Appeals Court Says Backpage.com Is Not Liable For Sex Trafficking Done Via Its Site

from the as-it-should-be dept

Backpage.com has been pretty busy in court. The site, which basically took over the market for "adult" classified ads after Craigslist shut down its ads (after being misleadingly attacked) has been sued a bunch of times, almost always by people misunderstanding Section 230 of the CDA which, as we've discussed hundreds of times, says that sites are not liable for the actions of their users. Last year, however, Backpage won a big case in Massachusetts in May, but then lost one in Washington in September. (Separately, it won a different case going after Cook County Sheriff Thomas Dart for meddling and getting credit card companies to stop supporting Backpage.com -- the company just asked the lower court to dismiss what's left of that case). The September ruling was surprising, as it's one of a very, very, very small number of cases that basically says that Section 230 doesn't apply.

Now, the appeal on the Massachusetts case has brought another good Section 230 win, saying that Backpage.com is not liable. Now, it should be clearly stated that both the Washington and Massachusetts cases involve some really awful and horrifying situations, in which girls were forced into sex trafficking. The situations that those girls were put in is horrifying and those responsible should be punished as much as the law will allow. But here's the important part: Backpage.com wasn't who was responsible. In fact, as at least some in law enforcement have recognized, Backpage.com can be a useful tool for tracking down such criminal activity.

It's been unfortunately easy for some to smear those who support Section 230 in these cases as being indifferent or somehow cruel to the plight of those who were trafficked. That's ridiculous. The explanation in the filing alone made me feel ill. But just because what happened to them was horrific and unconscionable, it doesn't mean you lash out and blame a tool that was used, rather than those who were actually responsible. Thankfully, unlike the Washington court, the 1st Circuit Appeals court understood this.

The specific issue in this case has to do with the Trafficking Victims Protection Reauthorization Act of 2008 (TVPRA), which says that anyone who "knowingly benefits, financially or by receiving anything of value from participation in a venture which that person knew or should have known has engaged in an act" of sex trafficking, can be held liable under the law. But, of course, Backpage notes that, as a platform, to claim that it is liable would be to reject CDA 230 that says it cannot be held liable "as a publisher" for information published by others. The crux of the argument against Backpage here is that it's not claiming that Backpage is a "publisher," but merely that it "knowingly benefits" from sex trafficking. They argued that based on the way Backpage is set up, in terms of what it allows or disallows for posting, how it allows people to post anonymously, how it strips metadata from photographs and more, makes it different from a standard "publishing" platform. This is a pretty common attack on Section 230, claiming that it does more than a publisher and thus isn't protected. Courts have almost universally rejected that, unless those additional actions themselves could be seen to break the law (such as the Roommates.com case where the company was seen to violate fair housing laws because it had discriminatory pull downs that it set up itself).

But the court rejects this argument, saying that everything Backpage.com does is a traditional publisher activity.

As an initial matter, some of the challenged practices — most obviously, the choice of what words or phrases can be displayed on the site — are traditional publisher functions under any coherent definition of the term. See Zeran, 129 F.3d at 330 (describing decisions about "whether to publish, withdraw, postpone or alter content" as "traditional editorial functions"). And after careful consideration, we are convinced that the "publisher or speaker" language of section 230(c)(1) extends to the formulation of precisely the sort of website policies and practices that the appellants assail.

Precedent cinches the matter. In Lycos, we considered the argument that the prophylaxis of section 230(c) did not encompass "decisions regarding the 'construct and operation'" of a defendant's websites. 478 F.3d at 422. There, the plaintiffs alleged that Lycos permitted users to register under multiple screen names and provided links to "objective financial information" from a finance-related message board, thus enabling "individuals to spread misinformation more credibly." Id. at 420. We noted that, at bottom, the plaintiffs were "ultimately alleging that the construct and operation of Lycos's web sites contributed to the proliferation of misinformation" and held that as long as "the cause of action is one that would treat the service provider as the publisher of a particular posting, immunity applies not only for the service provider's decisions with respect to that posting, but also for its inherent decisions about how to treat postings generally." Id. at 422. In short, "Lycos's decision not to reduce misinformation by changing its web site policies was as much an editorial decision with respect to that misinformation as a decision not to delete a particular posting."

And thus, the court finds that Backpage.com clearly is a publisher and protected by Section 230.

The lawsuit also tries to get around Section 230 by really trying to twist the so-called "Good Samaritan" clause of Section 230. This is a part of Section 230 that is often misunderstood or ignored, but is super important. It's the part that says that you don't lose your Section 230 protections if you do moderate any content on your website. While some Section 230 haters falsely argue that the law encourages sites to "leave up absolutely everything," that's not true. Section 230(c)(2) actually is helpful in encouraging moderation by sites, since they don't lose their safe harbors if they do moderate.

However, in this case, the plaintiffs tried to attack that by noting that the clause talks about "moderation in good faith," and they tried to argue that Backpage.com wasn't moderating "in good faith." The court doesn't buy it, saying that the argument is "misplaced."

Next up, they argue that because Section 230 does not apply to federal crimes, it shouldn't apply in this case, since the TVPRA is a federal criminal statute. But that fails because this is a civil lawsuit, which the court quickly points out:

The appellants posit that the TVPRA's civil suit provision is part of the "enforcement" of a federal criminal statute under the plain meaning of that term and, thus, outside the protections afforded by section 230(c)(1). This argument, though creative, does not withstand scrutiny.

The court notes that it's quite clear that the exception for criminal statutes clearly is meant for only criminal cases, not civil cases based on criminal statutes.

Here, the subsection's title, "[n]o effect on criminal law," quite clearly indicates that the provision is limited to criminal prosecutions.

It is equally telling that where Congress wanted to include both civil and criminal remedies in CDA provisions, it did so through broader language. For instance, section 230(e)(4) states that the protections of section 230 should not "be construed to limit the application of the Electronic Communications Privacy Act of 1986," a statute that contains both criminal penalties and civil remedies.... Preserving the "application" of this Act contrasts with Congress's significantly narrower word choice in safeguarding the "enforcement" of federal criminal statutes. The normal presumption is that the employment of different words within the same statutory scheme is deliberate, so the terms ordinarily should be given differing meanings.

Not surprisingly, the plaintiffs also try to argue that Backpage.com did specific things to actually block attempts to combat sex trafficking, and it was those actions that are not protected by Section 230. But the court notes that these claims are not backed up by facts:

This causal chain is shot through with conjecture: it pyramids speculative inference upon speculative inference. This rampant guesswork extends to the effect of the alleged misrepresentations on an indeterminate number of third parties, the real impact of Backpage's behavior on the overall marketplace for sex trafficking, and the odds that the appellants would not have been victimized had Backpage been more forthright.

When all is said and done, it is apparent that the attenuated causal chain proposed by the appellants is forged entirely out of surmise.

In the "really stretching it" arena, they also used the one other exception to Section 230: intellectual property law. For that, they argued that the pictures that were posted (mostly by the individuals who were running the sex trafficking) were "unauthorized." Of course, even if that were the case, that wouldn't make Backpage liable. The court quickly recognizes that if anyone unlawfully "benefited" from the unauthorized use of the photographs, it was the traffickers, not Backpage:

Here, there is no basis for an inference that Backpage appropriated the commercial value of the appellants' images. Although Backpage does profit from the sale of advertisements, it is not the entity that benefits from the misappropriation. A publisher like Backpage is "merely the conduit through which the advertising and publicity matter of customers" is conveyed..., and the party who actually benefits from the misappropriation is the advertiser. Matters might be different if Backpage had used the pictures to advertise its own services... but the appellants proffer no such claim.

Taking the IP claim even further, at least one photo used by the traffickers was actually taken by one of the girls herself. That girl then registered the copyright and used that to claim infringement. But, of course, the registration occurred after the case had been filed (and after the photo had been taken down), meaning that statutory damages are not available. The discussion goes into even more detail on why the copyright claim is a total non-starter that appears to have been added late as a last gasp effort to find something to use to go after Backpage.

None of this is to argue that Backpage.com is a wonderful site or a shining beacon. It may have its problems. But, as we've seen for years, people keep wanting to blame the tool for how people use it. Even a major NY Times columnist keeps writing totally misleading columns that try to place the blame on Backpage.com. This is desperately misguided. Just as it was misguided when everyone tried to blame Craigslist for the same thing. You'd think that, after Craigslist stopped accepting adult ads, and those ads quickly moved to Backpage.com, people might realize that blaming the website is monumentally stupid, because it's not the website causing this. Take down one website and another will pop up. Or maybe a few others. That's not the issue. You should blame the people who are actually breaking the law -- the people who are engaged in the sex trafficking business, who are forcing these women to participate. And, a great way to track down those people is to use tools like Backpage to track them down, rather than attacking the tool itself.

