TechLaw

Craigslist Eludes Sheriff Dart, Thanks to CDA Section 230 Immunity

A federal district court in Chicago yesterday summarily dismissed Cook County Sheriff Thomas Dart's lawsuit alleging that online classified ad service Craigslist facilitated prostitution and created a public nuisance through the operation of the "adult" (formerly "erotic") services section of its website.

The court held that the sheriff's claim was barred by Section 230 of the Communications Decency Act. The court said that the sheriff's claim essentially sought to hold Craigslist liable as a publisher or speaker of third-party online content -- the kind of claim for which CDA Section 230 gives broad immunity to online publishers.

The case is Dart v. Craigslist Inc., No. 09-1385 (N.D. Ill., Oct. 20, 2009).

More later certainly.

The Communications Decency Act and the Net Neutrality Debate

Telecom analyst Barbara Esbin's paper, The Audacity to Hope Regulatory Restraint Will Prevail, discusses an interesting argument that the Federal Communications Commission is making in support of its 2008 decision that Comcast's covert blocking of peer-to-peer traffic violated the Communications Act. The FCC, in a brief filed Sept. 21 in the D.C. Circuit, is arguing that it has implied authority (known as "ancillary jurisdiction" in telecom-speak) to regulate Internet communications via Section 230(b) of the Communications Decency Act, a subset of the federal government's telecom regulatory structure.

CDA Section 230 is a non-obvious place for find FCC authority to take action in support of net neutrality, and Esbin doesn't think much of the FCC's argument. I found her article and the FCC's brief, read together, to be illuminating reading about the legal issues surrounding net neutrality policy, mercifully free from the hysterical rhetoric that dominates most discussions of this issue.

CDA Section 230(b) is a policy statement rarely been discussed in the many judicial decisions involving the CDA, nearly all of which deal with the civil immunity it provides for interactive computer services in cases involving objectionable third-party content. Section 230(b) reads:

(b) Policy.--It is the policy of the United States--

(1) to promote the continued development of the Internet and other interactive computer services and other interactive media;

(2) to preserve the vibrant and competitive free market that presently exists for the Internet and other interactive computer services, unfettered by Federal or State regulation;

(3) to encourage the development of technologies which maximize user control over what information is received by individuals, families, and schools who use the Internet and other interactive computer services;

(4) to remove disincentives for the development and utilization of blocking and filtering technologies that empower parents to restrict their children's access to objectionable or inappropriate online material; and

(5) to ensure vigorous enforcement of Federal criminal laws to deter and punish trafficking in obscenity, stalking, and harassment by means of computer.

 The FCC, in its brief, contends that Section 230(b) expresses a congressional policy in favor of "maximizing user control over the receipt of Internet content." Building on this point, the FCC argues that its 2008 action against Comcast furthered "those express congressional policies." It will be interesting to see if this argument prevails in court.

Even if this part of Section 230 carried substantive weight, this language fairly supports arguments both in favor of and against federal regulation of Comcast's traffic management decisions. In one ruling I dug up, Vonage Holdings Corp. v. Minnesota Public Util. Comm'n, D. Minn., No. 03-5287 (MJD/JGL), 10/16/03), the court remarked that Section 230(b) expressed a policy against state regulation of the Internet.

Discussions about whether the FCC has authority, or should be given authority, to regulate in the area of net neutrality are now taking place both in Congress and within the FCC via Chairman Genachowski's recently announced rulemaking. Regardless of how the D.C. Circuit proceeding turns out, it appears there will be clarity on the FCC's net neutrality authority soon.

Ninth Circuit Permits Anti-Spyware Software Maker to Claim CDA 230 Immunity

The Ninth Circuit released its opinion in Zango Inc. v. Kaspersky Lab Inc., No. 07-35800 (9th Cir. June 25, 2009), this afternoon, rejecting an adware company's argument that anti-spyware software makers are not among the class of defendants that Congress intended to give immunity under the "safe harbor" protections in Section 230 of the Communications Decency Act. Zango argued, unsuccessfully, that CDA Section 230's protections should be limited to online content providers.

