The World Wide Web and the New World of Litigation: A Basic Introduction
Brady, Michael J., Monin, Lawrence O., Tingley, Curtis R., Skelton, Timothy L., Defense Counsel Journal
If legislatures, courts and policy makers fail to distinguish among the differing roles of ISPs, irrational liability decisions may be the result
THE rise of the Internet has challenges for the judiciary: they now will be required to apply laws that were written for the tangible world of paper and telephone to the new world factual setting created by computers. Can the old doctrines be boldly lifted and applied to the new concepts? This is the challenge.
It is vitally important to any intelligent discussion of Internet-related law that the participants understand the fundamentals of Internet transmission and the relationships between the parties. It also is important for the participants to understand the different services--World Wide Web, e-mail, Usenet--that collectively comprise what the end user perceives as the "Internet."
CONTENT CREATION V. DISTRIBUTION
There is a fundamental distinction between the entities that create Internet content and those that merely distribute it or provide access to content. With a few exceptions--for example, issues involving jurisdiction and applicable law--the Internet does not provide significant new legal challenges for content providers. Although there are some state-level common law issues, such as defamation, privacy, torts, etc., the substantive bodies of law that have generated the most reported litigation to date are typically federal and statutory--copyright, trademark, patent, etc. Conventional application of existing legal doctrines usually will be reliable in determining the liability of content providers. The Internet merely introduces problems of scale by amplifying content providers' potential scope of liability.
Most of the more significant unsettled Internet liability issues involve the vicarious or secondary liability of service providers or distributors. This introduces the classic "deep- pockets" policy concern. To what extent is it fair to impose secondary liability to ensure that a plaintiff can find a solvent defendant? The Internet introduces several unique considerations to the standard tort liability calculus.
First, there is the strong public policy consideration of maintaining free access to information. Lawmakers and courts are justifiably concerned about hampering the limitless potential benefits of friction-free Internet commerce and information exchange. Second, imposition of liability on service providers introduces problems of scale. If vicarious liability is aggressively imposed, it is difficult to articulate a legal standard that would not impose liability on every entity involved in the transmission of the offensive or illegal material. Finally, in order to preserve innovation, legislation must be flexible and minimal in order to provide needed technological and legal standardization while preserving the delicate balance between the private entities that comprise the Internet.
Since a service providers' liability for subscriber-generated content typically involves the degree of control that the provider can exercise over that content, some of the key issues are:
* What is a "copy" in the digital realm?
* How transient is the material (i.e., does the provider host content or merely pass digital data through its network)?
* Was the material posted by a subscriber, or was the material automatically forwarded by another provider's subscriber?
* How much similar material is present (i. e., is it feasible to monitor large volumes of data)?
* Is it possible for the provider to determine that a particular item of content is offensive or illegal (e.g., is the message unreadable or encrypted)?
* Should the fact that provider has voluntarily undertaken to monitor or screen content increase its liability?
In the United States, Congress attempted to respond to these concerns in late 1998 with the passage of the Digital Millennium Copyright Act (DMCA).(1) Although the DMCA is limited to copyright, it is likely an indicator of the nature of future Internet-related legislation in other substantive areas. The DMCA simultaneously increases copyright protection for content providers and establishes "safe harbors" against liability for service providers. It thus resolves two issues common to most Internet-related liability: (1) how do existing statutes apply to new technology, and (2) who should be held liable for violations of those statutes?
* Implements the World Intellectual Property Organization (WIPO) treaties, which increase copyright protection. A stand-alone bill previously failed owing to bitter opposition from service providers.
* Provides reciprocal international copyright protection for all signatory nations.
* Introduces civil and criminal liability for circumvention of anti-copy and anti-unauthorized use technological measures, with exceptions provided for fair use, reverse engineering, security testing, and other similar uses.
* Mandates anti-copying circuitry on new video cassette recorders.
* Requires the U.S. Copyright Office to conduct studies evaluating possible technological solutions to infringement and issue a report within one year.
* Implements the Online Copyright Infringement Liability Limitation Act, which reduces potential liability for service providers. A stand-alone bill previously failed owing to bitter opposition from content providers.
* Eliminates potential liability of service providers for transitory communications, system caching, information stored by direction of users, and information location tools. To be eligible, a service provider must (1) adopt a reasonable policy for terminating the service of repeat infringers and (2) must accommodate and not interfere with "standard technical measures" to prevent infringement.
* Establishes a procedure whereby a copyright owner can obtain an order from a U.S. district court requiring the service provider to disclose the identity of an infringing subscriber.
* Explicitly states that service providers are not responsible for monitoring content if that monitoring would violate a user's statutory or constitutional rights to privacy.
* To escape liability for infringing material stored at the direction of a subscriber--for example, a user's web page--the provider (1) must not have knowledge that the material infringes, (2) if the provider has the fight and ability to control the activity, it must not receive a direct financial benefit from the infringement, and (3) the provider must promptly remove or block access to the material upon proper notification.
The DMCA also contains various other miscellaneous provisions relating to the webcasting of sound recordings and limits on liability for nonprofit and educational institutions.
In sum, the DMCA appears to be a fair and balanced apportionment of liability for online copyright infringement. It has answered many of the critical issues in this area. It addresses the three concerns outlined above in that it does not significantly hamper the growth of the Internet by unfairly apportioning liability, it intelligently differentiates between types of service providers, and it is minimal and flexible. Although Internet copyright issues are far from settled, at least the courts no longer will be asked to decide the larger policy-driven issues, but instead will be left to perform a more mechanical application of the statute to facts.
Although we have a general belief in states' rights, Internet-related issues inherently cross state lines and demand uniform national legislation. It is logical that copyright issues would be resolved first, as all content on the Internet is inherently potentially protected intellectual property. In order to have value on the Internet, that intellectual property must be capable of rapidly being copied elsewhere. We believe that other Internet-related liability issues in the United States also will be resolved with national legislation in the near future.