Filed Under: 1st circuit, copyright, liability, section 230, sex trafficking
Companies: backpage.com

20 Years Ago Today: The Most Important Law On The Internet Was Signed, Almost By Accident

from the give-thanks dept

The internet as we know it would be a very, very different place if 20 years ago today, President Clinton hadn't signed the Communications Decency Act. To be fair, nearly all of the CDA was a horrible mess that was actually a terrible idea for the internet. A key part of the bill was about "cleaning up" pornography on the internet. However, to "balance" that out, the bill included Section 230 -- added by two Congressmen in the House of Representatives: Ron Wyden and Chris Cox. They had pushed this clause as a separate bill, the Internet Freedom and Family Empowerment Act, but it didn't get enough traction. It was only when they attached it to the Communications Decency Act (which had passed the Senate without it), that it was able to move forward. And thus, 20 years ago today, when President Clinton signed the CDA, most of the attention was on the "stopping indecency" part, and very little on the "throw in" of Section 230. And yet, there's a strong argument that Section 230 may be one of the most important laws -- perhaps the most important -- passed in the past few decades.

As you hopefully already know, a year later, in Reno v. ACLU, the Supreme Court tossed out basically all of the CDA as unconstitutional. The only tidbit of the law that remained valid? You guessed it: Section 230. And, of course, it became the key law in enabling the internet to grow the way it did. It's been said in the past, fairly accurately, that no law contributed more to the growth of the internet than CDA 230, and that's because of a fairly simple and straightforward principle. CDA 230 simply said that an internet service is not liable for actions of its users. This meant that new websites and internet services didn't need to carefully monitor and track everything that every user did to make sure it wasn't violating a law. That meant the legal risks and liability for creating services that allowed the public to create all kinds of content went way down.

Without a robust Section 230, it's difficult to see many of the most popular platforms today existing. It's no surprise that soon after CDA 230 we saw the rise of blogging and social media -- and almost always coming from American companies. Both would be significantly more difficult without Section 230's protections. In fact, much of the push for Section 230 came in response to a horrible court case, Stratton Oakmont v. Prodigy, in which an internet bulletin board commenter attacked financial firm Stratton Oakmont, and its president, for apparently being involved in criminal and fraudulent activity. Stratton Oakmont -- now perhaps well known as the firm portrayed as doing all sorts of criminal and fraudulent things in the movie The Wolf of Wall Street -- sued Prodigy for the comment and won. The liability from such a ruling scared numerous online platforms, in particular because a key part of the ruling was that because Prodigy posted "guidelines" and removed posts with offensive language, it suddenly became a "publisher" of the content, and was liable for that content.

A key, and often overlooked, part of Section 230, is that it actually does encourage sites to take proactive measures to filter content, by noting that any kind of moderation or guidelines absolutely does not remove the protections of Section 230. As such, sites get to decide for themselves whether or not to moderate their content in any way, without facing the legal risk of suddenly being declared the publisher. Other countries have no such protections, leading to some dangerous rulings, and creating something akin to a "right to be forgotten" in some instances.

There have been numerous cases testing Section 230 over the years -- and the law has remained strong and in place -- though it is still being challenged to this day. The biggest and most important case was Zeran v. AOL, the first case testing Section 230, in which the court found that Section 230 was a powerful tool that kept sites from being held responsible for content posted by users.

Section 230 has been powerful in so many ways. It has both enabled and protected free speech online by letting companies set up platforms where people can speak openly. Without it, the internet would be much more limited as a platform for communicating to the public. As the 4th Circuit noted in its ruling in the Zeran case:

The amount of information communicated via interactive computer services is therefore staggering. The specter of tort liability in an area of such prolific speech would have an obvious chilling effect. It would be impossible for service providers to screen each of their millions of postings for possible problems. Faced with potential liability for each message republished by their services, interactive computer service providers might choose to severely restrict the number and type of messages posted.

It has protected privacy, by making it clear that there was no duty for websites to monitor and track their users, to avoid any kind of liability. It has created incentives to create tremendous economic value, by making it clear that companies could be formed to enable public communications, such as blogging, forums and social media -- without being sued into bankruptcy over misuse. And it has actually enabled better moderation of platforms in not making them give up protections, if they choose how to moderate certain content.

It is difficult to express just how important Section 230 has been over the past 20 years other than to say that, without it, it's unlikely that you would be able to comment on Techdirt today. It's also unlikely that you'd have tools like Twitter or Facebook or Yelp or AirBnb. Any service that relies on public input owes a huge debt to Section 230, and it's quite incredible that it was basically included as an "add-on" that very few noticed when it was signed.

So, as we're hanging out here on the internet today, in a place that is alive only because of Section 230, please thank (now Senator) Ron Wyden in particular for his role in creating Section 230, and pay attention, because there are very powerful forces working right now to undermine Section 230 entirely. It's been a key driver of free expression and economic growth for the past 20 years, and it would be a shame to undermine that now.

Filed Under: cda, cda 230, communications decency act, free speech, immunity, innovation, internet, liability, ron wyden, safe harbors

Our Response To The Latest Ridiculous Legal Threat Against Us: Milorad Trkulja Can Go Pound Sand

from the damn-it-feels-good-to-be-a... dept

As we've noted, we regularly get legal threats, some of which are more serious than others. Sometimes we ignore them entirely, and sometimes we feel the need to respond. Depending on the situation, sometimes we respond privately. Sometimes we respond publicly. The more ridiculous the threat, the more likely we are to respond publicly -- and I think the latest holds up as one of the most ridiculous legal threats we've seen. It comes from Milorad Trkulja, who is also known as Michael Trkulja, and who lives in Australia. Trkulja made some news a few years back when he (somewhat surprisingly) successfully sued both Yahoo and Google for hundreds of thousands of dollars, because when people did image searches on a variety of phrases related to things like "Australian criminal underworld mafia" sometimes a picture of Trkulja would show up. Apparently, Trkulja was actually shot in the back a decade ago by an unknown gunman. And somehow, for whatever reasons, certain websites included pictures of him along with enough keywords that the search algorithms at both Google and Yahoo would return his photo in such searches. We wrote about his victory over Google back in November of 2012, pointing out how ridiculous it was that an Australian court said you could sue search engines because image search happens to pop up your image along with actual gangsters.

Anyway, after we wrote about the case, as happens on Techdirt, people commented on the story, including one anonymous comment from someone who, in a totally offhand way, claimed that "Trkulja's a gangster, too." The actual content of the comment, as you can see was actually to clarify some of the misconceptions -- including who "Tony Mokbel" is (a well-known Australian gangster) and responding to the author of the post, Tim Geigner's (admittedly weak) sarcastic joke that Australians fight with machetes, rather than guns.

Now, it appears that Trkulja just found out about this comment (more on how in a moment) and has sent off a fairly massive 54-page document to both myself and to Google with a series of increasingly hilarious demands -- including that we respond by 4pm today (he does not designate in what time zone -- not that it matters). The letter is, well, you kinda have to read it. It is full of misspellings, along with typographical and grammatical errors of all kinds. For someone who claims to have consulted a lawyer before sending the letter, you'd think he'd consult someone who could proofread his letter as well. No such luck, apparently.

It starts out by claiming that it's "Not for publication" but that's totally meaningless. You send it to us, we can absolutely publish it. Free speech means something here in the US. It then includes a recitation of some "facts" about certain Australian organized crime individuals, followed immediately by this: I'm not an expert on Australian law, but I'm pretty sure that's totally false. I believe that he's either referring to his own earlier case, or (more likely!) the dreadful recent decision in a South Australia court, concerning one "Janice Duffy." Duffy, as we've discussed, sued Google after she became quite upset that a Ripoff Report post mocking her was a high result on her name (what is often left out of this discussion was that Duffy went to Ripoff Report first and posted fake posts to attack a psychic website where she felt she had been connected to a psychic who provided her with false information, and the supposedly "defamatory" content on the site was someone referring to Duffy as a "psychic stalker"). The ruling in that case did not say that Google is automatically liable for any defamatory content online, but rather, in this specific instance, Google could be found as the "publisher" of some defamatory content, based on the way that Google chose to display that content. I disagree strongly with the decision as is, but even if we accept it at face value, it does not say what Trkulja is claiming.

