TechLaw

Ten Interesting Things I Read This Week

This post is a collection of links to materials I've been reading this week, really just trying to catch up on old news and re-engage myself in subjects that I spent most of my summer trying to forget while on vacation. I made supplications to the Muse all morning in the hope she would favor me with a catchy title, something that might yield one of those tragically sardonic acronyms like CAN-SPAM or SPY Act, but no, nothing, and now it's time to get back to work and all I have is Ten Interesting Things I Read This Week (TITIRTW):

1. Cleveland Plain Dealer: Idea for protecting newspapers draws national spotlight, bloggers' ire

2. Media & Communications Policy: More on Newspapers and Aggregators

At this point management at most of the leading newspapers have let go of the notion that "parasitic aggregators" are a significant source of their business problems. Yet here is a respected attorney (and counsel to the Cleveland Plain Dealer) making an argument that parasitic aggregators who are free-riding on newspaper content should be stopped. Stopped by reviving the common law doctrine of "hot news" misappropriation. He believes that the Copyright Act should be amended so that it no longer preempts state-law misappropriation claims. The attorney writes: "If the legal principles that we advocate in this analysis were the law, the newspaper publisher would have a legal right to enjoin temporarily or otherwise impede the business of an aggregator that commercially exploits the publisher's news reports in direct competition with the publisher." I don't want to "Go Pundit" here, but this is a solution to a problem that just does not exist.

3. Citizen Media Law Blog: Southeastern Conference Sacks Social Media, Then Recovers

A nice account of the Southeastern Conference's attempt to protect the interests of its television broadcast partners by prohibiting fans from blogging, twittering et cetera during football games that reminded me we are still very much at the beginning of the user-generated media era. The article summarizes the state of the law on the "hot news" doctrine, making a nice counterpoint to the "save the newspapers" discussions above. 

4. U.S. Department of Homeland Security: Secretary Napolitano Announces New Directives on Border Searches of Electronic Media

Modest privacy-enhancing protections announced here, though DHS is not giving back an ounce of their authority to search anyone, anything, any time, at the border. Which still includes laptops: "In the course of a border search, with or without individualized suspicion, an Officer may examine electronic devices and may review and analyze the information encountered at the border."

The American Civil Liberties Union filed a lawsuit this week seeking records relating to searches of electronic devices at the border.

5. The Volokh Conspiracy: How the Ninth Circuit Tried To End Plain View for Computer Searches Without Ending Plain View for Computer Searches

Prof. Orin Kerr ruefully labels the en banc Ninth Circuit's decision in United States v. Comprehensive Drug Testing Inc. as Miranda for computer searches. He writes: "I think the best way to understand today's remarkable Ninth Circuit Fourth Amendment decision in United States v. Comprehensive Drug Testing is that the Ninth Circuit did its best to end the plain view exception for computer searches without formally ending plain view for computer searches. Chief Judge Kozinski's opinion created an elaborate statute-like new regime to make sure the government acts like there is no plain view exception. The decision is a workaround that effectively ends plain view for computer searches by making sure the government will never collect electronic evidence in plain view in the first place."

Sounds a little bitter to me. Judge Kozinski's opinion is a sensational read. And if it really is like Miranda, read it, because it's going to be around for a long time.

6 & 7. Gregg Easterbrook (ESPN): Tuesday Morning Quarterback's AFC preview and TMQ travels back in time to August 2009

A personal favorite, a guilty pleasure, one of the best writers on the Web, reminds me of Tom Wolfe way back when. More than football in here too: smart ruminations on Twitter, the British Humanist Association, and deadly objects from space.

8. Consumer Law & Policy Blog: Official Word from US Courts -- Feel Free to Use RECAP With Our Blessing

The implication here is that the AO's office would naturally have disapproved of RECAP, a Firefox addon that uploads PACER documents to a free repository. But surprise surprise it appears they don't mind at all. Am I the only one who believes the judiciary is the most -- not the least -- open branch of the federal government?