A. Service Providers
At least as far as copyright liability is concerned, service providers should pursue a public "hands-off" policy, but they should quickly and privately respond to complaints to the extent possible. For some providers, such as web site hosting companies, this might mean immediate notification of the web page author that the provider has received a complaint about the web page and that the provider will temporarily block the page unless the author responds immediately. All service providers should carefully draft the terms of their service agreements to shield themselves from liability in such situations.
For other providers, such as Usenet server operators, monitoring content or responding to notices of infringement is simply not feasible. Public acknowledgment of this fact would seem to be the prudent course of action. For example, Newscene, a large Usenet news provider, has a novel strategy for limiting its liability. On its home page--http://www.newscene.com (visited April 1, 1999)--Newscene prominently displays a hyperlink entitled "content disclaimer." The linked page provides, in part:
It is possible for illegal messages to be posted to any group on Usenet and Newscene has no way of monitoring or controlling this. Newscene is not in a position to determine what is illegal as Newscene does not monitor the content nor is qualified to judge what is illegal. If you feel a customer of Newscene is using the service for illegal purposes, please contact the appropriate law enforcement officials. If you feel a customer of Newscene is using the service to violate copyright laws please contact the copyright holder directly. If Newscene is presented with a court order to remove messages, cancel an account, remove a newsgroup, or log a customer's activity, then Newscene will have no choice but to comply with the court order. Let it be known then that Newscene is not the censor, but rather the court who issues the order is the censor.
This hands-off approach is not only sensible but also mandated by the Usenet medium. As a worldwide bulletin board service, Newscene is medium where blatantly infringing and libelous messages are epidemic. For technological reasons, a Usenet server operator is practically powerless to stop the abuses. Most Usenet posting is done anonymously. The vast majority of the content on a server is not provided by a subscriber of that server but is automatically forwarded by other servers. Message removal is not practical; even if the message is deleted from the server, it will reappear in the incoming feed from other servers. There are more than 45,000 newsgroups and more than a million messages a day. Usenet messages come from users around the world, where copyright and other laws vary widely.
In some cases, evidence that a service provider had exercised editorial control in the past has been used to increase its liability by providing proof that the provider possessed the ability to monitor the content on its system. On the other hand, very few courts have imposed constructive knowledge on service providers without proof of past editorial control. Although the DMCA provides a "safe harbor" for voluntary policing efforts, the safest course of conduct for service providers is to adopt a wait-and-see policy. For a service provider such as Newscene, the most prudent course of conduct would be to continue its current hands-off policy, but to amend its content disclaimer and terms of service agreement notice to provide a clearer statement of the new "take-down after proper notice" provisions of the DMCA and to erect a better shield from liability for wrongful termination of service.
B. Content Providers
Although the Internet greatly increases the risk that an author's intellectual property will be misappropriated, the Internet also provides certain tools to prevent and monitor intentional or accidental abuses. First, there are many technological solutions available to prevent unauthorized copying and use of digitally rendered works. Second, there are companies that scan the Internet to locate unauthorized copies of infringing works or marks. Finally, there is a new company, Firstuse.com, that provides Web-based time-and-date-stamping of digital works, providing strong evidence of first use.
To those without an understanding of the Internet, cyberspace can seem as intimidating and threatening as it does promising. Even most of the experienced Internet users do not understand its underlying technologies. Indeed, many Internet visionaries and computer market leaders see information services as a future utility that will delivered by user-friendly "information appliances" and are therefore making a conscious effort to keep information technologies transparent to the average user. This school of thought is the same as that which teaches the telephone users don't need to know how the entire telephone system works in order to place a call.
While there may be little utility in requiting the average Internet user to understand its technological architecture, it is essential that legislatures and courts have an understanding. Knee-jerk reactions by uninformed lawmakers and courts will add to the growth-stifling uncertainties about the future of the Internet. As one Internet publishing executive noted: "This legislative time-gap between what politicians understand well enough to regulate and what is technologically operative today is an abyss of potential legal and financial risk."(2)
"Cyberspace" isn't at all like interstellar space. Whereas interstellar space is a void, cyberspace is a finite, but complicated, system of computers, wires and people.
A. Bulletin Board Services, Internet Access Providers and Online Services
Before the recent rise in popularity of the Internet, most computer communications were accomplished through bulletin board services. As a result, much of the legal precedent and commentary involving computer communications has been based on bulletin board service technology. The technological architecture of Internet, however, is dramatically different from that of a bulletin board service.
1. Bulletin Board Services
A bulletin board service (BBS) is a central computer that serves as an electronic message center.(3) A caller reaches a BBS by dialing in directly to the BBS host computer, or "server." It is possible, however, to dial into one BBS and to use a communications service such as Telnet to reach another.(4) Since most BBSs are either private or commercial enterprises, a BBS operator, or "sysop," typically controls access by requiring callers to enter a user name and password, which are provided only to those who have paid the subscription fee and/or been approved. "Sysop" generically refers to the person or organization responsible for administering a server.
Callers to a BBS can play online games, communicate with other users in "chat rooms," send (upload) and retrieve (download) files, and send (post) or retrieve messages. The software packages used to run BBS servers are proprietary and non-standardized, so the services available on any given BBS are defined both by the capability of the software and the sysop's choice as to which of the available services he wishes to enable.
2. Internet Access Providers
Although some users may be able to connect to the Internet through schools, libraries, and even businesses, 70 percent of users access the Internet from home using a commercial service provider, either an online service or an Internet access provider (IAP).(5) IAPs range in size from large commercial providers like AT&T's Worldnet Service and Netcom to small local providers with perhaps only a hundred accounts.
