Tangible/intangible? digital goods' nature at stake

Given that the debate in criminal law always turns towards the tangible/intangible nature of what is stolen, deceived..., this proposal from a Californian politician is quite interesting, although at first sight it does not concern criminal law, but simply tax law.

"California Lawmaker Wants To Change Law To Tax iTunes; Pretending Infinite Goods Are Tangible" (9 April 2008) http://www.techdirt.com/articles/20080408/152311789.shtml

Fraud and crime - statistics

As noted in David Wall's new book on Cybercrime - The transformation of crime in the information age -, statistics about e-crime are scarce; so it is interesting to have those of the joint research of the FBI and the NWCCC, in the 2007 Internet Crime Report. Fraud, not surprisingly, is the trendy crime (= big money for small efforts to make. See http://www.crime-research.org/news/07.04.2008/3294/ : “A cyber criminal is only looking for a less than 1% return on all the e-mails he sends out, because he can still make money hand over fist,” said Hambrick, FBI -); but surprise, surprise, the UK is on top of the list as a harbour/haven for criminals.

"UK nears US in cyber-crime, ahead of Nigeria, Romania" (10 April 2008)
http://www.crime-research.org/news/10.04.2008/3303/
"UK a hotbed of cybercriminal activity" (9 April 2008)
http://news.zdnet.co.uk/security/0,1000000189,39382596,00.htm

Will that make the Government think a bit more about establishing a specific task force? or at least give money to tackle more efficiently the problem? Or at least the police? See this article about what seems to be the US:
"Cyber crime: Police not taking it seriously" (8 April 2008)
http://www.crime-research.org/news/08.04.2008/3299/

For more statistics: "Cybercrime Losses Decline for Third Consecutive Year " (31 March 2008) http://www.crime-research.org/news/31.03.2008/3282/

Cyberattacks - prevention by Governments

Four interesting articles about preventing cyberattacks. The first is about creating a real-scale cyberattack to see how the different targets would react and their level of vulnerability.
"International cyberattack drill tests nations' responses " (10 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39383325,00.htm

The second is about the response to an attack, i.e. an early-warning system, a bit like for tsunamis in the pacific?
"US plans cyberattack early-warning system" (video- 10 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39383335,00.htm

With the European COmmission (EU) urging Europe to strengthen its cyber defences "Commission eyes common cyber defences " (9 April 2008) http://www.euractiv.com/en/infosociety/commission-eyes-common-cyber-defences/article-171476

and finally NATO! "NATO agrees common approach to cyber defence" (4 April 2008) http://www.euractiv.com/en/infosociety/nato-agrees-common-approach-cyber-defence/article-171377
"Nato creates cyber-defence command" (9 April 2008)http://news.zdnet.co.uk/security/0,1000000189,39382597,00.htm, with the irony of creating a centre in Estonia! http://www.crime-research.org/news/16.05.2008/3368/ (16 May 2008)

ISPs' criminal liability - YouTube and MySpace

Facts: an internet version of "happy slapping" which has nothing of happy but the name, for it is simply to beat someone up and diffuse the filming by phone or by the internet, here it was via YouTube. Can't see how one can legally argue criminal liability of YouTube: the company obviously did not know about the action before it was committed and can't in any way shape or form "aid, abet, advice..." to committing assault. Hopefully people seem to see sense.
The only liability could be if YouTube did not remove the video once informed of it...

"Video of teen beating raises questions" (11 April 2008)
http://news.yahoo.com/s/ap/20080411/ap_on_hi_te/teen_beating_ethics;_ylt=Aq3pQbSMs7fYFJrAKoBqUvch2.cA

Sentencing/ preventive measures

Rare are the decisions on sentencing and preventive measures. Yet for cybercrime, knowing which sanction is most appropriate is crucial. Ban of computer use may seem obvious, but apart from the question of being feasible, lies the issue of the extent of the ban. The following US example is quite enlightening and maybe the judge could have done with a bit of common sense. Cybercrime may be different (although that is still argued) but it does not mean it should escape logical reasoning. In an alleged $90000 (about £45 000) in tax fraud in New-York, a woman was banned from using computers. A bit too broad a preventive measure; it's like banning somebody to travel around the world for having trespassed in a park...

http://www.upi.com/NewsTrack/Top_News/2008/04/09/fraud_suspect_banned_from_computers/1256/
http://www.techdirt.com/articles/20080410/010534808.shtml (11 April 2008)

and the NY Times http://www.nytimes.com/2008/04/10/nyregion/10indict.html (10 April 2008)