Oh yes, speaking of Duffy, it felt... odd... to receive a legal threat from Australia so soon after discussing the Duffy decision -- especially given that Duffy had not only just yelled at us online, but had also been going off on some bizarre rants and outright threats against some individuals who expressed an opinion suggesting that the ruling in favor of Duffy was troubling.

So, it didn't come as a huge surprise that Trkulja then admits he only found out about our post and the comments... thanks to Duffy, who is apparently a "family friend" of his. If you can't read that, it notes that the "matter in paragraph 14" (which is the comment I mentioned above) "come to my attention when my family friend Dr Duffy from South Australia send me link that you have been defaming me as from 2012."

From there, he notes:

I complains is an article authored by you and posted to the "Techdirt" website situate at https://www.techdirt.com ("the website")....

Well, I'm really not quite sure what to do with that information, because almost everything in it is wrong, but we'll get there. From there, he mentions that he spoke to an Australian defamation lawyer, and suddenly shifts oddly from the first person to the third person -- possibly copying what someone told him, though it's not at all clear from the text of the letter. The key point: he claims that comment is defamatory and that Techdirt is liable for it. This is wrong on a variety of levels -- but we'll get there as well.

Then, we get to the "demands." It starts with a demand for Google. They are apparently supposed to delist Techdirt entirely because of a single comment that Trkulja falsely believes is defamatory. Also, it could be read as to be asking Google to block me personally from Google's website. Or something. Also, he wants Google to block some other websites. No reason or explanation is given. Then there are demands for me that include identifying the anonymous "subscriber," delete the comment, the post and anything ever mentioning Trkulja. Oh, and I should fork over a bunch of money: These demands are then repeated again on the next page in slightly different language. And numbered instead of lettered. No idea why. Then there's a demand that we respond by December 1st, 2012. Yes, 2012. I'll assume that's a typo.

Then there are a ton of screenshots that I assume are "exhibits" of some sort. They include my Twitter page for no clear reason. And also the Techdirt profile of the author of the original article, Tim Geigner, and, for reasons unknown, Tim's Amazon author page. He also refers to Tim as "Darknight aka Timothy Geigner" while I think most of our regulars recognize that Tim is better known as "Dark Helmet" in our comments....

Okay, so that's the situation. Now, the response: we're not going to do any of the demanded things. For a whole variety of reasons. Let's go through just a few, because this post is getting too long already and if I had to respond to all of the ways this letter is wrong, none of you would still be reading.

1. First up, not that it really matters, but the statute of limitations is one year in Australia, as it mostly is in the US as well. Under some circumstances, it can apparently be extended to three years, but (oops) that comment was published on November 13, 2012. The statute of limitations is up. Sorry.
2. The comment isn't defamatory. The reference claiming you're a "gangster" is totally innocuous. It's a trivial throw away comment on a blog post that no one would notice. Trivial comments are not defamation in Australia (or the US for that matter).
3. The other lines that you seem to complain about are opinions not statements of fact. The reference to the "gun" was a response to Geigner's joke in the post about machetes, not to anything involving you. Opinions are not defamation. Things unrelated to you are not defamation of you.
4. Also, we're a US company with no presence in Australia, so your threats are pretty pointless.
5. Even if you could convince an Australian court with some sort of wacky legal argument, we're totally protected from such judgment thanks to the SPEECH Act.
6. Free speech, dude.
7. We have no "subscriber" named Anonymous Coward. That's the designation given to anyone who comments without logging in.
8. We didn't publish the comment. An anonymous user did. We're not liable for it. If you have any legitimate complaint at all (and you don't), it's with an anonymous user who posted a trivial comment three years ago, rather than us or Google.
9. Even if none of the above is true: what the fuck? NO ONE is finding a comment buried deep below a blog post about your legal victory and suddenly saying "oh, well that proves that Trkulja was a gangster."
10. Wait, what's so terrible about being called a "gangster" anyway? To many people it's a compliment or something to brag about.

That's enough of a response. There are tons of other possible responses, but in short: we're not doing a damn thing in response to this ridiculous threat. You have no case whatsoever and complaining about this is ridiculous. It may be time to find a hobby or something, Mr. Trkulja, because poorly written and ridiculous legal threats to foreign entities aren't doing you any good.

Filed Under: australia, comments, defamation, intermediary liability, janice duffy, liability, michael trkulja, milorad trkulja, secondary liability, section 230, speech act

Law Professor Pens Ridiculous, Nearly Fact-Free, Misleading Attack On The Most Important Law On The Internet

from the stop-this dept

For the last few years, we've noted a worrying trend of a few law professors, who have decided that the best way to make people nice on the internet is to do away with Section 230 of the CDA. As we've noted repeatedly, Section 230 of the CDA is without a doubt the most important law on the internet. The internet would be a massively different (and worse) place without it. Almost every site or service you use would be very different, and the internet would be a much more bland and sterile place. Section 230 is fairly simple. There are two key elements to it:

1. People cannot blame service providers for content posted by users.
2. Service providers who decide to moderate/delete content cannot be held liable for the content they choose not to moderate (or the content they choose to moderate).

The reasoning behind the law should be pretty straightforward. First, you should apply any liability to the person actually doing the speech, rather than the person providing the tool for the speech. We don't blame the phone company when someone makes a threat over the phone. We don't blame the postal service when someone sends mail we don't like. We blame the individuals who actually did the thing.

But, because there are still some people who do terrible things online, a group of people have decided that perhaps the problem is not enough censorship and moderation -- and that yanking away the protection of Section 230 will magically make everyone nice on the internet. This is wrong and ridiculously short sighted. A month ago, we wrote about just such an attack from a minor internet/TV celebrity who clearly just didn't know any better. But now there's a law review article penned by law professor Ann Bartow, and it's a nearly fact-free and clueless attack on Section 230, based on a number of ridiculous to dangerous assumptions.

As if to warn how bad the article will be, it literally starts off with an attack on free speech -- suggesting that we have too much of it, and mocking "First Amendment absolutists" and the US's "unique" view on free speech. It doesn't even begin to acknowledge the results that you get when you take away free speech. From there, she pivots to Section 230, citing Danielle Citron, who has provided inspiration to many other law professors to attack Section 230. Amazingly, Bartow suggests Citron doesn't go far enough:

What she touches on far too briefly are the revenue producing and money saving advantages that Section 230 provides for Internet businesses both big and small. She laments the disgusting websites that profit from hate speech and nonconsensual porn. She expresses less concern about the mercenary corporations that earn billions by hosting, indexing, promoting and advertising these abhorrent websites; huge, “respectable” companies like Yahoo, Google, Facebook, Twitter, Instagram and Microsoft. They launder the proceeds of hate speech, and happily cash the checks.

Arguing that it's all about money is ridiculous. And wrong. We'll get back to that in a second, but let's go on to the next paragraph, where I can say with 100% certainty, that Bartow has no clue what she's talking about:

Anyone hosting a small blog knows that a good flame war or pile on will increase your links and page views, and therefore your advertising income. On a much bigger scale the same incentives apply to the largest ISPs. They create and host platforms designed to attract as much online traffic as possible. They benefit monetarily from popular content that is often hostile and offensive to groups with less power in society, such as sexual minorities, racial minorities, religious minorities, and, as Citron describes in such harrowing detail, to women generally. Under Section 230 the financial incentives for ISPs all fall in favor of ignoring internet harassment. Controversial news reports, gossip blogs and sexy intriguing dating profiles, even when false, generate logons, eyeballs, and browser clicks, all the things that lead to revenue streams. Section 230 enables large ISPs to disclaim any legal or moral responsibility for the harms that online speech can inflict all the way to the bank.

I host a small blog. And Bartow is full of shit here. A "good flame war" does not increase links or page views. It generally involves a very small group of people who just yell at each other and drive most everyone else away. Why do you think so many news sites have been shutting down their comment sections? Furthermore, this shows a lack of understanding of how internet advertising works. Again, a flame war doesn't tend to attract more viewers to an article, it drives many away. It just attracts a small number of participants and those participants don't click on or look at ads. It does not increase ad revenue. This is a confused myth by people who have clearly never managed an ad-supported website.

