ú Newsgroup: comp.org.eff.talk ú Message-ID: <1993Apr2.214920.10432@eff.org> ú Subject: EFFector Online 5.05 -==--==--==-<>-==--==--==- In this issue: Keys to Privacy in the Digital Information Age What's Important About the Medphone Libel Case? -==--==--==-<>-==--==--==- Keys to Privacy in the Digital Information Age by Jerry Berman and Daniel J. Weitzner With dramatic increases in reliance on digital media for communications, the need for comprehensive protection of privacy in these media grows. For many reading this newsletter, the point may seem trite, but the scope of the digital communications revolution (of which we only stand at the very beginning), poses major new challenges for those concerned about protecting communications privacy. Communication carried on paper through the mail system, or over the wire-based public telephone network, is relatively secure from random intrusion by others. But the same communication carried, for example, over a cellular or other wireless communication system is vulnerable to being intercepted by anyone who has very inexpensive, easy-to-obtain, scanning technology. If designed and deployed properly, communications technology has the potential to actually support and enhance the level of privacy that we all enjoy. But if, in the design process, privacy concerns are slighted, whether consciously or not, privacy may be compromised. Public policy has a critical impact on the degree of privacy protection afforded by the new communications systems now being designed and deployed for public use. Two ongoing public policy issues present the challenges of digital privacy protection in sharp relief. In the first case, government policy seeks to limit the introduction of robust encryption technologies. Motivated by national security concerns, the National Security Agency is using export control regulations to discourage the widespread foreign and domestic adoption of strong encryption systems. The NSA's reasoning is if uncrackable encryption is available, the NSA will be powerless to intercept the communications of foreign espionage agents operating in and around the United States. However, the NSA's restriction on the use of powerful encryption systems limits the ability of all who rely on electronic communication systems to protect their privacy. Second, on the domestic front, the FBI has proposed a comprehensive licensing regime that would require all new communications systems to be certified as "wire-tappable" before their introduction into the market. This proposal threatens to force the widespread use of communications systems that have "back doors" in them that make them inherently insecure and to expand the scope of the FBI's wiretapping authority to an unspecified degree. Although these two proposals are now being pursued in independent policy arenas, it is critical to view them together in order to appreciate the full implications for privacy. Encryption Policy For the individual who relies on digital communications media, reliable privacy protection cannot be achieved without the protection of robust encryption technology. While legal restrictions on the use of scanners or other technology that might facilitate such invasions of privacy seem to be attractive preventative measures, these are not lasting or comprehensive solutions. We should have a guarantee -- with physics and mathematics, not only with laws -- that we can give ourselves real privacy of personal communications through technical means. We already know how to do this, but we have not made encryption technology widely available for public use because of public policy barriers. The actual debate going on involves both the National Security Agency and the National Institute of Standards and Technology. They are in the process of deciding what version of a particularly strong type of encryption system ought to be promoted for public use. Called Public Key Encryption systems, these coding systems derive their strength, in part, from the size of the ÒkeyÓ used to encrypt the message. In examining discrete issues such as the desirability of various cryptography standards, we take a comprehensive view of "digital privacy" policy as a whole. Such a comprehensive view requires a clear vision of the underlying civil liberties issues at stake: privacy and free speech. It also requires looking beyond the cryptography questions raised by many to include some of law enforcement's recent concerns about the pace of digital infrastructure innovation. For the sake of promoting innovation and protecting civil liberties, we must also bear in mind the principle that computer security policy is fundamentally a concern for domestic, civilian agencies. Inasmuch as digital privacy policy has broad implications for constitutional rights of free speech and privacy, these issues must be explored and resolved in an open, civilian policy context. This principle is clearly articulated in the Computer Security Act of 1987. These questions are simply too important to be decided by the national security establishment alone. The structure of the Act arose, in significant part, from the concern that the national security establishment was exercising undue control over the flow of public information and the use of information technology. When considering the law in 1986, the Congress asked the question, "Whether it is proper for a super-secret