ISPs as enforcers of the law

Nothing new really, but more obvious now. Section 230 (c)(2) CDA (the other part of section 230 is the infamous "child porn provision") allows for ISPs to filter contentious contents. Spam being illegal, ISPs are allowed to filter content, i.e. here e-mails and block the account holder. Law enforced by private companies which are probably quite happy about it because spam is a hindrance to their services. Decision of 10 April 2008 (Northern District Court of Illinois)
http://www.spamsuite.com.nyud.net/index.php?q=node/387
the PDF version (and full decision) is available on http://www.circleid.com/pdf/come360-counterclaim.pdf

From "Court Tells Spammer That It's Not Illegal For An ISP To Filter Its Emails" (11 April 2008) http://www.techdirt.com/articles/20080411/150256827.shtml

Sexual assault and ISPs' liability

Would be funny if not sad and serious. MySpace was sued by daughter and mum as being liable for sexual assault. Hard to see how in this case, for the daughter actually lied about her age and engage into correspondence with a much older man. This in criminal law terms translates itself in error on fact, which means that even the author of the assault may not be considered as having mens rea to commit the actus reus.
"Mother And Daughter Still Blame MySpace For Not Protecting Her From Sexual Assault" (1 April 2008) http://www.techdirt.com/articles/20080331/172442708.shtml

Since then it has been dropped "MySpace Still Not Liable For Sexual Assault Between Two MySpace Users" http://www.techdirt.com/articles/20080517/1524041148.shtml (19 May 2008)

Censorship and China (once more)

Again a week with China and the Olympics. Can't avoid the subject.
This one is interesting: the Olympic Committee has asked China to lift its Firewall. Put aside (momentarily) the cynism of the request, I love what the request stands for: the fact that China could well acknowledge it has a firewall, which it never did up to now (even denied it if I remember well).
Going to the request itself, well, two interpretations which actually can be found in the comments attached to the post on TechDirt: the request does not engage much more the Committee nor China, for what matters is.... making money. Better to lift the veil temporarily to get the maximum profits both for the West ... and for China! Or else the Committee would have a change of heart? well in that case, why not ask for lifting of censorship indefinitely, not simply while the games are there? Plus, is the COmmittee really serious about human rights when it has allowed games in a country not only reknown for its continuous violations of basic human rights but also for its constant refusal to improve (see Tibet as the latest example...) and make the slightest concession
"IOC: No Chinese Internet Filters During Olympics; All Other Times It's Fine" (1 April 2008)http://www.techdirt.com/articles/20080401/105659717.shtml

Similar issue with iTunes http://www.techdirt.com/articles/20080825/2219562089.shtml (26 August2008)

ID fraud under the flashlights

It seems to be the week of ID fraud. A documentary on the BBC yesterday 3 April 2008 pointing out the work of the City of London's Economic Crime Unit and of the anti-virus firm Sophos demonstrating how easy it is to install trojans and the like on anyone computers...
The documentary should undoubtedly raise awareness about ID fraud online and how to protect oneself efficiently
http://www.bbc.co.uk/bbcone/listings/programme.shtml?day=today&service_id=4223&filename=20080403/20080403_2100_4223_10817_60

http://www.sophos.com/security/blog/2008/04/1255.html

One thing that always buggers me is the fact that details of the civil registry and electoral rolls are freely available (date of birth...). At a time when ID fraud is thriving and difficult to detect before it is too late, I can't understand why these personal information databases remain accessible to anyone.

Lastly, it is astonishing to realise that some do not see the threat caused by ID fraud and do not want to criminalise the use of stolen personal information! "ICO urges gov't to retain data-theft laws" (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378353,00.htm

Danger of terrorism...

The US Defense is publicly annoucing it takes cybercrime seriously whether as a direct consequence of cyberterrorism or just simple cyberattacks. Nothing new, but ironically the internet was created by the US military... who now needs to train its own service member about security issues
"US reveals plans to hit back at cyber threats " (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378374,00.htm

"Army Sets Up Phishing Scam To See How Gullible Service Members Are" (3 April 2008) http://www.techdirt.com/articles/20080402/194347734.shtml


and businesses also take the threat seriously "Accenture and Sun aim to widen security scope" (2 April 2008) http://news.zdnet.co.uk/security/0,1000000189,39378365,00.htm

ISPs, prosecution and human rights

It seems that Yahoo! wishes to "clean up" its act: it offered $1m to study the link between the internet and international values, meaning human rights. After having contributed to giving in a chinese dissident, is Yahoo! willing to repent? The gesture could go into two different directions: a pure PR exercise destined to exorcise the bad name but with no real consequences and change of policy; or a strength to behave more responsibility and more in accordance with what the US and the West are supposed to embody, i.e. human rights. Where the wind will blow will undoubtedly depend on the quality of the research done, i.e. the methodology used and the people employed to do the work, as well as the lessons that will be learnt. There is no time frame given in the article, so we may well have to wait a while, forever? Because to declare there are "grey areas" which render doing business difficult international is an euphemism for not having the courage to stand by one's opinions and values and let greed take over. Yes fighting for freedom does not bring any penny in difficult situations, but that's the short term view is it?
"Yahoo CEO: Business overseas fraught with 'grey areas' " (4 April 2008)
http://news.zdnet.co.uk/internet/0,1000000097,39379891,00.htm

ownership - ISPs

I do not know to which extent the following article could influence cybercrime, but at least the thought is there. The title on TechDirt is intriguing: "Ownership Doesn't Always Mean Control" (21st March 2008) because common assumption is to associate ownership with complete control on what is owned. What it means for ISPs is unclear: on the one hand, they do have control; on the other hand, they don't control everything...