Furthermore, if your site is nothing but harassment and flame wars, good advertisers stay the hell away. No one wants to be seen advertising on a site that is associated with harassment. And, in addition to that, public pressure has a way of pushing many sites to try to moderate out the worst behavior anyway. Bartow's article seems totally devoid of facts. Based on her description, you wouldn't even know that sites like Reddit and Twitter massively ramped up moderation efforts recently. To some, it's not enough (and to others it's way too much), but Bartow suggests that sites have no reason to do so. Clearly that's not true, because every major website does moderation -- and they have many incentives to do so, from not angering advertisers to general public perception and social pressure.

Bartow's law review article seems to be written in a parallel universe, in which she has no idea how internet sites or internet advertising actually operate.

But, armed with this near total misunderstanding of the internet, Bartow proceeds to suggest an absolutely horrific idea: make CDA 230 more like the DMCA notice-and-takedown process:

Reform must be bolder to have any measurable effect. A more conditional ISP immunity could be framed somewhat along the lines of the Digital Millennium Copyright Act (DMCA). Under the so called “notice and takedown” provisions of the DMCA, when an ISP takes down online information that has been used in a way that a copyright holder alleges was not authorized, it is essentially immune from copyright based liability for distributing infringing materials. If it chooses not to respond to the copyright holder’s demand, however, the ISP may later have to defend its decision not to takedown the disputed material on the merits. Risk aversion usually motivates takedowns. Even now, when victims hold the copyright in photos used to torment them, and ask ISPs to remove them for copyright reasons, ISPs generally remove them with great alacrity to avoid potential liability for copyright infringement. A recalibration of Section 230 immunity could establish a similar framework that creates potential liability when ISPs refuse to assist people whose victimization through online bullying, stalking and harassment they are facilitating and profiting from. Because speech torts are so much harder to prove than intellectual property infringement, takedowns in this realm are less likely to be routine.

This has been suggested before by others, but again, it suggests someone who lives in the world of theory and has no experience with how the internet operates in practice. The DMCA notice-and-takedown process is regularly used as a tool for censorship of content people don't like. Expanding it beyond copyright would just multiply that massively.

Again, as someone who runs a small blog, the number of requests we get from people demanding content be taken down is fairly incredible. It's Tuesday of this week and we've already received requests to take down one story (entirely) and a dozen or so comments on other stories. If we had to follow through on those we'd shut down all comments, and it would take away this entire community. It's not about "making money." It's about not being burdened with constant legal threats and the risk of having to go court because someone is unhappy.

Bartow doesn't think this is a big deal, because she says internet companies can afford it:

The stentorian and self-serving ISP party line is that without Section 230, behemoth online presences like Google, Yahoo, Bing, Facebook, YouTube and Twitter would not exist. Citron appears to accept this argument. But I do not believe it for one second, and you shouldn’t either. If they had to actively respond when their cyber products were actively harming people, just like other companies that make things are usually forced by law to do, their businesses might be less profitable. But they would still be highly profitable. And as long as there is money to be made on the Internet, ISPs will be pursing those dollars.

Yes, perhaps Google, Yahoo, Microsoft (Bing?!?), Facebook and Twitter could afford to deal with it, but they're giant massive companies. Small independent content creators like myself could not. We barely make any money as is. Being liable for others' content would almost certainly force us to shut down.

And that's the real concern that Bartow doesn't seem to acknowledge. The internet is not just those giant companies. It's the fact that anyone can start their own site and have a voice. The people she thinks she's defending -- the marginalized and the harassed -- would be much worse off in the world she thinks she wants. It would turn the internet from an open communications platform that has allowed marginalized groups to speak out, to a broadcast style world, where only the elite had the ability to speak their minds. Perhaps she doesn't mind because she's an elite law professor -- but she should talk to some of the people she thinks she's saving, who have relied on these platforms to make their voices heard.

Bartow claims that she knows sites would still be profitable without Section 230 because these US companies operate outside the US where there is no Section 230. But again, that's a constant risk and more a result of the nature of the internet, rather than anything else. I'm fairly concerned that there are some countries I cannot travel to because of a lack of Section 230 outside the US. The last time I was in Germany I literally had someone accuse me of war crimes because of a comment on Techdirt, and I started counting the hours left until I could get out of the country. Bartow is so sure of herself that she insists she's right despite all the evidence to the contrary.

Section 230 saves ISPs money. That is its real value to them.

No, it protects free speech and enables sites to operate in the first place -- especially smaller internet sites. It's not about "saving money" to me. It's about being able to actually create a forum where people can speak freely. There are tons of other pressures to moderate out the worst of the worst content, and Bartow (again) is simply factually wrong about the "value" of "flame wars" and on how internet advertising works. You'd think that she'd maybe talk to someone who actually has experience in this field before penning such an ignorant law review article, but apparently the Boston University law review doesn't require anything akin to fact checking to publish articles.

From there, Bartow breezily dismisses the fact that execs at Google were found guilty on criminal charges for not taking down a video fast enough, because it was overturned on appeal:

Many multinational ISPs were alarmed when three Google executives were criminally convicted in absentia in Italy for a privacy violation because the company hosted a video in which an autistic child was being bullied. Ultimately, though, the convictions were reversed on appeal, and there is no evidence that a single Internet company stopped doing business in Italy, even though the possibility of future content related arrests remains.

If Bartow really thinks that this has had no impact, then she, again, does not know what she's talking about. Many internet companies are quite fearful of doing business in such countries. We would never open an office there out of fear for the liability. We can operate there from afar because we know we're protected by Section 230 and the SPEECH Act. Again, big companies can afford to fight the liability. Small ones and individual operators cannot.

Finally, Bartow closes with the fact that internet companies are trying to expand in China as a weird sort of "proof" that it's fine for companies to operate under authoritarian regimes that crack down on free speech:

If Section 230 style immunity was critical for any reason other than maximizing profits, no ISP would do business in China, which has a highly censored Internet infrastructure, and actively jails people for criminal speech offenses such as “spreading rumors.” Yet Google is actively trying to expand its presence there. So are Microsoft, Facebook, Linked In, and Twitter just to name a few. All the large Internet companies are operating in China to the maximum extent that the Chinese government will allow, because they can make a lot money there, in spite of the dangers.

When you're pointing to China as your "example" of how it's great to crack down on free speech, you've already lost your argument.

This article is a travesty of ignorance and confusion, culminating in an attack on free speech and the most important law on the internet.

Filed Under: ann bartow, cda 230, censorship, danielle citron, free speech, immunity, innovation, lawsuits, liability, section 230

SalesForce Says It Doesn't Support CISA After Signing Letter That Suggested It Did

from the welcome-to-politics dept

One of the issues with various "cybersecurity information sharing" bills like CISPA from last year and CISA from this year, is that some tech companies have been (quietly) supportive of these bills. The whole focus of these bills is to encourage "cybersecurity information sharing" between private companies and the government. And, in theory, that may sound like a good thing. In reality, all the bills really do is focus on protecting companies from liability should they share private information they shouldn't have shared. And, of course, there's the fact that people who understand these things recognize that there's a hidden meaning behind CISA, in that it's really designed to give the NSA more "signatures" to use in its surveillance dragnet.

But, of course, for many companies, the bill just looks like a "get out of court free" bill -- because the entire focus is on protecting those companies from liability. Some companies take a more long-term, customer- or public-centric view of things and recognize all this, and have not supported CISA. Others, however, have been more supportive. A few weeks ago, the BSA -- which is really the Business Software Alliance, but refers to itself as The Software Alliance -- sent a letter to Congress outlining some of the issues that its members were supporting. This included a bunch of reasonable and good things, like much needed ECPA reform. However, it also included this:

Cyber Threat Information Sharing Legislation will promote cybersecurity and protect sensitive information by enabling private actors in possession of information about vulnerability and intrusions to more easily share that information voluntarily with others under threat, thus enabling the development of better solutions faster.

Now, it's notable that this line does not directly endorse CISA. And it's pretty clear that's on purpose. Of the bullet points in the letter three of the other four all name specific bills that the letter is supporting. Leaving out specific support of CISA is an interesting choice and at least indicates some hesitancy among some of the companies signing onto the letter to actually support CISA in its current form.

Of course, the problem is that, right now, there are no real alternatives being offered, and politicians who support CISA can and will point to this letter to argue that "the tech industry supports CISA." And, with that in hand, the good folks at Fight for the Future kicked off a campaign called YouBetrayedUs.org, calling on the companies who signed the letter -- including Apple, Microsoft, Adobe, Symantec, Salesforce.com, Oracle and more to renounce the letter itself.

