MIRLN -- Misc. IT Related Legal News [11 February – 3 March 2007; v10.03]

**************Introductory Note**********************

MIRLN (Misc. IT Related Legal News) is a free product of the American Bar Association’s Cyberspace Law Committee and Dickinson Wright PLLC. Please feel free to distribute this message. Dickinson Wright’s IT & Security Law practice group is described at http://tinyurl.com/joo5y.

Members of the ABA Cyberspace Law Committee automatically receive MIRLN postings (about every third week); members can manage their subscriptions at http://www.abanet.org/dch/committee.cfm?com=CL320000 (find the “Listserves” box; MIRLN comes through the CLCC-MEMS listserve). Others who wish to be added to the MIRLN distribution list should send email to Vince Polley with the word “MIRLN” in the subject line, and similarly will be removed from the distribution list after sending email to Vince with the words “MIRLN REMOVAL” in the subject line.

Recent MIRLN editions are archived at www.vip-law.com and blogged at http://mirln.blogspot.com/.

**************End of Introductory Note***************

FBI FREEZES FUNDS OF ‘VIRTUAL WALLET’ WEB PAYMENT FIRM (The Guardian, 6 Feb 2007) -- The FBI has frozen funds held in customer accounts at Neteller, the “virtual wallet” payment processor, as part of its case against the firm’s two Canadian founders who were last month arrested and charged with racketeering and money laundering. Neteller refused to disclose how much had been frozen but company filings make clear huge sums were flowing between its US customers’ “e-wallets” and online merchants - particularly gambling websites - up until the firm was pressured to close its American operations in the wake of last month’s arrests. Over a six-month period last year the company processed transactions worth $5.1bn (£2.6bn), with about 85% involving US customers. In the past five years, Neteller came to dominate gambling transactions in America because its e-wallets allowed users to get around credit card blocks on gambling sites. Following the arrests of founders Stephen Lawrence and John Lefebvre, who face up to 20 years in jail if convicted, the decision was quickly taken to shut down US operations. Trading in the company’s shares was also suspended and remains so. The FBI claim JSL Systems, a US-based payment company owned by Mr. Lefebvre, received customer funds in the US for Neteller and then transferred them to accounts held by a Neteller company in Canada. Last month Neteller told the Guardian that wagered money no longer passed through JSL. It is unclear whether the FBI will treat some or all of the funds as proceeds of illegal gambling. One US newspaper report cited Neil Donovan, an FBI agent, saying the funds were being held in court as potential evidence. Some money may be returned to Neteller customers but no timescale was forthcoming, the report said. A spokeswoman for the Department of Justice last night refused to confirm details in the report, as did Neteller. http://technology.guardian.co.uk/news/story/0,,2006709,00.html

DEBUNKING MYTHS ABOUT IDENTITY FRAUD (CNET, 7 Feb 2007) -- It seems that we constantly are hearing horror stories about the perils of rampant identity fraud. However, a recent survey seeks to set the record straight by saying that in the United States, the problem actually is decreasing. Javelin Strategy & Research has just released its Identity Fraud Survey Report. While identifying significant risk differentiators between age and income demographics, the report highlights an important reduction in fraudulent new account openings using private information. Interestingly, the report also says that more fraud happens via physical channels, such as in-person transactions, and by the direct theft of personal data by individuals, rather than taking place online. Let’s drill down a bit into some of the critical findings of the study, which is based on telephone interviews with 5,000 adults. http://news.com.com/Debunking+myths+about+identity+fraud/2010-1029_3-6156841.html?tag=nefd.top Report at http://www.javelinstrategy.com/2007/02/06/identity-fraud-has-dropped-since-2003-survey-shows/#more-613%202007

