Internet Law Commons^™

Regulating Manipulative Design Is Not Preempted By Cda 230 Or The First Amendment, Brett Frischmann, Peter Ormerod

Faculty Publications

For over two decades, there has been a heated debate among legal scholars, activists, judges, and others about the scope of Section 230 of the Communications Decency Act. A persistent theme in those debates has been hyperbolic claims about the necessity of immunity from state laws for digital tech platforms and fearmongering that anything less than maximum immunity will destroy the Internet.

This Article argues that states retain considerable discretion to regulate digital platforms’ design and engineering decisions. We argue that manipulation, engineered behavior, and even habituation and normalization of engineered behavior by digital platforms are content-agnostic harms attributable to …

Inexorably Entangled Environmental And Knowledge Commons, Todd Aagaard, Brett M. Frischmann

Faculty Publications

For people to effectively share an environment, they usually also must effectively share knowledge about that environment. While seemingly obvious and intuitive, this insight is often overlooked in literature about governing resources as commons. Focusing on the knowledge commons associated with an environmental commons helps to illuminate a host of complex governance dilemmas. This chapter examines the interrelationship between environmental and knowledge commons, weaving together different strands of commons research and practice. Examples discussed include shared pastures, forests, road systems, computer servers, social media platforms, living rooms, and antimicrobial effectiveness/resistance.

Disciplining Mechanisms: Governing Data Markets With Competition And Regulation, Peter Ormerod

Faculty Publications

The past decade has witnessed conceptual renewals in both competition law and information privacy law. These regulatory movements—Neo-Brandeis antitrust and structural data governance—share the objective of recalibrating the balance of power between individuals and the massive data-processing firms that now dominate modern life.

Despite their common ends, policy interventions drawn from these schools of thought can work at cross purposes: competitive pressure can induce data exploitation, and privacy rules tend to benefit the largest firms.

This Essay exposes the friction in their relationship and offers guidance on how to mediate their tension. Competition policy alone will prove ineffective at indirectly …

Online Age Gating: An Interdisciplinary Evaluation, Noah Apthorpe, Brett Frischmann, Yan Shvartzshnaider

Faculty Publications

The recent surge in regulation seeking to establish age-based governance online is part of a decades-long attempt to establish online zoning. It is driven by active development of technologies to estimate or verify user age based on various characteristics of users, their credentials, or their activities. However, these developments have heightened prevailing concerns that online age gating technology will inevitably be abused and misused to cause a variety of privacy harms and rights infringements. This paper examines this ongoing debate by bridging technical and legal scholarship to explore the current state of online age-based governance. We discuss the current legal …

(Re)Individualizing Criminal Law, Itay Ravid

Faculty Publications

Criminal law purports to care about the individual culpability of those committing crimes. Individual mental states or defenses based on one’s beliefs are considered foundational to moral responsibility and criminal conviction. The expansion of algorithmic risk assessment tools in the criminal legal system, however, threatens these principles, changing the criminal law subject from an autonomous individual to merely a predicted object. This Article argues that risk assessment tools—now functioning as gatekeepers at both the entry and exit stages of the criminal process, from predictive policing to compassionate release eligibility—have shifted the criminal system away from its foundation in individual culpability. …

Better Digital Contracts With Prosocial Friction-In-Design, Brett Frischmann, Moshe Y. Vardi

Faculty Publications

Contract law is supposed to enable people to reach genuine agreements and cooperate. If this ideal was ever a reality, the rise of mass market contracts and boil­erplate rendered it pure fiction. Modern consumer contracts are incomprehensible to most people. No one reads them anyway.

Digital contracting involves design features that amplify traditional boilerplate harms and create others. For example, digital contracting is too cheap; low marginal costs lead to overexpansion in scale and scope. To make matters worse, the loss of autonomy from repeat engagement with digital contracting systems is pernicious. People become increasingly predictable and programmable as digital …

Assessing Information Literacy In The Age Of Generative Ai: A Call To The National Conference Of Bar Examiners, Amy A. Emerson

Faculty Publications

Information literacy is crucial to satisfying a lawyer’s duty of technology competence by virtue of its inherent role in conducting legal research—a skill now recognized by the National Conference of Bar Examiners (NCBE) as a priority as it prepares for the NextGen Bar Exam. In light of the rapid rise in the number of attorneys facing disciplinary issues across the country, it is the NCBE’s responsibility to draw upon its rich history to address information literacy as a technological competency on the Multistate Professional Responsibility Exam to protect the public from newly licensed lawyers’ incompetent use of generative artificial intelligence.