It appears that they've claimed their first scalp, as Salesforce.com has issued a press release saying they do not support CISA and have never supported CISA. The quote is from the company's chief legal officer, Burke Norton, who is the same representative who signed the letter:

“At Salesforce, trust is our number one value and nothing is more important to our company than the privacy of our customers' data,” said Burke Norton, chief legal officer, Salesforce. “Contrary to reports, Salesforce does not support CISA and has never supported CISA.”

And here he is on the letter: Again, it's absolutely true that the letter did not directly support CISA. And it could have. As mentioned, most of the other bulletpoints list out bills by name and/or number. But the one on cybersecurity did not. Of course, one might argue that the BSA did this on purpose, knowing that if it cited CISA by name, all hell would rain down on them from the public.

Either way, perhaps this should act as a clear warning to tech companies that do want to support CISA. The public isn't going to like it very much. Similarly, this should provide further notice to companies in signing these kinds of letters that they should understand what it appears they're supporting as well.

Filed Under: cisa, cybersecurity, information sharing, liability
Companies: bsa, microsoft, oracle, salesforce

Court Order Takes Another Stab At Stripping Away Ripoff Report's Section 230 Protections

from the and-the-entity-doing-the-most-damage-to-section-230-is... dept

If anyone's going to succeed in carving a slice out of Section 230 protections, it's probably not going to be law profs and their terrible revenge porn legislation proposals. It will be Xcentric/Ripoff Report, a company that greatly benefits from these protections, but seems intent on muddying the third-party liability waters with questionable actions.

Eric Goldman covers yet another lawsuit involving Xcentric, one that could potentially cause some problems for thousands of other websites and platforms, thanks to lousy 10th Circuit precedent and the presiding judge's less-than-impressed take on Ripoff Report's tactics. Goldman quotes a fair bit of the order denying Xcentric's motion to reconsider its earlier (denied) motion to dismiss, pointing out the dubious precedent the court is relying on, as well as the inferences it draws from various Ripoff Report actions and statements.

First off, the court refers to 2009's FTC vs. Accusearch decision, which contains one of the district's more dubious Section 230 rulings.

Xcentric’s motion fails on the merits. The controlling authority for the interpretation of the CDA in the Tenth Circuit is FTC v. Accusearch Inc., 570 F.3d 1187 (10th Cir. 2009). Notwithstanding Xcentric’s claim that the Tenth Circuit was haphazard in its language, the Court stated: “We therefore conclude that a service provider is ‘responsible’ for the development of offensive content only if it in some way specifically encourages development of what is offensive about the content.”

The court came to the right decision then, but for the wrong reasons. Accusearch (aka, Akiba) was selling illicitly-obtained phone records, something that was clearly illegal. The court decided this implicated Section 230, thanks to Akiba raising it as a defense. It argued it was only the conduit between buyers and sellers and did no collection of phone records itself. This was partly true. But Akiba did more than act as an Amazon or Ebay of phone records. It directly sold records provided by third parties. This should have been what erased its Section 230 protections, but the court thought otherwise.

It ruled that Akiba was a "publisher" or "speaker," using very vaguely-drawn definitions of these terms. Furthermore, it asserted Akiba "participated in the creation or development of information," something it didn't seem to have done.

Goldman:

As for the interpretation of “creation and development,” I don’t see how anyone can interpret those words to include retailing a record without any modifications at all.

So, the court reached the right decision but deployed dodgy arguments. Now these arguments are being used to punch holes in Section 230 in this Xcentric case.

On top of the questionable precedent it cites, the court also finds other actions by Xcentric to be adversely effecting its 230 protections.

Xcentric argues that drawing all inferences in favor of Vision Security, it must be found to have been a neutral publisher. The facts as alleged, however, support a contrary conclusion. Applying the Iqbal standard, the court must give weight to the following allegations: Xcentric maintains the “Ripoff Report” website with a tag line, “By Consumers, for consumers” and “Don’t let them get away with it. Let the truth be known.” Contrary to the stated tagline, the Ripoff Report allows competitors, not just consumers, to post comments. The Ripoff Report home page states: “Complaints Reviews Scams Lawsuits Frauds Reported, File your review. Consumers educating consumers.” These allegations allow a reasonable inference that the Ripoff Report encourages negative content.

From there, the court wanders into a discussion of something nearing extortion allegations.

These specifically pleaded facts support a reasonable inference that Xcentric was not a neutral publisher. It had an interest in, and encouraged, negative content. It refused to remove the content, even when told by the author that it was false and he wanted it removed. What interest would a neutral publisher have in maintaining false and harmful content against the wishes of the author unless it advanced its own commercial interests? The alleged facts allow a reasonable inference that Xcentric refused to remove the offensive content to promote its own corporate advocacy program. Indeed, it is reasonable to infer that the very raison d’etre for the website was to commercialize on its ability to sell its program to counter the offensive content the Ripoff Report encouraged.

The conclusion the court reaches is that Xcentric is not immune under Section 230. This case hasn't been decided yet, but these opinions -- considering the precedent being cited -- have the potential to do genuine harm to Section 230 protections, at least in the Tenth Circuit. As Goldman points out, a favorable ruling employing these arguments would lay out a welcome mat for a ton of questionable lawsuits.

What stands out most to me is the favorable citation to the Accusearch case. It’s the governing law in the Tenth Circuit, so it’s an entirely appropriate citation, but this is additional evidence that perhaps the Accusearch case has done more damage to Section 230 than the more publicized Roommates.com case. I’m reminded of another recent bad Section 230 ruling, the General Steel v. Chumley case, also in the Tenth Circuit and also favorably citing Accusearch. To me, I’m getting nervous that Accusearch has tainted the Tenth Circuit’s jurisprudence such that we’ll see continued anomalous cases there. It would be a green light for Section 230 haters to forum-shop their cases into the Tenth Circuit.

Goldman also posits this combination of rulings has turned the definition of "neutral publisher" into an unreachable ideal.

The court’s legal test of “neutral publisher” is an oxymoron and incoherent. By definition, no publisher is ever neutral. Instead, any legal standard dependent on “neutrality” becomes a placeholder for other social norms. As we saw in the Washington Supreme Court Backpage ruling, when the battleground shifts to a website’s purported “neutrality,” the defendants are in trouble. In this case, the court misinterprets “neutrality” to mean that soliciting only negative reviews wasn’t “neutral.” By the same implication, then, a website that only permitted positive reviews wouldn’t be “neutral” either (for example, eBay’s feedback forum restricts sellers to only leaving positive feedback for buyers). [...] Now, in light of the Backpage ruling, I expect anti-230 plaintiffs will call the defendant “non-neutral” in every complaint. Can’t hurt, might help.

That's something Section 230 doesn't need: additional opportunities for misguided plaintiffs to throw every argument against a friendly venue's walls and hope that something sticks. Ripoff Report -- which spends a great deal of time in court -- uses its Section 230 protections to their fullest extent. The problem is that it deploys certain tactics that courts find unpleasant. While these really shouldn't be enough to strip it of these protections, the tactics do seem to be having a deleterious effect on judges' opinion of the website. And once one decides it has crossed the line, Section 230 protections will begin eroding quickly.

Filed Under: cda, jurisdiction shopping, liability, secondary liability, section 230, tenth circuit
Companies: ripoff report, xcentric

Appeals Court Says Topix Can't Be Held Responsible For Overdose Death Of Forum Member

from the tragic-circumstances-don't-create-new-liabilities dept

When a tragedy occurs, it's human instinct to find someone to blame -- even if said tragedy was an accident… or self-inflicted. When Andrew Witkoff overdosed on Oxycodone he obtained from someone he met on a website, his parents understandably looked to hold someone responsible for his death. But they chose to go after the website. And that hasn't resulted in any closure or remuneration, as Eric Goldman reports.

Seeking to buy Oxycodone, Witkoff did some Google searches and found a Topix forum titled “Oxycontin, Roxicodone, Oxycodone” (Oxycodone forum).” Topix created this forum title, but all of the content in the forum came from Topix’s users. One forum thread discussed where to buy Oxycodone, and Witkoff found a post where Daniel Park offered to sell Oxycodone. Witkoff and Park communicated by email and arranged a physical space meeting to close the purchase. Witkoff overdosed on Oxy and died two days later.

Topix is no stranger to legal maneuvers by parties who feel it should be held responsible for the content created by its users. Historically, this has taken the form of harassment from grandstanding government officials. In this case, it's the boy's parents. Both have chosen the wrong target for their actions. The protections afforded by Section 230 of the CDA explicitly bar websites from being held responsible for the actions of users.