Connecting to an IAP is similar to connecting to a BBS. Callers instruct their computer to call the IAP's remote host computer, and then they are required to provide their unique user name and password combination. Once logged on to an IAP, however, the similarities end.
An IAP's communications server provides no services of its own. It merely provides a gateway to the Internet, allowing the caller to access the virtually unlimited range of available Internet services by connecting to an Internet server hosting that service. IAPs, therefore, do not provide content; they merely provide access to content located elsewhere.
Because of the vastly greater audience, reach and flexibility of the Internet, BBSs are becoming obsolete, and their numbers are dwindling.(6)
Since each Internet server functions much like a BBS server, and there are thousands of Internet servers available from a single connection to an IAP, the IAP's "on-ramp" to the so-called Information Superhighway has largely replaced the closed environment of BBSs. Some BBSs have begun to add "gateways" (access) to Internet services. To the extent that they do so, they begin to resemble an online service.
3. Online Services
Online services, such as America Online and CompuServe, are somewhat of a hybrid between an IAP and a BBS. They not only provide Internet access, like an IAP, but they also provide their own proprietary value-added services, like a BBS. Once connected, callers have access not only to the online service's host computers but also to the other remote Internet servers. Although the number of users connecting to the Internet through online services continues to grow in absolute terms, they are quickly losing market share to the more direct connection offered by IAPs. Content and services once found only on an online service are now available on the Internet.(7)
As opposed to IAPs, online services allow users access to a broad array of content provided by the online service itself. This simple but often overlooked distinction is critical to a meaningful analysis of service provider liability. Since existing legal doctrines are largely sufficient to address issues related to provider-supplied content, value-added service providers like BBSs and online services, to the extent that they provide their own content, should be able to implement polices to reduce their exposure to liability for their own content.
The more challenging legal questions surround the liability of a service provider for user-supplier content. The degree to which a provider has both the right and ability to exert control over user content is often a critical legal distinction. At one extreme are BBSs, which provide subscribers with access to content physically contained in the mass storage devices of their servers. This access provides BBS sysops with some ability to control the content, and since the content has been supplied either by the sysop or a BBS subscriber, BBS sysops typically have the right to remove content.
At the other extreme are IAPs, which provide access only to content resident on servers located outside their system. Since IAPs have no physical access to that information, it has neither the right nor the ability to control that content.
The primary shortcoming of this polar classification, however, is that IAPs typically provide more than simple access to the Internet. Most also operate servers in order to provide their subscribers with basic Internet services such as e-mail, Usenet news, and web page hosting.(8) Thus, the term "Internet service provider" (ISP) is a more accurate description of most IAPs. As we use "ISP" in this article, it is meant to encompass both providers that offer only access to the Internet and those that also operate Internet servers.
B. What Is the "Internet?"
The Internet seems quite daunting--and justifiably so. Although like most fields in high technology, Internet technology is expressed in a strange language consisting of an alphabet soup of acronyms and complex technical jargon,(9) the basic concepts are simple. It is not a commercial entity or, in fact, an entity at all. Like the international telephone system, the Internet is a network of interconnected networks. It is the result of a series of agreements between the institutional owners of large networks. There is no central governing body.
Operational policies and technical standards are set by three international volunteer groups.(10) The Internet Society (ISOC) is responsible for the global cooperation and coordination of the Internet.(11) The Internet Architecture Board (IAB), composed of specially appointed members of ISOC, decides on the essential hardware and software standards.(12) Policies that govern relations among the network owners are handled by the Internet Engineering Task Force (IETF), which is a voluntary association of network designers, operators, vendors and researchers.(13)
Starting in the 1960s from a single network with just a few computers, the Internet has gradually added new commercial networks. These core networks, called the Internet "backbones," are high-speed data pipelines, interconnected with one another to form the heart of the Internet.(14) Although network interconnections are often made at other intermediate points, in general, national networks connect to the backbones, smaller regional networks connect to the national networks, Internet service providers connect to the regional networks, and businesses and consumers connect to ISPs. In 1992, there were less than a million host computers and less than 7,000 networks connected to the Internet, but by the end of 1997, the Internet had grown to almost 20 million hosts and more than 1.3 million networks.
