Saturday, May 30, 2009

Obama on net neutrality & cyber security

LA Times:
"Let me also be clear about what we will not do. Our pursuit of cyber-security will not -- I repeat, will not include -- monitoring private sector networks or Internet traffic. We will preserve and protect the personal privacy and civil liberties that we cherish as Americans. Indeed, I remain firmly committed to net neutrality so we can keep the Internet as it should be --

BBC reports
open and free."

US President Barack Obama has announced plans for securing American computer networks against cyber attacks.

Youtube Link - discussion on cyber security




Wednesday, May 20, 2009

My Reading for June

TONGUE-IN-CHEEK: HOW INTERNET DEFAMATION
LAWS OF THE UNITED STATES & CHINA ARE SHAPING GLOBAL INTERNET SPEECH
BY: Nicole Hostettler
Cite as 9 J. HIGH TECH. L. 66 (2009)
http://www.jhtl.org/docs/pdf/HOSTETTLER_Tongue_in_Cheek.pdf

Minimum Contacts in Cyberspace:
The Classic Jurisdiction Analysis in a New Setting
BY: Tricia Leigh Gray
http://www.jhtl.org/docs/pdf/TGRAYV1N1N.pdf

Mixing Oil with Water: Resolving the Differences Between
Domain Names and Trademark Law
BY: Jonathan O. Nilsen
“The Internet has evolved from its inception as primarily a research network
into a full-blown commercial marketplace.”
http://www.jhtl.org/docs/pdf/JNILSENV1N1N.pdf


The Internet Bankruptcy: What Happens When the Bell Tolls
for the eCommerce Industry?
BY: Warren E. Agin
Swiggart & Agin, LLC
Boston, Massachusetts
Cite as: 1 J. HIGH TECH. L. 1 (2002)
http://www.jhtl.org/docs/pdf/WAGINV1N1LA.pdf

Tuesday, May 19, 2009

Case Comment: Click-wrap Arbitration Clause found enforceable

Clickwrap Contract Enforcement: Arbitration & Forum Selection Clauses

Recommended Reading: For lawyers seeking to understand the contest and enforceability of clickwrap agreements, an article written by Rachel Cormier Anderson and published by the Shidler Journal of Law

Link:

http://www.lctjournal.washington.edu/Vol3/a011Cormier.html

In three recent cases, courts have invalidated portions of consumer clickwrap agreements containing either forum selection or binding arbitration clauses. In the first case, the Washington State Court of Appeals invalidated a forum selection clause found in a clickwrap agreement because the clause was contrary to state consumer protection policies. In the second case, the California Court of Appeals rejected a clickwrap agreement calling for binding arbitration in a specified forum when the plaintiff sought to bring a class action claim. Finally, the U.S. Court of Appeals for the Fifth Circuit recently declared a binding arbitration clause because it was unconscionable. Although these cases address a relatively new form of contracting known as "clickwrap agreements," the essential issue in each case was not new. These cases suggest that courts are willing to accept the validity of clickwrap agreements in general, but have invalidated specific clauses based on traditional contract doctrines such as unconscionability and public policy. This Article examines these recent cases in light of existing precedent concerning the enforceability of clickwrap agreements


Clickwrap Contract Enforcement Often Depends on the Specific Facts and Jurisdiction

The legal status of shrink wrap contracts in the US is somewhat unclear. One line of cases follows ProCD v. Zeidenberg which held such contracts enforceable (see, e.g., Brower v. Gateway) and the other follows Klocek v. Gateway, Inc., which found the contracts at hand unenforceable (e.g., Specht v. Netscape Communications Corp.), but did not comment on shrink wrap contracts as a whole. These decisions are split on the question of consent, with the former holding that only objective manifestation of consent is required while the latter require at least the possibility of subjective consent.

In particular, the Netscape contract was rejected because it lacked an express indication of consent (no "I agree" button) and because the contract was not presented directly to the user (users were required to click on a link to access the terms). However, the court in this case did make it clear that "Reasonably conspicuous notice of the existence of contract terms and unambiguous manifestation of assent to those terms by consumers are essential if electronic bargaining is to have integrity and credibility." Specht, 356 F.3d 17. It may be worth noting that the user in the Zeidenberg case had purchased and opened the packages of multiple copies of the product, and therefore could not easily prove he remained ignorant of the contract/license; whereas in many cases, the so-called shrink-wrap "license" agreement has not been reviewed at the time of purchase (having been hidden inside the box), and therefore is arguably not part of the sale of the copy, and thus not enforceable by either party without further "manifestation of assent" to its terms. In general, a user is not obligated to read, let alone consent to any literature or envelope packaging that may be contained inside a product; otherwise such transactions would unduly burden users who have no notice of the terms and conditions of their possession of the object purchased, or the blind, or those unfamiliar with the language in which such terms are provided, etc.