U.K. DATA THIEVES FACE TWO YEARS IN PRISON (CNET, 7 Feb 2007) -- Individuals who sell or deliberately misuse others’ personal data in the U.K. could now face a penalty of up to two years in prison. The previous penalty stipulated for the charge in the Data Protection Act 1998 was a fine. Now data thieves risk up to six months in prison for a summary conviction, while for a conviction on indictment, they could get up to two years, the U.K. Department for Constitutional Affairs said Wednesday. The change comes as the British government moves to increase data sharing as a way of offering higher-quality public services to citizens. http://news.com.com/2100-1029_3-6157219.html

MASS. AG LEADS MULTISTATE PROBE INTO TJX BREACH (Computerworld, 8 Feb 2007) -- Massachusetts Attorney General Martha Coakley will lead a civil investigation by dozens of states into the security breach disclosed last month by The TJX Companies Inc., the owner of T.J. Maxx and Marshalls retailers. The state’s consumer protection division is looking into the data breach, “particularly what security measures the company took to protect consumer information,” Coakley’s office said in a statement yesterday. A Coakley spokeswoman, Emily LaGrassa, added that more than 30 states have asked for details on the TJX investigation or expressed interest in joining the probe. TJX on Jan. 17 disclosed the security breach, in which one or more hackers penetrated the company’s computer network and made off with a still-unspecified number of customer records, including credit card numbers. More than three dozen banks in Massachusetts, the home state of the Framingham-based company, have reported that cards they’ve issued have been compromised. Although the attack began in May 2006, the breach was not discovered by TJX until mid-December. The company said it delayed disclosing the intrusion until January so it could contain the problem and meet confidentiality obligations to law enforcement agencies. http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9010884&source=NLT_PM&nlid=8 [It keeps getting worse; there are indications that the breaches occurred also in 2005, and perhaps earlier.]

-- and --

WILL PLAINTIFFS’ BAR SOON BE SINGING “T-T-T-T-T-T-T-T-TJX” IN BREACH CASES? (Steptoe & Johnson’s E-Commerce Law Week, 15 Feb 2007) -- Knowledgeable commentators (yes, we’re in a self-congratulatory mood this week) have predicted for a while that the plaintiffs’ bar will eventually succeed in a negligence suit based on a company’s failure to implement “reasonable” data security. And it appears that the “breach-chasers” may have finally found the right case. The data breach involving retail conglomerate TJX Companies, Inc. (the owner of discount chains T.J. Maxx and Marshalls, among others), first announced in mid-January, has so far drawn at least four putative class action suits in federal court in Massachusetts. While the plaintiffs in past class actions stemming from data breaches have had a difficult time establishing standing (for lack of cognizable harm) and/or damages, the TJX case might not suffer from the same weaknesses. The breach reportedly was broad in scope -- possibly involving more than 40 million credit and debit cards -- and has resulted in fraudulent debit and credit card purchases. These factors, combined with the emergence in recent years of a discernible standard of what constitutes “reasonable” security, could make this a precedent-setting case. If so, tort law in breach cases may “never ever [be] the same place,” as the old T.J. Maxx commercial went. Accordingly, companies will have even more reason to pay close attention to their data security procedures. http://www.steptoe.com/publications-4252.html

-- and --

MASS. BILL WANTS STORES TO PAY MORE IN DATA BREACHES (CNET, 22 Feb 2007) -- Businesses would have to reimburse banks for costs stemming from data security breaches, under a Massachusetts bill that could be mimicked by other states and in Congress. In what appears to be the first stab at such an approach, the proposal would require any “commercial entity” that handles personal financial data to foot the bill for various banking costs caused by hacks or other intrusions into their systems. The costs would include any fees associated with canceling or reissuing credit cards, opening and closing bank accounts, and restoring customers’ account balances after fraudulent transactions. The bill defines “commercial entity” as including everything from corporations to governmental agencies to associations, whether for-profit or not-for-profit. Shifting the liability away from banks--a step beyond previous proposals--has been a focus of discussion among advocacy groups for smaller banks. These banks argue that they are absorbing all the costs associated with data leaks, and they’re distressed they have to pick up the tab for damage they didn’t even create. The proposed remedy is primarily targeted at retailers, such as discount retailer TJX Companies. These have recently reported breaches potentially affecting thousands of customers, said Steve Kenneally, director of payments and technology policy for America’s Community Bankers, which advocates for smaller banks. ACB, which supports the state bill, would prefer to see national legislation. http://news.com.com/2100-7348_3-6161536.html