In addition to finding text-based support for immunity, the court also found that according immunity to Kaspersky advanced Congress's policy objectives as well:

According protection to providers of programs that filter adware and malware is also consistent with the Congressional goals for immunity articulated in § 230 itself. Five policy objectives are identified. Of these, two read on the issues in this case: “to encourage the development of technologies which maximize user control over what information is received by individuals, families, and schools who use the Internet and other interactive computer services;” and “to remove disincentives for the development and utilization of blocking and filtering technologies that empower parents to restrict their children’s access to objectionable or inappropriate online material[.]” §230(b)(3), (4). As more software is developed to block malware, users will be able to exercise more control over the content that is transmitted to their computers.

Thus, affording the safe harbor to providers of anti-malware software aligns with the Congressional policy stated in § 230(b)(3). Malware may also expose users to objectionable content, including links to pornographic websites, or to software that can compromise the user’s privacy, computer security, or identity. Thus, the policy stated in § 230(b)(4), of removing disincentives for the development of software that filters out objectionable or inappropriate material, is served by a safe harbor for providers of malware-filtering software who otherwise fall within the terms of the statute.

The court held that Kaspersky was entitled to immunity as a "provider" of an "interactive computer service," Section 230(f)(2), rejecting a handful of technical arguments otherwise.

The court also rejected, importantly, Zango's claim that Kaspersky was not entitled to immunity because Kaspersky -- not the user -- determined which sorts of content were objectionable. Zango claimed that Kaspersky's software unlawfully permitted Kaspersky to override the user's previous agreement to install Zango's adware. So long as the material blocked is objectionable under Section 230(c)(2)(A) -- defined there as "material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable ..." -- then Kaspersky is entitled to claim CDA Section 230 immunity, the court said.

The court declined to read a good faith requirement into this part of the statute. This part of the opinion troubled Judge Fisher, prompting him to to write a concurring opinion calling for some sort of "good faith" limitation on a provider's ability to declare content "objectionable":

[U]nder the generous coverage of § 230(c)(2)(B)’s immunity language, a blocking software provider might abuse that immunity to block content for anti-competitive purposes or merely at its malicious whim, under the cover of considering such material “otherwise objectionable.” Focusing for the moment on anti-competitive blocking, I am concerned that blocking software providers who flout users’ choices by blocking competitors’ content could hide behind § 230(c)(2)(B) when the competitor seeks to recover damages. I doubt Congress intended § 230(c)(2)(B) to be so forgiving.

• ...*

It would be an abuse of this immunity to apply it to blocking activity of the kind I have hypothesized here. Nevertheless, until Congress clarifies the statute or a future litigant makes the case for a possible limitation, I agree that Kaspersky qualifies for immunity under this broadly worded statute.

The Ninth Circuit's take on this case pretty much followed the lower court's approach, and it certainly accorded with most legal experts's views on the scope of CDA Section 230, so no big surprises today. Nevertheless, the court's opinion provides anti-spyware software makers (and anti-spam services) with additional confidence to go out and develop robust user protections, without fear of courting legal liability.

Justice Sotomayor's Potential Cyberlaw Influence? Not Much

It was pleasant to note the other day that Judge Sonia Sotomayor, President Obama's choice for Associate Supreme Court Justice, has written a few opinions relating to Internet law during her time as judge in the lower federal courts. A first, apparently, and a sign of the centrality of the Internet in our business and personal affairs. From now on, the high court nominee who doesn't have a few cyberlaw decisions on his or her resume will be the remarkable case.

But does a Justice Sotomayor mean anything for the future direction of the laws that regulate online activity? No, not really. Not in the near future.

Consider this:

The Supreme Court has never reviewed a case involving the Computer Fraud and Abuse Act.

