Ryanair screen scraping case is (partially) scraped away from the Irish courts

Remember Ryanair v. Bravofly - the case brought by Ryanair in the High Court seeking to prevent Bravofly from screen scraping its website to provide users with price comparison information?

In a recent judgment, the High Court has now accepted that it has no jurisdiction over a large portion of that litigation.

The issues here are somewhat complex but to summarise: after the action against Bravofly was commenced Ryanair added a second defendant - Travelfusion - to the proceedings, on the basis that they were the "provider of the technical facilities and services necessary to permit the screen-scraping facilities".

Travelfusion, in turn, applied to have the proceedings against it dismissed on the basis that the Irish courts had no jurisdiction to hear the matter under the Brussels Regulation. This argument had two dimensions - first that as an English company with no place of business in Ireland there was no basis for jurisdiction under the Regulation and secondly that the terms of use of the Ryanair website conferred exclusive jurisdiction on the English courts. Ultimately, however, Travelfusion rested its case entirely on the second aspect.

The relevant provision was Clause 7 of the Terms of Use, which provided:

Disputes arising from the use of this website and the interpretation of these Terms of Use of the Ryanair website are governed by English Law. All disputes relating to these Term of Use and the use of the Ryanair Website are subject to the exclusive jurisdiction of the English court, save that Ryanair may, at its sole discretion, institute proceedings in the country of your domicile.

Ryanair conceded that if the clause applied it would determine jurisdiction over all the screen scraping claims - the question was, however, whether the clause took effect as part of an agreement between the parties.

This put Ryanair in a difficult and awkward position. Their claim that screen scraping was prohibited rested in large part on the argument that the terms of use were contractually binding on visitors to the site - if that were so, however, then the clause would take effect and Article 23 of the Brussels Regulation would confer exclusive jurisdiction on the English courts. Travelfusion was also in an awkward position - seeking to assert that the choice of law clause was effective while the remainder of the terms of use were not. As the court noted:

the circumstances giving rise to the issue in this case are highly unusual. The party who has produced the standard form containing a choice of jurisdiction clause is the one saying it does not apply. Equally the party denying that there is any contract at all is the one who is placing reliance on a clause which arises out of a contract alleged by its opponent but denied by it.

Could Travelfusion rely on the choice of law clause while simultaneously denying the existence of a contract? The court's conclusion was that it could. Three factors were important in this outcome. First, it would do no injustice to Ryanair to apply a choice of law clause which it itself had put forward. Secondly, if Ryanair were successful in its claim the choice of law clause would necessarily be contained in any contract. Thirdly, the alternative would be wastefully to litigate the same issue (whether a contract existed) twice - once at the jurisdiction stage and once again at the substantive hearing.

Consequently, the court accepted that the choice of law clause applied and as such Ryanair's action against Travelfusion was struck out. The case against Bravofly, however, remains.

From a practical perspective, this is certainly a cautionary tale for internet businesses - don't assert a choice of law in your website terms of use unless you're happy for it to apply to all claims that might arise out of the use of the website.

(Ryanair's terms of use, incidentally, seem to have been amended since the start of this case in order to head off this type of defence. The current terms of use state "It is a condition precedent to the use of the Ryanair website, including access to information relating to flight details, costs etc., that any such party submits to the sole and exclusive jurisdiction of the Courts of the Republic of Ireland and to the application of the law in that jurisdiction, including any party accessing such information or facilities on their own behalf or on behalf of others.")

The case against an Irish Internet Death Penalty

I've written a short piece for today's Sunday Business Post on the implications of the Eircom / IRMA deal for Irish internet users. Unfortunately the Business Post is no longer updating its online content until late on Sunday (in a move to drive sales of the dead tree version?) so you can't see it there yet. In the meantime, here's the story as it was submitted:

Time to oppose an Irish Internet Death Penalty

Banning someone from internet use is a draconian punishment. In an era where internet access is increasingly essential – whether to send an email, look for a job, or book a flight – to deprive a person of this basic right is to seriously disrupt their daily life. In fact, an internet ban is such a sanction that the Irish courts have only ever imposed this punishment in extreme cases involving child pornography.

Yet in a private deal between Eircom and the music industry – a deal which the music industry is now trying to force on other Irish internet service providers – internet bans may become commonplace. The deal has been called “three strikes and you’re out” but it might better be called “three accusations and you’re out” as there would be no trial, no evidence held up to court scrutiny and no right of appeal. Instead, once the music industry makes three allegations that a particular internet user is sharing music then Eircom will disconnect that user, applying what’s often called an internet death penalty while acting as judge, jury and executioner.

What might this deal mean for the Irish internet? We can certainly expect users to be wrongfully accused. The company which the music industry previously used to identify filesharers – MediaSentry – has a track record of false accusations and was recently found to be operating illegally in several US states. As a result, the music industry has recently dumped MediaSentry and turned to Danish firm Dtecnet – but the inherent unreliability of this process remains.

Ironically, Eircom users will be particularly vulnerable to false accusations. In 2007 Eircom supplied up to 250,000 customers with wireless modems whose passwords were insecure. This means that a neighbour or passer by could easily use their broadband without their permission. Should they face an internet ban for the actions of somebody piggybacking on their wireless?

This reflects a broader problem where innocent third parties will be affected. Internet connections are not generally unique to an individual. Instead they’re shared – amongst families and flatmates for example. But three accusations will mean the connection will be shut off for every user so that others will suffer based on the alleged wrongdoing of another.

The deal is also undemocratic. The European Parliament has recently rejected a scheme to disconnect users based on mere accusations. In the United Kingdom similar proposals were ultimately rejected after public consultations and open debate. Here, however, the music industry is trying to foist this system on ISPs in a private deal while bypassing scrutiny by the Oireachtas, the Department of Communications and the democratic process.

In another part of this deal, as well as disconnecting users the music industry also wants Irish ISPs to impose a second type of internet death penalty, by preventing Irish users from reading certain websites. This time there is pretence of legal cover, in that the obligation would be to block websites only where a court order is granted – but the music industry has threatened to sue any ISP which opposes such an order, meaning that any court will hear only one side of the story. The result, if this scheme is allowed to proceed, will be to make ISPs responsible for censoring what their users can view on the internet.

If this precedent is set for the music industry, expect others to follow soon after. The publishing industry, for example, might target Google’s Book Search project which it has claimed infringes copyright. The Church of Scientology already has a track record of trying to silence criticism by claiming that its copyright is infringed by certain sites. Diebold – a US manufacturer of electronic voting machines – has been found by the US courts to have abused copyright law to shut down internet sites in order to conceal flaws in its technology. If Irish ISPs become internet censors then similar plaintiffs can be expected to try their luck here.

Quite apart from civil liberties concerns, there are also commercial costs. If this deal is allowed to proceed it will harm Ireland’s reputation as an internet-friendly country. By requiring companies to police the actions of their users and censor what they can see – a duty which they are not subject to in other jurisdictions such as the United States – it will drive up costs (for both companies and users), harm inward investment and encourage technology firms to relocate elsewhere.

In short, this deal is an unacceptable threat to Irish internet users and businesses. Fortunately, so far only Eircom has signed up. Other ISPs are still considering whether to cave in to the threats of the music industry. There is still time for them to do the right thing and say no to a privatised internet death penalty.

TJ McIntyre is a solicitor, Lecturer in Law in University College Dublin and chairman of Digital Rights Ireland.

Edited to add: The piece is now online.

ECJ upholds Data Retention Directive

The big news of the day is that the European Court of Justice has upheld the Data Retention Directive against the challenge by the Irish Government in Ireland v. Parliament and Council where it was claimed that it was adopted on the wrong legal basis. The decision doesn't consider whether the Directive is in breach of fundamental rights, and the Digital Rights Ireland action on that basis will continue. More once I've had a chance to read the full decision.