The key element that made the creation of the Internet possible was the agreement to use a common language, known as Internet protocol (IP), and a
common unit of communication, the IP "packet." Internet protocol specifies that data must be sent in a fixed size "datagram," which is colloquially referred to as a "packet" or "IP packet." The size of the packet will vary depending on the particular network over which it must travel.(15)
A useful analogy is to visualize the Internet backbones as the postal system and the IP packets as postcards. Each computer on the Internet is assigned a unique number, called its "IP address." Like a postcard, each IP packet is small and of a uniform size. A large message is broken up into many small packets. Also like a postcard, each packet is labeled with both destination and return addresses--the IP addresses of both the origination and destination computers. The computers at the ends of each physical link in the Internet ("routers") act like postal workers, sorting each packet and forwarding it another "midstream" router closer to the destination computer.(16)
Because each packet is individually addressed, although the packets typically get bounced around from computer to computer on their way, the routers can determine where each individual packet is heading and also from where it came. As a result, despite many different packets taking many different paths, the destination computer can reconstruct each message by sequentially ordering the individual packets as they arrive. The volume of packets traveling the Internet is staggering. In the 24-hour period ending February 23, 1998, the routers at the New York network access point, one of the four major network interconnecting points, carried as many as 25,000 packets per second.(17)
This seemingly chaotic system of message propagation was purposely designed into the Internet. The predecessor to the Internet was a network called ARPANET, created in 1969 by the Advanced Research Project Agency (ARPA), which was funded by the U.S. government to network the computers of certain universities, defense contractors, and the military. This system of dynamic routing of small packets of information would allow the network to continue to function even if portions of the system were destroyed by a military attack.(18)
Although personal computers are capable of creating the packets, individual users cannot directly gain access to the Internet. To bridge this gap, an ISP creates an intermediate network--like the local post office--between its dial-up subscribers and the Internet. At the subscriber end of this network is a device called an "access server," and at the other end is a router connected to the Internet. A caller's computer transmits and receives packets from the ISP's access server using a standard language called point-to-point protocol (PPP).(19)
When a caller initially connects to an ISP, the ISP's access server assigns to the caller's computer a 12-digit IP address from the pool of IP addresses the ISP has registered, a process called "dynamically assigned addressing." Service providers purchase contiguous blocks (CIDR blocks) of consecutive IP addresses. Rather than permanently assigning each IP address to a given subscriber, the ISP is able to maximize its fixed allocation of IP addresses by assigning them only as needed. Most service providers use this method of "dynamically assigned addresses." The alternative method of fixed IP addresses, whereby each user is permanently assigned an IP address, is inefficient. Under the fixed IP address system, for instance, a service provider with a 100-address CDIR block is limited to 100 subscribers. By dynamically assigning these addresses, the provider is able to take advantage of the fact that its subscribers are not constantly connected.(20)
At the moment the caller's computer is assigned an IP address, it actually becomes part of the Internet. It now can communicate with any other computer connected to the Internet because the remote computer now has a return address (the caller's assigned IP address) to which it can send its reply. The ISP's network translates the caller's incoming PPP packets into Internet-standard IP packets and forwards them to its routers, which in turn connect to other routers on a regional network. Information returning simply follows the reverse procedure.
C. Internet Services
In addition to an understanding of the Internet itself, a real-world, nut-and-bolts understanding of the mechanics of how infringing works and abusive messages are actually exchanged is crucial to the issues of Internet liability. Because the Internet provides only the link between computers, it is necessary to use one of several Internet services in order to transmit information. There are several commonly used Internet services, and it is well to know how each service works, how each is used to facilitate online abuses, and the degree to which sysops can detect and respond to these abuses. While directed specifically at copyright infringement, the mechanics of transmission and potential sysop responses described below will be the same for libelous messages and other illegal or improper communications.
1. Electronic Mail
One of the simplest and most widely used Internet services is electronic mail, or e-mail, a user-to-user worldwide messaging system. In order to use e-mail, users arrange with a mail server sysop to establish a "mailbox," which is a defined space on the mail server's mass storage devices and in which incoming mail is stored. Users are assigned a unique user name and password combination to prevent unauthorized access to the mailbox.
Although files (that is, documents) may be sent by using e-mail, its potential as a medium of massive copyright abuse is inherently limited by its single user-to-single user propagation. E-mail messages must be individually sent to each user. While an e-mail message may be sent to many recipients, the messages still inherently must be sent individually to each recipient's mail server. There are, however, computers called "mail exploders" or "list servers" that provide the user with the ability to send a single e-mail message to all users on a particular list.(21)
Mail server sysops also typically limit the size of each mailbox, making the exchange of large files like pirated software cumbersome since, to avoid filling up the recipient's mailbox, large files must be split into smaller messages and sent over a period of time.
Another problem for the would-be e-mail abuser is that return addresses are normally attached to the messages by the sending mail server, thereby making messages relatively easy to trace to the sender. This safeguard is to a certain degree eliminated by the use of certain mail servers known as "anonymous remailers," mail servers designed to conceal the sender's identity by replacing the message's return address with an address pointing to the remailer. Any reply to that message is sent through the same remailer, which maintains a list enabling it to reverse the procedure, forwarding the reply to the recipient's true address.
Since the remailer system is premised on the sysop's implicit promise not to divulge that information, faith in the security of anonymous remailers has been shaken since the sysop of the most popular remailer, Finland-based anon.penet.fi, was compelled by Finnish authorities to disclose the identities of three user's names.(22) A user may obtain more secure anonymity by "chain-remailing," a method by which users send their e-mail message to one remailer, which in turn sends it to another remailer, and so on.
The only way to send e-mail with absolute anonymity, however, is to use an anonymous remailer that removes the original return address and inserts nothing in its place. The obvious limitation with using such a remailer is that the sender cannot get a reply unless the recipient already knows his return address. It is highly impractical to use anonymous remailers as a method of piracy, however, since most remailers severely restrict the maximum individual message size, making it impractical to exchange large works, such as software and images.(23)
A mail server sysop has little ability to detect infringing or abusive messages on its server. Since e-mail is a one-to-one messaging system, e-mail users have an expectation of privacy, although e-mail sent or received from a user's place of business provides an exception to this rule. Many companies routinely monitor the e-mail of their employees.(24)
More important, the Electronic Communications Privacy Act of 1986 makes it a federal crime to intercept e-mail (18 U.S.C. [subsections] 2510-2521) or to view stored electronic communications (18 U.S.C. [sections] 2701-2709). There are, however, several provisions in the act that allow sysops to investigate potential e-mail abuses in order to protect their own interests or to assist law enforcement. The sysop may engage in random checks for the purpose of quality control and intercept any messages necessary for "the protection of the rights or property of the provider of that service." 18 U.S.C. [sections] 2511(2)(a)(i). Provided it follows strict procedures, the government may require the sysop to intercept messages at the request of authorized government officials. 18 U.S.C. [sections] 2511(2)(a)(ii).
Finally, it should be noted that e-mail users are increasingly relying on encryption to ensure e-mail privacy. It is virtually impossible for the sysop to view the contents of an encrypted message.
