I was interviewed yesterday for the local Fox affiliate on Cal. SB1411, which criminalizes online impersonations (or “e-personation”) under certain circumstances.

On paper, of course, this sounds like a fine idea.  As Palo Alto State Senator Joe Simitian, the bill’s sponsor, put it, “The Internet makes many things easier.  One of those, unfortunately, is pretending to be someone else.  When that happens with the intent of causing harm, folks need a law they can turn to.”

Or do they?

The Problem with New Laws for New Technology

SB1411 would make a great exam question of short paper assignment for an information law course.  It’s short, is loaded with good intentions, and on first blush looks perfectly reasonable—just extending existing harassment, intimidation and fraud laws to the modern context of online activity.  Unfortunately, a careful read reveals all sorts of potential problems and unintended consequences.

A number of states have passed new laws in the wake of highly-publicized cyberstalking and bullying incidents, including the tragic case involving a young girl’s suicide after being dumped by her online MySpace boyfriend, who turned out to be a made-up character created for the purpose of hurting her feelings.  (I’ve written about the case before, see “Lori Drew Verdict Finally Overturned.” )

Missouri passed a cyberbullying law when it turned out there was no federal law that covered the behavior in the MySpace case.  Texas and New York recently enacted laws similar to SB 1411, though the Texas law applies only to impersonation on social media sites.

The problem with all these laws generally is that the authors aren’t clear what behaviors exactly they are trying to criminalize.  And, mindful of the fact that the evolution of digital life is happening much faster than any legislative body can hope to keep up with, these laws are often written to be both too specific (the technology changes) and too broad (the behavior is undefined).  As a result, they often don’t wind up covering the behavior they intend to deter, and, left on the books, can often come back to life when prosecutors need something to hang a case on that otherwise doesn’t look illegal.

Given the proximity to free speech issues, the vagueness of many of these laws makes them good candidates for First Amendment challenges, and many have fallen on that sword.

California’s SB 1411 as a Case in Point

SB1411, which last week passed in the State Senate, suffers from all of these defects.  It punishes the impersonation of an “actual person through or on an Internet Web site or by other electronic means for purposes of harming, intimidating, threatening or defrauding another person.”  It requires the impersonator to knowingly commit the crime and do so without the consent of the person they are imitating.  It also requires that the impersonation be credible.  Punishment for violation can include a year in jail and a suit brought by the victim for punitive damages.

First let’s consider a few hypotheticals, starting with the one that inspired the law, the MySpace case noted above.  Since the boy whose profile lured the victim into an online romance that was then cruelly terminated was a made-up person (the perpetrators found some photo of a suitably shirtless teen and built a personality around it), SB 1411 would not apply had it been the law in Missouri.  The boy was not an “actual person,” and, except perhaps to a thirteen year old with existing mental health problems, may not have been credible either.  (The determination of “credibility” under SB 1411 would presumably be based on the “reasonable person” standard.)  Likewise, law enforcement agents creating fake Craigslist ads to smoke out drug buyers, child molesters, or customers of sex workers would also not be violating the law.

Also excluded from SB 1411 would probably be those who use Craigslist to get back at exes or other people they are angry at by placing ads promising sex to anyone who stops by, and then gives the address of the person they are trying to get even with.  In most cases, these ads are not credible impersonations of the victim; they are meant to offend them but not to convince a reasonable third person that they really speak for the victim.   A fake Facebook page for a teacher who proceeds to make cruel or otherwise harmful statements about her students, likewise, would not be a credible impersonation.

The Twitter profiles being created to issue fake press releases purportedly on behalf of BP would also not be illegal under SB 1411.  First, BP is not an “actual person.”  Second,  Twitter profiles such as BPGlobalPR are clearly parodies—they are issuing statements they believe to be what BP would say if it were telling the truth about its actions in relation to the gulf spill.  (“We’re on a seafood diet- When we see food, we eat it! Unless that food is seafood from the Gulf. Yuck to that.”)   Again, not a credible impersonation.

You also do not commit the crime by confusing people inadvertently.  There are several people I am aware of online named Larry Downes, including a New Jersey state natural resources regulator, a radio station executive and conservative commentator, a cage fighter and a veterinarian who lives in a nearby community.  (The latter is a distant cousin.)  Facebook alone has 11 profiles with my name.  Only one of them is actually me, but the others are not knowingly impersonating me just because they use the same name, even if some third person might be confused to my detriment.