ECHR expands scope of privacy rights?

OUT-LAW has details of a recent European Court of Human Rights decision which may push out the boundaries of privacy rights - in particular by finding a violation based on the taking of a photograph alone (without any publication). The facts in Reklos and Davourlis v. Greece were:

The applicants, Dimitrios Reklos and Vassiliki Davourli, are Greek nationals who were born in 1964 and 1967 respectively and live in Athens. They are the parents of Anastasios Reklos, who was born on 31 March 1997 in a private clinic. Immediately after birth, the baby was placed in a sterile unit to which only medical staff had access.

As part of the photography service offered to clients, two photographs of the new-born baby, viewed face on, were taken by a professional photographer. The parents objected to this intrusion into the sterile environment without their prior consent.

On 25 August 1997, following the clinic’s refusal to hand over the negatives of the photographs to them, the applicants brought an action for damages before the Athens Court of First Instance. The court dismissed the action as unfounded.

In September 1998 the child’s parents appealed unsuccessfully against that decision. In August 2002 they lodged an appeal on points of law, submitting that the court rulings had infringed the right “to dignity” and “to protection of private life”, and stressing the potential dangers for disabled children.

On 8 July 2004 the Court of Cassation dismissed the appeal on points of law on the ground that it was too vague. (Facts taken from the ECHR press release - judgment in English not yet available.)

The ECHR agreed with the parents, holding:

The Court reiterated that the concept of private life was a broad one which encompassed the right to identity. It stressed that a person’s image revealed his or her unique characteristics and constituted one of the chief attributes of his or her personality. The Court added that effective protection of the right to control one’s image presupposed, in the present circumstances, obtaining the consent of the person concerned when the picture was being taken and not just when it came to possible publication.

The Court observed that, since he was a minor, Anastasios’s right to protection of his image had been in the hands of his parents. Their consent had not been sought at any point, not even with regard to the keeping of the negatives, to which they objected. The Court noted that the negatives could have been used at a later date against the wishes of those concerned.

The Court concluded that the Greek courts had not taken sufficient steps to guarantee Anastasios’s right to protection of his private life, in breach of Article 8. (Emphasis added.)

The portions in bold are significant: unlike earlier caselaw on photography / CCTV (such as von Hannover v. Germany or Peck v. United Kingdom) the Court identified the taking of the photograph itself as a violation irrespective of whether it was subsequently published or otherwise made public. This is - as Rosemary Jay points out in the OUT-LAW post - consistent with the approach taken in the UK DNA Database case last December (S and Marper v. United Kingdom) where the focus was on the gathering and storage of personal information rather than its subsequent use. As such, it is potentially important for the argument that data retention is itself a violation of Article 8, whether or not any further use is made of the retained data.

"Three strikes" for Ireland - Eircom, music industry settle filtering case

The big news of the day in Ireland is that Eircom and the music industry have settled the case in which the music industry had demanded that Eircom monitor users' connections to block peer to peer filesharing (background here). Instead the industry has dropped the action on condition that Eircom introduce a "three strikes" system where users accused of filesharing by the music industry will be disconnected after two warning letters. According to Eircom it has agreed to:

1) inform its broadband subscribers that the subscribers IP address has been detected infringing copyright and

2) warn the subscriber that unless the infringement ceases the subscriber will be disconnected and

3) in default of compliance by the subscriber with the warning it will disconnect the subscriber

More from Digital Rights Ireland | EFF | ars technica | Boing Boing | Daithi. Oisin, commenting on Lex Ferenda, makes some interesting points which in the spirit of the litigation I'm shamelessly going to copy (though I'm not sure that I agree that Eircom will need to change their terms of use - the existing policy is already drafted to allow termination for almost any infraction):

What’s probably going to happen is that this whole issue is going to shift from being an IP/regulatory law one to being a contract/ consumer protection law one. Two points spring to mind.

First, to put this settlement into practice Eircom will have to modify its terms of service for all its current customers (without giving any legal consideration for a unilateral modification of a contract) which could pose considerable enforceability problems. Moreover, to properly incorporate the ‘three strikes and your out’ rule into its contracts Eircom is probably going to have to draw this new provision to the attention of its subscribers (so we may, indirectly, get to figure out what the terms of settlement were).

Second, and more interestingly, if, and when, Eircom seeks to terminate someone’s service, we may finally get some litigation as to whether or not these often unfair, impenetrable user agreements are actually enforceable or not. We’ll finally get to see if the Unfair Terms Directive, along with all the old common law and equity cases on enforcing one-sided terms that weren’t negotiated or drawn to the parties attention have any bearing on user agreements.

My take? This isn't really a win for the music industry. They were clearly hoping for an outright win requiring all ISPs to filter and setting a precedent in a common law jurisdiction to match SABAM v. Tiscali. Instead they've merely achieved an agreement with one ISP - albeit the largest - which doesn't go any further than they might have been able to achieve by negotiation in the first place. As Ronan Lupton points out the agreement is not enforceable against the rest of the industry, and it is debatable whether other ISPs will show any appetite to come on board. Moreover, if three strikes is challenged as Oisin suggests then it will receive much less judicial deference than if it had been adopted as part of an industry wide deal with explicit government support.

It is, though, a loss for the user. The three strikes process in this case is procedurally
unfair and represents an extreme model largely rejected elsewhere.

Blogger who didn't delete comment can't sue over it

OUT-LAW has a very interesting application of the rule that one cannot sue for libel in respect of a publication to which one consents:

Christopher Carrie is the author of a self-published book in which he claims to have been sexually abused by the son of writer JRR Tolkien, Father John Tolkien. John Tolkien, who was a priest, died in 2003.

Carrie set up a blog on 5th February 2007 and published a post under a pseudonym on 6th February, promoting his website and his book, which could be downloaded from there for free.

The court heard that JRR Tolkien's great grandson Royd Tolkien had posted a comment on the site claiming that Carrie was a fraudster who had tried to defraud the Catholic Church and the Tolkien family and had admitted to lying about sexual abuse to extract money from the church.

Carrie denied the claims via his pseudonym on the site, and sued Tolkien, claiming that the remarks were defamatory.

Carrie did not remove the remarks, though, even though the Court heard that he had seen them four-and-a-half hours after they were posted. The remarks are still online.

Tolkien argued that this meant that Carrie consented to the publication of the comments, and the High Court agreed. Mr Justice Eady granted summary judgment in favour of Tolkien.

"No explanation was offered for [Carrie] having taken no steps to delete it until his witness statement of 18 November 2008 was served," said the ruling. "The explanation given, however, of putting the words 'in context' does not in any way detract from the validity of a defence of authorisation or acquiescence. The fact remains that he could have removed it at any time over the last 22 months."

Full judgment here.

What's it all about?

Here's a word cloud from the excellent Wordle visualising recent posts to this blog:

Data Protection Review Group Announced

The Department of Justice has today announced the creation of a Data Protection Review Group on breaches of data protection. The terms of reference are:

a. Legal issues

i. Consider whether Irish Data Protection legislation needs to be amended to deal with data breaches.
ii. Assess the effectiveness of existing legislation in this context, including the impact of mandatory reporting legislation where it has been introduced.
iii. Assess the likely impact of the scope and timing of the forthcoming ePrivacy Directive and next EU Data Protection directive and other relevant international legislative developments.
iv. Describe the range of options in existing legislation within EU and with competing non EU states.
v. Consider the potential formats of mandatory reporting.
vi. Consider the role and level of penalties in any mandatory regime.

b. Technical issues

i. Definition of "breach" in the context of how organisations' use of technology is changing.
ii. Assessment of the assortment of devices and locations holding data now.
iii. Assessment of whether the same mechanisms should apply to paper and electronic media in any suggested change.
iv. Attempt to foresee unintended consequences in the light of the rapid evolution of technology and business practices.

c. Regulatory issues

i. Assess the prevalence of the data breach problem and level of existing reports.
ii. Assess any empirical evidence that Data Protection legislation informs industrial location decisions.
iii. Consider whether any change bear on Public and Private sectors equally.
iv. Assess how to establish the threshold of seriousness - in some cases a very small number of records could potentially cause substantial harm.
v. Balance the potential effectiveness of any proposed change against increasing the costs of doing business in Ireland - the Group should, insofar as possible, ensure that its deliberations equate to a Regulatory Impact Analysis.

