Bennet Kelley www.internetlawcenter.net

@InternetLawCent

INTERNET LAW 2014

1

NET NEUTRALITY

1860 Pacific Telegraph Act guarantees “messages received . . .shall be impartially transmitted in the order of their reception.

2002

FCC rules cable broadband providers are information services and do not have to share their lines with competing ISPs. Upheld by Supreme Court.

2005

FCC issues Net Neutrality Principles under Title I authority.

NET NEUTRALITY TIMELINE

FCC’s 2005 Net Neutrality Principles

To encourage broadband deployment and preserve and promote the open and interconnected nature of the public Internet, consumers are entitled to

• access the lawful Internet content of their choice;

• run applications and use services of their choice, subject to the needs of law enforcement;

• connect their choice of legal devices that do not harm the network; and

• competition among network providers, application and service providers, and content providers.

2005

AT&T Chairman Edward E. Whitacre, Jr. ignites debate about online toll-roads.

2008 FCC: Comcast has unduly interfered with Internet users' right to access content and applications" of their choice. Despite lack of sanctions, Comcast appealed.

2010 DC Circuit: FCC failed to cite any statutory authority that would justify its order compelling a broadband provider to adhere to open network management practices Comcast Corp. v. FCC, 600 F.3d 642 (D.C. Cir. 2010).

JUDGE TATEL

2010

FCC adopts Open Internet Order codifying Net Neutrality principles. In 3-2 vote. Verizon appeals.

2011

House passes resolution overturning FCC Open Internet Order. Senate vote fails.

2014

DC Circuit: Remember what I said last time? Recognizes FCC authority over internet but cannot impose common carrier obligations without re-classifying broadband providers. Verizon v. FCC, 740 F.3d 623 (D.C. Cir. 2014

JUDGE TATEL REP. MARSHA BLACKBURN (R-TN)

APRIL

FCC seeks request for comment on Open Internet rules

JUNE

Last Week Tonight with John Oliver compares entrusting net neutrality with a former cable-industry lobbyist is like using a dingo to babysit your child.

SEPT

Oliver’s comments and protests such as Internet Slowdown Day lead to over 3 million comments being submitted to the FCC.

OCT

President Obama states:

“we expect that whatever final rules to emerge, to make sure that we're not creating two or three or four tiers of Internet.“”

FTC Files Action Against AT&T for Throttling Unlimited Data Users

The FTC alleges that AT&T, despite its unequivocal promises of unlimited data, began throttling data speeds in 2011 for its unlimited data plan customers after they used as little as 2 gigabytes of data in a billing period.

THE LIVES OF OTHERS

NSA FALLOUT

NSA Fallout for US Industry

• New American Foundation Study: Surveillance Costs: The NSA's Impact on the Economy, Internet Freedom & Cybersecurity

• The NSA’s PRISM program is predicted to cost the cloud computing industry from $22 to $180 billion over the next three years

• Surveys of foreign companies show movement of data outside of U.S. One U.S,. Webhost company reported half of foreign clients have left.

• Cisco, Qualcomm, IBM, Microsoft, and Hewlett-Packard have all reported drop in sales in emerging markets due to scandal.

• More than a dozen countries, including Germany, Brazil, and India, are exploring data localization laws, which would prevent or limit information flow

• Technology industry analyst Rob Enderle claims that the “National Security Agency will kill the U.S. technology industry singlehandedly” as these companies “may be just dealing with the difficulty in meeting our numbers through the end of the decade

• NSA Reform Legislation Stalled in Congress

Potential EU Safe Harbor Suspension

Foreign Policy (especially China)

US-ICANN Transfer

Cyber Security Legislation Stalls

NSA FALLOUT ALSO SEEN IN THESE AREAS

THE WORLD IS NOT ENOUGH

ICANN-AMA EDITION

ICANN TRANSFER

• MOU with DOC/NTIA ends 2015 • but can be extended 4 additional years

• ICANN Transition must • Support and enhance the multi-stakeholder model; • Maintain the security, stability, and resiliency of the Internet DNS; • Meet the needs and expectation of the global customers and partners of the IANA

services; and, • Maintain the openness of the Internet.