2. File Transfer Protocol
Another widely used Internet service is file transfer protocol (FTP), a file transfer service using remote servers as a storage medium.(25) Although FTP server sysops control access by requiring visitors to supply a user name and password combination, many servers allow the visitor to log on "anonymously." The typical anonymous login procedure allows the visitor to use "anonymous" or "guest" as a user name and an e-mail address as a password. Since most FTP servers do not have the ability to check the information supplied, the visitor can log in with any fictional name and e-mail address.
Anonymous visitors are typically restricted as to which files they may access and frequently are not allowed to upload files to the server. Once connected to an FTP server, the user can navigate the directory structure of the server and select files to transfer. File descriptions usually are not presented, although many FTP servers provide text files briefly describing the contents of the files in any given directory. Since most FTP servers follow the UNIX convention of eight-character file names with three-character suffixes, or "extensions," filenames are displayed in the format xxxxxxx.xxx, which inherently limits the amount of information conveyed.
The use of FTP servers as a medium for intellectual property theft is widespread, primarily through their use as "drop sites."(26) To create a drop site, users log on to an FTP server, either anonymously or using a stolen password, and then use the server to exchange pirated works. These drop sites are only temporary, however, as FTP server sysops eventually discover and delete the files. One method used to help delay this inevitable discovery is the use of "hidden directories." This involves creating the drop site directories using certain attributes that make them partially invisible to the server's sysop. The modification of attributes is accomplished through the use of FTP client applications that have been altered ("hacked") to allow the user to create hidden directories. The directories are invisible to the normal visitor; only users of the hacked FTP program, who usually are experienced software pirates, can see them.(27)
The largest FBI crackdown on software piracy to date, "Operation Cyber Strike," specifically targeted FTP drop site abuse.(28)
Software pirates also commonly exchange files over the Internet by configuring their own personal computers as FTP servers. Using currently available technology, however, these "private drop sites" have some inherent limitations that prevent their use as a widespread medium of abuse. First, residential phone lines do not have the capacity to support more than a few simultaneous users. Second, maintaining a private drop site may be an inconvenience because operator must leave the computer constantly powered up and connected to the ISP. Finally, the operator's ISP may become irritated by the disproportionate use of the ISP's limited resources.
Most FTP abuse is difficult for a sysops to detect. Since FTP servers are designed to facilitate the anonymous transfer of large files, any increase in activity must be exceptional to raise the sysop's suspicions. Most FTP sites also have a huge number of files resident on the server, so any increase in the number of files must be significant enough to attract attention. Since FTP filenames typically are limited to eight characters, it is difficult for the sysop to monitor resident content by simply scanning the system for suspicious filenames. Restricting access and forbidding anonymous users to upload files are an FTP sysop's only practical methods of controlling abuse.
3. Internet Relay Chat
Internet relay chat (IRC) allows users around the world to send written messages to each other in real time--that is, to "chat."(29) Since IRC servers are linked together into networks, connection to a single server allows simultaneous communication with the hundreds or thousands of users connected to any other server on that network. Most IRC servers allow anonymous access to all visitors, who are identified only by their chosen pseudonyms. Communications are topically organized into groups, or "channels."
Although the IRC protocol does not directly support file transfers, IRC is frequently used to facilitate intellectual property theft using other Internet services. Certain IRC channels operated by software pirates serve as the primary medium for alerting other users about new FTP drop sites and for inviting other users to engage in private file exchanges. These transfers usually are initiated by the use of IRC robots ("bots"), which are programs that allow a user's computer to automatically perform certain tasks on one or more IRC channels. Although most IRC server sysops forbid the use of bots, their use is widespread in groups specializing in exchanging software, music, and adult material.
Although bots can perform many functions, pirates use them to initiate private communications automatically (a "DCC session") between the bot operator and one or more other users. A DCC session is done directly between the computers; the communications no longer flow through the IRC servers. Once this private connection is established, the bot operator's computer becomes, in essence, an FTP host. Files may then be transferred between the two computers, but, as with e-mail, the one-to-one nature of the system limits its usefulness as a medium of mass distribution of protected works.(30)
IRC is virtually impossible for a sysop to monitor. IRC communications are in real-time, with hundreds of channels and thousands of users operating simultaneously. Since users log on anonymously and use pseudonyms, the sysop can identify them only by their IP addresses. Moreover, since IRC servers are linked together in networks, only a small percentage of the communications flowing through any individual IRC server actually originate from users directly connected to that server. Denial of service is not a realistic option for an IRC Sysops, because denying service to an IP address would not necessarily exclude that user, but instead simply impose a burden on the ISP that owns that address, since an ISP's subscribers are typically assigned a different address each time they connect to the ISP.
Usenet is a one-to-many messaging system providing a worldwide public forum where users can read and post messages.(31) The Usenet system is a worldwide distributed message database consisting of approximately 200,000 servers connected to each other in a "peer-to-peer" arrangement; each news server has one or more "peers" with which it exchanges information. A message posted on one Usenet server is therefore automatically and rapidly propagated to every other news server in the worldwide system. As of February 1998, there were more than 46,000 newsgroups, topically arranged to cover almost any interest imaginable, and Usenet's daily volume, which has been doubling every year, exceeded half a million messages, comprising more than 900 million bytes, the equivalent of 360,000 full pages of text.(32)
Since any computer file may be converted into its text equivalent, many Usenet "messages" are actually computer programs, images, sound recordings, and other types of computer files.
Virtually all Usenet servers restrict access. Although there are some "public" news servers that allow access to any user, they represent less than a tenth of 1 percent of the total servers. As of February 7, 1998, there were only 132 news servers open to the public. Of the few servers that are public, many do not allow users to post messages, and most carry far fewer groups than private servers.(33)
Some private servers belong to universities or businesses and therefore restrict access to their students or employees. Most private servers, however, are commercial and thus restrict access to paid subscribers only. A few news servers require the user to purchase a stand-alone subscription, but the vast majority of the servers offer access as a value-added service provided as part of an ISP's basic service package.