Likewise, the statute doesn’t reach out to those who help the perpetrator, intentionally or otherwise.  The “Internet Web sites” or providers of other electronic means aren’t themselves subject to prosecution or civil cases brought by the victims of the impersonation.  So Craigslist, MySpace, Facebook, and Twitter aren’t liable here, nor are the ISPs of the perpetrators, even if made aware of the activity of their users and/or customers.

For one thing, a federal law, Section 230, immunizes providers against that kind of liability under most circumstances.  Last week, Craigslist lost its bid to preclude a California lawsuit using Section 230 as its defense when sued by the victim of fake posts soliciting sex and offering to give away his possessions.  The victim informed Craigslist of the problem, and the company promised to take action to stop future posts but did not succeed.  But it lost its immunity only by promising to help which, of course, the site won’t do in the future!  (See Eric Goldman’s analysis of the case.)

So there are important limitations (some added through recent amendments) to SB 1411 that reduce the possibility of its being applied to speech that is otherwise protected or immunized by federal law.  (In the BP example, the company might have a trademark case to bring.)  Most of these limits, however, seem to take any teeth out of the statute, and seem to exclude most of the behavior Sen. Simitian says he is concerned about.

Unintended Consequences

What’s left?  Imagine a case where, angry at you, I create a fake Facebook profile that purports to represent you.  I post material there that is not so outrageous that the impersonation is no longer credible, but which still has the intent of harming, intimidating, threatening or defrauding you.  Perhaps I report, pretending to be you, about all of my extravagant purchases (but not so extravagant that I am not credible), leading your friends to believe you are spending beyond your means.  You find out, and find my actions intimidating or threatening.

Perhaps I announce that you have defaulted on your mortgage and are being foreclosed, leading your creditors to seek security on your other debts.  Perhaps I threaten to continue posting stories of your sexual exploits, forcing you to pay me blackmail to save you embarrassment.

Would these cases be covered under SB 1411?  Perhaps, unless of course the claims that I am making as you turn out to be true.  In the U.S., truth is a defense to defamation, so even if my intent is to “harm” you by revealing these facts, if they are facts then there is no action for defamation.  That I say the facts pretending to be you, under SB 1411, would appear to turn a protected activity into a crime, perhaps not what the drafters intended and perhaps not something that would stand up in court.  (The truth-as-defense in defamation cases rests on First Amendment principles—you can’t be prosecuted for saying the truth.)

Of course, much of the other behavior I described above is already a crime in California—in particular, various forms of intimidation, harassment and, by definition, fraud.  The authors of SB 1411 believe the new law is needed to extend those crimes to cover the use of “Internet Web sites” and “other electronic means,” but there’s no reason to believe that the technology used is any bar to prosecutions under existing law.  (Indeed, the use of electronic communications to commit the acts would extend the possible criminal laws that apply, since electronic communications are generally considered interstate commerce and thus subject to federal as well as state laws.)

For the most part, then, SB 1411 covers very little new behavior, and little of the behavior its drafters thought needed to be criminalized.  For an impersonation to be damaging would, in most cases, mean that it was also not credible.  Pretending to be me and telling the truth could be harmful, but probably a form of protected speech.  Pretending to be me in order to defraud a third party is already a crime-that is the crime of identity theft.

Which is not to say, pun intended, that the proposed law is harmless.  For in addition to categories of behavior already covered by existing law, SB 1411 makes it a crime to impersonate someone with the purpose of “harming” “another person.”  There is, not surprisingly, no definition given for what it means to have the purpose of “harming,” nor is it clear if “another person” refers only to the person whose identity has been usurped, or includes some third party (perhaps a family member or friend of that person, perhaps their employer.)

Having a purpose of “harming” “another person” is incredibly vague, and can cover a wide range of behaviors that wouldn’t, in offline contexts, be subject to criminal prosecution.  The only difference would be that the intended harm here would be operationalized through online channels, and would take the form of a credible impersonation of some actual person.

Why those differences ought to result in a year in jail doesn’t make much sense.  Consequently, an attempt to use the law to prosecute “harmful” behavior would be met with a strong constitutional objection.

That’s my read of the bill, in any case.  Since I posed this as an exam question, I’m offering extra credit for anyone who can come up with examples—there are none given by the California State Senate—of situations where the law would actually apply and that would not already be illegal and which would not be subject to plausible Constitutional challenges.