The district court arrived at that conclusion last year. The Witkoffs appealed, only to find the higher court similarly inclined to find in favor of Topix, despite their use of a somewhat novel legal argument.

Plaintiffs contend defendant here is liable because it created the offending content—the Oxycodone forum. Thus, plaintiffs assert they are bringing a cause of action against defendant as an information content provider. Plaintiffs contend the allegation that defendant’s creation of the Oxycodone forum is sufficient to state a claim for public nuisance.

"Public nuisance" also includes the distribution of controlled substances, as Goldman points out. The problem is that -- even though Topix created the forum where Witkoff met someone who would sell him Oxycodone -- all content within the forum was generated by users. Public nuisance or not, Topix did not create the content, arrange the meeting between Witkoff and the other forum user or sell drugs to Andrew Witkoff.

Plaintiffs seek to hold defendant liable for “the illegal sale of controlled substances” under a nuisance theory. (Civ. Code, § 3479.) In the first amended complaint, plaintiffs allege that defendant aided and abetted illegal drug trafficking by failing to monitor or prohibit such communications. However, the illegal discussions concerning controlled substances that allegedly occurred on defendant’s Oxycodone forum derives from third-party threads created by the Web site’s users. There is no allegation that defendant controlled or created the content in the threads. The gravamen of plaintiffs’ allegations is to hold defendant liable as publisher of content from third parties. Immunity under section 230(c)(1) applies in such situations.

The court also points out that, although the end result was the illegal sale (and illegal purchase) of a controlled substance, simply discussing controlled substances is not a criminal act.

Oxycodone is a Schedule II controlled substance, which means it can be obtained legally for medical use. Defendant’s creation of an Oxycodone forum would encourage discussion of Oxycodone by its users. Discussion of Oxycodone is not per se illegal. Defendant is entitled to the section 230(c)(1) immunity as to plaintiffs’ claims.

As for the seeming oddness of Topix creating a forum for the discussion of Oxycodone, Goldman obtained a statement from a Topix rep. Basically, the site auto-generates any number of "topics/x," including the 842 forums it has algorithmically created to discuss a number of prescription drugs. If you're in the business of "generating" third-party content, any topic that starts a conversation is a win, no matter how sketchy it might appear from the outside. And, as the Second Circuit Appeals Court notes, simply discussing controlled substances is not illegal, even if any number of aggrieved parties would desperately like this to be true.

Filed Under: andrew witkoff, appeals court, cda 230, free speech, liability, oxycodone, secondary liability
Companies: topix

Kenya Pushes New Copyright Law Which Will Blame ISPs For Not Magically Stopping Piracy

from the that's-not-the-dmca-you're-copying dept

Update: Quick update on the story below, again alerted by Mitch Stoltz, a copy of the actual text of the law has been released and it does appear to more closely track with the safe harbor protections for ISPs. That is, the claims made by the copyright bureaucrat above that it's about making ISPs liable was misleading... The rest of the post stands however.

Via Mitch Stoltz, we learn of a new proposed copyright law in Kenya that not only would be a disaster for the internet in that country, but where the people pushing it don't even seem to understand what they're talking about. The key element: forcing ISPs to be copyright cops and putting liability on them if they somehow fail to magically stop piracy:

The Government is now turning it’s sights on ISPs in a move to curb piracy, which erodes revenues for the country’s film industry.

“We are proposing to introduce an amendment in the Copyright Act that will place the onus of responsibility for Kenyan content illegally downloaded, squarely on local internet service providers,” said Head of the Kenya Copyright Board (Kecobo) Edward Sigei.

Bizarrely, Sigei argues that he's just copying the DMCA in the US:

“We are borrowing from the Digital Millennium Copyright Act of America and others that have come after it and we have designed an amendment where the ISP will be liable under certain circumstances for infringements that happen through their channels.”

Except, that's the exact opposite approach of the DMCA, whose safe harbors protect ISPs from liability, by noting that the responsibility should be on the actual people infringing, rather than the service providers in the middle. It's this safe harbor protection that allows the internet to function as it does, encouraging platforms for communication, sharing and content creation and hosting. Making ISPs liable puts tremendous liability on those ISPs, meaning they're much less likely to offer such services at all.

Is Kenya really looking to shut down useful internet services in that country?

Even more bizarre is that Kenya claims it's doing this in order to catch up with countries like Nigeria, whose movies have become huge throughout Africa:

This is part of a push to have Kenyan local content earn a larger foothold on Kenya’s airwaves currently dominated by Nigerian and Latin American programming.

Except, if you actually look at why the Nigeraian film business became so successful, it was actually because of a lack of copyright enforcement that helped create informal distribution and promotional channels across Africa. As the Economist explained years ago:

The merchants curse the pirates, but in a way they are a blessing. Pirate gangs were probably Nollywood's first exporters. They knew how to cross tricky borders and distribute goods across a disparate continent where vast tracts of land are inaccessible. Sometimes they filled empty bags with films when returning from an arms delivery. Often they used films to bribe bored guards at remote borders. The pirates created the pan-African market Mr Akudinobi now feeds.

A detailed academic research paper a few years later made it clear that it was piracy, not regulations that helped establish Nigerian film as a dominant player across Africa and further noted that this lack of copyright enforcement actually massively helped the economy.

Notably, although many countries have sought to incentivize particular types of film production through direct government funding, subsidies, or film protection schemes involving film quotas, many of these industries have not been commercially viable in the absence of subsidies or other support schemes. In contrast, Nollywood has created significant volume of local video film content with virtually no government involvement or subsidies. The success of Nollywood may in many respects be attributable to a lack of government involvement and its decentralized nature, which has permitted Nollywood participants to be highly entrepreneurial, adaptive and innovative. Nollywood now may employ as many as 200,000 people directly, with estimates of indirect employment as high as 1 million. The market-driven Nollywood approach is less costly than existing models of film production and distribution and may offer a new model for developing countries that wish to develop domestic film industries.

And yet, Kenya insists that it's trying to copy Nigeria, but it's doing the exact opposite? And it's going to do so by "copying" the DMCA, by apparently doing the exact opposite of the DMCA? It really makes you wonder what officials in Kenya are actually thinking in pushing this forward. Given the nature of the proposal, it looks much more like the wishes of foreign film interests, such as those from Hollywood, looking for yet another beachhead from which to push bogus rules to make ISPs copyright cops, rather than fixing their own business models.

Filed Under: copyright, culture, dmca, edward sigei, films, kenya, liability, nigeria

Washington State Court Confused By Section 230, Says Backpage May Be Liable For User Posts

from the because-we-said-so dept

What is it about state courts where they seem much more confused by the law than federal courts? The latest is a horrifically confused ruling out of Washington State's Supreme Court, basically handwaving its way past nearly all caselaw on Section 230 of the CDA. That law makes it clear that online service providers are not liable for actions/content of their users. This was a key purpose behind the law, which Congress passed to make sure that people couldn't file frivolous lawsuits targeting service providers, rather than the actual users who broke the law. It's a good and extremely important law in the development of the internet, having helped stop numerous frivolous lawsuits, but more importantly, for providing strong protections that made it possible for many internet services to exist in the first place. And, yet, every once in a while, a court seems to miss all of this, and today that court is the Washington State Supreme Court, ruling that Backpage.com may be directly liable for the fact that one of its users used the service to engage in sex trafficking with young girls.

Let's start by making one thing clear: the trafficking of these girls is horrific and one hopes that all legal recourse is being used against those who actually were engaged in the trafficking. But targeting Backpage makes no more sense than targeting Ford because one of its cars was used as the getaway vehicle in a bank robbery. And yet... the court rules otherwise. And it doesn't give any good reason at all, other than because it said so. The court doesn't ignore Section 230. It properly notes that Section 230 protects service providers, but not those who develop the content. And then it decides that Backpage may have created rules that "induce sex trafficking," and thus it could be seen as developing the content. Here's the key part of the ruling:

Viewing J.S. 's allegations in the light most favorable to J.S., as we must at this stage, J.S. alleged facts that, if proved true, would show that Backpage did more than simply maintain neutral policies prohibiting or limiting certain content. Those allegations include that (1) "Backpage.com ... has intentionally developed its website to require information that allows and encourages ... illegal trade to occur through its website, including the illegal trafficking of underage girls," (2) "Backpage.com has developed content requirements that it knows will allow pimps and prostitutes to evade law enforcement," (3) "Backpage.com knows that the foregoing content requirements are a fraud and a ruse that is aimed at helping pimps, prostitutes, and Backpage.com evade law enforcement by giving the [false] appearance that Backpage.com does not allow sex trafficking on its website," (4) "the content requirements are nothing more than a method developed by Backpage.com to allow pimps, prostitutes, and Backpage.com to evade law enforcement for illegal sex trafficking, including the trafficking of minors for sex," ( 5) Backpage' s "content requirements are specifically designed to control the nature and context of those advertisements so that pimps can continue to use Backpage.com to traffic in sex, including the trafficking of children, and so Backpage.com can continue to profit from those advertisements," and (6) Backpage has a "substantial role in creating the content and context of the advertisements on its website." ... According to J.S., Backpage' s advertisement posting rules were not simply neutral policies prohibiting or limiting certain content but were instead ~'specifically designed ... so that pimps can continue to use Backpage.com to traffic in sex." ...