-- and --

BILL WOULD TIE RETAILERS TO COSTS OF ID THEFT (NPR, 26 Feb 2007) -- Massachusetts eyes a law to hold retailers accountable when thieves steal credit card information. The bill would force retailers to pay for the cost of reissuing new cards and for other expenses. Credit-card companies now absorb most of those costs. (2 minute audio program available at http://www.npr.org/templates/story/story.php?storyId=7599116)

NEW CYBERSECURITY CHIEF LAYS OUT GUIDANCE (Computerworld, 9 Feb 2007) -- U.S. companies and the federal government need to step up and fix the problems in their computer networks, the nation’s new cybersecurity czar told attendees during his first-ever address at RSA Conference here in San Francisco on Thursday. Within the next 10 years, the majority of the world’s communication needs will probably be handled by the Internet, said Gregory Garcia, the assistant secretary for cybersecurity and telecommunications at the Department of Homeland Security (DHS). “This proliferation of applications and devices within the converged network is going to create a breeding ground for security problems,” he said. “Our networks and our systems are vulnerable and they are exposed.” Garcia outlined two priorities for the year ahead. First, his office is working with federal agencies to adopt common security policies and practices. Second, he plans to work with the private sector to push forward a process called the National Infrastructure Protection Plan. This effort is intended to evaluate computer security risks on an industry-by-industry basis and outline the steps that need to be taken to address them. [Garcia] made it clear that the DHS expects U.S. companies to participate. “There are a lot of plans in Washington. This one is going to stick,” he said. “The private sector owns and operates 90% of the critical infrastructure, and it’s up to you all, not just the DHS, to secure this infrastructure.” http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=Security&articleId=9010939&taxonomyId=17&intsrc=kc_li_story

LAWMAKERS INTRODUCE BREACH NOTIFICATION, OTHER BILLS (PC World, 9 Feb 2007) -- Senators Patrick Leahy, a Vermont Democrat, and Bernie Sanders, a Vermont independent, introduced the Personal Data Privacy and Security Act. In addition to requiring data breach notification, the bill would also require data brokers to disclose what information they hold on individuals. The bill would allow individuals to correct information held by data brokers, and it would require companies that have databases with personal information on more than 10,000 U.S. residents to implement data privacy and security programs. Representatives Bobby Rush, a Illinois Democrat, and Cliff Stearns, a Florida Republican, introduced the Data Accountability and Trust Act this week. Their bill, with 24 co-sponsors, authorizes the U.S. Federal Trade Commission (FTC) to draw up data privacy requirements for businesses, including requirements that they have vulnerability assessments and policies for disposing of obsolete data. After a company reports a data breach, the FTC would conduct an audit of its security practices, and, like the Leahy-Sanders bill, the bill would require data brokers to disclose the information they hold on individuals and allow individuals to correct wrong information. http://www.pcworld.com/article/id,128887-c,techrelatedlegislation/article.html Bill at http://www.epic.org/privacy/pdf/DPSA2007.pdf

