not prohibit governmental use of that information.’ [United States v.] Jacobsen, 466 U.S. 109, 117 (1984). . . . Thus, even granting defendants a reasonable expectation of privacy in the graphic website images of Jane Doe, by sharing the website access information with the anonymous caller, defendants took the risk that their right to privacy in the website's contents could be compromised.

United States v. D’Andrea, supra.

So, it appears that if you share your login information with anyone else, you assume the risk they will give that information to the police, who use it to access your website or whatever else it provides access to.

Virtual world, virtual cops

I was chatting with a friend the other day – a former police officer, who now works in the area of computer crime. We were talking specifically about virtual worlds like Second Life and, basically, about whether they may evolve their own law enforcement presence.

Virtual world, virtual police . . . ? It’s an interesting idea. I found a clip on YouTube showing a police chase in Second Life. Although, as far as I know, there are no actual virtual cops in Second Life. It’s an interesting notion.

Then today I find this news story from China, which says that as of September 1 the Beijing police will be using virtual police officers to patrol the Internet:

Police in China's capital said Tuesday they will start patrolling the Web using animated beat officers that pop up on a user's browser and walk, bike or drive across the screen warning them to stay away from illegal Internet content.

Starting Sept. 1, the cartoon alerts will appear every half hour on 13 of China's top portals . . .and by the end of the year will appear on all Web sites registered with Beijing servers, the Beijing Public Security Ministry said. . . .

The male and female cartoon officers, designed for the ministry by Sohu (one of China’s web portals), will offer a text warning to surfers to abide by the law and tips on Internet security as they move across the screen in a virtual car, motorcycle or on foot. . .

If you go to the story linked above, you can see the little virtual cops, a male officer with his virtual motorcyle and a female officer with her virtual police car. (I’m assuming there are lots more of these animations . . . I wonder if they all look just alike? I assume the female officers only use police cars, since they’re wearing skirts . . . but maybe there are variations, and some wear pants. Why do I care?)

I have an initial reaction to this effort, and several questions (substantive questions, not the idle ones outlined above).

My reaction is that I would find having these people popping up on my browser to be INCREDIBLY annoying. Maybe someone with computer skills and a certain irreverence (hacker?) will come up with a way to eliminate them . . . but maybe that would qualify as a virtual assault on a police officer. I’m joking about the latter part, but I suspect it would be some kind of crime in China to interfere with these things.

My initial question is, what makes the Public Security Ministry think these things will be particularly effective? If they are only intended to discourage Chinese web users from accessing content that is outlawed in China, then I can maybe see how that could be effective . . . It could be like having a Walt Disneyesque Big Brother hanging around to remind you to avoid pornography and unrestrained political discussions and postings and other, similarly undesirable things. (The news story above notes that China closes down sites that are “obscene or subversive.”)

If they are actually intended to discourage real criminal activity online, then I do not think they will have any effect, at all. As I rather jokingly noted above, I suspect it would not be at all difficult for a talented person to either eliminate them or turn them into rogue operatives who direct people to porn and/or open political discussion groups.

I’m not going to inflict all of the questions I came up with upon you, but here’s one more: Why virtual cops? Why be so literal? You could, I think, accomplish the same thing with a button or a logo or something more abstract. And if you have to have virtual cops, why make them look like Hello Kitty? You could make them really weird and interesting . . . or really abstract and interesting. These cartoons look like something I’d expect to find on a children’s website. I can’t imagine that anyone would take them seriously, but, then, I probably underestimate the Public Security Ministry.

It is a little creepy. Hello Kitty people as virtual spies

Cyberconflict

We have all, I'm sure, seen news stories about an incident of "cyber war," which turns out to have been something else . . . crime or terrorism.

I want to talk a bit about why I think those errors occur . . . and what I think we need to do to avoid them.

The title of this post is “cyberconflict.” That is an umbrella term I use to encompass cybercrime, cyberterrorism and cyberwarfare. As I explain at length in an article I recently published, these three concepts are conceptually distinct but they all deal with the same problem: a society’s, a nation-state’s, need to maintain social order.