Given J. S. 's allegations, it does not appear "'beyond a reasonable doubt that no facts exist that would justify recovery"' in this case, and, therefore, dismissal of J.S.'s claims under CR 12(b)(6) is not appropriate.... It is important to ascertain whether in fact Backpage designed its posting rules to induce sex trafficking to determine whether Backpage is subject to suit under the CDA because "a website helps to develop unlawful content, and thus falls within the exception to section 230, if it contributes materially to the alleged illegality of the conduct." ... Fact-finding on this issue is warranted.

In short, because the plaintiffs claim that -- even though Backpage's terms of service directly state that you are not allowed to use the service for illegal activities such as trafficking or prostitution -- because they believe Backpage really wants that, it means that it's somehow crossed the line and helped to "develop" the content. That's bizarre and legally wrong. I imagine this will reach a federal court which will destroy this decision.

There's a concurring ruling from Justice Charles Wiggins that is even more confused and completely misreads Section 230 and the volumes of caselaw that make it clear that 230 grants full immunity to service providers. Wiggins insists that's not true. Because he's wrong.

I write separately to emphasize that this holding implies that the plaintiffs' claims do not treat Backpage.com as the publisher or speaker of another's information under the Communications Decency Act of 1996 (CDA), 47 U.S.C. § 230(c). The dissent misreads this statute to provide "immunity" to '"interactive service providers.'" Dissent at 1. This reading is irreconcilable with the actual language of the statute, which does not include the term or any synonym of "immunity." Subsection 230(c)(1) instead provides a narrower protection from liability: the plain language of the statute creates a defense when there is (1) a provider or user of an interactive computer service (2) whom a plaintiff seeks to treat, under a state law cause of action, as a publisher or speaker of information (3) that is provided by another information content provider.

Thus, when the cause of action does not treat an intermediary as a publisher or speaker, subsection 230(c)(1) cannot be read to protect that intermediary from liability. Plaintiffs' claims that Backpage.com created ucontent rules" specifically designed to induce sex trafficking and evade law enforcement do not treat Backpage.com as the publisher or speaker of another's information. Accordingly, I join the majority opinion.

This is just wrong. It's a really twisted reading of Section 230 that no court has made before. Wiggins is trying to argue that they're not blaming Backpage for the sex trafficking, but merely for the rules that induce sex trafficking (even though the company goes way beyond what's legally necessary to insist that no sex trafficking is allowed on the platform). Basically, he's arguing that if people think you mean one thing, but say another, Section 230 safe harbors might no longer apply to you. Because.

There's a strong dissent from Justice Sheryl Gordon McCloud pointing out how ridiculous it is that things got this far.

The majority holds that J.S.'s complaint would support a claim that Backpage functions as an "information content provider" because it alleged that Backpage maintains content requirements for advertisements posted on its website that surreptitiously guide pimps on how to post illegal, exploitative ads. But J.S.'s complaint clearly alleges that another content provider, not Backpage, provided the content for the advertisements. J.S. thus seeks to hold Backpage liable as a publisher or speaker of that information. Subsection 230(c)(l) therefore bars J.S.'s claims.

That dissent also trashes Wiggins' attempt to parse a difference between "immunity" and a more limited liability protection:

Given the allegations in this particular case, the difference in terminology is irrelevant. The question is how far the subsection 230( c )(1) protection reaches, and courts interpreting subsection 230(c)(1)'s language uniformly hold that its protection for publishers is "quite robust." They apply an expansive definition of '"interactive computer service provider"' and a rather restrictive definition of "information content provider." Carafano v. Metrosplash.com .... They hold that the law provides immunity if the plaintiff alleges that the defendant violated a duty deriving from the defendant's status or conduct as a publisher or speaker. Barnes v. Yahoo!... As long as a third party "'willingly provides the essential published content, the interactive service provider receives full immunity regardless of the specific editing or selection process."' Corbis Corp. v. Amazon.com.... The inquiry is whether the defendant "function[ed] as an 'information content provider' for the portion of the statement or publication at issue." Carafano...; see also Nemet Chevrolet, Ltd. v. Consumeraffairs.com ... (affirming district court's dismissal of complaint where plaintiff failed to show that defendant "was responsible for the creation or development. of the allegedly defamatory content at issue").

The dissent further notes that the majority decision mistakenly takes J.S.'s assertions that Backpage is the developer of content as true, even though it's clearly not the case under the law:

This allegation-that Backpage designed its posting rules to induce sex trafficking-might prove true. Indeed, we presume it is true when evaluating the sufficiency of J. S. 's complaint. But adopting such posting rules still does not make Backpage a "content provider" within the meaning of the CDA, even under the Ninth Circuit case upon which J.S., the majority, and the concurrence place principal reliance....

In fact, courts have consistently rejected the contention that defendants "develop" content by maintaining neutral policies prohibiting or limiting certain content. For example, in Dart v. Craigslist... which the majority cites at 7, the plaintiff claimed that even though Craigslist, an Internet classifieds service, prohibited illegal content on its website, users frequently posted ads promising sex for money.... Consequently, the plaintiff asserted that Craigslist "ma[de] it easier for prostitutes, pimps, and patrons to conduct business." ... A federal court in Illinois dismissed the claims... explaining, "Plaintiffs argument that Craigslist causes or induces illegal content is further undercut by the fact that Craigslist repeatedly warns users not to post such content. While we accept as true for the purposes of this motion plaintiffs allegation that users routinely flout Craigslist's guidelines, it is not because Craigslist has caused them to do so. Or if it has, it is only 'in the sense that no one could post [unlawful content] if craigslist did not offer a forum."' ... see also Chi. Lawyers'... ("Nothing in the service craigslist offers induces anyone to post any particular listing."); Roommates, ... ("To be sure, the website provided neutral tools, which the anonymous dastard used to publish the libel, but the website did absolutely nothing to encourage the posting of defamatory content-indeed, the defamatory posting was contrary to the website's express policies.")....

The facts in Dart are analogous to the facts here. J.S. alleges that pimps-not Backpage-created and uploaded the ads at issue... ("adult pimps ... posted advertisements for the girls") ... ("adult pimps ... create[ d] ... and then uploaded [the] advertisements of S.L. onto . . . Backpage.com"). Nothing in Backpage's policies obligated users to flout Backpage's express content requirements or to post unlawful content. J. S. 's allegations indicate that the pimps chose the content ultimately used in the advertisements.... The actual "information" at issue consisted of the particular wording and photos that the pimps provided....

Thus, holding Backpage liable would punish it for publishing third party content, and the CDA prohibits such liability.

It seems highly likely that Backpage will appeal and will win.

Filed Under: cda, immunity, liability, safe harbors, section 230, trafficking, washington
Companies: backpage, backpage.com

Insanity Rules: NSA Apologists Actually Think Apple Protecting You & Your Data Could Be 'Material Support' For ISIS

from the this-is-wrong dept

A few weeks ago, we pointed out that Senator Sheldon Whitehouse led the way with perhaps the most ridiculous statement of any Senator (and there were a lot of crazy statements) in the debate over encryption and the FBI's exaggerated fear of "going dark." He argued that if the police couldn't find a missing girl (using a hypothetical that not only didn't make any sense, but which also was entirely unlikely to ever happen), then perhaps Apple could face some civil liability for not allowing the government to spy on your data. Here's what he said:

It strikes me that one of the balances that we have in these circumstances, where a company may wish to privatize value -- by saying "gosh, we're secure now, we got a really good product, you're gonna love it" -- that's to their benefit. But for the family of the girl that disappeared in the van, that's a pretty big cost. And, when we see corporations privatizing value and socializing costs, so that other people have to bear the cost, one of the ways that we get back to that and try to put some balance into it, is through the civil courts. Through the liability system. If you're a polluter and you're dumping poisonous waste into the water rather than treating it properly somebody downstream can bring an action and can get damages for the harm they sustained, can get an order telling you to knock it off.