Virtual Currency As Real Currency, Jeffrey A. Maine

Faculty Publications

Convertible virtual currency is increasingly equated with the notion of real currency. Indeed, the increased acceptance of virtual currency as a payment method among retailers and consumers, the evolution of new types of virtual currency that alleviate price volatility, and the recent expansion of foreign country initiatives confirm the strong trajectory toward virtual currency’s function as a transactional currency. Yet, the tax system continues to classify all forms of virtual currency as “property,” and not “currency,” which results in immediate taxation every time someone buys something with virtual currency. This Article argues that the adopted tax treatment of virtual currency …

"We Can't Allow Iot Vendors To Pass Off All Such Liability To The Consumer": Investigating The U.S. Legal Perspectives On Liability For Iot Product Security, Prianka Mandal, Amit Seal Ami, Iria Giuffrida, Daniel Shin, Ella Sullivan, Adwait Nadkarni

Faculty Publications

As the regulatory landscape for the Internet of Things (IoT) evolves, vendors are moving towards certifying their products for security. Thus, we need to understand who is liable when certification failures result in harm, i.e., when certified products have vulnerabilities that are exploited to cause harm to users. This paper addresses the fundamental and timely question that has significant implications for vulnerability detection in certified products: who is liable for harm resulting from vulnerabilities in certified products, and who should be so liable? Through a qualitative analysis of contractual documents from 20 IoT vendors, this paper investigates how liability is …

A Threshold Assessment: Is Technology Among The Competencies Tested By The Mpre?, Amy A. Emerson

Faculty Publications

No abstract provided.

Leveraging Technology To Promote Access To Justice, Amy Emerson

Faculty Publications

No abstract provided.

Of Systems Thinking And Straw Men, Kate Klonick

Faculty Publications

(Excerpt)

In Content Moderation as Systems Thinking, Professor Evelyn Douek, as the title suggests, endorses an approach to the people, rules, and processes governing online speech as one not of anecdote and doctrine but of systems thinking. She constructs this concept as a novel and superior understanding of the problems of online-speech governance as compared to those existent in what she calls the “standard [scholarly] picture of content moderation.” This standard picture of content moderation — which is roughly five years old — is “outdated and incomplete,” she argues. It is preoccupied with anecdotal, high-profile adjudications in which platforms …

Pandora’S Loot Box, Sheldon Evans

Faculty Publications

The emerging trend of loot boxes in video game platforms continues to expand the shifting boundaries between the real and virtual world and presents unique insights into the impact each world should have on the other. Borrowing their design from the gambling industry, loot boxes operate as a hybrid between slot machines and trading cards. A consumer pays real-world money to buy a virtual box without knowing its contents. Upon opening the box, the consumer receives a virtual good that may be of great value, but more commonly is of little or no value.

This Article contributes a novel theory …

The Facebook Oversight Board: Creating An Independent Institution To Adjudicate Online Free Expression, Kate Klonick

Faculty Publications

For a decade and a half, Facebook has dominated the landscape of digital social networks, becoming one of the most powerful arbiters of online speech. Twenty-four hours a day, seven days a week, over two billion users leverage the platform to post, share, discuss, react to, and access content from all over the globe. Through a system of semipublic rules called “Community Standards,” Facebook has created a body of “laws” and a system of governance that dictate what users may say on the platform. In recent years, as this intricately built system to dispatch the company’s immense private power over …

Internet Of Things For Sustainability: Perspectives In Privacy, Cybersecurity, And Future Trends, Abdul Salam

Faculty Publications

In the sustainability IoT, the cybersecurity risks to things, sensors, and monitoring systems are distinct from the conventional networking systems in many aspects. The interaction of sustainability IoT with the physical world phenomena (e.g., weather, climate, water, and oceans) is mostly not found in the modern information technology systems. Accordingly, actuation, the ability of these devices to make changes in real world based on sensing and monitoring, requires special consideration in terms of privacy and security. Moreover, the energy efficiency, safety, power, performance requirements of these device distinguish them from conventional computers systems. In this chapter, the cybersecurity approaches towards …

Wannacry, Ransomware, And The Emerging Threat To Corporations, Lawrence J. Trautman, Peter Ormerod

Faculty Publications

The WannaCry ransomware attack began on May 12, 2017, and is unprecedented in scale-quickly impacting nearly a quarter-million computers in over 150 countries. The WannaCry virus exploits a vulnerability to Microsoft Windows that was originally developed by the U.S. National Security Agency and operates by encrypting a victim's data and demanding payment of a ransom in exchange for data recovery. Security experts have indicated that a North Korea- linked group of hackers-who have also been implicated in cyberattacks against Sony Pictures in 2014, the Bangladeshi Central Bank in 2016, and Polish banks in February 2017-is behind the attack.