Usenet servers restrict access either by requiring the visitor to log on with a user name and password combination, which is the method used by most news servers that provide service as stand-alone subscriptions, or by allowing access only to visitors connecting from certain known IP addresses. This latter is the method used by news servers that belong to businesses or universities or are offered as part of an access provider's value-added services. It allows access by anyone connecting from an IP address that it owns.
As with IRC, Usenet users may choose to be identified by a pseudonym. Once connected to a news server, users are able to browse the newsgroups, select messages to retrieve, and post their own messages.
Usenet is the source of widespread intellectual property theft; it is truly the problem child of the Internet. Pirated software is openly exchanged in many newsgroups. These groups, of which the nine most popular are estimated to alone account for 30 to 40 percent of Usenet's daily traffic, have been called online software piracy's "pulsing heart."(34) The regular participants in these groups are remarkably sophisticated and organized, with established rules and procedures for posting and requesting pirated software. They have developed sophisticated protocols and procedures for trading pirated softeware.(35)
A large portion of the software posted is provided by organized software piracy groups. "Suppliers" provide the programs, "crackers" defeat any copy protection devices, "rippers" remove superfluous material from the programs to reduce transmission time, "packagers" divide the programs into easier to transmit portions, and "couriers" exchange these programs with couriers from other piracy groups. Finally, one or more of the couriers will post the program to Usenet, complete with installation instructions.
The various groups compete among themselves for bragging rights for providing software having the most trouble free installations or for being the first to distribute a new program through files included with the pirated software. These files proudly list the aliases of the prominent members of the organization, the groups most recent successes, and invitations for new users to join.
These pirate organizations typically operate one or more BBSs. Distribution may be done through either through the Internet using FTP transfers or by conventional direct computer-to-computer transfer using proprietary software. They often have affiliates located throughout the world.(36)
They are so well organized and efficient that they frequently make new software available in the newsgroups before it can be shipped by the manufacturer to retail stores. These so-called "zero-day warez" are the most highly prized commodity among Internet piracy groups.(37)
There also are many groups specializing in the exchange of adult images, the vast majority of which are unauthorized copies of protected works. Many images are obviously magazine pages that have been scanned and then posted. Other newsgroups specialize in the exchange of "MP3s," commercial music recordings that have been specially processed to reduce transmission time. Other groups specialize in providing utility programs ("cracks") and serial numbers used to defeat software copyright protection schemes.(38)
Usenet has several features that make it an ideal medium for the mass exchange of pirated works. First, Usenet messages may be posted with a reasonable degree of anonymity. Although users may assume any name, each Usenet message contains certain information that can be used to help track down an uploading user's identity. Sophisticated software pirates use a "patch" that strips away much of this information. A few news server sysops, who understandably are popular with software pirates, refuse to attach identifying information to messages originating from their servers.(39) Second, each message is propagated to thousands of news servers around the world within minutes, thereby making its contents available to millions of users. Finally, in contrast with FTP sites or web pages, newsgroups provide a centralized shared source for pirated works. Trading is done on a quid pro quo system. If a specific work is desired, the user simply follows the procedure for posting a request and other users will respond by posting the desired material. That user is then implicitly obligated to reciprocate.
Unlike the other primary Internet services, Usenet does have a sort of central authority, generically called "the administrators," a voluntary association of individual Usenet server sysops. Although Usenet administrators are empowered to a certain extent to correct abuses, "abuse" in this context means abuse of the Usenet system itself, not to the legality or appropriateness of the content of messages.(40)
Content on Usenet servers is extremely difficult to monitor. Although Usenet messages are identified by descriptive subject headers, the contents of any given message can be accurately determined only by retrieving (and in the case of binary files, decoding) the actual message. The massive number of messages flowing through Usenet servers each day, however, makes any such monitoring system practically impossible.
A Usenet sysop, moreover, has few weapons with which to fight abuse. Since the content resident on any Usenet server is predominantly supplied by other users outside the control of its sysop, denial of service to a Sysop's subscribers is not an effective weapon. Usenet's distributed messaging system dictates that the vast majority of incoming content originates not from subscribers of any given server, but rather by subscribers of other Usenet servers. As an example, assuming that there are only 100 news servers, that each server has an equal number of subscribers, and that each subscriber posts exactly the same number of messages, then 99 percent of the messages on each individual server would have originated from subscribers of other servers. And there are some 200,000 news servers.
Even if a sysop were to terminate the posting privileges of every one of its subscribers, it would have only a marginal effect on the content on its news server. A sysop cannot discriminate among the incoming messages within any particular newsgroup, so the only practical method of controlling the content resident on its server is to filter out those newsgroups that have a high level of abuse. This may not be an attractive option, however, because many potential subscribers may be hesitant to establish service with a provider that exercises censorship. In fact, most standalone Usenet servers advertise that they have a "no censorship" policy, so it seems reasonable to infer that censorship is an important customer criterion.(41)
This would not be an effective longterm solution, in any event, as the pirates would merely invade other groups or establish new groups. In addition, once a harmful message is propagated out across the Usenet system, the harm. cannot be easily undone. The continued propagation of a Usenet message can be stopped, or "cancelled," only from the originating server. A cancel message must be sent out by either the user who originally posted the message or by the sysop of the originating server. An individual Usenet sysop cannot unilaterally cancel a message. Many Usenet sysops refuse to honor cancel messages.(42) Even if a message is quickly cancelled, it will have already been made available to millions of users.