The Supreme Court has never reviewed a case involving the Electronic Communications Privacy Act.

The Supreme Court has never reviewed a case involving Section 230 of the Communications Decency Act (which gives interactive computer services immunity from most claims arising from the publication of third-party content), though it did consider, and strike down, the prohibitions against indecent online speech contained in another part of the CDA in Reno v. American Civil Liberties Union, 521 U.S. 844 (1997).

The Supreme Court has never reviewed a case involving the CAN-SPAM Act or the Digital Millennium Copyright Act.

The Supreme Court has never reviewed a case involving electronic contracting, jurisdiction arising from online activities, cybersquatting or any other domain name-related dispute.

Aside from Doe v. Chao, a case involving standing to sue the federal government under the Privacy Act, the Supreme Court has never taken a case involving online privacy or security (GLB, COPPA, FTC Act, you name it). If you want to count Bartnicki v. Vopper, go ahead, though I don't think that obscure decision in any way undermines the point I am trying to make here.

So that covers that vast majority of what I consider to fall under the general heading of cyberlaw. None of it is even on the Supreme Court's radar. And I don't see that situation changing anytime soon. The Web is a welter of contracts (a state law issue), and all of the afore-mentioned statutes need many more years of intermediate appellate scrutiny before they'll make good candidates for Supreme Court review. Sure, there are plenty of prosecutorial and judicial missteps to feed our blogs. But, as the Supreme Court often reminds us (see Rule 10), the Supreme Court is not in the business of correcting erroneous applications of settled law.

What's left? Copyright, patent, and First Amendment law. The last (and only) time the high court decided a digital copyright case was Metro-Goldwyn-Mayer Studios Inc. v. Grokster, 545 U.S. 913 (2005), a case in which Justice Souter (whom Judge Sotomayor will replace) wrote for a unanimous court that Grokster, a distributor of peer-to-peer file-sharing software, was a secondary infringer of the movie studios' copyrights. Not only did Grokster lose the case, but it inspired the high court to create a new theory of secondary liability -- "inducing" copyright infringement -- along the way. Given the apparently entrenched views already on the court, Judge Sotomayor's ascent to the Supreme Court offers little hope of benefiting copyright fair use advocates anytime soon, if at all.

First Amendment issues have traditionally been a leading source of Supreme Court activity, and it is not too far-fetched to imagine high court review of a case involving a federal government (FCC?) attempt to impose broadcast-style regulation on Internet transmissions. Here alone, I think, we have an area where Judge Sotomayor could exert some influence on cyberlaw issues. Without question, the Internet would be a far different -- and worse -- place if Reno v. American Civil Liberties Union had come out the other way. On First Amendment issues, Judge Sotomayor appears to have a rather unremarkable though liberal-leaning view of the First Amendment. About the same as the departing Justice Souter. No gain or loss for free speech proponents.

That leaves patents. In re Bilski, No. 08-964 (certiorari petition filed Jan. 28, 2009), is an important case in which the Federal Circuit curtailed the patentability of software-implemented business methods. According to SCOTUSBlog, there is a good chance the Supreme Court will grant review of the Bilski decision. Bilski was up for discussion yesterday at the Supreme Court's private cert-consideration conference, so we could know as early as Monday if Judge Sotomayor will have that one facing her in the fall. I have no idea what Judge Sotomayor's views are on the patentability of software-implemented business method patents, and I don't think anyone else does either. The Inventive Step blog unearthed a couple district court decisions. Not much there to go on.

Feel free to e-mail me (as usual) all the cases I've missed!

---

Follow me on Twitter at @bnatechlaw

Five Post-Roommates.com Decisions Confine Immunity Exception to Narrow Circumstances

When the en banc Ninth Circuit decided Fair Housing Council of San Fernando Valley v. Roommates.com, 521 F.3d (1157 (9th Cir. 2008), a case in which the court held that a Web site could be liable as an "information content provider" of unlawfully discriminatory content that users were required to submit to the site, the prevailing view among publishers' attorneys was that they could live with it.