Ransomware threatens …

The Ironic Privacy Act, Margaret Hu

Faculty Publications

This Article contends that the Privacy Act of 1974, a law intended to engender trust in government records, can be implemented in a way that inverts its intent. Specifically, pursuant to the Privacy Act's reporting requirements, in September 2017, the U.S. Department of Homeland Security (DHS) notified the public that record systems would be modified to encompass the collection of social media data. The notification justified the collection of social media data as a part of national security screening and immigration vetting procedures. However, the collection will encompass social media data on both citizens and noncitizens, and was not explicitly …

#I U: Considering The Context Of Online Threats, Lyrissa Lidsky

Faculty Publications

The United States Supreme Court has failed to grapple with the unique interpretive difficulties presented by social media threats cases. Social media make hateful and threatening speech more common but also magnify the potential for a speaker's innocent words to be misunderstood People speak differently on different social media platforms, and architecturalf eatures ofplatforms, such as character limits, affect the meaning of speech. The same is true of other contextual clues unique to social media, such as gifs, hashtags, and emojis. Only by understanding social media contexts can legal decision-makers avoid overcriminalization of speech protected by the First Amendment. This …

Delineating Victims From Perpetrators: Prosecuting Self-Produced Child Pornography In Youth Criminal Justice Systems, Bryce Westlake

Faculty Publications

Video recording technology advancements and accessibility has been paralleled by a growth in self-produced child pornography (SPCP). Although social and judicial attention has been given to instances of teenage sexting, Internet-based forms of SPCP, such as webcam/website sex tourism, have almost been ignored. While some of the proposed legislation reform has referenced video-based SPCP, the majority has focused on SPCP distributed through cellular phones; excluding that which is manifested online or through entrepreneurial efforts. The purpose of this article is to introduce non-sexting SPCP, using the case study of Justin Berry (in the United States), and to propose a broad …

Industrial Cyber Vulnerabilities: Lessons From Stuxnet And The Internet Of Things, Lawrence J. Trautman, Peter C. Ormerod

Faculty Publications

Cyber breaches continue at an alarming pace with new vulnerability warnings an almost daily occurrence. Discovery of the industrial virus Stuxnet during 2010 introduced a global threat of malware focused toward disruption of industrial control devices. By the year 2020, it is estimated that over 30 billion Internet of Things (IoT) devices will exist. The IoT global market spend is estimated to grow from $591.7 billion in 2014 to $1.3 trillion in 2019 with a compound annual growth rate of 17%. The installed base of IoT endpoints will grow from 9.7 billion in 2014 to more than 25.6 billion in …

There's An "App" For That: Developing Online Dispute Resolution To Empower Economic Development, Amy J. Schmitz

Faculty Publications

Traditionally, litigation has been the norm for resolving disputes. It takes place in a public forum and face-to-face. In a global economy, however, such public and face-to-face dispute resolution is not feasible. This is especially true with cross-border purchases through e-commerce. E-commerce requires more efficient and less litigious remedy systems that allow consumers to obtain remedies on their purchases without the cost and travel associated with traditional face-to-face procedures. This has led to development of online dispute resolution (“ODR”) processes, especially with respect to business-to-consumer contracts. Accordingly, scholarship and policy papers have advanced ODR for the benefit of consumers. What …

A Blueprint For Online Dispute Resolution System Design, Amy J. Schmitz

Faculty Publications

A great deal of discussion focuses on how arbitration and similar private dispute resolution harms consumers, and how businesses seek ways to avoid helping consumers. It is often assumed that companies and consumers are on opposing “teams.” In reality, however, consumers and companies enjoy more commonalities than contradictions. Both benefit when deals go well and disputes are resolved quickly and cheaply. The problem is that face-to-face dispute resolution can be costly in terms of time and money. Furthermore, getting lawyers involved may inspire gamesmanship and adversarial antics aimed to protect one’s reputation for staying “strong” and refusing to settle or …

Corporate Directors' And Officers' Cybersecurity Standard Of Care: The Yahoo Data Breach, Lawrence J. Trautman, Peter C. Ormerod

