The Progress & Freedom Foundation Blog

Lori Drew was convicted late last year on charges related to her role in a cruel hoax that led to the tragic suicide of thirteen-year old Megan Meier in Missouri in 2006. But today, at her sentencing, the judge threw out her convictions. Millions around the world were horrified by Megan's fate, and many will probably be upset that Drew might go unpunished. But we need to separate three questions in this case:

Should the federal anti-hacking law under which she was convicted really be applied in such cases?

What, precisely, was Drew's involvement?

The key question: What should be done about the general problems of cyberbullying and cyberharassment?

Misuse of the Anti-Hacking Statute

Judge Wu has yet to issue his written opinion but seems to have agreed with the various experts on Internet law who argued that, however tragic the Meier case was, the Computer Fraud & Abuse Act (CFAA) should not have been applied to Drew. Most notably, the Electronic Frontier Foundation filed an Amicus Brief in support of Drew's motion to dismiss the charges against her--summarized by Groklaw and the Harvard Journal of Law & Technology. Orin Kerr, a leading Internet law professor, felt so strongly about the consequences of using the CFAA to criminalize violations of privately written terms of service that he joined Drew's defense team. Kerr demonstrated the problems of essentially allowing private parties to create the grounds for criminal offenses (if violated by users) by suggesting obviously ridiculous new terms of service for the Volokh Conspiracy, the group blog he writes on.

Hard as it may be for those who want to "see justice done" in this case, the CFAA just isn't the right law to apply--which raises the question of whether new laws are needed, discussed below.

Uncertainty About Drew's Role

The judge may also have been influenced by uncertainty as to Drew's actual role in the case. Initial coverage of the story suggested that Drew created the fake MySpace persona of a teen boy ("Josh Evans"), then used that profile to woo Meier, a classmate of Drew's daughter, only to deliberately--and cruelly--break her heart. After Missouri prosecutors and the FBI declined to press charges against Drew, federal prosecutors in California decided to do so, but Drew consistently maintained that it was not her idea to create the account.

As I noted recently, Berin Szoka and I just released a big PFF white paper (PDF) entitled, "Cyberbullying Legislation: Why Education is Preferable to Regulation," which examines two very different federal approaches to the issue. One approach is focused on the creation of a new federal crime to punish cyberbullying, which would include fines and jail time for violators. One approach, set forth by Rep. Linda Sánchez (D-CA) in H.R. 1966 (originally H.R. 6123), the "Megan Meier Cyberbullying Prevention Act," would create a new federal felony: "Whoever transmits in interstate or foreign commerce any communication, with the intent to coerce, intimidate, harass, or cause substantial emotional distress to a person, using electronic means to support severe, repeated, and hostile behavior, shall be fined under this title or imprisoned not more than two years, or both."

The other legislative approach is education-based and would create an Internet safety education grant program to address the issue in schools and communities. In mid-May, the "School and Family Education about the Internet (SAFE Internet) Act" (S. 1047) was introduced in the Senate by Sen. Robert Menendez (D-NJ) and in the House by Rep. Debbie Wasserman Schultz (D-FL). The measure proposes an Internet safety education grant program that will be administered by the Department of Justice, in concurrence with the Department of Education, and the Department of Health & Human Services.

On June 12, the Family Online Safety Institute (FOSI) hosted a discussion about these bill on Cap Hill, which was moderated by FOSI CEO Stephen Balkam. Representatives from both Rep. Sanchez's and Sen. Menendez's offices were on hand to discuss their bills, and I provided some feedback based upon what Berin and I concluded in our paper. It was a good discussion and I encourage you to watch the whole thing because there were some good questions from the audience later in the show.

The Wired article ("Great Wall of Facebook: The Social Network's Plan to Dominate the Internet -- and Keep Google Out") I discussed yesterday touched on another issue near & dear to my heart (besides the importance of smarter advertising): the future of online anonymity. The article lays out Facebook's "4-Step Plan for Online Domination," which involves "colonizing" the web though Facebook's Connect (launched Dec. 2008) and Open Stream API (launched April 2009) initiatives, which:

don't just allow users to access their Facebook networks from anywhere online. They also help realize Facebook's longtime vision of giving users a unique, Web-wide online profile. By linking Web activity to Facebook accounts, they begin to replace the largely anonymous "no one knows you're a dog" version of online identity with one in which every action is tied to who users really are.