Speaking at a conference several months after the Roommates.com decision, Barbara W. Wall, vice president and associate general counsel, Gannett Co. Inc., said that she was “heartened” by the Roommates.com decision, rather than seeing it as a “threat” to online publisher protections created by Section 230 of the Communications Decency Act. By requiring answers to its profile-building questions, the Roommates.com Web site "turned your computer into [a Fair Housing Act] violation machine,” Wall said.

Section 230 of the Communications Decency Act gives "interactive computer services" immunity from most claims arising from the publication of content submitted by third-party "information content providers." The problem identified by Roommates.com was that profile-building forms on the Web site required users to express unlawful preferences for potential roommates. This aspect of the Web site's operation made Roommates.com an "information content provider" with respect to the unlawful content supplied by its users, the Ninth Circuit ruled. Thus, the Web site was not entitled to CDA Section 230 immunity from Fair Housing Act liability arising from this content.

Wall's reading of the Roommates.com decision has so far held up, at least in the lower court cases that have considered that aspect of the Roommates.com decision. The five cases decided since Roommates.com all pretty much bear out Wall's view that publishers lose their CDA Section 230 immunity only when they require the submission of unlawful content. In fact, one court took an even narrower view, stating that in Roommates.com it was the Web site's profile-building questions themselves that were unlawful.

In Doe v. MySpace Inc., No. 08-140 (E.D. Texas May 22, 2009), the court held that MySpace was not an "information content provider" of information contained in an online profile supplied by the plaintiff, a crime victim whose sexual assault was allegedly orchestrated through use of the MySpace Web site:

[T]he Plaintiff argues that the Defendant is an information content provider because it developed the information on the profiles which caused Julie Doe’s injuries. However, Roommates.com is not applicable to the instant case. The Ninth Circuit repeatedly stated throughout its en banc opinion that the Roommates.com website required its users to provide certain information as a condition of its use and was, therefore, and information content provider. Here, however, users of MySpace.com are not required to provide any additional information to their profiles identified and later sexually assaulted. ... [A]lthough MySpace.com prompts its users to supplement their profiles with additional information via a list of categories, such conduct is insufficient to hold the Defendant out as an information content provider.

Another decision, Goddard v. Google, Inc., involved allegedly unlawful content that was submitted by a Google Adwords advertiser. The court rejected a Roommates.com-based attack on CDA Section 230 immunity, stating that Roommates.com lost its immunity "only by forcing its users to provide the allegedly discriminatory information as a condition of access."

In GW Equity LLC v. Xcentric Ventures LLC, No. 07-976 (N.D. Texas Jan. 9, 2009), the court said that Roommates.com held that a Web site would not be entitled to CDA Section 230 immunity only in cases in which "a mere question leads to liability." Merely encouraging a Web user to select a category from a broad range of proposed categories did not deprive the Web site operator of immunity for user-supplied unlawful content.

In Atlantic Recording Corp. v. Project Playlist Inc., No. 08-3922 (S.D.N.Y. March 25, 2009), the court offered an even narrower reading of the Roommates.com decision. This court believed that the questions themselves must be unlawful:

The Ninth Circuit's decision was based solely on the fact that the content on the website that was discriminatory was supplied by Roommates.com itself. It was Roommates.com that, in violation of federal and California state housing law, required potential subscribers to identify their sex, sexual orientation, and family status, and to indicate their preferred sex, sexual orientation, and family status in a roommate.

Lastly, in Barnes v. Yahoo! Inc., No. 05-36189 (9th Cir. May 7, 2009), the court described Roommates.com as holding that merely providing "neutral tools to carry out what may be unlawful or illicit" does not make a Web site an information content provider.

Looking at these cases, it's fair to say that while Roommates.com was a loss for one particular online publisher, it is causing very few problems for the rest of the Web.