• Pro • Part of original plan for ICANN • US Maintaining Control Strengthens Case for Other Powers to Challenge US Control

• Con • Political move to deflect NSA scandal. • Panama Canal analogy • Concerns about censoring governments gaining control

“We built it, we paid for it, it’s ours, and we are going to keep it.” Ronald Reagan on Panama Canal transfer

The XYZs of New gTLDs

417

1226

287

0

New gTLDs

Approved and Live Pending Approval Withdrawn

587,374

139057

117611

75,031

72,978

51869

46274

44372

41696

0

.xyz

.berlin

.club

.wang

.guru

.ovh

.photography

.london

.link

.

0 100,000 200,000 300,000 400,000 500,000 600,000 700,000

New gTLD Sales

New gTLD Sales

POINT BREAK

CYBER SECURITY

Year of the Drunken Burglar

2013-2014

Mandiant exposes Chinese People’s Liberation Army (PLA) Cyber Espionage Units. Concludes China is escalating economic espionage because it believes benefits outweigh international backlash.

Spring-Summer 2014

Justice Department indicts PLA officers for Computer Fraud and Abuse Act violations, aggravated identity theft, economic espionage and trade secret theft.

CrowdStrike Report exposes another PLA cyber espionage unit and concludes “China’s decade-long economic espionage campaign is massive and unrelenting.”

Fall 2014

Senate Armed Services Committee report details Chinese hacking of U.S. defense contractors.

FBI Director Comey compares Chinese to “drunken burglars”

醉防盗的一年

Dude, Where’s My Domain?

• Domain Theft • Via Hack • Via Phishing

• DomainGang: Ename quickly becoming “the domain venue of choice for laundering stolen domain names.”

• Remedies • UDRP • Anti-Cyber Squatting Protection Act

(in rem)

Dude, We Have to Call a Lawyer

FTC Wins Wyndham Challenge (Round 1)

• Wyndham challenged FTC consent decree over data breach.

• The FTC has not published any rules or regulations that might provide the business community with . . . notice of what data-security protections a company must employ to comply with Section 5.

• Court rejected motion to dismiss • And this decision does not give the FTC a blank check to

sustain a lawsuit against every business that has been hacked. Instead, the Court denies a motion to dismiss given the allegations in this complaint— which must be taken as true at this stage—in view of binding and persuasive precedent. FTC v. Wyndham Worldwide Corp., No. 2:13-cv-01887, 2014 BL 94785 (D.N.J. Apr. 7, 2014))

• Court Approved Wyndham’s Request for 3rd Cir. Review

Fandango/Credit Karma Consent Decrees

• Companies • Did not follow “industry-leading security

precautions”

• Did not run basic tests

• Disabled SSL certificate validation

• FTC Blog Post offers tips to app developers • Exercise extreme care when modifying security

defaults.

• Test your app thoroughly before releasing it.

• Consider how people will use your apps.

• You’re responsible for what others do on your behalf.

• Keep your ear to the ground and consult available resources

FTC Is Serious About Mobile Security

You’ve Had a Data Breach, Now What?

5.85 million Average cost per data breach for U.S. company

$509,237 Average notification cost per breach

$3,324,959 Average lost business costs per breach

$574,984 Average cost of defense of a data breach lawsuit

$258,099 Average settlement for a data breach lawsuit

Source: Ponemon Institute and Net Diligence

Comply with All Applicable State Data Breach Notification Laws (only AL, NM and SD do not have one).

Public Companies must also consider SEC reporting requirements.

Insurance – not included in advertising injury. Zurich American Insurance Co., et al. vs. Sony Corp. of America, No. 651982/2011 (N.Y. Sup. Ct. New York Cty. 2014).

Restore consumer confidence. Target breach cost it sales (2.5% decline) and a CEO.