The members of the group are:

Chairman: Mr. Eddie Sullivan (former Secretary General Department of Finance), Mr. Billy Hawkes, Data Protection Commissioner, Professor Robert Clark (School of Law, UCD), Ms. Isolde Goggin (former Chair of Comreg and expert on Regulatory Impact Assessment), Mr. Alec Dolan & Ms. Noreen Walsh (Department of Justice, Equality and Law Reform, Mr. Dave Ring (CMOD, Department of Finance), Mr. Tony McGrath (Department of Enterprise, Trade and Employment), Mr. Paul Carroll (Department of Social and Family Affairs) and Mr. Roger O'Connor (Department of Communications, Marine and Natural Resources).

The decision to look at data breaches - and in particular mandatory reporting - was made in October of last year after parliamentary questions revealed that the government was losing at least one electronic device per week, and that the vast majority of devices were not encrypted.

Submissions to the group should be sent to dataprotectionreview@justice.ie by March 1st.

The Music Industry v. Eircom - Let Battle Commence!

The trial started today in the case being brought by the EMI, Sony, Warner and Universal against Eircom, in which the music industry is demanding that Eircom put in place a filtering system to block peer to peer downloads. The case is being heard in the High Court before Charleton J. under the record number 2008/1601P EMI RECORDS IRELAND LTD & ORS V EIRCOM LTD. It's listed for hearing for four weeks (and will be in Court 7 should you be passing the Four Courts and interested in observing some of the argument). For the argument that the plaintiffs' case represents a threat to privacy and freedom of expression on the internet see this Digital Rights Ireland post.

Update (16.01.08): The Irish Times has coverage of the first day of hearings. I was rather amused by this internal email from 2001:

"We need to reach a decision on how we are going to handle this," the e-mail said. "PS: 'piracy' is a loaded term. Could we say 'sharing' – 'piracy' implies there’s something wrong with it.

"Think of it as helping the health and good living of rich cocaine-sniffing rock stars by leaving them with less free money to spend on sex and drugs."

In a separate story, the Irish Times also reveals claims by the music industry that their campaign of litigation directly against individual uploaders "had cost the companies some €600,000 and secured compensation of only €70,000".

ComReg to Regulate .ie ccTLD

Important news for the Irish internet with the announcement that Comreg has completed its consultation process and now proposes to introduce a new framework for regulation of the .ie top level domain. The press release summarises the changes as follows:

- ComReg will, by way of regulation, appoint IEDR as the authority authorised to register .ie domain names in accordance with Section 32(4)(a) of the Act of 2007,
- IEDR will set up and maintain a Policy Advisory Committee (PAC) representative of all stakeholders with a focus on more transparent policy development,
- IEDR will continue to adopt the "managed approach" to .ie registrations to ensure continued protection for .ie domain name holders and consumers,
- ComReg will implement a monitoring framework and will participate in the PAC to keep abreast of activities in the marketplace,
- Further regulatory measures may be considered in the future, as warranted.

Daithi has an excellent post discussing the ComReg proposals and their background, which I won't attempt to follow until I've had a chance to look at the proposals in more detail - but I can't help wondering whether this will now mean that the IEDR may be subject to judicial review.

An Irish "Digital Legal Services Centre"?

The Irish Institute of European Affairs has a strong track record of hosting and promoting debate on issues around technology and law. Recent speakers have included Jonathan Zittrain, Bruce Schneier, Viviane Reding, Peter Fleischer, and Larry Sanger.

Now the IIEA has launched a report - The Next Leap: Competitive Ireland in the Digital Era (PDF) - which is full of interesting ideas aimed towards promoting Ireland as a "software and services hub".

One that struck me was the notion of establishing an Irish Digital Legal Services Centre. This, so the suggestion goes, would be:

an IFSC type development from which services such as intellectual property, rights clearance, payments, data protection, retention & privacy etc. could be provided for digital firms operating within the EMEA region.

This is a particularly good idea and in many ways is the next logical step from the early approach which the Irish government took towards promoting Ireland as an e-commerce location (particularly in the run up to the adoption of the Electronic Commerce Act 2000). It would also build on the expertise which is already developing here in servicing the Irish branches of firms such as PayPal, Ebay, Google and Microsoft.

So what could be done to promote this idea?

For a start, we would need government recognition of the importance of the Data Protection Commissioner. If Ireland is to be a credible location for online businesses it needs a data protection system which is capable of being the de facto lead regulator for multinational operations. Recent government moves (by decentralising the office to Portarlington resulting in the loss of staff and expertise and by the abortive proposals to merge the office with entirely dissimilar agencies) suggest that the government has little understanding of the importance of this role.

We would also need to see a reversal of policy in relation to data retention. The Department of Communications has repeatedly warned that government policy here will mean imposing increased costs on Irish business and reducing competitiveness - particularly where there are no provisions for cost reimbursement - but the Department of Justice has ploughed on regardless to achieve the largely mythical benefits of data retention.

Conversely, the Department of Justice has also ignored areas of Irish law where change is essential and could be achieved at relatively low cost. As I've said for a while now, Irish law on computer crime is badly in need of reform. Areas such as interception of online communications, access to stored communications and denial of service attacks are essentially unregulated - giving little protection to online businesses. Legislation in this area is long overdue and would help to promote Irish attractiveness for online business.

Another area which would benefit from (relatively cheap and easy) reform is Internet gaming. Ireland is already a hub of internet gaming sites, but still operates on the basis of laws which are obscure and outdated. The Department of Justice has already - to its credit - dealt with some of the issues involved in the report "Regulating Gaming in Ireland", but more needs to be done. It would be undesirable if the political dispute in relation to fixed odds betting terminals were to hold up reform of online gaming.

Reforming the possible liability of online intermediaries generally should also be a priority. Ireland has adopted a barebones implementation of the Electronic Commerce Directive, creating only the mandatory exemptions from liability in respect of hosting, mere conduits and caching. This compares with other jurisdictions which have created immunities for e.g. search engines and content aggregators. This narrow approach is something which worries intermediaries (UK link but Irish law is very similar) and there is a strong argument to be made for extending the hosting notice and takedown model to other intermediaries also. Failure to do so will undermine the desirability of Ireland as a location for such services.

Neil Leyden has some interesting comments / proposals in a similar vein here and here.

Data Protection Commissioner may prosecute for spam without seeking negotiated settlement - High Court

As we've seen before ("How to be sued by space cadets") Realm Communications has been trying to stymie prosecutions being brought against it for spam. Their claim has been that the Data Protection Commissioner is under a statutory duty to seek an amicable resolution before resorting to the heavy guns of a criminal prosecution.

In the recent statutory instrument amending data protection law the Minister sought to preempt this argument for future cases, by including a provision stating that:

If of the opinion that the circumstances relating to a complaint investigated under Regulation 17 involve the commission of an offence under these Regulations, the Commissioner may bring and prosecute proceedings for the offence without attempting to bring about an amicable resolution of the complaint.