agency [the NSA] that operates without public scrutiny to involve itself in domestic activities...?" The answer was a clear no, and the authority for establishing computer security policy was vested in NIST (then the National Bureau of Standards). In this context, we need a robust public debate over our government's continuing heavy-handed efforts to control commercially developed cryptography. It is no secret that throughout the cold war era, the Defense and State Departments and the National Security Agency have used any and all means, including threats of prosecution, control over research and denial of export licenses, to prevent advanced secret coding capabilities from getting into the hands of our adversaries. NSA does this to maximize its ability to intercept and crack all international communications of national security interest. Now the Cold War is over, but the practice continues. In recent years, Lotus, Microsoft, and others have developed or tried to incorporate powerful encryption means into mass market software to enhance the security and privacy of business, financial, and personal communications. In an era of computer crime, sophisticated surveillance technologies and industrial espionage, it is a laudable goal. Although NSA does not have the authority to interfere with domestic distribution encryption systems, its licensing stranglehold over foreign distribution has significant domestic consequences. United States firms have been unable to sell competitive security and privacy products in international markets. More important, because the cost of producing two different products is often prohibitive, NSA policy encourages firms to produce a single product for both domestic and worldwide use, resulting in sub-standard privacy and security for users both here and abroad. While we all recognize that NSA has legitimate national security concerns in the post cold war era, this is a seriously flawed process. Foreign countries or entities who want to obtain advanced encryption technology can purchase it through intermediaries in the United States or from companies in a host of foreign countries who are not subject to US export restrictions. By taking a page out of the Emperor's New Clothes, NSA opts to act as if the process works by continuing to block export. In order to get some improvement in mass market encryption, the computer industry had to resort to using the threat of legislation to get NSA to engage in the negotiations that finally led NSA to agree to expedited clearance for the export of encryption software of limited key lengths. Still, all concede that the agreement does not go far enough and that far more powerful products are commonly available in the US. The remaining limits specifying maximum key lengths offers little long-term security given advances in computer processing power. Does this kind of policy make any sense in the post Cold War era? Mass market products offer limited security for our citizens. Determined adversaries can obtain much more powerful products from foreign countries or by purchasing it here in the US. Is the NSA policy of slowing down the pace of encryption use by foreigners and adversaries -- and there's some debate as to whether the NSA policy really does slow down that pace -- any longer worth the significant price we pay in terms of failing to meet our own communications privacy and security needs? We don't think so. FBI's Digital Telephony Proposal The public policy debate on electronic privacy issues over the last few years has demonstrated that a comprehensive approach to digital privacy policy cannot be complete without examining both questions regarding the availability of encryption technology and the corresponding infrastructure issues, such as those raised by the FBI's Digital Telephony Proposal. Last year, the FBI first proposed a "Sense of the Congress" resolution stating that communications firms and computer and communications equipment manufacturers were obligated to provide law enforcement access to the "plain text" of all voice, data and video communications, including communications using software encryption. The Electronic Frontier Foundation (EFF) played an active and leading role both in opposing such a law and in seeking to find more acceptable means for meeting legitimate law enforcement needs. Because of our advocacy and coalition-building efforts with communications and privacy groups, we were successful in persuading Senate Judiciary Chairman Joseph Biden to remove the Sense of the Congress Resolution from active consideration as part of Omnibus crime legislation last year. Putting aside its attempt to control the use of encryption systems, last year the FBI proposed legislation that would require telephone companies, electronic information providers, and computer and communications equipment manufacturers to seek an FCC "license" or Attorney General "certification" that their technologies are susceptible to electronic surveillance. EFF fears we are in danger of creating a domestic version of the export control laws for computer and communications technology. While the FBI claims that neither of last year's proposals address encryption issues, the Bureau has made it clear it plans to return to this issue in the future. A broad-based coalition of public interest and industry groups, coordinated by the Electronic Frontier Foundation, has called