---

Follow me on Twitter at @bnatechlaw

South Carolina AG Signs Off on Craigslist Injunction

Sort of a fait accompli in light of statements made earlier this week, but the South Carolina Attorney General's office formally agreed this afternoon "to refrain from initiating or pursuing any prosecution against craigslist or its officers and employees in relation to content posted by third parties on craigslist's website." The consent order is available here.

Nice Win for Online Publishers in Ninth Circuit Today

Great case from the Ninth Circuit today. And a nice CDA Section 230 win for online publishers. But tempered by the fact that the publisher still has to defend part of the plaintiff's case: a contract-based claim that the publisher promised to remove objectionable material from its Web site -- but failed to do so.

In Barnes v. Yahoo! Inc., No. 05-36189 (9th Cir. May 7, 2009), the court held that Yahoo! was entitled to claim immunity under Section 230 of the Communications Decency Act (47 U.S.C. 230) to a tort claim alleging that Yahoo! negligently failed to remove scandalous and false materials from its Web site after promising the plaintiff it would do so.

The court held that Yahoo! was entitled to immunity on the tort of "negligent undertaking," and in the process rejected the plaintiff's argument that CDA Section 230 is limited to defamation claims only.

To summarize, we hold that section 230(c)(1) bars Barnes’ claim, under Oregon law, for negligent provision of services that Yahoo undertook to provide. The district court properly granted Yahoo’s motion to dismiss that cause of action.

Unfortunately for Yahoo!, one of its employees allegedly promised to remove the offending material -- which was posted by the plaintiff's former boyfriend. The court said that Yahoo! was not necessarily entitled to CDA Section 230 immunity to plaintiff's cause of action for promissory estoppel, a contract-based claim.

The court wrote:

Subsection 230(c)(1) creates a baseline rule: no liability for publishing or speaking the content of other information service providers. Insofar as Yahoo made a promise with the constructive intent that it be enforceable, it has implicitly agreed to an alteration in such baseline.

The court held that "insofar as Barnes alleges a breach of contract claim under the theory of promissory estoppel, subsection 230(c)(1) of the Act does not preclude her cause of action." It remanded to the trial court for consideration of whether a valid contract was actually formed by Yahoo!'s actions, and whether Yahoo! might have an affirmation defense to the contract claim under CDA Section 230(c)(2).

Stanford E-Commerce Best Practices Conference

The Sixth Annual E-Commerce Best Practices Conference will take place on June 12, 2009, on the Stanford University campus. Right now, this is probably the best annual event going for learning about cyberlaw topics (in my uncompensated, unsolicited opinion).

Web Host/Kiddie Porn Impresario Isn't Entitled to CDA 230 Immunity

A very interesting case involving online publisher immunity under Section 230 of the Communications Decency Act came out of Michigan earlier this month in the case of People v. Gourlay, No. 271214 (Mich. Ct. App. March 3, 2009)(unpublished). The CDA 230 issue arose in the context of a criminal prosecution for child pornography tucked inside an ineffective assistance of counsel claim. But even at that procedural distance the court's exploration of how CDA Section 230 might apply to hosting unlawful content is worth reading.

It's a weird case, involving an underage boy who was "self-publishing" over the Internet videos of himself engaged in sexual acts. This was before he came to the attention of defendant Gourlay. After the defendant saw the videos on the Internet, he contacted the boy and together they hatched a plan to take the boy's Web site to "the next level." The defendant involved himself in the boy's activities by registering a new domain name, hosting the site, supplying some computer programming to permit the Web site to supply video streaming of the boy's activities via a premium, members-only portion of the site. The defendant also allegedly advised the boy how to use the camera and "act" for maximum effect. Together, they developed two Web sites.

The defendant was tried and convicted of three state-law child pornography offenses. On appeal, he argued that he was entitled to a new trial because his attorney had failed to request a jury instruction advising the jury that, under CDA Section 230, "an Internet service provider does not create pornography by providing bandwidth or by providing technical or artistic assistance."

