Internet Law Commons^™

Cybersecurity Spillovers, Mark Verstraete, Tal Zarsky

BYU Law Review

This Article identifies and analyzes a previously unrecognized source of positive externalities within cybersecurity, which we term "cybersecurity spillovers". Most commentators have focused on negative externalities and market failures, leading to a pervasive pessimism about the possibility of adequate cybersecurity protections. In response, this Article demonstrates that unique dynamics from the world of cloud computing – most notably, indivisibility – may force cloud service firms to generate spillovers. These spillovers are additional security protections provided to common cloud users: clients who may not have been willing or able to acquire these security services otherwise. Furthermore, this additional source of security …

Data Privacy Regulations In The United States, China, And The European Union, Charlsey A. Kelly

Honors College Theses

This paper compares and discusses the different data privacy regulations found in the United States, China, and the European Union. It is no secret that big tech companies like Facebook and Google continuously collect data on their users. The big question is what protections and rights one has as a consumer. The answer to this question differs when you are in different parts of the world. Currently the United States does not have a federal data privacy law, China recently adopted a new data privacy law called the Personal Information Protection Law, and the European Union has a data privacy …

The "Worst Law In Technology": How The Computer Fraud And Abuse Act Allows Big Businesses To Collect And Sell Your Personal Information, Alicia Nakhjavan

Brooklyn Law Review

For years, big businesses have been collecting and selling users’ personal information without permission. In attempts at preventing this practice, users have brought civil actions under the Computer Fraud and Abuse Act (CFAA), alleging a loss of personal privacy. As currently enacted, “personal privacy” is not included in the statutory definition of loss. Further, courts have been reluctant to interpret the CFAA broadly to cover loss of personal privacy claims. This note proposes that an amendment to the CFAA is necessary to close this gap in the statute’s coverage and better protect users’ right to privacy.

Understanding Chilling Effects, Jonathon W. Penney

Articles & Book Chapters

With digital surveillance and censorship on the rise, the amount of data available unprecedented, and corporate and governmental actors increasingly employing emerging technologies like artificial intelligence and facial recognition technology for surveillance and data analytics, concerns about “chilling effects,” that is, the capacity for these activities to “chill” or deter people from exercising their rights and freedoms, have taken on greater urgency and importance. Yet, there remains a clear dearth in systematic theoretical and empirical work points. This has left significant gaps in understanding. This Article has attempted to fill that void, synthesizing theoretical and empirical insights from law, privacy, …

Platforms, Encryption, And The Cfaa: The Case Of Whatsapp V Nso Group, Jonathon W. Penney, Bruce Schneier

Articles & Book Chapters

End-to-end encryption technology has gone mainstream. But this wider use has led hackers, cybercriminals, foreign governments, and other threat actors to employ creative and novel attacks to compromise or workaround these protections, raising important questions as to how the Computer Fraud and Abuse Act (CFAA), the primary federal anti-hacking statute, is best applied to these new encryption implementations. Now, after the Supreme Court recently narrowed the CFAA’s scope in Van Buren and suggested it favors a code-based approach to liability under the statute, understanding how best to theorize sophisticated code-based access barriers like end-to-end encryption, and their circumvention, is now …

Regulating Social Media In The Global South, Zahra Takhshid

Sturm College of Law: Faculty Scholarship

In recent years, the disinformation crisis has made regulating social media platforms a necessity. The consequences of disinformation campaigns are not only limited to election interferences or political debates; they have also included fatal consequences. In response, however, scholars in the United States have generally focused on regulating social media companies in the United States, without paying much attention to these companies’ global impact, particularly in the Global South. Lost in the quest to fight disinformation is addressing the social media companies’ neglect of consumer rights in the Global South.