9. Spam Notes: Electronic Communications, Privacy, Data Protection, and More: Gordon v. Virtumundo: 9th Cir Smacks Down Anti-Spammers in Trifecta Defense Win

Ah, August 6, 10 a.m. PST. I was fly-fishing a gentlemanly stretch of the Gallatin River in Yellowstone National Park. Wretched souls like Venkat were slogging through Gordon v. Virtumundo's discussion of CAN-SPAM preemption. He writes: "As far as opinions go, this is as good as it gets." I couldn't agree more. About the fishing, of course.

10. Techdirt: Interview With William Patry: Understanding How The Copyright Debate Got Twisted

Prof. William Patry is coming out with a new book, Moral Panics and the Copyright Wars. Here, a very interesting discussion with Techdirt's Mike Masnick draws out Patry's views on fair use, the file-sharing wars, and copyright politics.

Feds Muscle in on Cybersecurity Game With Standards and Money

Sens. John D. Rockefeller IV (D-W.Va.) and Olympia J. Snowe (R-Maine) introduced a significant piece of legislation yesterday, the Cybersecurity Act of 2009 (S. 778). The measure puts the federal government, specifically the White House, at the center of the nation's cybersecurity effort and equips it with unprecedented authority to assert its will across the public and private Internet.

OK, so federal government hegemony over the global (and private) Internet is a troubling prospect. On the other hand, if you are able to set aside civil liberties forebodings or the prospect of re-engineering your company's IT operation, or obtaining federal government approval for any piece of software or hardware you might want to distribute, consider this: S. 778 contains vast opportunities for businesses and their legal representatives to make money in the emerging cybersecurity industry. Call it a Stimulus Act for security geeks and their attorneys.

The message I got out of the Rockefeller/Snowe bill is that the federal government would like to end an era of feckless pleading for private companies to participate together with the government on cybersecurity matters. S. 778 proposes giving the federal government the authority to dictate computer security standards and to enforce them against providers of online services, software developers, and private companies connected to the Internet (basically everybody). Private industry will be allowed to participate in the decision-making process, but at the end of the day there will be "measurable and auditable cybersecurity standards" for both government and business.

Section 18 (Cybersecurity Responsibilities and Authority) is the much-discussed section that creates the cybersecurity czar, an official in the White House, empowering him or her to shut down Internet traffic in the event of a "cybersecurity emergency." And other sweeping powers. However, I found other parts of the bill much more interesting.

Section 3 (Cybersecurity Advisory Panel) of the proposed Act creates a "Cybersecurity Advisory Panel," a private sector and government group that will advise the President on all aspects of the federal cybersecurity strategy. No mention is made of the permissible size of the panel. The government will pay the expenses of non-federal members. The panel is exempt from the sunset provisions of the Federal Advisory Committee Act. In other words, if you are a tech-sector lobbyist, an academic or member of an advocacy group relating to cybersecurity or cyberliberties, this is a very good appointment to land.

An added benefit of panel membership is that, pursuant to Section 8 (Review of NTIA Domain Name Contracts), the panel has the authority to veto the Department of Commerce's decision to extend or modify the government's domain name management contract with the Internet Corporation for Assigned Names and Numbers.

In a further shot across ICANN's bow, Section 9 (Secure Domain Name Addressing System) directs the Department of Commerce to develop its own secure domain name addressing system, a project that ICANN itself has been working on.

The heart of S. 778 is Section 6 (NIST Standards Development and Compliance), which would give the Director of the National Institute for Standards and Technology one year to develop comprehensive security standards for computer information systems. Though the bill is nominally directed toward government agencies and federal contractors, the clear intent is to establish a comprehensive security strategy across the Internet. How could it be otherwise? Security is only as strong as the weakest link, meaning in this context that all parts of the Internet need to be secured. A final provision in this section gives the Federal Communications Commission to weigh in on the "most effective and efficient means to ensure the cybersecurity of commercial broadband networks."