WIFI TURNS INTERNET INTO HIDEOUT FOR CRIMINALS (Washington Post, 11 Feb 2007) -- Detectives arrived last summer at a high-rise apartment building in Arlington County, warrant in hand, to nab a suspected pedophile who had traded child pornography online. It was to be a routine, mostly effortless arrest. But when they pounded on the door, detectives found an elderly woman who, they quickly concluded, had nothing to do with the crime. The real problem was her computer’s wireless router, a device sending a signal through her 10-story building and allowing savvy neighbors a free path to the Internet from the privacy of their homes. Perhaps one of those neighbors, authorities said, was stealthily uploading photographs of nude children. Doing so essentially rendered him or her untraceable. With nearly 46,000 public access points across the country -- many of them free -- hundreds of thousands of computer users are logging on every day to wireless networks at cafes, hotels, airports and even while sitting on park benches. And although the majority of those people are simply checking their e-mail and surfing the Web, authorities said an increasing number of criminals are taking advantage of the anonymity offered by the wireless signals to commit a raft of serious crimes -- from identity theft to the sexual solicitation of children. http://www.washingtonpost.com/wp-dyn/content/article/2007/02/10/AR2007021001457.html

COMPANIES IMPLEMENT P2P SOLUTIONS TO TRANSFER DATA (BNA’s Internet Law News, 13 Feb 2007) -- The WSJ reports that companies such as GM, Coca-Cola Co. and videogame publisher Tulga Games Inc. are now using peer-to-peer technology to transmit large chunks of data like video files or software updates, to employees and customers. Instead of a costly expansion of its satellite network last year, GM turned to P2P to push videos of marketing messages and sales targets to employees overseas, especially those in regions that have limited Internet capacity.

SKYPE SNOOP AGENT READS MOBO SERIAL NUMBERS (The Register, 11 Feb 2007) -- Skype has been spying on its Windows-based users since the middle of December by secretly accessing their system bios settings and recording the motherboard serial number. A blog entry (http://share.skype.com/sites/security/2007/02/skype_extras_plugin_manager.html) made on Skype’s website assures us it’s no big deal. The snooper agent is the handiwork of a third-party program called EasyBits Software, which Skype uses to manage Skype plug-ins. Among other things, EasyBits offers DRM features that prevent the unauthorized use or distribution of plug-ins, and that’s why Skype 3.0 has been nosing around in users’ bios. Reading the serial number allows EasyBits to quickly identify the physical computer the software is running on. The practice was discontinued on Thursday, when Skype was updated to version 3.0.0.216. Skype goes to great lengths (http://www.skype.com/download/adwarefree/) to assure users they will not be fed spyware, which the eBay-owned VOIP provider defines as “software that becomes installed on computer without the informed consent or knowledge of the computer’s owner and covertly transmits or receives data to or from a remote host.” What’s more, we were unable to find terms of service the spells out what EasyBits does with the information it gathers on Skype users. It’s also hard to take Skype’s nothing-to-see-here notification at face value because of the lengths the software goes to conceal its snooping. As documented (http://www.pagetable.com/?p=27) in the Pagetable blog, the Skype snoopware runs a .com file and prevents the more curious users among us from reading it. Were it not for errors it was giving users of 64-bit versions, we’d probably still be in the dark. http://www.theregister.co.uk/2007/02/11/skype_bios_snoop/print.html

STUDY: P2P EFFECT ON LEGAL MUSIC SALES “NOT STATISTICALLY DISTINGUISHABLE FROM ZERO” (ARStechnica, 12 Feb 2007) -- A new study in the Journal of Political Economy by Felix Oberholzer-Gee and Koleman Strumpf has found that illegal music downloads have had no noticeable effects on the sale of music, contrary to the claims of the recording industry. Entitled “The Effect of File Sharing on Record Sales: An Empirical Analysis,” the study matched an extensive sample of music downloads to American music sales data in order to search for causality between illicit downloading and album sales. Analyzing data from the final four months of 2002, the researchers estimated that P2P affected no more than 0.7% of sales in that timeframe. The study compared the logs of two OpenNAP P2P servers with sales data from Nielsen SoundScan, tracking the effects of 1.75 million songs downloads on 680 different albums sold during that same period. The study then took a surprising twist. Popular music will often have both high downloads and high sales figures, so what the researchers wanted was a way to test for effects on albums sales when file-sharing activity was increased on account of something other than US song popularity. Does the occasionally increased availability of music from Germany affect US sales? The study looked at time periods when German students were on holiday after demonstrating that P2P use increases at these times. German users collectively are the #2 P2P suppliers, providing “about one out of every six U.S. downloads,” according to the study. Yet the effects on American sales were not large enough to be statistically significant. Using this and several other methods, the study’s authors could find no meaningful causality. The availability and even increased downloads of music on P2P networks did not correlate to a negative effect on music sales. http://arstechnica.com/news.ars/post/20070212-8813.html