on the FBI to explore more realistic, less vague, and less potentially onerous policy options for meeting legitimate law enforcement needs. The EFF-coordinated coalition includes over 30 industry groups (including AT&T, Lotus, Microsoft, Sun Microsystems, IBM and Digital Equipment) along with public interest organizations such as the American Civil Liberties Union and Computer Professionals for Social Responsibility. Last year the coalition was successful at stopping two separate FBI legislative attempts, but we fully expect that the Digital Telephony proposal will be back on the table. TOWARD A COMPREHENSIVE VISION OF COMMUNICATIONS PRIVACY IN THE INFORMATION AGE At times, the arcana of encryption standards, export control laws, and technical specifications of new digital telephony equipment may unfortunately obscure the critical issues at stake in protecting individual privacy. Many people are already relying on digital media -- whether electronic mail, bulletin board systems, or other new media -- for a plethora of personal, political, professional, and cultural communications tasks. To provide adequate privacy protection in the future, we will have to learn to wrestle with both technical details and constitutional principles together, simply because more and more of our personal activities will be pursued through new digital media. The multi-front battle being waged about digital privacy creates formidable roadblocks to a final resolution of the policy disputes at issue. Neither the restrictions of encryption, nor the FBI's wiretap concerns, can be thoroughly addressed independent of the other. Those who seek greater privacy and security cannot trust a settlement on one front, because their victory is likely to be undermined by action on the other issue. And law enforcement and national security concerns cannot be adequately addressed without a sense of the overall solution being proposed on both the encryption and infrastructure fronts. It is time for policymakers to conduct a comprehensive review of digital privacy and security policy, with a consideration of both of these sets of issues. In the case of the FBI's Digital Telephony proposal, we must tread carefully. Current laws governing wiretapping authority, for example, reflect a subtle balance between the guarantees of privacy and security from state intervention embodied in our constitutional tradition on the one hand, and the needs of law enforcement, on the other. The rule developed for one medium -- voice telephony -- cannot be mechanically extended to the host of new communications options now becoming available. Rather, we must give careful consideration to the scope of wiretap authority that is appropriate to the new media that the FBI seek to sweep under their wiretap authority. In the case of encryption policy, it is critical that private citizens have access to affordable, effective, and legal encryption technology. In the information age, concerns for protecting individual privacy should take precedence over outmoded national security concerns left over from the Cold War. -==--==--==-<>-==--==--==- "What's Important About the Medphone Libel Case?" By Mike Godwin Online conferencing seems so much like informal conversation that it may come as a surprise to some people to discover that they may be bound by the same libel law that applies to The New York Times. It certainly came as a surprise to Peter DeNigris, who is now being sued for statements he made while participating in a forum on Prodigy. But a look at the law of defamation (of which libel law is a major part) makes clear that there's no reason to believe that online statements are "immune" from libel lawsuits. _What is defamation and what is libel?_ A communication is considered defamatory if it tends to damage someone's reputation. Some legal definitions of "defamation" also specify that the communication has to be false. If a communication is both false and it defames someone, the person whose reputation is injured can sue for damages. In general, if the defamation is *spoken* in the direct presence of an audience, it's called "slander"; defamation in print or in other media is normally called "libel." Libel law is an area of great interest for the people who run online forums. If a newspaper or TV station "republishes" a false defamatory statement, the defamed person can sue the newspaper or the station for damages *in addition* to suing the person who made the original false statement. The big question for online forum operators, like CompuServe and Prodigy, is the extent to which the services will be treated like newspapers and TV stations and made responsible for "republication" of libel. A possible answer to this question appeared in a recent case called Cubby Inc. v. CompuServe. In that case, which took place in a federal district court in New York, the judge dismissed a libel suit that had been brought against CompuServe as a "republisher." In that case, the judge held that CompuServe is less like a newspaper or TV station than like a library or bookstore owner or book distributor. Although libel law, as limited by the First Amendment, allows print and TV "republishers" to be liable for defamation, it does not allow such liability for those who run bookstores or libraries; holding the latter liable would create a burden on these parties to review every book they carry for defamatory