To hear Facebook executives tell it, this will make online interactions more meaningful and more personal. Imagine, for example, if online comments were written by people using their real names rather than by anonymous trolls. "Up until now all the advancements in technology have said information and data are the most important thing," says Dave Morin, Facebook's senior platform manager. "The most important thing to us is that there is a person sitting behind that keyboard. We think the Internet is about people."

The bolded prediction of what I would call "Online Identity Integration" is already happening. To take one tiny example, readers can now post comments on the TLF by logging into Disqus (our Comment Management System) through their Facebook (or Twitter) account, which will also allow them to automatically share those comments on Facebook (or Twitter). This is purely opt-in: Users are free to continue to post anonymous comments. But as more websites and platforms implement such Identity Integration functionality, a growing percentage of online speech will be tied to profiles offered by major social networks.

Some free speech advocates are sure to bemoan Identity Integration as directly undermining online anonymity.

By Berin Szoka & Adam Thierer

We've just released a new PFF white paper (PDF) entitled, "Cyberbullying Legislation: Why Education is Preferable to Regulation." In this 24-page study we note that, compared to previous fears about online predation, which have been greatly overblown, concerns about cyberbullying are more well-founded. Evidence suggests the cyberbullying is on the rise and that it can have profoundly damaging consequences for children.

Unsurprisingly, in the wake of a handful of high-profile cyberbullying incidents that resulted in teen/tween suicides, some state lawmakers began floating legislation to address the issue. More recently, two very different federal approaches have been proposed. One approach is focused on the creation of a new federal crime to punish cyberbullying, which would include fines and jail time for violators. In April 2008, Rep. Linda Sánchez (D-CA) introduced H.R. 1966 (originally H.R. 6123), the "Megan Meier Cyberbullying Prevention Act," a bill that would create a new federal felony:

"Whoever transmits in interstate or foreign commerce any communication, with the intent to coerce, intimidate, harass, or cause substantial emotional distress to a person, using electronic means to support severe, repeated, and hostile behavior, shall be fined under this title or imprisoned not more than two years, or both."

Behavioral Advertising Industry Practices Hearing: Some Issues that Need to be Discussed

by Berin Szoka & Adam Thierer

This morning, the House Energy & Commerce Committee will hold a hearing on "Behavioral Advertising: Industry Practices And Consumers' Expectations." If nothing else, it promises to be quite entertaining: With full-time Google bashers Jeff Chester and Scott Cleland on the agenda, the likelihood that top Google officials will be burned in effigy appears high!

Chester, self-appointed spokesman for what one might call the People for the Ethical Treatment of Data (PETD) movement, is sure to rant and rave about the impending techno-apocalypse that will, like all his other Chicken-Little scenarios, befall us all if online advertisers were permitted to better tailor ads to consumers' liking. After all, can you imagine the nightmare of less annoying ads that might actually convey more useful information to consumers? Isn't serving up "untargeted" dumb banner ads for Viagra to young women and Victoria's Secret ads to Catholic school kids the pinnacle of modern online advertising? God forbid we actually make advertising more relevant and interest-based! (Those Catholic school boys may appreciate the lingerie ads, but few will likely buy bras.)

Anyway, according to National Journal's Tech Daily Dose, the hearing lineup also includes:

Charles Curran, Executive Director, Network Advertising Initiative

Christopher Kelly, Chief Privacy Officer, Facebook

Edward Felten, Director, Center for IT Policy, Princeton University

Anne Toth, Chief Privacy Officer & Vice President, Policy, Yahoo!