But this still left the position in doubt in respect of offences committed and prosecutions commenced before this change.

The High Court has now rejected the argument that an amicable resolution must be sought, McCarthy J. holding (according to the Irish Times report) that "the absence of resolution attempts did not erase the fact that regulations were breached". This is an unsurprising result - the legislation certainly doesn't expressly provide that there must be an attempt at settlement, and while it might be best practice to do so, a strict duty would tie the hands of the DPC (especially when dealing with repeat offenders) and would undermine the effectiveness of the criminal penalty. But though the result might have been predictable the ruling is still useful, particularly as it clarifies the position in respect of other pending prosecutions. (Edited to add: full judgment now available here.)

Danish censorship list leaked

Another internet censorship story which didn't get the attention it deserved over Christmas was the revelation that the blacklist operated by the Danish child pornography filtering system - all 3863 blocked URLs - was leaked on December 23 and is available in full online.

If nothing else, this (in conjunction with the Thai leak) vividly illustrates one key criticism of any internet filtering system - that the list of blocked content will inevitably leak and so facilitate access to the supposedly blocked content.

A note of caution for bloggers - the Danish list is reported to contain links to child pornography sites, meaning that linking to the list might itself be an offence under section 5 of the Child Trafficking and Pornography Act 1998. That section makes it a criminal offence to "knowingly [publish] or [distribute] any advertisement likely to be understood as conveying that ... any other person produces, distributes, prints, publishes, imports, exports, sells or shows any child pornography". Legal opinion in the UK (in relation to their similar Protection of Children Act 1978) has been that domain names and URLs might themselves constitute such illegal advertisements.

Thai censorship list leaked: RTÉ News blocked

Thailand's Ministry of Information and Communication Technology operates a secret internet censorship system, blocking access to websites deemed unsuitable for the Thai people. The list of blocked websites has now been leaked, and makes for interesting reading. Doubtless Thais will be glad to know that they are being protected from such evils as the Economist , Charlie Chaplin and Hillary Clinton's campaign videos.

Irish readers will be interested to note that one of the banned pages is from RTÉ News, even though that page merely discusses Thai blocking of YouTube and does not itself contain any content that could remotely be considered offensive.

Some thoughts on the IWF / Wikipedia debacle

One of the highest profile internet stories of December came when the Internet Watch Foundation placed a Wikipedia page on its black list of child pornography URLs, causing the page itself to be blocked by most UK ISPs and (more significantly) causing substantial collateral damage by preventing many UK users from being able to edit Wikipedia pages.

Now, after heavy criticism from internet users, the IWF has executed a hasty about turn, backing down after just five days. Though it still claims that the image in question is "potentially in breach of the Protection of Children Act 1978", nevertheless it has stated that given the "contextual issues involved in this specific case" and "in light of the length of time the image has existed and its wide availability, the decision has been taken to remove this webpage from our list".

While it's too soon to say what the long term implications of this might be, in the short term it has certainly damaged the reputation of the IWF, perhaps irreparably. As John Ozimek has pointed out, other actions of the IWF must now come into question:

So the scene was set for the IWF to take a fall. Gone is its record for 100 per cent undisputed blocking. Gone, too, is its reputation for being the undisputed good guy. Many people have looked at the image in question and have taken the view that it is not porn, or indecent, or abuse. Having made that judgement, they have started to ask questions about other imagery that the IWF has sought to block.

The absolute certainties that underpin a view that claims indecency is always porn is always abuse are shaken. Not least by reports that the child - now an adult - whose image lies at the heart of this controversy, is reported to have no regrets at all in respect of the photo.

It has also tarnished the IWF's legitimacy. In large part this rests on claims that it operates a formal mechanism for identifying material to be blocked, along with a (semi-) independent appeals procedure. But the ad hoc nature of the decision making in this case - where the IWF board ignored the results of its own appeals procedure - suggests that there are different rules in place for high profile sites with vocal supporters. Lilian Edwards puts the point well:

Non-accountable: the IWF`applied their own appeals procedure to the decision, after media pressure, and reversed it. Effectively they changed their mind. This is not how true courts and tribunals work, where an appeal must be heard by a seperate body with an account of what factors lead to a different legal decision. The IWF may have truely reconsidered their opinion as to the law (although their own press release rather speaks against this), but they may equally well have simply bent to public pressure, or practical enforcement problems. For those who truly want an objective system which responsibly cracks down on child porn, this is surely unacceptable. Justice is a system, not an arbitrary private discretion.

The incident has also compromised claims for the technical efficiency of UK internet filtering. While at least one UK ISP has resorted to a crude form of IP blocking, the two stage filtering process pioneered by BT (as its "Cleanfeed" system) has been sold on the basis that it can effectively block specific URLs without degrading network performance and with no collateral damage to legitimate content. That has been shown not to be the case. As Richard Clayton points out in a comprehensive post on the technical aspects of the system:

To sum up the key technical matters: the IWF chose to filter text pages on Wikipedia rather than just the images they were concerned about; the use of proxies by ISPs broke Wikipedia’s security model that prevents vandalism; the previous controversy about the Virgin Killers album cover meant that IWF’s URLs were quickly identified; however different capitalisations of URLs, the different blocking technologies, and the different implementation timescales led to considerable confusion as to who blocked what and when.

Some of these matters could be described as "human error" and might be done better in any re-run of these events with any of the other questionable images hosted on Wikipedia (and many other mainstream sites). However, most of the differences in the effectiveness of the attempted censorship stem directly from diverse blocking system designs — and we can expect to see them recur in future incidents. The bottom line is that these blocking systems are fragile, easy to evade (even unintentionally), and little more than a fig leaf to save the IWF’s blushes in being so ineffective at getting child abuse image websites removed in a timely manner.

The case has also thrown up issues of selective enforcement and parity of treatment between offline and online content. The IWF blacklisted this image only when hosted by Wikipeda - despite the fact that the same image was hosted by online retailers (and, indeed, has appeared on the cover of albums in your local record shop for the last thirty years). This disparity was bound to cause criticism, and the IWF's response - that it only acts on complaints received by it - has been felt by many to be inadequate.

Many users - when made aware of the blocking - also questioned the deceptive error messages used by most ISPs. Although some (notably Demon Internet) show pages indicating that content has been blocked, most ISPs appeared to be using fake 404 pages. It is far from clear why this is done, particularly when the practice in many jurisdictions using similar systems is to use block pages telling users why content has been blocked and what they can do if they feel that this is a mistake. (E.g. Sweden | Finland.)

The approach taken by the IWF to borderline images and fair procedures also comes into question. On their own admission they blocked the image on the basis that it was "potentially illegal" - and did so without notifying Wikipedia much less offering a right to be heard. One Wikipedia admin board sums up this point well:

The image is not certain to be illegal. In the IWFs own words the image was judged to be "potentially illegal indecent image of a child under the age of 18, but hosted outside the UK". The album has been for sale in many countries with this cover for over 30 years. No one has ever been prosecuted over the image as far as is known. The FBI investigated a report of this album cover in spring 2008 and decided to take no action. The Wikimedia Foundation has not been requested by the FBI or any other law enforcement agency to remove the image and has certainly not been charged over it. The ultimate arbiter of whether an image is illegal is a court of law, in particular a jury, and not a self-selecting group, however well-intentioned their motives.

The IWF blocked access to a page on one of the world's most-visited websites without informing its owners. We understand that their policy is not to contact any of the hosts they block, but commonsense should have told them that blocking such a website might have unforeseen consequences. In particular, they failed to understand that whereas a block of the article itself may well amount to restraint on the guaranteed freedom to receive and impart information, the image itself is uploaded from a different URL which could have been separately blocked by the ISPs with whom they are in partnership; in this way, they demonstrate a complete lack of understanding of how websites work, which is chilling in the extreme for a supposed Internet Watchdog.