material. This burden would "chill" the distribution of books (not to mention causing some people to get out of the bookstore or library business) and thus would come into serious conflict with the First Amendment. But the issues raised in this new libel suit involving Prodigy are different from those in Cubby v. CompuServe. _The facts of Medphone v. DeNigris_ Peter DeNigis is being sued by the medical-instrument manufacturer Medphone for statements he made in the Money Talk forum on Prodigy. Medphone is claiming that DeNigris engaged in a "systematic program for defamation and trade disparagement" against the company, and is suing on business-libel and securities- fraud theories. The company decided to sue DeNigris after its stock price plummeted in a way that seemed "not objectively related to the company's performance"--according to the company's press release, its sales had been going up, and it had recently formed two important business alliances. Medphone was alerted to the possible cause of the stock decline when a stockholder notified the company about DeNigris's "frequent" statements about the company on Prodigy. One example of a DeNigris posting (on Sept. 7), appeared in the LOS ANGELES TIMES account of the story: "Is the end near for Medphone?????????? Stock is quoted 25 cents to 38 cents. Closed at a new low Friday, at (38 cents). My research indicated company is really having a difficult time. No case, no sales, no profits, and terrible management. This company appears to be a fraud. Probably will cease operations soon." Note that this statement does not prove that DeNigris has committed libel. DeNigris is reported to have lost $9000 on Medphone stock that he sold in November, so he may have good- faith reasons to believe what he was saying about the company. He insists his opinions, as stated, are "fair" and "can be documented" by leading publications. If his statements turn out to be true, or even if it turns out that they're false but that he had a good-faith belief that the statements are true, it could mean that he'll win the libel case against him. This does not mean, however, that there is not a credible case against him. For one thing, the comment about "fraud" is a very serious and extreme charge and arguably cannot be based merely on the stock's or company's underperformance. For another, DeNigris is alleged to have called Prodigy several times a day to post negative statements about Medphone, which could be credibly interpreted as a plan to affect the company's reputation and stock price. _Does this case raise any new legal issues?_ The major difference between Medphone v. DeNigris and Cubby Inc. v. CompuServe is that there has been no effort to hold the online forum (Prodigy) liable as a republisher. This means that the complicated legal issue of "republisher liability" doesn't arise. This makes the case a lot simpler legally. It is a well-settled legal principle that the person who *originates* a defamatory statement may be held liable for defamation. Although the Electronic Frontier Foundation and other groups have taken the position (consistent with Cubby) that the owners and operators of digital forums, as *republishers*, deserve the same protections as republishers in other media, none of these groups has taken the position that there is something different about a defamatory statement on a digital forum that makes it less damaging or less libelous than if it appears in other media. Some people argue, however, that Prodigy *should* be a party to this lawsuit, or perhaps to another lawsuit. They argue that since Prodigy prescreens its messages, it's less like a bookstore and more like, say, USA Today. And they're troubled by the fact that Prodigy turned over records of some of its subscribers' messages to Medphone's and DeNigris's lawyers--isn't this a violation of the subscribers' privacy rights? Let's address these criticisms in detail: Some Prodigy subscribers apparently are arguing that Prodigy should be a codefendant along with DeNigris, a position that seems grounded in part on a simplistic understanding of traditional libel law and in part on subscribers' innate sympathy to the plight of another subscriber. There are two good reasons to disagree with this position: a) In general, when republishers are held liable for defamation, it tends to create a chilling effect on their medium. b) In particular, Prodigy now says it does not prescreen messages for content (other than bouncing postings with profane language--this is apparently done through software). Following Cubby v. CompuServe, and absent any facts to the contrary, there is no reason to think Prodigy should be a party. (Nor is there any legal reason to think that Peter DeNigris cannot be a defendant.) And even if there were a good reason for Prodigy to be a party, it's up to Medphone and its lawyers, not to anyone else, whether to sue Prodigy. With regard to the privacy rights of subscribers, it should be noted that Prodigy turned over records of subscriber messages to Medphone's lawyers (and, apparently, to DeNigris's lawyers) *in response to subpoenas.* This suggests that there is no violation of the Electronic Communications Privacy Act, which authorizes disclosure of stored electronic communications in response to subpoena. What's more, Prodigy could have been held in contempt of court had it *not* complied with the subpoenas. At this point, at least, it seems that the Medphone case does not raise any of the complicated legal issues we might expect to find in a libel lawsuit involving an online forum. _What is significant about this case?