Via Viente Taiwan, L.P. v. United Parcel Service, Inc., 2009 WL 398729 (E.D. Tex. February 17, 2009)
A federal court in Texas held the clickwrap agreement between United Parcel Service and one of its customers was binding. After plaintiff Via Viente sued UPS in Texas, UPS moved to transfer venue to the Northern District of Georgia, citing to a forum selection clause in a license agreement governing Via Viente’s use of a UPS-provided software Via Viente argued that the clickwrap agreement (and by extension the forum selection clause) was not binding because a UPS technician installed the application on a Via Viente computer, and therefore Via Viente never had a chance to agree to the terms. The court rejected that argument for the following three reasons:

• Via Viente was a sophisticated company and “should have been aware that terms of service were forthcoming” after having signed the general Carrier Agreement with UPS that required the use of the software;

• It was “difficult to believe” that Via Viente would have left the UPS technician installing the software unsupervised. Moreover, it was not UPS’s practice to install the software unsupervised;

• Via Viente had kept the benefit of the bargain (convenience and “palatable” shipping costs) so it would have been inequitable to allow it to disavow provisions it did not like.

After finding the clickwrap agreement to be binding, the court went on to find the forum selection clause enforceable, and transferred the matter to the Northern District of Georgia.


Available at: http://blog.internetcases.com/page/2/

Monday, May 11, 2009

electronic records mngt - something for the lawxul students!!

Do you know where your data is?

It is often said that technology is the problem and the solution. This is surely appropriate for data security. After all, more than 95 per cent of corporate data is held electronically.

Perhaps the best approach is to distinguish between data security ­ – preventing unauthorised disclosure – ­ and litigation/regulatory readiness ­ – managing authorised disclosure effectively. The legal rules of data protection and the civil courts require those responsible for the relevant data to consider what technology is available to better avoid unauthorised and manage authorised disclosure. This fact alone dictates that IT and legal experts should communicate and collaborate.

The Data Protection Act imposes a duty to ensure an appropriate level of security. This involves a consideration of the nature of the data, and the likelihood of loss, cost and developments in technology. It is not sufficient for the risks around storing and using high volumes of electronic data to appeal to the legal framework alone.

The potential damage to brand and reputation is too often underestimated.

When 1,500 Standard Life savers’ personal details were lost en route between HM Revenue and Customs (HMRC) offices in Newcastle and Edinburgh, the data was encrypted to the highest degree. But two lost HMRC CDs containing Child Benefit Agency information were protected by only one password.

Subcontracting is another example of risk – ­ one that led to Marks & Spencer (M&S) losing an unencrypted laptop and being found by the Information Commissioner to have violated the law.

What about the litigation/regulatory risk? Few organisations appreciate the burden, time and cost of a request from an opponent in litigation or from a regulator to produce documents. Most are blissfully unaware of what is involved.

What are you going to do when asked to produce substantial volumes of data against a tight deadline? Where is the data? How are you going to search for it? What happens if you do not produce files when requested but they subsequently come to light? The low priority accorded to this risk could prove disastrous.

What should companies be doing?

First, the risks must be appreciated and managed. Make data management an organisational priority. Instigate ongoing communication and collaboration between the IT function and the legal team. For example, is there a policy about the removal of mobile devices from company premises? What about the use of removable media such as memory sticks? Who is controlling that data?

Second, draw up and enforce appropriate policies that should be kept under constant review. Keep audit trails so that a course of action can be justified later if necessary.

The use of encryption is not as widespread as may be thought, as the M&S incident testified. Training is vital, and every contract within the organisation should be reviewed in relation to the data management risk.

Whether your technology is in-house or outsourced, those responsible will need to appreciate the different data protection laws in different countries, the prevention of over-writing backup procedures during the preservation and collection phase, and the challenges presented by differences in local language and culture where data has to be collected across continents.

Volume reduction is essential to confine data within reasonable parameters such as date ranges, file types, and relevance, to eliminate unnecessary duplication.