Taking a longer term view, this incident means that any widening of the IWF's remit is now likely to be put on hold. There have been suggestions in the past that the blacklist should be extended to e.g. websites which "glorify terrorism", while the police and Ministry of Justice have already been advising individuals to refer alleged "extreme pornography" images to the IWF for assessment - however, in light of the considerable reputational damage caused by the Wikipedia ban the IWF is likely to be more cautious before it takes on any new roles.

Of course, it's not just in the UK that these debates are taking place - in the United States for example there are striking parallels about the way in which an private body (the National Center for Missing and Exploited Children) has become an "unofficial internet regulator" carrying out internet censorship without any legislative basis, oversight or transparency. Chris Soghoian has an insightful editorial with more detail.

Increased criminal penalties for spammers

In good news for Irish internet and mobile phone users the sending of spam has for the first time become an indictable offence, carrying a possible maximum penalty of €250,000 or up to 10% of a company's turnover (Sunday Times, Silicon Republic). Most cases will presumably remain in the District Court, where the maximum penalty is increased to €3,000. The changes should substantially strengthen the hand of the Data Protection Commissioner in dealing with persistent offenders.

Update - 12 January 2009: The full text of the amending statutory instrument is now available. Other changes made by the SI include extending to two years the period in which summary prosecutions can be brought, providing that in prosecutions where consent is an issue the burden of proof rests on the defendant to show that a subscriber opted in, clarifying the scope of the soft opt-in provision in respect of similar goods or services, and providing that an officer of a company can be prosecuted without the need first to proceed against or convict the company of the offence.

Mobile phone bullying - operators try to ward off regulation?

The Irish Times is reporting that the major mobile operators have launched a new pamphlet aimed at helping parents deal with issues such as mobile phone bullying. A response to recent political demands that the industry be required to implement (rather ill conceived) technological solutions?

It's probably worth mentioning that this is taking place against the backdrop of European initiatives on safer mobile use under which the industry has agreed to implement national self-regulation.

HEAnet Conference - video and slides now available

The HEAnet National Networking Conference took place last month in Kilkenny and the organisers have now put up video and slides for all presenters. I'm obviously biased in recommending my own presentation "Here come the Internet cops" (final keynote) but other highlights for me included Aidan Carty and Anthony Keane's "Honeypots and Darknets - What are they good for?" and Cathal McCauley and Peter Clarke's "Second Life - Brave New Frontier or Fleeting Gimmick?".

Internet Watch Foundation blocks Wikipedia

The internet - and more significantly the mainstream media - is abuzz with the news that the hitherto low profile Internet Watch Foundation has blacklisted a Wikipedia page. The IWF blacklist - more formally the Child Sexual Abuse Content URL List - is a list of URLs alleged to contain child pornography, which UK ISPs have "voluntarily" agreed to block (that is, they volunteered when the government indicated that if they did not legislation would be introduced compelling them to do so).

This presents all sorts of interesting problems for the law and civil liberties. There is no legislation underpinning the IWF, which is a purely private body. There is no judicial control of its activities, and the process by which it blocks sites is particularly opaque (it does not notify site owners either before or after sites are blocked, nor does it offer a right to be heard). It does claim to offer a right of appeal against blocking, but that is not an appeal to an independent body but to a division of the Metropolitan Police. In short, it has (with government backing) implemented a remarkable system of censorship which departs from almost every traditional understanding of freedom of expression in the UK.

I've been following the development of this system for some time now, and I spoke about some of these issues in this paper at the 2008 BILETA Conference in Glasgow:

UK DNA database held to be in breach of European Convention on Human Rights

Good news from the European Court of Human Rights, which has held that the UK DNA database - the largest in the world, containing the DNA of hundreds of thousands of innocent people (amongst them forty thousand children) - is in breach of Article 8 of the ECHR on private and family life. Here are some highlights from the decision:

The Court observes that the protection afforded by Article 8 of the Convention would be unacceptably weakened if the use of modern scientific techniques in the criminal-justice system were allowed at any cost and without carefully balancing the potential benefits of the extensive use of such techniques against important private-life interests. In the Court's view, the strong consensus existing among the Contracting States in this respect is of considerable importance and narrows the margin of appreciation left to the respondent State in the assessment of the permissible limits of the interference with private life in this sphere. The Court considers that any State claiming a pioneer role in the development of new technologies bears special responsibility for striking the right balance in this regard.
...
The Court acknowledges that the level of interference with the applicants' right to private life may be different for each of the three different categories of personal data retained. The retention of cellular samples is particularly intrusive given the wealth of genetic and health information contained therein. However, such an indiscriminate and open-ended retention regime as the one in issue calls for careful scrutiny regardless of these differences.
...
Of particular concern in the present context is the risk of stigmatisation, stemming from the fact that persons in the position of the applicants, who have not been convicted of any offence and are entitled to the presumption of innocence, are treated in the same way as convicted persons. In this respect, the Court must bear in mind that the right of every person under the Convention to be presumed innocent includes the general rule that no suspicion regarding an accused's innocence may be voiced after his acquittal (see Asan Rushiti v. Austria, no. 28389/95, § 31, 21 March 2000, with further references). It is true that the retention of the applicants' private data cannot be equated with the voicing of suspicions. Nonetheless, their perception that they are not being treated as innocent is heightened by the fact that their data are retained indefinitely in the same way as the data of convicted persons, while the data of those who have never been suspected of an offence are required to be destroyed.
...
The Court further considers that the retention of the unconvicted persons' data may be especially harmful in the case of minors such as the first applicant, given their special situation and the importance of their development and integration in society. The Court has already emphasised, drawing on the provisions of Article 40 of the UN Convention on the Rights of the Child of 1989, the special position of minors in the criminal-justice sphere and has noted in particular the need for the protection of their privacy at criminal trials (see T. v. the United Kingdom [GC], no. 24724/94, §§ 75 and 85, 16 December 1999). In the same way, the Court considers that particular attention should be paid to the protection of juveniles from any detriment that may result from the retention by the authorities of their private data following acquittals of a criminal offence. The Court shares the view of the Nuffield Council as to the impact on young persons of the indefinite retention of their DNA material and notes the Council's concerns that the policies applied have led to the over-representation in the database of young persons and ethnic minorities, who have not been convicted of any crime (see paragraphs 38-40 above).
...
In conclusion, the Court finds that the blanket and indiscriminate nature of the powers of retention of the fingerprints, cellular samples and DNA profiles of persons suspected but not convicted of offences, as applied in the case of the present applicants, fails to strike a fair balance between the competing public and private interests and that the respondent State has overstepped any acceptable margin of appreciation in this regard. Accordingly, the retention at issue constitutes a disproportionate interference with the applicants' right to respect for private life and cannot be regarded as necessary in a democratic society. This conclusion obviates the need for the Court to consider the applicants' criticism regarding the adequacy of certain particular safeguards, such as too broad an access to the personal data concerned and insufficient protection against the misuse or abuse of such data.

That last sentence is key - the court is holding that the principle of retention itself is unacceptable, irrespective of the procedural safeguards that might apply to access to or use of the genetic data.

Identifying Individuals in Internet Iniquity: ECHR rules on naming wrongdoers

The European Court of Human Rights gave an important decision today in KU v. Finland, dealing with the issue of whether states are obliged to have laws which allow for the identification of internet wrongdoers. In short, according to the court the answer is yes - national laws must "provide the framework for reconciling the various claims which compete for protection in this context" and a national law which gives an absolute guarantee of anonymity and confidentiality of communication may breach the rights of persons who are affected by online wrongdoing.