YELP*

REPUTATION MANAGEMENT

THE YELP! CONUNDRUM

Yelp Under Scrutiny • Over 2,000 FTC Complaints Since 2008

Yelp! has been plagued by charges that it engages in extortionate practices in which it promises to provide a more favorable mix of reviews should a business advertise with Yelp! or conversely retaliate should it not.

• Substantial Hurdles to Liability

• Section 230 Immunity

• Anti-SLAPP Motion

CDA Immunity • No provider or user of an interactive computer

service shall be treated as the publisher or speaker of any information provided by another content providers. Communications Decency Act of 1996 (“CDA”), 47 U.S.C. § 230(c)(1)

• “By its plain language § 230 creates a federal immunity to any cause of action that would make service providers liable for information originating with a third-party user of the service.” Zeran v. American Online, Inc., 129 F.3d 327, 330 (4th Cir. 1997), cert. denied, 24 U.S. 937 (1998).

NOT SO ABSOLUTE ABSOLUTE

David S. Ardia, Free Speech Savior or Shield for Scoundrels: An Empirical Study of Intermediary Immunity under Section 230 of the Communications Decency Act, 43 Loy. L.A. L. Rev. 373 (2010).

CHASING YELP!

WIN SOME

• Court rejected claim that Yelp practices were extortion since that requires that litigant have “a pre-existing right to be free from the threatened harm, or that the defendant had no right to seek payment for the service offered.” Yelp’s actions were not a “wrongful use of economic fear”. Boris Y. Levitt, et al. v. Yelp Inc., No. 11-17676, 2014 U.S. App. LEXIS 17079 (9th Cir. Sept. 2, 2014)

• Fact that Yelp! Created star rating based on reviews, did not “transform an interactive computer service into a developer of the underlying misinformation.” Kimzey v. Yelp Inc., 2014 WL 1805551 (W.D. Wash. May 7, 2014).

LOSE SOME

• FTC Consent Decree For COPPA Violations

• Cal. Court of Appeal judge reversed a SLAPP dismissal of a False Advertising action based on Yelp’s claims that each review “passed through a ‘filter’ that gave consumers the most trusted reviews.” Demetriades v Yelp!, 2014 WL 3661491 (Cal. App. Ct. July 24, 2014).

• Pending Complaint under Securities Laws for misrepresentations its contributors posted first-hand reviews of local business, and boasted of the quality of its reviews and the robust nature of the Company’s recommendation software, which was purportedly designed to screen unreliable reviews. Curry v Yelp!, Case No. 3:2014cv03547 (C.D. Cal. 2014).

DUTY TO WARN EXCEPTION TO CDA – Doe v Model Mayhem • Instead, Jane Doe attempts to hold Internet Brands liable for

failing to warn her about how third parties targeted and lured victims through Model Mayhem. The duty to warn allegedly . . . would not require Internet Brands to remove any user content or otherwise affect how it publishes such content. Any obligation to warn could have been satisfied without changes to the content posted by the website’s users. Internet Brands would simply have been required to give a warning to Model Mayhem users, perhaps by posting a notice on the website or by informing users by email what it knew about the activities of [the rapists]. . . .

• The theory is that Internet Brands should be held liable, based on its knowledge of the rape scheme and its “special relationship” with users like Jane Doe, for failing to generate its own warning. Liability would not discourage “Good Samaritan” filtering of third party content. The core policy of section 230(c), reflected in the statute’s heading, does not apply, and neither does the CDA’s bar.

Jane Doe No. 14 v. Internet Brands, Inc., 2014 WL 4627993 (9th Cir. Sept. 17, 2014)

THE CASE OF THE BENGAL CHEERLEADER AT THE CYBER ZOO – Jones v. Dirty World Lower Court Finds Liability

• the manner in which it is managed, and the personal comments of defendant . . ., the defendants have specifically encouraged development of what is offensive about the content of the site.” Jones v. Dirty World Entertainment, 840 F. Supp.2d 1008 (E.D. Ky. 2012)

Sixth Circuit Reverses

• We note that the broad immunity furnished by the CDA does not necessarily leave persons who are the objects of anonymously posted, online, defamatory content without a remedy. . . . [May sue poster of content.] But, under the CDA, Jones cannot seek her recovery from the online publisher where that publisher did not materially contribute to the tortious content.