A documented and defensible methodology to justify decisions is indispensable. And project management skills to review the data for confidentiality, privilege and non-relevance is essential to stop costs spiralling out of control.

Legal teams must understand what technologies are available, and IT managers must understand the rules governing the retention, destruction and disclosure of electronically stored information.

What better way to start taking control than for IT and legal to talk to each other?

Mark Surguy is a senior associate at international law firm Pinsent Masons

Data protection disasters

* HMRC lost two unencrypted CDs containing the details of 25 million child benefit recipients. It appears that it was a breach of company policy to use the internal post (a courier) rather than recorded mail that led to the loss, and not a breach of any encryption requirement.
* M&S used a consultancy to prepare pensions statements. The evening before a meeting, the company’s data was downloaded to a laptop in unencrypted format, and the computer was stolen. M&S immediately put into operation an encryption programme for all its laptops.
* When Arthur Anderson staff shredded documents in connection with the Enron affair, the fatal damage to the company was caused by a failure to comply with a document-destruction policy. Had the shredded documents been destroyed in accordance with the policy, no complaint could have been made and the organisation would still be in existence today.

Available at: http://techlaw.computing.co.uk/

Q&A

Last week on the 8th May, a blogger opinionised on the last post and asked an interesting question- which posed a great challenge...below is my opinion....i welcome further contributions.

The Challenge!

Do you think it would be better to have one all inclusive law or several laws covering say e-commerce, intellectual property etc

Such issues as with intellectual property should be dealt with separately, following examples of other such as the Singapore and South Africa. In my opinion, having one all inclusive law dealing with all the matters pertaining to electronic commerce would result to having an "ambiguous and complex" legal framework which will in turn be hard to adopt especially in an environment such as our own where by judges and lawyers need extensive training in this new area of law. Therefore, by having separate laws dealing with, intellectual property, consumer protection, electronic transactions, privacy, data protection etc is the best option due to the complex nature of the issues arising within e-commerce.


Below is a good example of how we should move forward.....


Singapore for example:

Electronic Transactions Act (Cap. 88) Singapore covers matters such as:

  • Electronic contracts;
  • Electronic records and signatures;
  • Secure electronic records and signatures;
  • Effect of digital signatures and duties relating to such signatures;
  • Duties of Certification Authorities and their subscribers;
  • Regulation of Certification Authorities;
  • Government use of electronic records and signatures; and Liability of network service providers

In drafting the Electronic Transactions Act, the following guiding principles were adopted:

  1. The need to conform to international standards and international models in order to be integrated with the global e-commerce framework;
  2. The need to avoid over regulation;
  3. The need to be flexible and technologically neutral to adapt quickly to a fluid global environment; and
  4. The need for transparency and predictability in our laws.

· Broadly, the Act seeks to do the following:

  1. Enact a Commercial Code to support e-commerce transactions;
  2. Provide for a Public Key Infrastructure;
  3. Enable Electronic Applications and Licences for the Public Sector; and
  4. Clarify Network Service Providers' liability for third party content.

In order to strike a balance between the protection of rights for owners of creative works and increased public access to intellectual property, Tanzania has to ensure that its intellectual property and copyright laws are harmonised with the underlying principles in global laws on intellectual property rights (IPRs). For example, IPRs are accorded the standards of protection as prescribed by international agreements such as the World Trade Organisation's Trade-Related Aspects of Intellectual Property Rights (TRIPS) Agreement, and the Berne and Paris Conventions.

The Internet has extended the reach of providers of information and other forms of content, but it has also changed radically the ease to reproduce, distribute and publish such information and content. This has posed new challenges for intellectual property protection. The laws providing for IPR should thus be reinforced to provide a strong and conducive IPR regime to encourage the growth of a knowledge-based economy and promote electronic commerce and creative innovations.

The amendments should aim to:

  1. Improve copyright protection and enforcement measures for copyright owners in the digital environment, thus promoting the use of the Internet for business.
    For example, the amendments-
    • extended copyright protection to multimedia and interactive productions which qualify as intellectual creations;
    • clarified that copyright owners enjoy protection against the making of electronic and transient copies of their work; and
    • provided the conditions allowing an additional avenue whereby copyright owners may require Internet Service Providers to "take down" materials which may be guilty of copyright infringement, even before the owners initiate enforcement proceedings against the actual infringes.
  2. Promote legal certainty in the usage of the Internet by clarifying the rights and obligations of copyright owners, intermediaries such as network service providers, and users such as educational institutions.
    For example, allowing end users to browse materials made available on the Internet such amendments should also spell out when intermediaries such as Internet Service Providers are exempted from liabilities.