In this case the applicant, who was then aged 12, was the victim of a fake personal ad giving his name, phone number, date of birth and his picture and claiming that he was looking for a homosexual relationship. The applicant learned of this when he received a phone call from an older man. Although that man was eventually identified and charged with an offence the person who placed the ad remained unidentified. The police sought to find out (from the ISP) the name of the subscriber behind the dynamic IP address used to place the ad. The service provider however was advised that it was bound by the duty of the confidentiality of telecommunications and could not reveal the user's identity. The Finnish courts ultimately agreed, holding that the law as it stood provided for this information to be revealed only in respect of specified criminal offences - and although defamation ("calumny") was a criminal offence, it was not a sufficiently serious offence to fall within the scope of the legislation.

The applicant applied to the European Court of Human Rights, claiming that the fake ad constituted a violation of his right to a private life under Art. 8 of the ECHR, and that as he could not identify the person responsible he had been denied an effective remedy for that violation under Art. 13 ECHR.

The court held that Finland was in breach of its obligations under Article 8, in that it had not provided an effective criminal sanction for the violation of the applicant's rights. The fact that a remedy was available against a third party - the service provider - was not sufficient. This did not mean that the identity of the person responsible would have to be revealed in every case - but national law must provide a framework within which a decision could be made balancing the rights of a victim with the considerations of freedom of expression and confidentiality of communications. As the national law at the relevant time failed to do this (prohibiting disclosure except in a narrow class of cases) it was in breach of Article 8. Consequently the court did not go on to consider the issue under Article 13. The relevant passages are worth quoting in full:

45. The Court considers that, while this case might not attain the seriousness of X and Y v. the Netherlands, where a breach of Article 8 arose from the lack of an effective criminal sanction for the rape of a handicapped girl, it cannot be treated as trivial. The act was criminal, involved a minor and made him a target for approaches by paedophiles...
46. The Government conceded that at the time the operator of the server could not be ordered to provide information identifying the offender. They argued that protection was provided by the mere existence of the criminal offence of calumny and by the possibility of bringing criminal charges or an action for damages against the server operator. As to the former, the Court notes that the existence of an offence has limited deterrent effects if there is no means to identify the actual offender and to bring him to justice...
47. As to the Government's argument that the applicant had the possibility to obtain damages from a third party, namely the service provider, the Court considers that it was not sufficient in the circumstances of this case. It is plain that both the public interest and the protection of the interests of victims of crimes committed against their physical or psychological well-being require the availability of a remedy enabling the actual offender to be identified and brought to justice, in the instant case the person who placed the advertisement in the applicant's name, and the victim to obtain financial reparation from him.
48. The Court accepts that in view of the difficulties involved in policing modern societies, a positive obligation must be interpreted in a way which does not impose an impossible or disproportionate burden on the authorities or, as in this case, the legislator. Another relevant consideration is the need to ensure that powers to control, prevent and investigate crime are exercised in a manner which fully respects the due process and other guarantees which legitimately place restraints on crime investigation and bringing offenders to justice, including the guarantees contained in Articles 8 and 10 of the Convention, guarantees which offenders themselves can rely on. The Court is sensitive to the Government's argument that any legislative shortcoming should be seen in its social context at the time. The Court notes at the same time that the relevant incident took place in 1999, that is, at a time when it was well-known that the Internet, precisely because of its anonymous character, could be used for criminal purposes (see paragraphs 22 and 24 above). Also the widespread problem of child sexual abuse had become well-known over the preceding decade. Therefore, it cannot be said that the respondent Government did not have the opportunity to put in place a system to protect child victims from being exposed as targets for paedophiliac approaches via the Internet.
49. The Court considers that practical and effective protection of the applicant required that effective steps be taken to identify and prosecute the perpetrator, that is, the person who placed the advertisement. In the instant case such protection was not afforded. An effective investigation could never be launched because of an overriding requirement of confidentiality. Although freedom of expression and confidentiality of communications are primary considerations and users of telecommunications and Internet services must have a guarantee that their own privacy and freedom of expression will be respected, such guarantee cannot be absolute and must yield on occasion to other legitimate imperatives, such as the prevention of disorder or crime or the protection of the rights and freedoms of others. Without prejudice to the question whether the conduct of the person who placed the offending advertisement on the Internet can attract the protection of Articles 8 and 10, having regard to its reprehensible nature, it is nonetheless the task of the legislator to provide the framework for reconciling the various claims which compete for protection in this context. Such framework was not however in place at the material time, with the result that Finland's positive obligation with respect to the applicant could not be discharged.

When I blogged about this case before, I mentioned concerns that it might require states to introduce much wider rules to identify internet users. Is it likely to have this effect? While it's difficult to make an immediate assessment, there are factors in the judgment which could go either way. The court points out that it is dealing with a "grave" criminal offence, which leaves open the question of whether the reasoning would apply to less serious offences or to civil matters only. It also limits itself to requiring a national balancing framework between the rights of an alleged victim and the general rights of privacy in communications and freedom of expression - presumably within that framework states will enjoy a significant margin of appreciation. On the other hand, it rejects the argument that other systems (such as notice and takedown or intermediary liability) can suffice, insisting instead on requiring identification of users. It also focuses on the "ability of the victim to obtain financial reparation", which seems to extend the reasoning to civil matters also. On the whole, the judgment raises more questions than it answers, and these issues will need to be addressed in future cases.

James Boyle - The Public Domain

James Boyle is one of the most interesting people working in the area of intellectual property. His 1996 book Shamans, Software, and Spleens was an early and engaging look at whether intellectual property law had become tilted too heavily in favour of rights-holders. In Bound by Law he collaborated with Keith Aoki and Jennifer Jenkins to produce something other than "grey lawyerly prose" - an entertaining comic book guide to the way in which IP law is crippling documentary film-makers. He's chair of the Creative Commons board. Oh, and he also writes novels.

In his latest book - The Public Domain: Enclosing the Commons of the Mind - he has produced another fascinating read. Starting by asking just why the US government issued a patent on making peanut butter and jelly sandwiches(!) he argues that we have allowed IP law to grow in an almost unfettered way and that this "New Enclosure Movement" has created an environment which stifles creativity and jeopardises the notion of the public domain.

Best of all, he's practising what he preaches by making the book available in its entirety for free under a Creative Commons licence.

Has the Internet Governance Forum really been a success?

In the run up to the third Internet Governance Forum (IGF) in Hyderabad it's worth asking how successful the IGF has been since its establishment. "Not very" is the view of Jeremy Malcolm, who has argued that the IGF is compromised by the fact that many issues (such as copyright enforcement and the oversight of ICANN) have been essentially excluded from its consideration, with the result that policy is being made in other fora which privilege the views of particular vested interests:

Internet-related public policy issues continue to be addressed primarily in an ad hoc, isolated manner in individual stakeholder silos, outside the IGF, rather than in collaboration between stakeholder groups through the IGF...

Across a number of jurisdictions, organisations representing copyright owners have been privately negotiating with Internet Service Providers (ISPs) to limit or terminate the Internet access of customers suspected of illegally sharing copyright material online, without such alleged infringements having been proved to a court or other authority. Such negotiations take place in the shadow of the threat of government regulation, for which these organisations have also been strongly lobbying (so far with success in France). However because such discussions have taken place outside a multistakeholder policy body such as the IGF, they have been dominated by the voices of intellectual property holders, without the opportunity for Internet consumers to interject with balancing perspectives...

As another example of parallel initiatives in multistakeholder Internet governance that have bypassed the IGF, ICANN, although notionally an institution with a purely technical mandate, has continued to attempt to determine issues of public policy such as the balancing of privacy interests in the WHOIS service that identifies the ownership of Internet domains, and in setting non-technical specifications for the introduction of new top-level generic domain names (gTLDs).