Section 7 (Licensing and Certification of Cybersecurity Professionals) is interesting, in that it contains the strong suggestion that existing security certification providers have not been up to the task. Section 7 directs the Secretary of Commerce to create a national certification program for cybersecurity professionals. Unfortunately, the bill does not define "cybersecurity professional," and I was left wondering whether attorneys in this area will need to have this designation to give legal advice on information security matters. I also wonder about the effect of this section on the private entities who are now providing information security and privacy certifications (companies like SANS Institute and the International Association of Privacy Professionals come to mind, though I am sure there are many others). Section 7(b) sounds like it means business:

MANDATORY LICENSING.--Beginning 3 years after the date of enactment of this act, it shall be unlawful for any individual to engage in business in the United States, or to be employed in the United States, as a provider of cybersecurity services to any Federal agency or an information system or network designated by the President, or the President’s designee, as a critical infrastructure information system or network, who is not licensed and certified under the program.

It is hard to know what impact this will have on providers of certification services. Perhaps this business will go away entirely in three years, leaving only a government-supplied certification. Or perhaps it will be possible to be designated as a NIST-certified provider of certifications. One thing is certain: in three years everybody is going to need a new certification, a tidy piece of business for lucky certification providers. Again, more lobbying work here for someone.

Money. Quite a bit of spending is authorized by S. 778. I added up over $1 billion in spending that can be doled out by the National Science Foundation and NIST for research, competitions, cybersecurity scholarships, and various other programs.

Section 14 (Public-Private Clearinghouse) reposes quite a bit of authority in the Secretary of Commerce to demand information from network providers. For example, the bill states "The Secretary of Commerce ... (1) shall have access to all relevant data concerning such networks without regard to any provision of law, regulation, rule, or policy restricting such access; (2) shall manage the sharing of Federal government and other critical infrastructure threat and vulnerability information between the Federal government and the persons primarily responsible for the operation and maintenance of the networks concerned; ...." That's a lot of power to give to a relatively weak and politicized agency. Starting in 1989, the following individuals have served as Secretary of Commerce: Robert Mosbacher, Barbara Franklin, Ron Brown, Mickey Kantor, William M. Daley, Norman Mineta, Donald Evans, Carlos Gutierrez, and Gary Locke. I count a lot of fundraisers and political operatives in this bunch. Perhaps the feeling with S. 778's sponsors is that, if someone is going to have unfettered power to demand "all relevant data" about Internet operations regardless of federal legal protections, such power should be reposed in someone highly unlikely to use it.

The final part of S. 778 that I found interesting was Section 16 (Legal Framework Review and Report), a section that directs the President to complete a comprehensive review of federal laws relating to cybersecurity. Among them: the Privacy Act, the Electronic Communications Privacy Act, the Computer Security Act, the Federal Information Security Management Act, the E-Government Act, and the Defense Protection Action. Interesting that the Computer Fraud and Abuse Act was not specifically mentioned. The ECPA and the Privacy Act are both shopworn and in need of attention; however, receiving attention in the context of a cybersecurity assessment seems unlikely to result in greater privacy. Here again, good lobbying work for somebody.

There is a lot of loose change in other sections of the bill. The President is directed to prepare a report on the feasibility of an identity management system, including a discussion of civil liberties and privacy issues. The President is also empowered to act on the international stage to "develop norms, organizations, and other cooperative activities for international engagement to improve cybersecurity." Patent rights are protected for companies involved in, and whose activities are funded as a part of, the standards-setting process. Information-sharing duties, long a source of contention between law enforcement and business, are reposed in the business-friendly Department of Commerce. Elsewhere, the Director of National Intelligence and the Secretary of Commerce are directed to jointly prepare an assessment and report on cybersecurity threats.

(Finally, I want to express how frustrating it is when legislation is announced in the middle of the day, as it was yesterday, but the text of the bill is not available until much later in the day. It was 6 p.m. here at BNA. Nobody who wrote a story yesterday on the Cybersecurity Act had a copy of the bill in their possession when they wrote the story; at least it didn't look that way to me. Legislators withhold the text of legislation to ensure that the first wave of news accounts are based entirely on press releases and summaries, resulting inevitably in stories that carry the bill sponsors' message. In this case, the message was: We need a federal cyber-czar to head off cyber-Katrina. Perhaps. Not all legislators withhold bill text, but plenty do. This way of doing business doesn't reflect well on our elected representatives, who peddle important public policy like laundry detergent, nor does it reflect well on journalists such as myself, who rarely go back and write a revised account with the legislation in hand.)

---

Follow me on Twitter at @bnatechlaw