Countries in the Global North, such as the United States, …

Narrowing Data Protection's Enforcement Gap, Filippo Lancieri

Maine Law Review

The rise of data protection laws is one of the most profound legal changes of this century. Yet, despite their nominal force and widespread adoption, available data indicates that these laws recurrently suffer from an enforcement gap—that is, a wide disparity between the stated protections on the books and the reality of how companies respond to them on the ground. Indeed, Appendix I to this Article introduces a novel literature review of twenty-six studies that analyzed the impact on the ground of the GDPR and the CCPA: none found a meaningful improvement in citizen’s data privacy. This raises the question: …

Passcodes, Protection, And Legal Practicality: The Necessity Of A Digital Fifth Amendment, Ethan Swierczewski

Catholic University Journal of Law and Technology

No abstract provided.

Dignity, Intersectional Gendered Harm, And A Flexible Approach: Analysis Of The Right To One’S Image In Quebec, Yuan Stevens

Canadian Journal of Law and Technology

This article draws on critical feminist theory and the framework of intersectionality to examine how courts in Quebec have begun — and are poised — to respond to the phenomenon of the non-consensual sharing of images, particularly if they are of an intimate or sexual nature. Dunn’s work has demonstrated that Quebec’s dignity-focused approach to the protection of identity and privacy ought to guide the development of similar civil recourse provided in common law Canada. This paper fills a gap by identifying the affordances and gaps of Quebec’s legal approach from the vantage point of equality-seeking groups, with a particular …

Data Property, James Grimmelmann, Christina Mulligan

American University Law Review

In this, the Information Age, people and businesses depend on data. From your family photos to Google’s search index, data has become one of society’s most important resources. But there is a gaping hole in the law’s treatment of data. If someone destroys your car, they have committed the tort of conversion, and the law gives a remedy. But if someone deletes your data, it is far from clear that they have done you a legally actionable wrong. If you are lucky, and the data was stored on your own computer, you may be able to sue them for trespass …

Sharenting Is Here To Stay, So Now What?, Anonymous Author

Seattle University Law Review

This Note explores the concept of sharenting, its real-world consequences, and the daunting task of creating a workable solution. Part I of this Note provides a broad overview of sharenting and its implications. Part II describes the current state of the law and why sharenting remains a difficult issue to address. Part III discusses four legal frameworks posed by legal scholars to combat sharenting: anti-bullying, privacy, erasure, and child labor laws—and, ultimately, why each fails to offer an airtight solution. Part IV offers an alternative solution: the regulation of data brokers and outlawing advertisement-based social media platforms to protect children’s …

Do We Own What We Post?: The Fundamental Property Right To Destroy Your Presence On The Internet, Olivia Shangrow

Seattle University Law Review

This Note will explore the well-established right to destroy your own property and how such a fundamental right can and should be applied to our online property to develop more protective data privacy legislation. Part I highlights the longstanding pillar of property law establishing a right to destroy one’s property, and how that can and should be applied to your digital identity. Part II will discuss the ambiguity of personal data ownership online and the ill effects resulting from the lack of control of our personal information on the Internet. Part III examines the current state of data privacy legislation …

Table Of Contents

Seattle University Law Review

Table of Contents

Masthead, Lead Article Editor

Catholic University Journal of Law and Technology

No abstract provided.

Table Of Contents, Lead Article Editor

Catholic University Journal of Law and Technology

No abstract provided.

The Rise Of 5g Technology: How Internet Privacy And Protection Of Personal Data Is A Must In An Evolving Digital Landscape, Justin Rabine

Catholic University Journal of Law and Technology

No abstract provided.

The Application Of The Right To Be Forgotten In The Machine Learning Context: From The Perspective Of European Laws, Zeyu Zhao

Catholic University Journal of Law and Technology

The right to be forgotten has been evolving for decades along with the progress of different statutes and cases and, finally, independently enacted by the General Data Protection Regulation, making it widely applied across Europe. However, the related provisions in the regulation fail to enable machine learning systems to realistically forget the personal information which is stored and processed therein.