http://www.techdirt.com/articles/20080305/052101445.shtml

Wi-Fi and piggybacking

In the State of Maryland in the US, an MP proposed a Bill to criminalise piggybacking with Wi-Fi. See PDF document: http://mlis.state.md.us/2008rs/bills/hb/hb1377f.pdf

"FOR the purpose of prohibiting a person from intentionally, willfully, and without
authorization accessing, attempting to access, causing to be accessed, or
exceeding the person’s authorized access to wireless Internet service with a
certain knowledge; applying certain penalties; and generally relating to
unauthorized access to computers and related material."

Wonder if any similar proposal would be of any use? CMA 1990 section 1 cirminalised unauthorised access to computer; can the interpretation be extended to Wi-Fi (which after all requires access to computers?)

See "A Public Official Actually Shows Common Sense in Wireless 'Piggybacking' Debate" (21 March 2008) http://www.techdirt.com/articles/20080320/172759602.shtml

Second life and copyrights virtual claims

Yes, it happened! A lawsuit launched, now dropped, about copyrights in Second Life. Apparently a company specialised in writing scripts for virtual sex toys and M. Leatherwood a year ago did copy the items to sell them on Second Life. The company sued him for breach of copyrights. The case (federal) was dropped after settlement with no admission of liability.
Reading the article, I was interested in the plaintiff's argument that the legal rules of the real world apply to online universe like Second Life. And the contrast to M. Leatherwood's approach to the breach: "I did it in private," he said. "I wasn't out to do a huge market thing. I was doing it for a little bit of money." In other words, breach was implicitly acknowledged; motive (=money) was at the heart of the action, like most copyrights infringment by the way; defendant did not really challenge the fact that real world rules could be transplanted to virtual worlds. Is it because money is at stake? Second Life currency being exhangeable against real dollars?
See TEchDirt 27 March 2008 http://www.techdirt.com/articles/20080326/164522658.shtml refering to
26 March 2008 on SignOnSanDiego http://hosted.ap.org/dynamic/stories/T/TECHBIT_VIRTUAL_SEX_MACHINE?SITE=CADIU&SECTION=HOME&TEMPLATE=DEFAULT
and even the Forbes newspaper mentioned it : "Lawsuit over online sex toys settled" (26 March 2006) http://www.forbes.com/markets/feeds/afx/2008/03/26/afx4817411.html

Facebook and harassment claim

An odd case, which facts are not yet very clear, at least for me. It seems that M. Hurst did a search on the internet about his ex-girlfriend and was added on the list of requests to be her friend on Facebook; she denied and then complained to the police who charged him with harassment under the 1997 Harassment Act. Well, on those facts alone, it is hard to believe that the prosecution could have any chance to win the case. So it begs the question of why it all started and spent the taxpayer's money on a charge unlikely to succeed?

See "First 'Facebook harassment' defendant cleared" (27 March 2008)http://www.theregister.co.uk/2008/03/27/facebook_birmingham_harassment_cleared/

and with more details, the Birmingham Post (27 March 2008) http://www.birminghampost.net/news/west-midlands-news/2008/03/27/ex-boyfriend-cleared-of-facebook-harassment-65233-20681245/

Investigations: clicking=guilty

Please read the following article carefully. It is about US law, but the practice could be more widespread and whether UK law on interception could protect people is questionable.

The facts are the following: honeypot (= fake website or similar created by law enforcement forces like the FBI here, to attract illegal behaviours) on child porn; Mr Vosburgh clicked on a link, did not look any further on the website, and found himself arrested by the FBI. Guilty verdict returned by jury; his lawyer tries to overturn the verdict, but chances of success are small.
I have several issues with the case:
1) in itself setting up a honeypot is not "kind of sad", contrary to what is said in the McCullagh's article. Entrapment always existed, especially for serious crime which detection causes difficulties. Nothing new here