Nicole Wong, Deputy General Counsel, Google

That's an interesting group and we're sure that they will say interesting things about the issue. Nonetheless, because four of them have a corporate affiliation that fact will inevitably be used by some critics to dismiss what they have to say about the sensibility of more targeted or interest-based forms of online advertising. So, we'd like to offer a few thoughts and pose a few questions to make sure that Committee members understand why, regardless of what it means for any particular online operator, targeting online advertising is very pro-consumer and essential to the future of online content, culture, and competition. As Wall Street Journal technology columnist Walt Mossberg has noted, "Advertising is the mother's milk of all the mass media." Much of the "free speech" we all cherish isn't really free, but ad-supported!

Rebecca MacKinnon has an important piece in the Wall Street Journal today about China's "Green Dam Youth Escort" filtering mandate and the danger of this model catching on with other governments. "More and more governments -- including democracies like Britain, Australia and Germany -- are trying to control public behavior online, especially by exerting pressure on Internet service providers," she notes. "Green Dam has only exposed the next frontier in these efforts: the personal computer."

She's right, and that's cause for serious concern. Moreover, there's the question of how corporations doing business in China should respond to demands and threats related to installing such filters. She notes:

In a world that includes child pornographers and violent hate groups, it is probably not reasonable to oppose all censorship in all situations. But if technical censorship systems are to be put in place, they must be sufficiently transparent and accountable so that they do not become opaque extensions of incumbent power -- or get hijacked by politically influential interest groups without the public knowing exactly what is going on.

Which brings us back to companies: the ones that build and run Internet and telecoms networks, host and publish speech, and that now make devices via which citizens can go online and create more speech. Companies have a duty as global citizens to do all they can to protect users' universally recognized right to free expression, and to avoid becoming opaque extensions of incumbent power -- be it in China or Britain.

I generally agree with all that but this is a difficult issue and one that I have struggled with personally. (See this "Friendly Conversation about Corporate High-Tech Engagement with China" that Jim Harper and I had three years ago). But I do hope that more companies take a hard line with the Chinese as well as there own governemnts when it comes to filtering mandates or even restricitve parental control defaults and settings [an issue I wrote more about in this paper: "The Perils of Mandatory Parental Controls and Restrictive Defaults."] On that note, kudos to the business groups that already signed on to a joint letter oppossing China's new filtering mandate.

Cory Doctorow has called for a Wikipedia-style effort to build an open source, non-profit search engine. From his column in The Guardian:

What's more, the way that search engines determine the ranking and relevance of any given website has become more critical than the editorial berth at the New York Times combined with the chief spots at the major TV networks. Good search engine placement is make-or-break advertising. It's ideological mindshare. It's relevance...

It's a terrible idea to vest this much power with one company, even one as fun, user-centered and technologically excellent as Google. It's too much power for a handful of companies to wield.

The question of what we can and can't see when we go hunting for answers demands a transparent, participatory solution. There's no dictator benevolent enough to entrust with the power to determine our political, commercial, social and ideological agenda. This is one for The People.

Put that way, it's obvious: if search engines set the public agenda, they should be public.

He goes on to claim that "Google's algorithms are editorial decisions." For Doctorow, this is an outrage: "so much editorial power is better vested in big, transparent, public entities than a few giant private concerns."

I wish Doctorow well in his effort to crowdsource a Google-killer, but I'm more than a little skeptical that anyone would actually want to use his search engine of The People. My guess is that, like most things produced in the name of "The People" (Soviet toilet paper comes to mind), it will probably won't be much fun to use, and will likely chafe noticeably. (For the record, I love and regularly use Wikipedia; I just don't think that model is unlikely to produce a particularly useful search engine. As Doctorow himself has noted of Google, "they make incredibly awesome search tools.")

But I'm glad to see that Doctorow has conceded an important point of constitutional law: The First Amendment protects the editorial discretion of search engines, like all private companies, to decide what to content to communicate. For a newspaper, that means deciding which articles or editorials to run. For a library or bookstore, it means which books to carry. For search engines, it means how to write their search algorithims.

Berin recently encouraged me to re-read Thomas Sowell's The Vision of the Anointed: Self-Congratulation as a Basis for Social Policy, which I hadn't looked at since I first read it back in 1995 or 96. I'm glad I did since Sowell's work has always been profoundly influential on my thinking (especially his masterpiece, A Conflict of Visions) and I had forgotten how useful The Vision of the Anointed was in helping me understand the reoccurring model that drives ideological crusades to expand government power over our lives and economy.