Importantly, a clarity between the connection of IP and e-commerce to beginners -

There are several reasons why IP is important to E-Commerce and e-commerce is important to IP. E-Commerce, more than other business systems, often involves selling products and services that are based on IP and its licensing. Music, pictures, photos, software, designs, training modules, systems, etc. can all be traded through E-Commerce, in which case, IP is the main component of value in the transaction. IP is important because the things of value that are traded on the Internet must be protected, using technological security systems and IP laws, or else they can be stolen or pirated and whole businesses can be destroyed.

Also, IP is involved in making E-Commerce work. The systems that allow the Internet to function - software, networks, designs, chips, routers and switches, the user interface, and so on - are forms of IP and often protected by IP rights. Trademarks are an essential part of E-Commerce business, as branding, customer recognition and good will, essential elements of Web-based business, are protected by trademarks and unfair competition law.

E-Commerce businesses and Internet related businesses are based on product or patent licensing. This is because so many different technologies are required to create a product that companies often outsource the development of some component of products, or share technologies through licensing arrangements. If every company had to develop and produce all technological aspects of every product independently, development of high technology products would be impossible. The economics of E-Commerce depends on companies working together to share, through licensing, the opportunities and risks of business. Many of these companies are SMEs.

Finally, E-Commerce based businesses usually hold a great deal of their value in IP; so the valuation of your E-Commerce business will be affected by whether you have protected your IP. Many E-Commerce companies, like other technology companies, have patent portfolios and trademarks that enhance the value of their business.

Available at: http://www.wipo.int/sme/en/e_commerce/ip_ecommerce.htm

Sunday, May 3, 2009

time to regulate

Notably, there has been activities in drafting model laws to regulate cyber activities alongside Kenya "electronic Transactions Bill 2007" and other east african states (http://africa.bizcommunity.com/Article/111/23/18306.html)......Kenya, Uganda and Tanzania are in the process of adopting harmonized cyber laws to enable the establishment of e-government and e-commerce programs, according to the East African Community, the intergovernmental organization representing these three countries with a population totaling 82 million people. The cyber laws will cover data security, network security, cyber crime, information systems and electronic transactions (http://www.ibls.com/internet_law_news_portal_view.aspx?s=latestnews&id=1539)

in short the process of the legislature passing the laws in Tanzania needs to be fast-tracked in order for the country to reap out the benefits of e-commerce especially due to the fact that the first question asked by a foreign company, wanting to operate a website targeted at the Tanzanian audience, is about the laws dealing with online content.

i read an interesting article a few days ago, based on the Indian Information Technology Act whereby the author omits that in the absence of specific laws governing online content regulation, laws which have not specifically made for online content regulation will still apply to it. This is the principle of functional equivalence with statutes such as the Indian Penal Code, 1860 will be made applicable to online act’s and omissions. read more.....http://www.livemint.com/2008/01/14001653/Management--A-legal-framework.html


another interesting bit of info...in addition to one of my first articles on e-defamtion..

Civil Procedure Code + the Internet!

The Delhi High Court in the case of Frank Finn Management Consultants v. Subhash Motwani and Another (CS(OS) 367/2002) determined the scope of its jurisdiction under Section 19 of the Code of Civil Procedure, 1908 while making refrence to the availibility of the publication on the internet. The case concerned a suit for damages publishing libelous information. The defendant’s argument was that since the publication of the libelous material did not occur in the forum hence it did not have jurisdiction within the meaning of Section 19. The court intepreting section 19 held that, “publication in the sense of a libel is not the mechanical act of printing of the magazine but is of communication of the libelous article”. In reaching the conclusion that it had jurisdiction it held that, “…growing number of readers prefer to read newspapers and magazines via internet rather than in hard form. By putting the magazine on the internet, the magazine cannot be said to be for circulation within Mumbai only and is concluded to be having circulation all over India.” (available at: http://iltb.apargupta.com/?p=76)

Friday, May 1, 2009

E-News!

Nigeria: That Delay on Cyber Crime Law is Dangerous!
By Zakariyya Adaramola dated 23 February 2009

Internet-based attacks and crimes are increasing in Nigeria as 'greedy' criminals continue to steal data from businesses and individuals....available at: http://allafrica.com/stories/200902231107.html