I write in “The Laws of Disruption” of the risk of unintended consequences that regulators run in legislating emerging technologies.  Because the pace of change for these technologies is so much faster than it is for law, the likelihood of defining a legal problem and crafting a solution that will address it is very slim.  I give several examples in the book of regulatory actions that quickly become not just obsolete but, worse, wind up having the opposite result to what regulators intended.

An unfortunate example of that problem in the news quite a bit lately is the Electronic Communications Privacy Act or ECPA.   (My first published legal scholarship, in 1994, was an article about a provision of ECPA that allowed law enforcement officers to use evidence they came across by accident in the course of an otherwise lawful wiretap, see “Electronic Communications and the Plain View Exception:  More ‘Bad Physics.’”)

Passed in 1986, ECPA at the time was a model of smart lawmaking in response to changing technologies.  It updated the federal wiretap statute, known as Title III, to take into account the rise of cellular technologies and electronic messages–which didn’t exist when the original law was passed in 1968.

In essence, ECPA brought these new forms of communications under the legal controls of the wiretap law, meaning for example that police could not intercept cell phone transmissions without a warrant, just as under Title III they needed a warrant to intercept wireline calls.  Private interception was also made illegal.

Lost in the Clouds

A lot has happened since 1986, and unfortunately for the most part ECPA hasn’t kept up.  Most significant has been the explosion of new data sources of all varieties, and in particular the now billions (trillions?) of messages sent and received each day by individuals communicating through the Internet.  The potential evidence those messages contain for a variety of investigations—criminal, civil, terror-related—has made them an irresistible target for law enforcement as well as civil litigants.

In addition to the sheer volume of new data sources, the other significant change undermining ECPA’s assumptions has been the movement to cloud-based services, particularly for email.  In the early days of email (say, 1995), ISPs kept messages on their servers only until the user, through a client email program such as Eudora, downloaded the message to his or her personal computer.  Once downloaded, the message was immediately or soon after deleted from the server, if for no other reason than to save storage space.

Storage, however, has gotten cheap, and the potential uses of stored data for a variety of purposes has made it attractive for ISPs and other services (e.g., Google’s Gmail) to retain copies of messages and other user data on a permanent basis.

The drafters of ECPA had great foresight, but they couldn’t have imagined these changes.

Here come the unintended consequences.  Under the law, law enforcement agents hoping to get access to your emails as part of an investigation are required to obtain a warrant, just as they would need a warrant to search your home and seize your computer.

But for data stored on a third party computer—an ISP or other cloud provider—the warrant requirement applies only for “unopened” messages and only for 180 days after receipt.  Once the message is opened and 180 have passed, any stored data can be obtained without a warrant based on the much lower standard of a subpoena.

In some sense, this means that as users move to cloud computing they are inadvertently and unknowingly waiving protections against law enforcement uses of their data. Keep your data only locally on equipment in your home or office, and the police need a warrant to look at or take it.  Leave it in the cloud somewhere, and they can get at it without much fuss at all.

This turn of events, the result not of any secret conspiracy so much as the random confluence of technological inventions since 1986, is almost certainly not what the drafters of ECPA had in mind.  It is more likely to be just the opposite.  For ECPA, like the wiretap law it amended, was intended to give greater protection to communications than what the Fourth Amendment to the U.S. Constitution would otherwise have provided.

A Very Brief History of the Fourth Amendment in Cyberspace

The Fourth Amendment, recall, protects citizens from “unreasonable searches and seizures” by the government.  (We are, it bears emphasizing, talking ONLY about government access here—employers, parents, friends and companies are not subject to the Fourth Amendment.)

Which is to say, the Fourth Amendment is the absolute floor of citizen protections from government.  Title III and ECPA were intended to raise that floor for telephone and later data communications to something that gave citizens more, not less, privacy.

At some point, indeed, technology may push the law below the standards of the Fourth Amendment, making it unconstitutional.  That’s been a concern all along, from the beginning of the wiretap statute itself in 1968.  The passage of Title III followed landmark Supreme Court decisions in the Katz and Berger cases, in which the Court reversed the 1928 Olmstead case, which allowed the police to intercept phone calls of a suspect without a warrant.

The Olmstead decision, Justice Harlan wrote in his concurrence to Katz, was “bad physics as well as bad law, for reasonable expectations of privacy may be defeated by electronic as well as physical invasion,” 398 U.S. at 362 (1967).