2) entrapment is however regulated, for the obvious reason that innocent people may fall in the trap without knowingly engaging into illegal behaviours. And that's where the difficulties start. To click to a porn website cannot constitute a crime in itself if mens rea, intent to go to a porn website, does not exist. Mens rea cannot be deducted from the simple action of clicking. Anybody who used the internet knows how sometimes we end up on a website we surely never intended to go, for its contents does not reflect our original search. Therefore, I found it troublesome that the FBI relied on evidence based solely on clicking. The least that we can say is that evidence gathered by entrapment is never sufficient; other corroborative evidence must be brought. According to the article, it does not seem the case. In other words, by not engaging into other investigations that could corrobate the clicking action as proof of looking at child porn, the FBI simply did not investigate the case of the alleged offender. And this is more than troublesome. The life of this person found guilty is shattered until his death: if the conviction is not overturned, he will never find employment again in academia (and he is a PhD student; think of the amount of money one has to pay to do a 3 to 4 years PhD - you have to be wealthy or borrow a lot of money), and will be systematically stigmatised for something that looks like he has never done.
Last thing, even if he was interested in child porn, that simple fact NEVER discharges the prosecution to prove beyond reasonable doubt that the person engaged in the illegal activity. If it were, we would simply live in a dictatorship, like it used to be in the USSR where one could be found guilty and send to the goulag for "unauthorised thoughts". Criminal procedure is far too serious a matter to be played with simply because we think we are morally on the right side. Reading this article on Good Friday just reminds me that whether one believes or not in Jesus Christ, the story of Good Friday is there to remind us of our "dark side", what we tend to do when we think we are right. Agree: striking the balance is not easy; but criminal procedure is about finding that balance, not denying it per se.

M. Masnick "Click This Link, Go To Jail" (20 March 2008)
http://www.techdirt.com/articles/20080320/102209599.shtml

D. McCullagh "FBI posts fake hyperlinks to snare child porn suspects" (20 March 2008)
http://www.news.com/8301-13578_3-9899151-38.html

Social networking and identity theft

I though I wrote about it but can't find the post (please tell me if you do). So the issue is about a fake profile created on Facebook involving a Morrocan prince. Apparently, the person has been discovered and since then sentenced to three years imprisonment in Morroco for identity fraud. Mr Masnick, from TechDirt, disagrees on the harshness of the sentence and the principle of prosecuting the offender. He thinks the reaction is disproportionate to the crime.
I can't disagree that three years, when there is no money gain and no defamatory statements, is harsh. But on the principle of prosecuting, sorry, I wholly agree. A fake profile in a CV or a newspaper would certainly have attracted prosecution, so why not when it's on the web? The public interest defended here is that of integrity of information. In that sense, resorting to a take down notice, as suggested in the article, does not seem appropriate. Moreover, this idea of constantly using take down notices is not particularly protective of freedom of speech, for there is absolutely no impartial control on who says what; the procedure actually bypasses completely judicial proceedings and as such attracts the same criticisms as it does for defamatory statements. "Moroccan Man Pardoned For Fake Facebook Profile" (19 March 2008)
http://www.techdirt.com/articles/20080319/121024586.shtml

Investigations of files and documents

Nothing new: we all know that documents keep track of their multiple modifications. Not to difficult to find out. Hence the French Government could have been a bit more careful when releasing its first Bill reforming liability of hosting providers a few days ago. A Word document was issued and it revealed important information of who intervened... and was not said to have been officially consulted! No military secret, but still a secret: openness/transparency could have been prefered really. "De curieuses traces dans le fichier de l'avant-projet Olivennes" (14 March 2008) http://www.pcinpact.com/actu/news/42427-olivennes-FAI-editeur-hexadecimal-log.htm

Second life: Second crime?

Rare are the articles or comments about Second Life and cybercrime. Here is an article in French (yes I know, there is no translation so far), which in substance says the following:
1) although a virtual world in theory, its impact on the real world exists simply because the currency in Second Life can be exchanged againts... real dollars. Hence a lawyer (!) suing the publisher LInden Lab for loss of 8000 dollars because he was evicted when buying property (he did not comply with some rules). What I have not investigated and is unclear from the article is whether the eviction was based on virtual rules designed to prevent fraud...

2) the charity Familles de France (literally Families of France) is suing the publisher ... because the contents on Second Life give easy access to children to violence and pornography. The First Instance Tribunal rejected the claim on the basis the evidence presented was not tangible enough. But what if it becomes? What about the other violent games available on the market whether through or outside the internet?

By the way the article is an interview first published in December 2007, Michael Malka "Le droit dans «Second Life» (interview) " http://www.juriscom.net/pro/visu.php?ID=1039

Fraud and spamming: the US

I have not looked at it in details, but spamming in the US is tacled through fraud. Would the new offence in the UK cover the same ground? Suggestions welcome... "Top Spammer Pleads Guilty, But Spam Still Going Strong" (17 March 2008) http://www.techdirt.com/articles/20080316/212058558.shtml