ELI LILLY LOSES EFFORT TO CENSOR ZYPREXA DOCUMENTS OFF THE INTERNET (EFF, 13 Feb 2007) -- A U.S. District Court judge today refused Eli Lilly’s request to ban a number of websites from publishing leaked documents relating to Zyprexa, Eli Lilly’s top-selling drug. Although the judge rejected the First Amendment arguments made by a variety of individuals eager to publish the documents, the court concluded that “it is unlikely that the court can now effectively enforce an injunction against the Internet in its various manifestations, and it would constitute a dubious manifestation of public policy were it to attempt to do so.” The order is a victory for the Electronic Frontier Foundation (EFF), which represents an anonymous individual who was previously barred by the court’s earlier orders from posting links to the Zyprexa documents on the zyprexa.pbwiki.com wiki. The Zyprexa documents were leaked from an ongoing product liability lawsuit against Eli Lilly. The internal documents allegedly show that Eli Lilly intentionally downplayed the drug’s side effects, including weight gain, high blood sugar, and diabetes, and marketed the drug for “off-label” uses not approved by the Food and Drug Administration (FDA). The documents were the basis for a front-page story in the New York Times in December of last year, and electronic copies are readily available from a variety of Internet sources. EFF’s client posted links to one set of copies on a wiki devoted to the controversy that were part of extensive, in-depth analysis from a number of citizen journalists. “This ruling makes it clear that Eli Lilly cannot invoke any court orders in its futile efforts to censor these documents off the Internet,” said EFF Staff Attorney Fred von Lohmann. “We are disappointed, however, that the judge failed to appreciate that its previous orders constituted prior restraints in violation of the First Amendment.” http://www.eff.org/news/archives/2007_02.php#005122 Order at http://eff.org/legal/cases/zyprexa/zyprexa_judgement.pdf

CONGRESS SEEKS ‘BITE’ FOR PRIVACY WATCHDOG (Washington Post, 13 Feb 2007) -- Key lawmakers want to replace a White House privacy and civil liberties board created by Congress in 2004 with one that is more independent of the president. The idea is to make the board more like the one envisioned by the bipartisan 9/11 Commission. As the commission’s vice chairman, Lee H. Hamilton, said yesterday: “We felt that you had to have a voice within the executive branch that reached across all of the departments of government with strong powers to protect our civil liberties.” But the five-member Privacy and Civil Liberties Oversight Board is resisting proposals that would dramatically change its composition and powers. The battle is another sign of the changed political landscape, with the Democratic-controlled Congress pushing for stronger oversight of the Bush administration’s counterterrorism programs. http://www.washingtonpost.com/wp-dyn/content/article/2007/02/12/AR2007021201430.html

WHY VISTA’S DRM IS BAD FOR YOU (Forbes, essay by Bruce Schneier, 12 Feb 2007) -- Windows Vista includes an array of “features” that you don’t want. These features will make your computer less reliable and less secure. They’ll make your computer less stable and run slower. They will cause technical support problems. They may even require you to upgrade some of your peripheral hardware and existing software. And these features won’t do anything useful. In fact, they’re working against you. They’re digital rights management (DRM) features built into Vista at the behest of the entertainment industry. And you don’t get to refuse them. The details are pretty geeky, but basically Microsoft reworked a lot of the core operating system to add copy protection technology for new media formats like HD-DVD and Blu-ray disks. Certain high-quality output paths--audio and video--are reserved for protected peripheral devices. Sometimes output quality is artificially degraded; sometimes output is prevented entirely. And Vista continuously spends CPU time monitoring itself, trying to figure out if you’re doing something that it thinks you shouldn’t. If it does, it limits functionality and in extreme cases restarts just the video subsystem. We still don’t know the exact details of all this, and how far-reaching it is, but it doesn’t look good. http://www.forbes.com/security/2007/02/10/microsoft-vista-drm-tech-security-cz_bs_0212vista.html Technical analysis at http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html