• Given the role that the CDA plays in an open and robust internet by preventing the speech-chilling threat of the heckler’s veto, we point out that determinations of immunity under the CDA should be resolved at an earlier stage of litigation. Jones v. Dirty World L.L.C., --- F.3d ----, 2014 WL 2694184 (6th Cir. 2014)

KLEARGEAR’S SELF-INFLICTED WOUND

Attempt to enforce non-disparagement clause becomes cause célèbre, resulting in judgment of $354K.

CALIFORNIA PASSES ANTI-KLEARGEAR LAW

A contract for the sale or lease of consumer goods or services may not include a provision waiving the consumer’s right to make any statement regarding the seller or lessor or its employees or agents, or concerning the goods or services.

RIPOFF REPORT UNDER CRIMINAL INVESTIGATION

An Iowa prosecutor has indicted a Rip Off Report operative for using the site for witness and jury tampering.

MADMEN

VERSUS THE REGULATORS

NATIVE v PAID ADVERTISING

• 2002 and 2013 FTC Sent Letters to Search Engines

• any paid ranking search results are distinguished from non-paid results with clear and conspicuous disclosures;

• the use of paid inclusion is clearly and conspicuously explained and disclosed; and

• no affirmative statement is made that might mislead consumers as to the basis on which a search engine is generated.

• December 2013 FTC Workshop • National Advertising Division has heard several

Native Advertising claims in 2014

FTC’s CRITICAL OF MOBILE SHOPPING APPS FTC STAFF STUDY:

• Apps studied often failed to provide pre-download information on issues that are important to consumers.

• Prior to download, few of the in-store purchase apps provided any information explaining consumers’ liability or describing the app’s process for handling payment-related disputes.

• Additionally, although nearly all of the apps made strong security promises and linked to privacy policies, most privacy policies used vague language that reserved broad rights to collect, use, and share consumer data, making it difficult for readers to understand how the apps actually used consumer data or to compare the apps’ data practices.

What’s the Deal? An FTC Study on Mobile Shopping Apps

FTC CHECK SWINGS ON ENDORSEMENT GUIDELINE ENFORCEMENT

• Cole Hann launched a Wandering Sole promotion in which consumers could win a $1,000 shopping spree by posting images using the Wandering Sole hash tag on Pinterest. Warning only since had not previously stated applied to Pinterest.

• The FTC also took no action over Yahoo “astro-turfing”, i.e., employee reviewing their own app, due to limited scope, no incentivizing by Yahoo! and the app was free so no meaningful consumer harm.

In 2010, six Northern California County District Attorneys filed suit against Overstock for fraudulent price comparisons in Alameda County Superior Court.

In January 2014, the court assessed a $6.42 million fine for overstating the differences in comparing prices with its competitors in violating of California’s unfair competition and false advertising laws. Many of the comparison prices were simply fabricated.

Overstock would have been wise to consult the FTC’s Guide Against Deceptive Pricing.

OVERSTOCK TAGGED FOR $6.4M FOR DECEPTIVE PRICING CLAIMS

CANADA’S SPAM LAW TAKES EFFECT

Although passed in December 2010, the Canadian law went through a regulatory maze and did not go into effect until July 1 (which is also Canada Day) 2014. The new law prohibits

• sending of commercial electronic messages without the recipient’s express consent, including messages to email addresses and social networking accounts, and text messages sent to a cell phone;

• alteration of transmission data in an electronic message which results in the message being delivered to a different destination without express consent

• use of false or misleading representations online in the promotion of products or services;

• collection of personal information through accessing a computer system in violation of federal law ; and

• address harvesting

• The law establishes damages of $200 for email violation up to $1 million per day.

CANADA’S SPAM LAW TAKES EFFECT - 2

The law phases in some key provisions, including:

• a prohibition that addresses the unauthorized installation of computer programs or use of a bot to send email from another computer (January 2015);

• a private right of action which may proceed only if no governmental action (July 1, 2017); and

• A company has 36-months to convert implied consents based on a prior business relationship to express consents.