This failure is not only because existing European rules do not stipulate standard codes of conduct and corresponding responsibilities for the parties involved, but they also cannot accommodate themselves to the new environment of machine learning, where specific information can …

Book Review: Mike Zajko, Telecom Tension: Internet Service Providers And Public Policy In Canada*, Matt Malone

Canadian Journal of Law and Technology

The world of telecommunications, writes Mike Zajko in this timely analysis of internet service providers (ISPs), “is a world many of us have never wondered about, just as we are rarely curious about where our sewage goes or how the electricity grid is configured.” Yet ISPs are not just conduits of fast-traveling light pulses that deliver the internet; they transmit, channel, form, and express a multitude of public policy issues, and they have an important level of agency in the construction and exercise of those policies, too. These dynamics have implications for a large bandwidth of topics relevant to Canadians, …

Reframing Technology-Facilitated Gender-Based Violence At The Intersections Of Law & Society, Jane Bailey, Carys Craig, Suzie Dunn, Sonia Lawrence

Canadian Journal of Law and Technology

This introductory article proceeds in three parts. First, it discusses the origins of this special issue as part of a multi-event, SSHRC-funded conference that focused on pushing beyond a narrow conception of TFGBV; rather than approaching TFGBV as solely an issue of interpersonal behaviours, the animating objective of the conference was to examine the structural, systemic, and design factors that contribute to TFGBV. Second, it explores the importance and promise of reframing TFGBV in this way through intersectional and structural lenses. Third, it briefly highlights some of the key insights from each of the contributions in this special issue. It …

Understanding Chilling Effects, Jonathon Penney

Articles, Book Chapters, & Popular Press

With digital surveillance and censorship on the rise, the amount of data available online unprecedented, and corporate and governmental actors increasingly employing emerging technologies like artificial intelligence (AI), machine learning, and facial recognition technology (FRT) for surveillance and data analytics, concerns about “chilling effects”, that is, the capacity for these activities “chill” or deter people from exercising their rights and freedoms have taken on greater urgency and importance. Yet, there remains a clear dearth in systematic theoretical and empirical work point. This has left significant gaps in understanding. This article has attempted to fill that void, synthesizing theoretical and empirical …

Platforms, Encryption, And The Cfaa: The Case Of Whatsapp V Nso Group, Jonathon Penney, Bruce Schneier

Articles, Book Chapters, & Popular Press

End-to-end encryption technology has gone mainstream. But this wider use has led hackers, cybercriminals, foreign governments, and other threat actors to employ creative and novel attacks to compromise or workaround these protections, raising important questions as to how the Computer Fraud and Abuse Act (CFAA), the primary federal anti-hacking statute, is best applied to these new encryption implementations. Now, after the Supreme Court recently narrowed the CFAA’s scope in Van Buren and suggested it favors a code-based approach to liability under the statute, understanding how best to theorize sophisticated code-based access barriers like end-to-end encryption, and their circumvention, is now …

The Crimes Of Digital Capitalism, Aitor Jiménez, J.C. Oleson

Mitchell Hamline Law Review

No abstract provided.

Data Breach Notification Laws And The Quantum Decryption Problem, Phillip Harmon

Washington and Lee Law Review

In the United States, state data breach notification laws protect citizens by forcing businesses to notify those citizens when their personal information has been compromised. These laws almost universally include an exception for encrypted personal data. Modern encryption methods make encrypted data largely useless, and the notification laws aim to encourage good encryption practices.

This Note challenges the wisdom of laws that place blind faith in the continued infallibility of encryption. For decades, Shor’s algorithm has promised polynomial-time factoring once a sufficiently powerful quantum computer can be built. Competing laboratories around the world steadily continue to march toward this end. …

Comment: The Necessary Evolution Of State Data Breach Notification Laws: Keeping Pace With New Cyber Threats, Quantum Decryption, And The Rapid Expansion Of Technology, Beth Burgin Waller, Elaine Mccafferty

Washington and Lee Law Review

The legal framework that was built almost two decades ago now struggles to keep pace with the rapid expansion of technology, including quantum computing and artificial intelligence, and an ever-evolving cyber threat landscape. In 2002, California passed the first data breach notification law, with all fifty states following suit to require notice of unauthorized access to and acquisition of an individual’s personal information.1 These data breach notification laws, originally designed to capture one-off unauthorized views of data in a computerized database, were not built to address PowerShell scripts by cyber terrorists run across thousands of servers, leaving automated accessed data …