"The great ideological crusades of the twentieth-century intellectuals have ranged across the most disparate fields," Sowell noted in the book. But what they all had in common, he argued, was "their moral exaltation of the anointed above others, who are to have their different views nullified and superseded by the views of the anointed, imposed via the power of government." (p. 5) These elitist, government-expanding crusades shared several key elements, which Sowell identified as follows:

Assertion of a great danger to the whole society, a danger to which the masses of people are oblivious.

An urgent need for government action to avert impending catastrophe.

A need for government to drastically curtail the dangerous behavior of the many, in response to the prescient conclusions of the few.

A disdainful dismissal of arguments to the contrary as either uninformed, irresponsible, or motivated by unworthy purposes.

You can see this model at work on a daily basis today with our government's various efforts to reshape our economy, but I think this model is equally applicable to debates over social policy and speech control. In particular, the various "technopanics" I have been writing about recently fit this model. (See 1, 2, 3, 4, 5). For example, consider how this plays out in the debate over online social networking:

As Berin mentioned last week, we have a new paper out on proposals to expand the Children's Online Privacy Protection Act (COPPA) of 1998. We generically refer to those COPPA-expansion efforts as "COPPA 2.0." Hence, the title of our paper: "COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech." To recap what Berin already noted, in the name of improving online child safety, some legislators and state attorneys general (AGs) are advocating the expansion of COPPA's "verifiable parental consent" model of age verification before certain sites or services may collect, or enable the sharing of, personal information for children.

Unlike "COPPA 1.0," however, which only applied to children under the age of 13, "COPPA 2.0" would apply to all minors up to age 17. Moreover, the range of sites covered by the new law would generally be expanded to include just about any site or service with social networking functionality.

Since Berin has already summarized our general concerns with efforts to expand COPPA's "verifiable parental consent" online age verification system to cover more online users and sites, I thought I would focus here on what I believe will be the most controversial (and important) part of our paper -- our discussion about how COPPA 2.0 affects the speech rights of both adults and adolescents.

COPPA 2.0: The New Battle over Privacy, Age Verification, Online Safety & Free Speech

Adam Thierer & I have just released a detailed examination (PDF) of brewing efforts to expand the Children's Online Privacy Protection Act of 1998 to cover adolescents and potentially all social networking sites--an approach we call "COPPA 2.0."

As Adam explained on Larry Magid's CNET podcast, COPPA mandates certain online privacy protections for children under 13, most importantly that websites obtain the "verifiable consent" of a child's parent before collecting personal information about that child or giving that child access to interactive functionality that might allow the child to share their personal information with others. The law was intended primarily to "enhance parental involvement in a child's online activities" as a means of protecting the online privacy and safety of children.

Yet advocates of expanding COPPA--or "COPPA 2.0"--see COPPA's verifiable parental consent framework as a means for imposing broad regulatory mandates in the name of online child safety and concerns about social networking, cyber-harassment, etc. Two COPPA 2.0 bills are currently pending in New Jersey and Illinois. The accelerated review of COPPA to be conducted by the FTC next year (five years ahead of schedule) is likely to bring to Washington serious talk of expanding COPPA--even though Congress clearly rejected covering adolescents age 13-16 when COPPA was first proposed back in 1998.

We'll discuss some of the key points of our paper in a series of blog posts, but here are the top nine reasons for rejecting COPPA 2.0, in that such an approach would:

Burden the free speech rights of adults by imposing age verification mandates on many sites used by adults, thus restricting anonymous speech and essentially converging--in terms of practical consequences--with the unconstitutional Children's Online Protection Act (COPA), another 1998 law sometimes confused with COPPA;
Burden the free speech rights of adolescents to speak freely on--or gather information from--legal and socially beneficial websites;
Hamper routine and socially beneficial communication between adolescents and adults;
Reduce, rather than enhance, the privacy of adolescents, parents and other adults because of the massive volume of personal information that would have to be collected about users for authentication purposes (likely including credit card data);