While it may not be feasible for a Usenet sysop to deny service, there are reasons why the Usenet server sysops might not choose to carry all of the available groups. Carrying the "full feed" of all newsgroups requires tremendous mass storage space and the massive data flow required to keep the groups current requires expensive connections. News server sysops may decide to censor some groups because of content that they consider inappropriate or illegal. Businesses that maintain news servers may only carry newsgroups relevant to their industry.(43)
5. World Wide Web
The most popular Internet service is the World Wide Web, a collection of documents, or "pages," stored on computers located throughout the world. Although most Web pages exist on a single server, some sites are "mirrored," meaning that they are simultaneously housed on several servers. Additionally, many ISPs "cache" (temporarily copy to local mass storage devices) Web pages as they are retrieved in order to speed up subsequent subscriber requests for that page.(44)
Web pages are written in hypertext markup language, known as html, a powerful text-based computer language that allows an author to incorporate "objects" such as graphics, sounds, or "hyperlinks" within the text of a page.(45) When a visitor selects a hyperlink, the associated object or action is executed. For example, hyperlinks can automatically initiate the creation of an e-mail message, start an FTP file transfer, or display messages from a Usenet newsgroup. If, as is more common, the selected hyperlink refers to another web page, the user's software, or "browser," is instructed to seek out and display that document. Although the linked page may actually reside on another web server located halfway around the globe, hyperlinks allow the visitor to "surf the web," transparently moving from site to site by simply clicking on the hyperlinks.
The potential for abuse associated with web pages is great. Although web site space is usually limited,(46) thus providing insufficient storage space for stockpiles of pirated works, web pages are frequently used to provide links to works located on FTP drop sites. Other web pages help the visitor obtain pirated works by providing tools to defeat copy protection systems or by providing instructions for obtaining pirated software from other Internet services like Usenet, FTP, and IRC.
Despite this potential for abuse, web sites are relatively easy to monitor. Since the pages are relatively fixed in time and are encoded in a standard text-based format, web server sysops can inspect the pages with a simple visual scan. The identity of a web page author is usually known to the server sysop, and web servers are configured so that web pages may only be modified by their author, thus making the author solely responsible for the content of the page. This accountability deters the subscriber from posting illegal material, which in turn makes the Sysop's monitoring easier.
Some web servers, however, permit virtually anonymous web page creation by allowing for a quick and free signup, which the author can get by providing false personal information. For example, there are several popular web site hosting companies that allow users to upload web pages onto their servers with no verification of identity other an e-mail address, which itself may be either false or obtained from a free e-mail service with equally inadequate verification procedures.(47)
Although each Internet service operates in a unique way and therefore each has its own distinct potential for copyright and other abuses, these services can be grouped and distinguished according to certain common features.
* For each of these services, the user must gain access to a server before uploading infringing or abusive material. Services such as FTP, IRC and Usenet allow some measure of anonymity and thus present a much greater potential for abuse than services such as e-mail and the World Wide Web, where users who provide infringing material can generally be identified.
* As opposed to one-to-one services such as e-mail, the other services are one-to-many, thus providing for much greater potential losses to copyright holders or defamed persons. E-mail's private nature also restricts a sysop's ability, ethically and legally, to monitor one-to-one communications.
* Real-time services such as IRC present a distinct challenge to any monitoring efforts, since the content remains on the servers only long enough to be transmitted to other servers.
* Whereas the content of a web page is relatively easy to visually determine, other services present much greater content identification problems.
* Distributed services such as Usenet and IRC present much greater challenges to sysop monitoring than non-distributed services such as FTP and World Wide Web. The majority of the content on servers offering distributed services is not provided by a subscriber but automatically supplied by other servers on the network. Most important, the distributed services have a much greater daily data flow, presenting problems of scale to their sysops.
Unfortunately, most of the case law and commentary regarding ISP liability have failed to distinguish clearly the differing role that ISPs play in connection with each of the different Internet services. This is an understandable oversight, given the newness and complexity of the Internet. Application of this oversimplistic view of the role of ISPs and Internet Sysops, however, will lead lawmakers and courts to unfair, inconsistent and ineffective policies.
As noted by one service provider association:
Although there are no Internet-specific laws at present, it is conceivable that each different service provided by Internet access and technology suppliers may attract a differing policy or legal regime. For instance, point to point communication such as email and file transfers might be treated differently by legislators and courts than services for the creation or hosting of Web sites, or for the storage and retransmission of content such as newsgroups, and on-line video or audio services.(48)
[EDITOR'S NOTE: This is the first of a two-part article on the World Wide Web and the new world of litigation arising from use of the Internet. The second part dealing with Internet liability issues will appear in the January 2000 issue of Defense Counsel Journal.]
(1.) Pub. L. No. 105-304, 112 Stat. 2860 (Oct. 28, 1998).
(2.) Bill Washburn, No Slam Dunk, Internet World 32, 33 (March 1996), available at
(3.) See generally The BBS Corner--What BBSes Are All About, available at
(4.) See Adam Gaffin, EFF's Guide to the Internet, v. 3.15, at [sections] 6.4
(5.) Latest Intelliquest Survey Reports 62 Million American Adults Access the Internet/Online Service
(6.) See David H. Dennis, The Inet-Access Frequently Asked Questions List, at [sections] 10.13
(7.) Prepared Testimony of Ken Wasch, president, Software Publishers Ass'n, Before the House Judiciary Comm., Courts and Intellectual Property Subcomm., Federal News Service, Sept. 16, 1997, available in Lexis, Legis Library, Fednew File [hereinafter Wasch Testimony on H.R. 2180].
(8.) Observations based on an October 4, 1997, examination of "the List," a comprehensive Internet service provider database located at
(9.) See Pamela Mendels, Awash in Cyberspace Jargon, Judges Remained Good Sports, N.Y. TIMES CYBERTIMES
(10.) See generally E. Krol & E. Hoffman, RFC 1462: FYI on "What is the Internet?"