_ But even if the case does not raise new legal issues, it certainly seems to have raised a new social issue. Specifically, it shows that the very same technology that empowers people to be their own reporters and editors has also created a new potential for them to be defendants. In the old days, individuals who didn't work for newspapers or TV stations rarely had to think about the potential that they might be sued for libel--after all, there wasn't much risk that even an intentionally irresponsible statement was going to do a significant fraction of the damage that might be done through a libelous newspaper article or TV broadcast. But just as the increasingly common phenomenon of online forums creates the possibility for each of us to reach vast, new audiences, it also creates the potential for us to commit defamation on a vast new scale. And there isn't any legal ambiguity about whether we can be sued for the defamation that we create ourselves. So, the Medphone case does turn out to be significant in a major way--not because it breaks any new legal ground, but because it serves as a warning signal for the increasing number of Americans who publish their opinions online. Absent some new legislation that would give online discussions *more* freedom than the traditional press, participants in online forums will have to learn the same rules that generations of professional journalists have already learned-- say something defamatory about somebody to a large audience, and that statement may come back to haunt you. ============================================================= EFFector Online is published by The Electronic Frontier Foundation 666 Pennsylvania Ave., Washington, DC 20003 Phone: +1 202 544-9237 FAX: +1 202 547 5481 Internet Address: eff@eff.org Coordination, production and shipping by Cliff Figallo, EFF Online Communications Coordinator (fig@eff.org) Reproduction of this publication in electronic media is encouraged. Signed articles do not necessarily represent the view of the EFF. To reproduce signed articles individually, please contact the authors for their express permission. *This newsletter is printed on 100% recycled electrons* ============================================================= MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION In order to continue the work already begun and to expand our efforts and activities into other realms of the electronic frontier, we need the financial support of individuals and organizations. If you support our goals and our work, you can show that support by becoming a member now. Members receive our bi-weekly electronic newsletter, EFFector Online (if you have an electronic address that can be reached through the Net), and special releases and other notices on our activities. But because we believe that support should be freely given, you can receive these things even if you do not elect to become a member. Your membership/donation is fully tax deductible. Our memberships are $20.00 per year for students and $40.00 per year for regular members. You may, of course, donate more if you wish. Our privacy policy: The Electronic Frontier Foundation will never, under any circumstances, sell any part of its membership list. We will, from time to time, share this list with other non-profit organizations whose work we determine to be in line with our goals. But with us, member privacy is the default. This means that you must actively grant us permission to share your name with other groups. If you do not grant explicit permission, we assume that you do not wish your membership disclosed to any group for any reason. ============================================================= Mail to: The Electronic Frontier Foundation, Inc. 238 Main St. Cambridge, MA 02142 I wish to become a member of the EFF. I enclose: $_______ $20.00 (student or low income membership) $40.00 (regular membership) [ ] I enclose an additional donation of $_______ Name: Organization: Address: City or Town: State: Zip: Phone: ( ) (optional) FAX: ( ) (optional) Email address: I enclose a check [ ]. Please charge my membership in the amount of $ to my Mastercard [ ] Visa [ ] American Express [ ] Number: Expiration date: Signature: ________________________________________________ Date: I hereby grant permission to the EFF to share my name with other non-profit groups from time to time as it deems appropriate [ ]. Initials:___________________________ -- <<*>><<*>><<*>><<*>><<*>><<*>> Cliff Figallo fig@eff.org Electronic Frontier Foundation (617)576-4500 (voice) Online Communications Coordinator (617)576-4520 (fax) Path: channel1!uupsi!psinntp!uunet!gatech!usenet.ins.cwru.edu!agate!spool.mu.edu!uwm.edu!zaphod.mps.ohio-state.edu!sol.ctr.columbia.edu!eff!fig From: fig@eff.org (Cliff Figallo) Newsgroups: comp.org.eff.news,comp.org.eff.talk Subject: EFFector Online 5.05 Message-ID: <1993Apr2.214920.10432@eff.org> Date: Fri, 2 Apr 1993 21:49:20 GMT Sender: usenet@eff.org (NNTP News Poster) Organization: The Electronic Frontier Foundation Lines: 519 Approved: fig@eff.org Originator: fig@eff.org Nntp-Posting-Host: eff.org Downloaded From P-80 International Information Systems 304-744-2253