“I Bet You Don’T Get What We Get”: An Intersectional Analysis Of Technology-Facilitated Violence Experienced By Racialized Women Anti- Violence Online Activists In Canada, Nasreen Rajani

Canadian Journal of Law and Technology

Despite growing attention to violence that women face in online settings, a relatively small proportion of academic work centres on the experiences and perspectives of racialized women in Canada. Informed by an intersectional framework, I draw on semi-structured interviews with nine women across Canada, all of whom are involved in anti-violence online activism, about their experiences of technology-facilitated violence (TFV). Their experiences revealed less prominent narratives, including instances of TFV beyond instances of intimate partner violence (IPV) and beyond sources of anonymous trolling by supposed white men, such as violence perpetrated by peers, white women, and racialized men. In this …

Intimate Images And Authors’ Rights: Non- Consensual Disclosure And The Copyright Disconnect, Meghan Sali

Canadian Journal of Law and Technology

This article responds to a brand of legal realpolitik that says using property law to respond to the non-consensual distribution of intimate images (NCDII) is appropriate and even necessary, because its remedial frameworks are well developed and provide the relief that is often most sought after by targets of an assault: the immediate removal of photos from online platforms. While some targets are not considered the ‘‘authors’’ of their intimate images, most of the images that are the subject of NCDII are selfies, taken by the target themselves. In these cases, that person rightfully owns the copyright in those images …

On The Internet, Nobody Knows You Are A Dog: Contested Authorship Of Digital Evidence In Cases Of Gender-Based Violence, Suzie Dunn, Moira Aikenhead

Canadian Journal of Law and Technology

We examine various aspects of digital evidence at GBV trials, drawing on relevant Canadian criminal case law. First, we describe some of the unique challenges related to electronic documents generally with respect to determining authorship. Second, we review some of the historical and ongoing practices within the criminal justice system that rely on harmful gendered myths about GBV and note the potential for these myths to emerge in relation to digital evidence. Third, we discuss the duty of investigating police officers to gather the necessary available digital evidence to demonstrate authorship and note potential gaps in current investigatory practices that …

Responding To Deficiencies In The Architecture Of Privacy: Co-Regulation As The Path Forward For Data Protection On Social Networking Sites, Laurent Cre ́Peau

Canadian Journal of Law and Technology

Social Networking Sites like Facebook, Twitter and the like are a ubiquitous part of contemporary culture. Yet, as exemplified on numerous occasions, most recently in the Cambridge Analytica scandal that shook Facebook in 2018, these sites pose major concerns for personal data protection. Whereas self-regulation has characterized the general regulatory mindset since the early days of the Internet, it is no longer viable given the threat social media poses to user privacy. This article notes the deficiencies of self-regulatory models of privacy and contends jurisdictions like Canada should ensure they have strong data protection regulations to adequately protect the public. …

Artificial Intelligence In Canadian Healthcare: Will The Law Protect Us From Algorithmic Bias Resulting In Discrimination?, Bradley Henderson, Colleen M. Flood, Teresa Scassa

Canadian Journal of Law and Technology

In this article, we canvas why AI may perpetuate or exacerbate extant discrimination through a review of the training, development, and implementation of healthcare-related AI applications and set out policy options to militate against such discrimination. The article is divided into eight short parts including this introduction. Part II focuses on explaining AI, some of its basic functions and processes, and its relevance to healthcare. In Part III, we define and explain the difference and relationship between algorithmic bias and data bias, both of which can result in discrimination in healthcare settings, and provide some prominent examples of healthcare-related AI …

The Anomaly That Is Privacy: Data Privacy Concerns Related To The Rise Of Microchip Implants In Humans, Kendra Lobban

Catholic University Journal of Law and Technology

No abstract provided.