Harlan’s phrasing has proven prophetic.  In order to avoid the metaphysical problem of explaining how electronic interception could constitute a “search” or a “seizure” when no physical property of the subject is involved, the Court focused instead on the “reasonable” part of the Fourth Amendment.

Search and seizure, the Court has held over the last fifty years, is really about privacy, and a “reasonable” expectation of privacy for any information law enforcement agents want to gather requires a warrant.  What part of a wiretap is a search and what part a seizure are questions neatly elided (though perhaps too neatly as we’ll see) by the “reasonable expectation of privacy” standard.

The privacy standard has proven at least somewhat resilient to changing technologies.  But with mainstream adoption of revolutionary information technologies comes changing expectations of what is reasonably expected to be “private” information.  Indeed, Olmstead can be seen as a perfectly understandable decision in light of the fact that in 1928 nearly all telephones were connected through party lines, where no caller had any expectation of privacy.

But that also means there is no absolute baseline for Fourth Amendment challenges (usually by a criminal defendant) to evidence collected by the government.  Again, Title III and ECPA can and did set a higher bar than was required as a constitutional minimum, but even as those intentions have been reversed by technology it does not automatically follow that ECPA is now below what the Fourth Amendment requires.

Absent special protections citizens may have had from ECPA, the question under Fourth Amendment jurisprudence becomes:  Do users who keep email and other data archived with ISPs and other cloud providers have an expectation of privacy?  Is that expectation reasonable?

The Ugly Details

Not surprisingly, courts are increasingly asked to weigh in on those questions, and the results are also not surprisingly inconclusive.  (David Couillard at Ars Technica reviewed some of the case law in a recent article, “The Cloud and the Future of the Fourth Amendment.”)

Earlier this month, the Department of Justice abandoned an attempt to avoid a search warrant even for mail messages less than 180 days old in a case that involved Yahoo mail.  (See Declan McCullagh, “DOJ Abandons Warrantless Attempts to Read Yahoo E-mail.”)

Google, which came to Yahoo’s defense, has begun disclosing just how many requests for information about its users it receives from various government agencies.  (See Jessica Vascellaro, “Google Discloses Requests on Users.”)

It’s also worth noting that sometimes technology goes the other way—making it harder for law enforcement officials to collect evidence and conduct investigations.  Encryption is a good example here—stronger encryption protocols make it easier for criminals to hide activity from the police.

Indeed, law enforcement and privacy advocates are in some sense always engaged in a complicated dance.  As technology constantly changes the delicate balance between the sanctity of private activity and the need for effective law enforcement, lawmakers are regularly asked by one side or the other (or both) to change the law to bring it back into something that satisfies both groups.

The Digital Due Process Coalition

The cloud computing problem has inspired the creation of an interesting coalition aimed at returning ECPA where its drafters intended to set the scales.  The group, called Digital Due Process, was launched in March and is calling for specific reforms of ECPA to take into account the reality of digital life in 2010.  (For those who want the legal details, the site includes an excellent analysis by my one-time boss Becky Burr, see “The Electronic Communications Privacy Act of 1986: Principles for Reform.”)

The Digital Due Process group is a remarkable coalition of organizations and corporations who might not otherwise be thought to agree on too many issues of technology policy.  It includes advocacy groups normally thought to be on the right or the left, including the ACLU, the Center for Democracy and Technology, the Progress and Freedom Foundation, the Electronic Frontier Foundation and the American Library Association.  Corporate members include Google, AT&T, Microsoft, eBay, and Intel.

One might think that with such specific recommendations and such a wide coalition of support from across the ideological spectrum that ECPA reform would be a slam dunk.  But of course that would ignore one very powerful lobby not represented by Digital Due Process–the lobby of law enforcement agencies.

These agencies almost certainly recognize that the move to cloud computing has given them unintended and unprecedented access to information otherwise protected by the law, but naturally they are loathe to let go of any advantage in the fight against crime.

Though there have been some calls in Congress for enacting the reforms called for by the coalition, the success of Digital Due Process is far from certain.  And even if the group does succeed, there’s no telling how long it will be before the scales become unbalanced yet again, or in whose favor, by the next set of disruptive information technologies to become mainstream.

As Thomas Jefferson said, “The price of freedom is eternal vigilance.”

After attending last week’s Federal Trade Commission online privacy roundtable, I struggled for several days to make some sense out of my notes and my own response to calls for new legislation to protect consumer privacy. The result was a 5,000 word article—too long for nearly anyone to read. More on that later.