Faculty Publications

On September 22, 2016, Yahoo! Inc. ("Yahoo") announced that a data breach and theft of information from over 500 million user accounts had taken place during 2014, marking the largest data breach ever at the time. The information stolen likely included names, birthdays, telephone numbers, email addresses, hashed passwords, and, in some cases, encrypted or unencrypted security questions and answers. Yahoo further disclosed its belief that the stolen data "did not include unprotected passwords, payment card data, or bank account information." Just two months before Yahoo disclosed its 2014 data breach, it announced a proposed sale of the company's core …

Reader Privacy In Digital Library Collaborations: Signs Of Commitment, Opportunities For Improvement, Anne Klinefelter

Faculty Publications

Libraries collaborate to digitize collections large and small in order to provide information with fewer geographical, temporal, or socio-economic barriers. These collaborations promise economy of scale and breadth of impact, both for access to content and for preservation of decaying print source material. Some suggest this increased access to information through the digital environment comes at the expense of reader privacy, a value that United States librarians have advanced for nearly eighty years. Multiplying risks to digital reader privacy are said to weaken librarians’ commitment to privacy of library use and to overwhelm libraries’ ability to ensure confidential access to …

Of Reasonable Readers And Unreasonable Speakers: Libel Law In A Networked World, Lyrissa Lidsky, Ronnell Anderson Jones

Faculty Publications

Social-media libel cases require courts to map existing defamation doctrines onto social-media fact patterns in ways that create adequate breathing space for expression without lincensing character assassination. This Article explores these challenges by investigating developments involving two important constitutional doctrines - the so-called opinion privlege, which protects statements that are unverifiable or cannot be regarded as stating actual facts about a person, and the actual malice rule, which requires defamation plaintiff's who are public officials or public figures to prove that the defendant made a defamatory statement with knowledge of or reckless disregard for, its falsity. Given the critical role …

Re-Shaming The Debate: Social Norms, Shame, And Regulation In An Internet Age, Kate Klonick

Faculty Publications

Advances in technological communication have dramatically changed the ways in which social norm enforcement is used to constrain behavior. Nowhere is this more powerfully demonstrated than through current events around online shaming and cyber harassment. Low cost, anonymous, instant, and ubiquitous access to the Internet has removed most—if not all—of the natural checks on shaming. The result is norm enforcement that is indeterminate, uncalibrated, and often tips into behavior punishable in its own right—thus generating a debate over whether the state should intervene to curb online shaming and cyber harassment.

A few years before this change in technology, a group …

Big Data Blacklisting, Margaret Hu

Faculty Publications

“Big data blacklisting” is the process of categorizing individuals as administratively “guilty until proven innocent” by virtue of suspicious digital data and database screening results. Database screening and digital watchlisting systems are increasingly used to determine who can work, vote, fly, etc. In a big data world, through the deployment of these big data tools, both substantive and procedural due process protections may be threatened in new and nearly invisible ways. Substantive due process rights safeguard fundamental liberty interests. Procedural due process rights prevent arbitrary deprivations by the government of constitutionally protected interests. This Article frames the increasing digital mediation …

The History And Future Of E-Commerce Patents, Dennis D. Crouch, Mitchell L. Terry

Faculty Publications

The past two decades have seen a great rise in the patenting of e-commerce inventions. Now, those same patents are taking an equally great fall. In a series of four recent cases, the U.S. Supreme Court has shifted the doctrine of patent eligibility and, in the process, raised the bar for e-commerce and software patents - making it more difficult to obtain and enforce those types of patents.

Privacy And The New Press, Lyrissa Lidsky

Faculty Publications

In The First Amendment Bubble, Professor Amy Gajda comprehensively examines privacy threats posed by digital media and “quasi-journalists” and demonstrates how their intrusive practices threaten existing press freedoms.

A New Taxonomy For Online Harms, Kate Klonick

Faculty Publications

(Excerpt)

Bullying is generally understood among academics and educators as having to meet three criteria: (1) it must be verbal or physical aggression; (2) it must be repeated over time; and (3) it must involve a power differential. When talking about cyber bullying, the aggression is mostly verbal, using “threats, blackmail. . . gossip and rumors” and online personas or messages can be more cruel, vindictive and mean. Though cyber bullying typically describes acts between children, the same acts by adults could also be considered cyber harassment. Unlike harassment, however, bullying does not have a history of criminal liability—though all …