The full paper, with suggestions for reform, is well worth reading. It's based in part on his PhD thesis - "Multi-Stakeholder Public Policy Governance and its Application to the Internet Governance Forum" - which is now also available online.

(Via the Internet Governance Project blog)

Computer surveillance - now available in your local corner shop

Despite knowing that computer surveillance is going mainstream I was still surprised to see this flyer in my local Spar. I wonder whether the installer will mention to employers the extensive law on surveillance of employees in the workplace.

SABAM v. Scarlet: Belgian ISP released from obligation to filter network for illegal downloads

Significant news from Belgium where it's being reported that ISP Scarlet has succeeded in overturning the injunction requiring it to monitor users and filter out illegal peer to peer filesharing of music. That injunction, granted in June 2007, was the first in a series of attempts by the music industry to oblige ISPs to police their users, and was granted on the basis of evidence by SABAM (representing the industry) that monitoring downloads and filtering infringing content was both technically feasible and cost effective. Since then, however, Scarlet has demonstrated to the court that even the system of filtering suggested by SABAM - produced by Audible Magic - was technically unworkable and that SABAM had deceived the court by falsely representing that the technology had been used elsewhere (automatic translation). On that basis the trial court has set aside the order against Scarlet.

This is far from an end of the matter - it seems (though the reports are unclear) that the trial court still proposes to require Scarlet to filter if an effective solution can be found, an appeal against the original decision remains scheduled for the Court of Appeal in Brussels next year (automatic translation) and ultimately it looks likely that the ECJ will have to decide whether in principle ISPs can be obliged to filter user connections in this way. In the meantime, though, it's a significant blow for the music industry insofar as it undermines their argument that filtering is a technically viable solution. It also couldn't come at a better time for Eircom who will be defending an Irish rerun of the SABAM v. Scarlet litigation in the High Court in Dublin in the near future.

Edited to add (8.02.10): The Belgian courts have now made a prelimary reference to the European Court of Justice, which promises to be one of the most important cases yet on the scope of the E-Commerce Directive.

National Identity Fraud Prevention Week

Normally I'm not a fan of press releases dressed up as news stories. You know the type - "163% of Irish adults are Vitamin X deficient" (survey sponsored by manufacturers of Vitamin X). But I had to make an exception for this story on National Identity Fraud Prevention Week as the sponsors Fellowes (who unsurprisingly make shredders) have produced a very good site with tips on identity fraud, phishing and more. While I'm sure the savvy readers of this blog wouldn't dream of replying to that plausible looking email from PayPal, there are more subtle risks which are pointed out in an accessible way. Recommended.

European Court of Human Rights to hear case on whether online victims have a right to identify internet users

In K.U. v. Finland the European Court of Human Rights has decided to hear a potentially very significant case considering whether victims of online activity may have a right to identify the internet users alleged to be responsible.

In this case the applicant, who was then aged 12, was the victim of a fake personal ad giving his name, phone number, date of birth and his picture and claiming that he was looking for a homosexual relationship. The applicant learned of this when he received a phone call from an older man. Although that man was eventually identified and charged with an offence the person who placed the ad remained unidentified. The police sought to find out (from the ISP) the name of the subscriber behind the dynamic IP address used to place the ad. The service provider however was advised that it was bound by the duty of the confidentiality of telecommunications and could not reveal the user's identity. The Finnish courts ultimately agreed, holding that the law as it stood provided for this information to be revealed only in respect of specified criminal offences - and although defamation ("calumny") was a criminal offence, it was not a sufficiently serious offence to fall within the scope of the legislation.

The applicant applied to the European Court of Human Rights, claiming simply that the fake ad constituted a violation of his right to a private life under Art. 8 of the ECHR, and that as he could not identify the person responsible he had been denied an effective remedy for that violation under Art. 13 ECHR. The case is currently pending.

So why does the case matter? Although the facts are narrow, the implications may be quite wide and may require states to introduce much more extensive rules for identifying internet users. In particular (and I'm obliged to Patrick Breyer for these points) the action presupposes that an effective remedy for a victim requires the identification of (alleged) wrongdoers. But this overlooks the fact that other effective remedies (such as notice and takedown procedures and host liability) already exist and were provided for in Finnish law. In addition, the claim that access to this information must be available even in respect of minor crimes ignores the principle of proportionality - respected even in the Data Retention Directive - under which access to communications data should generally be limited to cases of serious crime. Similarly, most national caselaw has required a showing of proportionality before courts will order users' identities to be disclosed. I've written before about the issues involved in identifying internet users.

Mandatory reporting of missing data considered

According to the Irish Times, the Minister for Justice is now considering introducing mandatory reporting of missing data in Ireland. I've written more about these proposals - and why they might be too narrow - on the Digital Rights Ireland blog.

How to be sued by space cadets - Regtel, text messages and "Ireland's first astronaut"

Tom Higgins is a space cadet. Literally. He has signed a contract with Virgin Galactic for their forthcoming space tourism service and claims the grandiloquent and somewhat premature title of Ireland's first astronaut.

He's also the owner of Realm Communications, a company which runs premium text and chatline services such as Irish Psychics Live and which has, to say the least, a patchy record when it comes to sending spam text messages. In fact, the Data Protection Commissioner (DPC) is currently prosecuting Realm for sending these messages, something which Realm is seeking to head off by claiming in the High Court that the DPC is "obliged to seek an amicable resolution" before prosecuting an offender.

Now Realm is also suing Regtel - the industry self-regulatory body for premium rate telecommunications services. Why? After multiple complaints (e.g. 1, 2, 3) about Realm's Foneclub / MobileMania services, RegTel decided that Realm was operating in breach of its Code of Practice and decided to impose a 12 month suspension during which it would be unable to send premium messages. From the Irish Times:

ONE OF Ireland's best-known premium mobile phone text providers claims that its business would be 'wiped out' if a 12-month suspension from sending messages is imposed by the independent regulator (RegTel).

Realm Communications Ltd, Castle Drive City West business Park, Dublin, has brought High Court proceedings arising out of a finding by the Regulator of Premium Rate Telecommunications Services (RegTel) that its mobile phone credit service, FoneClub/ Mobile Mania, had breached the terms of its code of practice.

Realm was founded by businessman Tom Higgins and provides other services such as Irish Psychics Live, WebTarot, Century Psychics and Great Irish Breaks, as well as a live weather forecasting service. It argues that the findings made by RegTel following alleged complaints are unlawful.

Realm is seeking to have RegTel's adjudication and proposed sanctions, including the suspension of its services, quashed.

This case will, if it proceeds, be the first time that this industry self-regulation has been examined in the courts. (Realm Communications has, apparently, sued RegTel before, but that action doesn't seem to have made it to trial.) Ironically, this dispute comes just after the Minister for Communications announced his belief that self-regulation has failed and promised to amend the Broadcasting Bill 2008 to have RegTel's functions transferred to Comreg. In light of its apparent imminent demise, how keen will RegTel be to fight this particular battle?

Eoin O'Dell has more on how RegTel and the Data Protection Commissioner have been cooperating to stop mobile phone spam.

Update (4.11.08): Imminent demise or otherwise, RegTel appear to be keen to have the matter determined and have had the case transferred to the Commercial Court in order to "fast track" it.