Even as the issue of privacy continues to confound much brighter people than me, however, the related problem of securing the Internet has also been getting a great deal of attention. This is in part due to the widely-reported announcement from Google that its servers and the Gmail accounts of Chinese dissidents had been hacked, leading the company to threaten to leave China altogether if its government continues to censor search results.

Both John Markoff of the New York Times and Declan McCullagh of CBS Interactive have also been back on the beat, publishing some important stories on the state of American preparedness for cyberattacks (not well prepared, they conclude) and on the continued tension between privacy and law enforcement. See in particular Markoff’s stories on Jan. 26 and on Feb. 4th and McCullagh’s post on Feb. 3.

Markoff reports a consensus view that the U.S. does not have adequate defensive and deterrent capabilities to protect government and critical infrastructure from cyberattacks. Even worse, after years of effort and studies, the author of the most recent effort to craft a national strategy told him “We didn’t even come close.”

Markoff reports that Google has now asked the National Security Agency to investigate the attacks that led to its China announcement and the subsequent exchange of hostile diplomacy between the U.S. and China. Dennis C. Blair, director of the Office of National Intelligence, told Congress earlier this week that “Sensitive information is stolen every daily from both government and private-sector networks….”

That finding seems to be buttressed by findings in a new study sponsored by McAfee. As Elinor Mills of CNET reported, 90% of survey respondents from critical infrastructure providers in 14 countries acknowledged that their enterprises had been the victim of some kind of malware. Over 50% had experienced denial of service attacks.

These attacks and the lack of adequate defenses are leading companies and law enforcement agencies to work more closely, if only after the fact. But privacy advocates, including the Electronic Frontier Foundation and the Electronic Privacy Information Center, are concerned about increasingly cozy relations between major Internet service providers and law enforcement agencies including the NSA.

They are likely to become apoplectic, however, when they read McCullagh’s post. He reports that a federal task force is about to release survey results that suggest law enforcement agencies would like an easier interface to request customer data from cell phone carriers and rules that would require Internet companies to retain user data “for up to five years.” The interface would replace the time-consuming and expense paper warrant processes now necessary for investigators to gain access to customer records.

Privacy advocates and law enforcement agencies are simply arguing past each other, with Internet companies trapped in the middle. Unmentioned at the FTC hearing—largely because law enforcement is out of the scope of the agency’s jurisdiction—is the legal whipsaw that Internet companies are currently facing. On the one hand, privacy and consumer regulators in the U.S., Europe and elsewhere are demanding that information collectors, including communications providers, search engines and social networking sites, purge personally-identifiable user data from their servers within 12 or even 6 months.

At the same time, law enforcement agencies of the very same governments are asking the same providers to retain the very same data in the interest of criminal investigations. Frank Kardasz, who conducted the law enforcement survey, wrote in 2009 that ISPs who do not keep records long enough “are the unwitting facilitators of Internet crimes against children.” Kardazs wants laws that “mandate data preservation and reporting,” perhaps as long as five years.

ISPs and other Internet companies are caught between a rock and a hard place. If they retain user data they are accused of violating the privacy interests of their consumers. If they purge it, they are accused of facilitating the worst kinds of crime. This privacy/security schizophrenia has led leading Internet companies to the unusual position of asking for new regulations, if only to make clear what it is governments want them to do.

The conflict becomes clear just by considering one lurid example (the favorite variety of privacy advocates on both sides) that was raised repeatedly at the FTC hearing last week. As long as service providers retain data, the audience was told, there is the potential for the perpetrators of domestic violence to piece together bits and pieces of that information to locate and continue to terrorize their victims. Complete anonymization and deletion, therefore, must be mandated.

But turn the same example around and you reach the opposite conclusion. While the victim of the crime is best protected by purging, capturing and prosecuting the perpetrator is easiest when all the information about his or her activities has been preserved. Permanent retention, therefore, must be mandated.

This paradox would be easily resolved, of course, if we knew in advance who was the victim and who was the perpetrator. But what to do in the real world?

For the most part, these and other sticky privacy-related problems are avoided by compartmentalizing the conversation—that is, by talking only about victims or only about perpetrators. As Homer Simpson once said, it’s easy to criticize, and fun too.

Unfortunately it doesn’t solve any problem, nor does it advance the discussion.