California Spam Statute

• Irrespective of the allegedly untraceable domain names herein, the identity of the sender was readily ascertainable from the body of the emails; therefore, Plaintiffs failed to state a cause of action against Guthy for misrepresented header information under section 17529.5, subdivision (a)(2).

• The court also rejected Plaintiffs attempt to trigger liability based on whether the email subject line alone was misleading and not whether the emails are misleading in their entirety

MEMENTO

REGULATING REVENGE PORN

STATE REVENGE PORN LAWS

California law prohibits • person who intentionally distributes by any means

an image of the uncovered, or visible through less than fully opaque clothing, body part or parts of another identifiable person or an image of another identifiable person engaged in a sexual act, knowing that the depicted person does not consent to the distribution of the image, is guilty of disorderly conduct.

Provides a private right of action and injunctive relief for • Material distributed without consent that exposes

an intimate body part of the other person, or shows the other person engaging in a sexual act; and

• causes emotional distress to the other person.

IN BRIEF

FACEBOOK, OK CUPID DRAW FIRE FOR USER EXPERIMENTATION

Both studies ignored ethical requirements that:

• each potential subject must be adequately informed of the aims, methods, sources of funding, any possible conflicts of interest, institutional affiliations of the researcher,

• the anticipated benefits and potential risks of the study

• and the discomfort it may entail, post-study provisions and any other relevant aspects of the study. The potential subject must be informed of the right to refuse to participate in the study or to withdraw consent to participate at any time without reprisal.

NINTH CIRCUIT ORDERS YOU TUBE TO TAKE DOWN CONTROVERSIAL VIDEO

Plaintiff actress claimed the use of her performance without authorization constituted copyright infringement and the court agreed even though her performance constituted only 5 seconds out of a thirteen minute video.

The dissent disagreed that the performance is copyrightable. Congress has listed examples of copyrightable works, like architectural works, motion pictures, literary works, and pictorial or sculptural works. . . In no case does copyright protection” extend to an acting performance, “regardless of the form in which it is described, illustrated, or embodied in” the original work.

Garcia v. Google, Case No. 12-57302 (9thCir. 2014)

POTENTIAL SETTLEMENT OF US-ANTIGUA ONLINE GAMBLING DISPUTE

• 2007 WTO Awarded Antigua $21M/YR for blocking US Online Gambling Market

• Authorized Antigua to collect by disregarding US copyright laws

• Prior Prime Minister was establishing commission to implement

• New Prime Minister seeks lump sum ($100M) which is less than accrued penalties to date.

CROWDFUNDING REGS STILL NOT FINALIZED

In 2012, President Obama signed the JOBS Act which had several provisions designed to spur crowdfunding:

• changing rules for advertising and solicitation of private investment offerings to accredited investors; and

• allowing companies to raise up to $1M through non-accredited investors using crowdfunding platforms.

Only the first part is in effect, as the SEC has yet to finalize the regulations to implement the crowdfunding for non-accredited investors.

ABOUT BENNET KELLEY Bennet Kelley is the founder of the Internet Law Center. He previously had worked in-house with internet marketing and e-commerce companies such as ValueClick.

He is the publisher of the award-winning newsletter Cyber Report and host of Cyber Law and Business Report on WebmasterRadio.fm.

In addition to being Vice-Chair of the Technology, Internet and Privacy Interest Group of the California Bar IP Law Section, Bennet previously served as Co-Chair of the Business Law’s Cyberspace Committee where he led the effort to create a cyberspace law primer for state policymakers.

Bennet was selected by the U.S. Department of Commerce to present on e-commerce issues at the 17th U.S.-China Legal Exchange in China. He also was selected by a leading NGO to participate in a discussion of internet law with leading Chinese netizens.

In 2014, Bennet was named by the Los Angeles Business Journal as one of the most influential lawyers in Digital Media and E-Commerce.

Bennet graduated manga cum laude from Georgetown University Law Center and is admitted in California, the District of Columbia and Maryland (inactive).