The appellate court accepted the defendant's arguments that he was an interactive computer service provider for CDA Section 230 purposes, and that CDA Section 230 potentially immunized him from state-law criminal prosecution. At this point, the court could have -- but didn't -- simply ruled that the defendant was an "information content provider" not entitled to immunity because he had involved himself in the creation of the child pornography being streamed via the boy's Web site. CDA Section 230(f)(3) defines an "information content provider" as "any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet ...."

Instead, the court looked at the elements of the criminal offenses that the defendant was convicted of and compared them to the activities of a hypothetical interactive computer service provider. At least that's what I think the court was doing here. The charged offenses required proof that the defendant actively and intentionally directed the child to engage in sexual activity for the purpose of producing child pornography. Other charges for distributing or promoting child porn required proof that the defendant promoted or distributed child pornography with criminal intent. In other words, the court said, the prosecution alleged and proved that the defendant was a knowing, active participant in the creation of the two Web sites. These activities do not fit the definition of an interactive computer service provider, the court reasoned, so the defendant was not entitled to a jury instruction on CDA Section 230.

Along the way the court remarked that it could imagine a child porn prosecution in which a Web host was entitled to a CDA Section 230 defense, such as might be the case if a Web host continued to make available child porn even after it had received notice that the material was available on its network. "However," it said, "the prosecution of defendant for distributing or promoting child sexually abusive material was not based on such a theory."

Who knows what to make of this case? I don't think it stands for the proposition that a Web host distributing user-generated pornography is in danger of losing its CDA Section 230 immunity. The defendant recruited the boy to go into business with him, so he was actively involved in the creation of the unlawful material. The court made no mention of whether the defendant was making money off the site other than a hosting fee (unfortunately, though the statute seems indifferent to this fact). And, as for his claim that the programming, domain name registration, and other hosting services he offered to the boy were standard Web hosting services, the court noted that the defendant failed to present any evidence at trial that he provided similar services to other customers.

---

Follow me on Twitter at @bnatechlaw

High Court Declines Review of MySpace CDA 230 Case

The U.S. Supreme Court denied certiorari this morning in Doe v. MySpace Inc., No. 08-340, a case raising the issue whether Section 230 of the Communications Decency Act immunizes MySpace from a claim that it negligently failed to protect an underage user from sexual assault by another MySpace user. The Fifth Circuit held that allegations in the plaintiff's complaint that MySpace had negligently failed to implement reasonable safety measures to protect her daughter--a 14-year-old who misrepresented her age when registering on the site--were, in effect, seeking to hold MySpace liable for the communications between the daughter and her attacker. This is forbidden by CDA Section 230, a federal law that immunizes interactive service providers from state-law claims arising seeking to hold them liable as publishers or third party content, the court said.

The plaintiff did not have a lot to work with here, inasmuch as the Fifth Circuit's take on CDA Section 230 was consistent with the language of the statute and with the overwhelming majority of prior judicial interpretations. In addition to the argument that the Fifth Circuit had read CDA SeCtion 230 too expansively, the plaintiff made a couple other policy arguments: first, that Internet businesses are not the fragile entities they were in 1996, and thus are no longer in need of special treatment; second, that the ruling below undermines the efforts of state attorneys general who are asking social networking sites to do more to prevent criminal activity. Whatever the merits of these arguments as policy matters, they are not the sort of arguments that capture the Supreme Court's attention.

With the court's action today, the Supreme Court does not have a case presenting a CDA Section 230 issue pending on its docket. Since the law was passed in 1996, the high court has declined all seven invitations to review the law: Doe v. MySpace Inc. (2008), Perfect 10 Inc v. CCBill LLC (2007), Batzel v. Smith (2004), Green v. America Online Inc. (2003), Doe v. America Online Inc. (2001), Ben Ezra, Weinstein & Co. v. America Online Inc. (2000), and Zeran v. America Online Inc. (1998).