(14.) See generally Jack Rickard, Internet Architecture
(15.) See Charles L. Hedrick, Introduction to the lnternet Protocols [subsections] 2.0-2.2, [sections] 8 (1987)
(16.) See generally Routing in the Internet
(17.) New York NAP Usage Statistics
(18.) See Hedrick, supra note 15, at [sections] 8. See generally Gaffin, supra note 4, at [sections] 1.7; History of the Internet
(19.) PPP is the most commonly used protocol for transmitting TCP/IP information over standard telephone lines. See generally Drew D. Perkins, RFC1171: The Point-to-Point Protocol for the Transmission of Multi-Protocol Datagrams over Point-to-Point Links
(20.) See Dennis, supra note 6, at [sections] 18.2.
(21.) See generally Internet Mailing Lists: Guides and Resources
(22.) See generally Andre Bacard, Anonymous Remailers
(23.) See Ron Newman, The Church of Scientology vs. anon.penet.fi
(24.) See generally Karen L. Casser, Employers, Employees, E-mail and the Internet, in The Internet and Business: A Lawyer's Guide to Emerging Legal Issues (Joseph F. Ruh Jr., ed.)
(25.) See generally Gaffin, supra note 4, at [subsections] 7.1-7.4; Perry Rovers, Anonymous FTP Frequently Asked Questions (FAQ) List
(26.) See David McCandless, Warez Wars, WIRED 175 (April 1997); Noah Robischon, Filching for Fun and Profit
(27.) See generally Anonymous FTP Abuses, supra note 25.
(28.) See Courtney Macavinta, FBI Hunts Software Pirates
(29) See generally Nicolas Pioch, A Short IRC Primer
(30.) See generally Eric Hauser, mIRC Bot FAQ
(31.) See generally Usenet Help
(32.) Welcome to the Newscene
(33.) Open NNTP Servers
(34.) See McCandless, supra note 26, at 134.
(35.) See The Usenet Warez FAQ ("Politeness Man!," ed.) (visited Oct. 16, 1997) (current Internet location unknown, on file with San Diego Law Review). "FAQ" is shorthand for frequently asked questions. This FAQ, like many others, also is displayed as a web page, but web pages that involve piracy are frequently removed by the web server sysops.
(36.) See generally McCandless, supra note 26. See also Prepared Statement of Kevin V. DiGregory, Deputy Ass't Attorney Gen., Criminal Div., Before the House Judiciary Comm., Subcomm. on Courts and Intellectual Property, Concerning H.R. 2265, The "No Electronic Theft (NET) Act," Federal News Service, Sept. 11, 1997, available in LEXIS, Legis Library, Fednew File [hereinafter DiGregory Testimony on H.R. 2265].
(37.) See McCandless, supra note 26, at 175.
(38.) See Dennis, supra note 6, at [sections] 15.2. Many other images are now being taken from commercial adult Web sites. This is evident by the display of the site's URL along with the copyright information. There is even a newsgroup called "alt.binaries. pictures.erotica.commercial-websites." See also Janelle Brown, Heat Turned Up on Digital Music Pirates
(39.) See McCandless, supra note 26, at 175. See also Altopia Frequently Asked Questions
(40.) The Net Abuse FAQ [sections] 1.3 (Scott Southwick & J. D. Falk, 41.eds.)
(41.) See, e.g., Altopia Frequently Asked Questions, supra note 39 (first section on page entitled "Q: Do You Censor?" answered in the negative).
(42.) See generally Kevin Hughes, Entering the World-Wide Web: A Guide to Cyberspace
(43.) See Dennis, supra note 6, at [subsections] 4.2-4.5, 6.16, 6.24-6.28, 9.3 (at [sections] 6.16 noting, "Many newsgroups contain blatant violations of copyright law.")
(44.) See generally Kevin Hughes, Entering the World-wide Web: A Guide to Cyberspace
(45.) See generally National Center for Supercomputing Applications, A Beginner's Guide to HTML
(46.) Most ISPs provide their subscribers with a limited amount of space on a web server, thus enabling them to set up their own web pages.
(47.) See Robischon, supra note 26 (describing abuse of anonymous web sites and FTP drop sites by software and music pirates).
(48.) The Canadian Association of Internet Providers (CAIP) "Code of Conduct"
IADC member Michael J. Brady is a member of Ropers, Majeski, Kohn & Bentley in the Redwood City, California, office, and heads the firm's appellate, insurance coverage and bad faith departments. He is a graduate of Stanford University (1964) and the Harvard Law School (1967).
Lawrence O. Monin is a member of the firm in its San Francisco office and concentrates in the areas of complex insurance coverage, bad faith, insurance regulation, and reinsurance. He is a graduate of the University of Buffalo (B.S. 1964), the Harvard Law School (J.D. 1967) and the London School of Economics (LL.M. 1968).
Curtis R. Tingley is a member of the firm in its San Jose office and concentrates in corporate law and commercial and intellectual property litigation. He was educated at Stanford University (B.A. 1979) and Santa Clara University (M.B.A., J.D. 1983).
Timothy L. Skelton is in the firm's Los Angeles office. He was graduated from the University of South Carolina (B.A. 1991) and the University of San Diego Law School (J.D. 1998). He concentrates in intellectual property and business litigation.3…
Questia, a part of Gale, Cengage Learning. www.questia.com
Publication information: Article title: The World Wide Web and the New World of Litigation: A Basic Introduction. Contributors: Brady, Michael J. - Author, Monin, Lawrence O. - Author, Tingley, Curtis R. - Author, Skelton, Timothy L. - Author. Journal title: Defense Counsel Journal. Volume: 66. Issue: 4 Publication date: October 1999. Page number: 497. © 1999 International Association of Defense Counsels. COPYRIGHT 1999 Gale Group.