If societies cannot maintain both internal order (keep their citizens from preying on each other, keep the strong from taking advantage of the weak) and external order (keep other societies from coming in and taking over that society’s territory and population), they cannot survive. We’re seeing an object lesson in the need to maintain internal order (at least) in Iraq; if a country can’t establish basic order so people can go about the tasks that have to be done for their physical survival, then the country falls apart . . . and is in a pretty good condition to be taken over by some other country (not that I’m saying that is about to happen in Iraq, but it has happened to other countries that became destabilized).

Countries therefore create a division of labor, the first part of which deals with the need for external order. Militaries (and diplomats) deal with external threats. I’m assuming, as the default, peaceful, non-aggressive societies; their goal in having a military (and diplomats) is to defend themselves against the Hitlers of the world – the countries that are aggressive and are perfectly willing to take over societies they see as weak.

The other part of this division of labor deals with internal order – keeping the citizens in a society from preying on each other in a way that will lead to chaos. Societies do this with two kinds of rules: What I call “civil” rules define what is and is not “legal” (and a subset define what is and is not “proper,” or acceptable) in that society. So every society defines who can marry whom and at what age; some define who can own property, and when; rules say if people can vote and, if so, when. They define property ownership, status, etc. Those are the rules that basically tell us how to live a normal, lawful life, and most of us do.

But since people are intelligent, they can do something social insects and other animals that live in groups can’t really do: They can basically say “the hell with the civil rules, I’m going to do what I want to do, take what I want.” We call that deviance, and societies have to discourage that. They do this with a separate set of criminal rules, which tell us that certain behaviors are really, seriously out of bounds and if we engage in those behaviors we will be punished (locked up, executed, banished, branded, etc.). For roughly the last century and a half, societies have used an analogue of the military to enforce these criminal rules: law enforcement officers. The process of enforcing criminal law used to be more eclectic – civilians used to get involved and, indeed, at times during Anglo-American history, anyway, pretty much were responsible for criminal law enforcement. They had to catch criminals and bring them into whoever was responsible for trying and sanctioning them (conviction pretty much seemed to be a foregone conclusion back then).

Law enforcement officers, then, deal with “crime,” which is internal; they keep the citizens of a society (and people visiting that society) from really, seriously preying on each other. Military personnel deal with “war,” which is external; they engage in combat with military personnel from other societies, societies that are trying to take over their own society, as Hitler did in 1939 when he invaded Poland.

One more note: Basically, societies lump terrorism in with crime. If you recall the Oklahoma City bombing in 1995, Timothy McVeigh was prosecuted for setting off the bomb, convicted and executed. The perpetrators of the 1993 bombing of the World Trade Center were federally prosecuted in New York, as were Al-Qaeda members for the 1993 bombings of U.S. embassies in Kenya and Tanzania.

Now we come to the problem: All of this assumes a tidy division based on territory. Law enforcement handles order within a country’s territory, the military handles order outside the territory. In the U.S., we have laws that rigidly establish that division; it seems to be less rigidly established in other countries, not rigid at all in some.

Cyberspace makes territory irrelevant. A cybercriminal or cyberterrorist or cyberwarrior can strike a target in another country as easily as he can one that’s just down the block. And that creates problems for (i) figuring out what kind of attack it is (Crime? Terrorism? Warfare?), (ii) who the attackers are and (iii) how to respond (Do we launch a military counterstrike? Send in the police?).

Simple example: In May of this year, Estonia was the target of a two-week set of sustained cyberattacks that shut down government websites, media sites, internet service providers and other communications sites. The news stories almost entirely referred to the attacks as cyberwarfare, because that’s what the Estonian government thought they were. They were DDoS attacks that reportedly involved the use of a botnet consisting of a million zombies. The Estonian government, and many reporters, cited the duration of the attack, the size of the botnets and the alleged complexity of the attack as factors establishing it as cyberwarfare. Estonian authorities also heard about the attack in advance and were able to watch as it was planned on Russian-language sites; they suspected the attack was retaliation for their removing a statue honoring World War II Russian soldiers shortly before a holiday honoring former Soviet soldiers.

So, attack-attribution = war. Attacker-attribution = Russian government. Response . . . well, there really wasn’t one.