You can read our longer analysis of how wrong this is, but in short: encryption is not pollution. Pollution is a negative externality. Encryption is the opposite of that. It's a tool that better protects the public in the vast majority of cases. That's why Apple is making it so standard.

The suggestion was so ridiculous and so wrong that we were surprised that famed NSA apologist Ben Wittes of the Brookings Institute found Whitehouse's nonsensical rant "interesting" and worthy of consideration. While we disagree with Wittes on nearly everything, we thought at the very least common sense would have to eventually reach him, leading him to recognize that absolutely nothing Whitehouse said made any sense (then again, this is the same Wittes who seems to have joined the magic unicorn/golden key brigade -- so I'm beginning to doubt my initial assessment that Wittes is well-informed but just comes to bad conclusions).

However, even with Wittes finding Whitehouse's insane suggestion "interesting," it's still rather surprising to see him find it worthy of a multi-part detailed legal analysis for which he brought in a Harvard Law student, Zoe Bedell, to help. In the first analysis, they take a modified form of Whitehouse's hypothetical (after even they admit that his version doesn't actually make any sense), but still come to the conclusion that the company "could" face civil liability. Though, at least they admit plaintiffs would "not have an easy case."

The first challenge for plaintiffs will be to establish that Apple even had a duty, or an obligation, to take steps to prevent their products from being used in an attack in the first place. Plaintiffs might first argue that Apple actually already has a statutory duty to provide communications to government under a variety of laws. While Apple has no express statutory obligation to maintain the ability to provide decrypted information to the FBI, plaintiffs could argue that legal obligations it clearly does have would be meaningless if the communications remained encrypted.

To make this possible, Bedell and Wittes try to read into various wiretapping and surveillance laws a non-existent duty to decrypt information from your mobile phone. But that's clearly not true. If that actually existed, then we wouldn't be having this debate right now in the first place, and FBI Director James Comey wouldn't be talking to Congress about changing the law to require such things. But, still, they hope that maybe, just maybe, a court would create such a duty out of thin air based on things like "the foreseeability of the harm." Except, that's going to fall flat on its face, because the likelihood of harm here goes the other way. Not encrypting your information leads to a much, much, much greater probability of harm than encrypting your data and not allowing law enforcement to see it.

Going to even more ridiculous levels than the "pollution" argument, this article compares Apple encrypting your data to the potential liability of the guy who taught the Columbine shooters how to use their guns:

For example, after the Columbine shooting, the parents of a victim sued the retailer who sold the shooters one of their shotguns and even taught the shooters how to saw down the gun’s barrel. In refusing to dismiss the case, the court stated that “[t]he intervening or superseding act of a third party, . . . including a third-party's intentionally tortious or criminal conduct[,] does not absolve a defendant from responsibility if the third-party's conduct is reasonably and generally foreseeable.” The facts were different here in some respects—the Columbine shooters were under-age, and notably, they bought their supplies in person, rather than online. But that does not explain how two federal district courts in Colorado ended up selecting and applying two different standards for evaluating the defendant's duty.

But it's even more different than that. Even with this standard -- which many disagree with -- there still needs to be "conduct" that is "reasonably and generally foreseeable." And that's not the case here that it is "reasonably and generally foreseeable" that because data is encrypted that people will be at more risk. In all these years, the FBI still can't come up with a single example where such encryption was a real problem. It would be basically impossible to argue that this is a foreseeable "problem," especially when weighed against the very real and very present problem of people trying to hack into your device and get your data.

In the second in the series, Bedell and Wittes go even further in looking at whether or not Apple could be found to have provided material support to terrorists thanks to encryption. If this sounds vaguely familiar, remember a similarly ridiculous claim not to long ago from a music industry lawyer and a DOJ official that YouTube and Twitter could be charged with material support for terrorism because ISIS used both platforms.

Bedell and Wittes concoct a scenario in which a court might argue that providing a phone that can encrypt a terrorist's data, opens the company up to liability:

In our scenario, a plaintiff might argue that the material support was either the provision of the cell phone itself, or the provision of the encrypted messaging services that are native on it. Thus, if a jury could find that providing terrorists with encrypted communications services is just asking for trouble, then plaintiffs would have satisfied the first element of the definition of international terrorism in § 2331, a necessary step for making a case for liability under § 2333.

Of course, this is wiped out pretty quickly because that law requires intent. The authors note that this would "pose a challenge" to any plaintiff "as it would appear to be difficult, if not impossible, to prove that Apple intended to intimidate civilians or threaten governments by selling someone an iPhone..."

You think?

But, our intrepid NSA apologists still dig deeper to see if they can come up with a legal theory that will actually work:

But again, courts have handled this question in ways that make it feasible for a plaintiff to succeed on this point against Apple. For example, when the judge presiding over the Arab Bank case considered and denied the bank’s motion to dismiss, he shifted the analysis of intimidation and coercion (as well as the question of the violent act and the broken criminal law) from the defendant in the case to the group receiving the assistance. The question for the jury was thus whether the bank was secondarily, rather than primarily, liable for the injuries. The issue was not whether Arab Bank was trying to intimidate civilians or threaten governments. It was whether Hamas was trying to do this, and whether Arab Bank was knowingly helping Hamas.

Judge Posner’s opinion in Boim takes a different route to the same result. Instead of requiring a demonstration of actual intent to coerce or intimidate civilians or a government, Judge Posner essentially permits the inference that when terrorist attacks are a “foreseeable consequence” of providing support, an organization or individual knowingly providing that support can be understood to have intended those consequences. Because Judge Posner concludes that Congress created an intentional tort, § 2333 in his reading requires the plaintiff to prove that the defendant knew it was supporting a terrorist or terrorist organization, or at least that it was deliberately indifferent to that fact. In other words, the terrorist attack must be a foreseeable consequence of the specific act of support, rather than just a general risk of providing a good or service.

But even under those standards, it's hard to see how Apple could possibly be liable for material support. It's just selling an iPhone and doing so in a way that -- for the vast majority of its customers -- is better protecting their privacy and data. It would take an extremely twisted mind and argument to turn that into somehow "knowingly" helping terrorists or creating a "foreseeable consequence." At least the authors admit that much.

But why stop there? They then say that Apple could still be liable after the government asks them to decrypt messages. If Apple doesn't magically stop the user in particular from encrypting messages, then, they claim, Apple could be shown to be "knowingly" supporting terrorism.

The trouble for Apple is that our story does not end with the sale of the phone to the person who turns out later to be an ISIS recruit. There is an intermediate step in the story, a step at which Apple’s knowledge dramatically increases, and its conduct arguably comes to look much more like that of someone who—as Posner explains—is recklessly indifferent to the consequences of his actions and thus carries liability for the foreseeable consequences of the aid he gives a bad guy.

That is the point at which the government serves Apple with a warrant—either a Title III warrant or a FISA warrant. In either case, the warrant is issued by a judge and puts Apple on notice that there is probable cause to believe the individual under investigation is engaged in criminal activity or activity of interest for national security reasons and is using Apple’s services and products to help further his aims. Apple, quite reasonably given its technical architecture, informs the FBI at this point that it cannot comply in any useful way with the warrant as to communications content. It can only provide the metadata associated with the communications. But it continues to provide service to the individual in question.

But all of this, once again, assumes an impossibility: that once out of its hands, Apple can somehow stop the end user from using the encryption on their phone.

This is the mother of all stretches in terms of legal theories. And, throughout it all, neither Bedell nor Wittes even seems to recognize that stronger encryption protects the end user. It's like it doesn't even enter their minds that there's a reason why Apple is providing encryption that isn't "to help people hide from the government." It's not about government snooping. It's about anyone snooping. The other cases they cite are not like that at all. These arguments, even as thin as they are, only make sense if Apple's move to encryption doesn't really have widespread value for basically the entire population. You don't sue Toyota for "material support for terrorism" just because a terrorist uses a Toyota to make a car bomb. Yet, Wittes and Bedell are somehow trying to make the argument that Apple is liable for better protecting you, just because in some instances it might also help "bad" people. That's a ridiculous legal theory that barely deserves to be laughed at, let alone a multi-part analysis of how it "might work."

Filed Under: ben wittes, encryption, isis, liability, material support, mobile encryption, pollution, sheldon whitehouse, terorrism, zoe bedell
Companies: apple