Back to the future? Applying the Press Code of Practice retrospectively to online archives

Eoin's post on the statistics for the first six months of operation of the Press Ombudsman prompted me to browse the summaries of each case on the Ombudsman's site. There are a variety of issues in those cases, but one interesting feature was the apparent willingness of the Ombudsman and newspapers to apply the Code of Practice retrospectively. When initially established, the Press Ombudsman indicated that complaints would not be accepted in respect of material published prior to November 2007 - and in any event, the complaint must be made within three months of the material being published. Despite this, however, in two cases resolved by the Ombudsman newspapers were willing to take down material published by them between 2001 and 2004 but still available on their websites. Is this significant in itself? Probably not. The cases were resolved by conciliation - the Ombudsman doesn't seem to be asserting any formal power to comb over the archives. But it is indicative of an ongoing problem for editors, who increasingly have to stand over not just what they publish but also (via the online archives) what their predecessors might have published.

US court upholds free / open source licences

Great news for the free software / open source world - in Jacobsen v. Katzer the US Court of Appeals for the Federal Circuit (a leading US IP court) has upheld a free software licence in a way which makes it much easier for the authors of free software to prevent its misuse. (The particular licence is the Artistic licence, but the principles apply across the board).

This is hugely significant as it resolves what has, until now, been a major dispute as to the effect of free software licences in US law.

The mainstream view - that of the proponents of free software (1, 2) - has been that free software licences set conditions on the use of the software. Breach those conditions (e.g. by modifying and then distributing code under a proprietary licence, or by failing to attribute) and the licence evaporates so that you are then infringing the copyright of the author. The full force of copyright law can then come into play - you can, for example, have an interlocutory injunction awarded against you restraining you from using the code.

Some, though, have argued that a free software licence amounts to a general licence to copy, modify, etc. with mere contractual restrictions on what the licensee can do. (E.g.) If true, this would mean that breaching the terms of the licence would merely be a breach of contract, not a breach of copyright. This would, for example, make it more difficult for the author to obtain an injunction against the infringer. It might also cast doubt on the enforceability of free software licences, for example by requiring authors to show that the elements of a contract were present before they could enforce restrictions against infringers.

Jacobsen v. Katzer resolves this argument conclusively in favour of the mainstream view, and holds that while free software licences may also have a contractual element, the restrictions they impose are conditions and not merely contractual restrictions. It also contains a striking judicial endorsement of the objectives and legitimacy of open source / free software generally.

Lessig and Groklaw have more.

Judge: Bulletin board users "say the first things that come into their heads"

In Smith v. ADVFN Plc & Others Mr Justice Eady of the English High Court recently showed a keen insight into the world of bulletin boards by noting that users are prone to reacting in the heat of the moment, not thinking about what they are doing, and saying the first thing that comes into their heads. A statement of the blindingly obvious? Perhaps. But the underlying point is important.

A perennial problem with defamation on the internet has been that of tone. Casual conversations - on bulletin boards or blog post comments - can feel as though they are transient and ephemeral. People write in a way which they would never use in a more formal setting such as a newspaper's letters page. But this perceived informality may clash with the approach taken by libel lawyers and courts, who are used to parsing newspaper articles closely for any possible defamatory meaning and who may apply this approach to turn the loose language of a post into something defamatory.

Offline, casual conversations also benefit from the more relaxed rules of slander, where oral (as opposed to written) communications generally don't give a person a right to sue for defamation unless they have suffered actual damage as a result. Online, though, the distinction between slander and libel evaporates so that (in most jurisdictions) an internet posting - however casual - will be treated as libel rather than slander, giving a person a right to sue irrespective of whether they have suffered any actual harm.

Significantly, however, in Smith v. ADVFN Mr Justice Eady took the informal nature of bulletin boards into account in deciding whether a claimant had a chance of succeeding in a defamation action, holding that these cases should often be treated as closer to slander so that the casual nature of posts should be taken into account when interpreting them. His summary of "the nature of bulletin boards" is worth quoting in full:

13. It is necessary to have well in mind the nature of bulletin board communications, which are a relatively recent development. This is central to a proper consideration of all the matters now before the court.

14. This has been explained in the material before me and is, in any event, nowadays a matter of general knowledge. Particular characteristics which I should have in mind are that they are read by relatively few people, most of whom will share an interest in the subject-matter; they are rather like contributions to a casual conversation (the analogy sometimes being drawn with people chatting in a bar) which people simply note before moving on; they are often uninhibited, casual and ill thought out; those who participate know this and expect a certain amount of repartee or “give and take”.

15. The participants in these exchanges were mostly using pseudonyms (or “avatars”), so that their identities will often not be known to others. This is no doubt a disinhibiting factor affecting what people are prepared to say in this special environment.

16. When considered in the context of defamation law, therefore, communications of this kind are much more akin to slanders (this cause of action being nowadays relatively rare) than to the usual, more permanent kind of communications found in libel actions. People do not often take a “thread” and go through it as a whole like a newspaper article. They tend to read the remarks, make their own contributions if they feel inclined, and think no more about it.

17. It is this analogy with slander which led me in my ruling of 12 May to refer to “mere vulgar abuse”, which used to be discussed quite often in the heyday of slander actions. It is not so much a defence that is unique to slander as an aspect of interpreting the meaning of words. From the context of casual conversations, one can often tell that a remark is not to be taken literally or seriously and is rather to be construed merely as abuse. That is less common in the case of more permanent written communication, although it is by no means unknown. But in the case of a bulletin board thread it is often obvious to casual observers that people are just saying the first thing that comes into their heads and reacting in the heat of the moment. The remarks are often not intended, or to be taken, as serious.

More on this case - including the way in which the claimant attempted to use defamation actions to silence his critics - at The Register.

Fake Facebook profile case - Full decision now available

Remember the libel action brought by a businessman against a former friend who created a false Facebook profile under his name? The full text of that decision is now available on BAILII as Applause Store Productions Ltd and Firsht v. Raphael. The bulk of the decision is unremarkable and deals with the (unconvincing) attempts by the defendant to deny that he was responsible for creating the page, but there are some interesting comments showing how judges are putting a figure on damages where material is only available for a short period of time to a relatively small number of people:

Ultimately, I have to approach the question of damages in the same way as a jury would, giving a verdict without a reasoned judgment. I bear in mind, of course, that the profile and group were only available on Facebook between 19th/20th June and 6th July 2007, when Facebook appears to have taken the material down at Mr Firsht's request. Given the times when the material was put up and taken down, that is a period of 17 days (for the profile) and 16 days (for the group). I bear in mind also the limited extent of proved publication, but I accept that Facebook is a medium in which users do regularly search for the names of others whom they know, and anyone who searched for the name Mathew Firsht during those few days will have found the false group without difficulty. In my view, a not insubstantial number of people is likely to have done so. By that I have in mind a substantial two-figure, rather than a three-figure, number. I also accept that the Defendant has increased the hurt and upset of Mr Firsht by the allegations which he rashly made in his original Defence and by his persistence in a defence which I have founded to be built on lies, which has compelled Mr Firsht to give evidence and face lengthy cross-examination in a public trial.

The libel is, as Ms Skinner rightly said, not at the top end of the scale, although it is serious enough to say of a successful businessman that (as I have found the words to mean) he owes substantial sums of money which he has repeatedly avoided paying by lying and making implausible excuses, so that he is not to be trusted in the financial conduct of his business and represents a serious credit risk. I do take into account also the effect on Mr Firsht of the unpleasant allegations against him which the Defendant made in his original Defence, and the fact that the Defendant has persisted to trial in a case which I have found to be no more than a lie. It seems to me that a proper award for the libel of Mr Firsht, to include an element for aggravation of damage, is £15,000. The pleaded meaning in the case of the company - against which the allegations of debt and dishonest prevarication are not directly made - is just the consequential meaning, that as a result of Mr Firsht's conduct the company is not to be trusted in the financial conduct of its business and represents a serious credit risk. It seems to me that a substantially lower award should be made in respect of the company, and in my judgment the right figure is £5,000.