After the fact, analysis of the attack showed it was hactivisim which, depending on your point of view, is either cybercrime (DDoS attacks are criminal in many countries ) or cyberterrorism (DDoS attacks undertaken with a political motive). The Estonian attacks are a perfect illustration of how difficult attribution and response are online . . . unlike in the real-world. When Hitler invaded Poland, Poland didn’t have any doubts that it was at war or who it was at war with.

In the article I mentioned (which you can find here), I took a first shot at parsing out how these difficulties in attribution and response arise, and what we can do to improve our ability at dealing with them. It’s just a first attempt – I need to do more with it, but I wanted to note the existence of these problems.

One final note: As the Estonian authorities learned when the contacted NATO and asked for help in dealing with what they then believed to be cyberwarfare, they learned that cyberattacks do not constitute “warfare” under the modern law of war. Those laws define warfare as the result of an “armed attack,” and everyone pretty much agrees that a DDoS attack may be an attack, but it isn’t and “armed” attack. As things stand now, if a country started an overt cyberwar, the victim country really could not treat that as “war” and respond with military force, at least, not without becoming the aggressor in the war.

Anti-GPS technology

You may have heard about these – devices that block (purport to block?) GPS tracking devices installed on vehicles.

Here’s the description of one such product, available on Chinavasion:

small sized Anti GPS Tracking Device, powered by and for use with any car that has a standard Cigarette Jack for power and supplys 12V . Operation is incredibly easy, as all it take to work is plugging it into the cigarette lighter and it's on and working! The Anti-Tracker will knock out GPS logging or GPS tracking systems that may be operating on your vehicle. Using our Anti-Tracker will make it very hard for any one to keep tabs on you or your vehicle.

So here’s the way criminals (and anyone else) can protect themselves from being tracked by GPS devices surreptitiously installed on their vehicles. As I’ve written before, courts have consistently, and correctly, held that under current Fourth Amendment law it is not a “search” to monitor such a device, one it has been installed in a “public” part of the vehicle (e.g., not inside, in the trunk, etc.). A few courts have held (incorrectly, IMHO) that it is not a “seizure” under current Fourth Amendment law to install such a device.

If this product works as it’s supposed to, that would eliminate the problem: Install the device in your vehicle and block any surreptitiously-installed GPS devices from tracking your movements.

As to whether the use of an anti-GPS device is legal or not, I don’t know. I did some quick research just now, being in a bit of a hurry to go somewhere, and couldn’t find anything that seems to criminalize its use. I did find cites to several cases in which courts approved law enforcement’s using certain tactics because the suspect was utilizing “anti-surveillance” technology, which frustrated their wiretapping efforts.

I know lots of people, including lawyers, who periodically have their offices swept for bugs, and that’s never been a crime, so I’m guessing the use of a device like this isn’t a crime, either. (Don’t take that as legal advice – it’s a rushed Sunday morning guess.)

The analogy that comes to mind is the use of radar detectors to try to avoid getting a speeding ticket. I know the use of radar detectors is illegal in some states (don’t know how many), but that’s different: You’re using the radar detector intentionally to facilitate your violating the law – the laws against speeding. So, since a radar detector’s only purpose is to facilitate the commission of illegal activity (granted, minor illegal activity, but it’s still illegal), it’s only logical to outlaw their use. (The other way to go would be to hole the manufacturers of radar detectors as accomplices to the crime they are facilitating, speeding, but that’s just silly.)

Unlike radar detectors, anti-GPS technology is not, itself, facilitating a crime. It’s a way to preserve your privacy . . . from police, from your spouse’s divorce attorney, from a jealous lover, from anyone you don’t want spying on you. Since you have a right to privacy, I can’t see why or how Congress or state legislatures could outlaw the use of this technology.

Some might argue that it is being used to commit a crime if it’s being used by criminals, but that argument only works if the anti-GPS technology itself is being used to commit a crime or to facilitate the commission of a crime . . . such as, say, a fugitive’s flight from justice. But I still don’t think you can outlaw it because, to continue with this example, someone who is fleeing from justice uses all kinds of things in the course of doing so: telephones, cars, airplanes, trains, hotels, etc. We don’t hold those who provide these products and services liable for facilitating the flight, so I don’t really see why that would work for the anti-GPS technology, either.