GOOGLE SAID TO VIOLATE COPYRIGHT LAWS (New York Times, 14 Feb 2007) -- A Brussels court ruled Tuesday that Google had violated copyright laws by publishing links to articles from Belgian newspapers without permission. Legal experts said the case could have broad implications in Europe for the news indexes provided by search engines. The ruling, which Google said it would appeal, was hailed by some newspaper industry representatives and may also have an impact on a lawsuit against Google by the news service Agence France-Presse. “As the first decision to condemn a search engine for indexing news articles, you can be sure publishers around the world are paying attention,” said Cyril Fabre, a lawyer in Paris at Alexen, a law firm specializing in Internet law and intellectual property. “The implications in Europe are particularly strong since copyright law is so uniform across the Continent.” The Brussels court ruled that Google, which operates the dominant Internet search engine, must pay 25,000 euros, or $32,600, for each day it displayed content from the plaintiff publications in violation of copyright. The court scaled back a September ruling that called for damages of up to 1 million euros a day and required Google to publish the judgment on its home page. The lawsuit, filed shortly after Google introduced the Belgian news site in January 2006, originally included two organizations representing journalists and photographers, but they reached a deal with the search engine. Google said the accord involved making use of content in new ways, but would not elaborate. Google believes that pointing to content on the Web is legal under copyright law, Mr. Elkaim added. “We have always explained that any licensing agreements Google does with content providers is for use that goes beyond indexing or referencing,” he said. Jessica Powell, a spokeswoman in London for Google, said the main complaints in the case — making reference to articles without prior permission, and the continued availability of articles in Google’s database after newspapers have restricted access to them — are issues easily rectified without legal action. Legal experts in the United States said the decision would have no direct impact there. But if upheld, they said, it could result in headaches for Google on both sides of the Atlantic. “It could set up a chain reaction, especially in European countries, where the authors’ rights are stronger,” said Pamela Samuelson, a law professor at the University of California, Berkeley, and the co-director of the Berkeley Center for Law and Policy. “If a Belgian court causes Google to change its ways, by preventing links from happening or forcing it to pay, other countries and other newspapers and other entities that have put things on the Web could say ‘me too.’ “Still, she said, “I think that argument that linking is an infringement is not a particularly strong argument.” http://www.nytimes.com/2007/02/14/business/14google.html?ex=1329109200&en=744fe208cddd4bdd&ei=5090&partner=rssuserland&emc=rss

-- and --

GOOGLE LOOSES ROUND TWO IN BELGIAN COPYRIGHT DISPUTE (CCH Computer Law Report, 22 Feb 2007) -- The Court of First Instance in Brussels has affirmed its prior ruling that Google violated Belgian copyright law by retaining cached copies of webpages and by publishing headlines, thumbnail images, and snippets of news gathered from articles on Belgium newspaper websites. On September 5, 2006, the court held that Google’s news and cache services violated Belgium’s law relating to copyright and ancillary rights (1991) and its law on data bases (1998). The rulings prohibit the search engine from displaying portions of articles, pictures, or drawings on webpages belonging to the members of Copiepresse, a trade group representing 17 Belgian newspapers. Google News uses a robot to search for content that it automatically indexes according to common categories on its website. Although newspaper headlines, snippets of text, and some thumbnail images are visible on Google’s website, to access a full story, visitors must click on a link that takes them to the newspaper’s own website. Google cache system also uses a robot that takes snapshots of webpages as they appear at specific points in time. The cached copies, which are stored on Google’s servers, are accessible via links appearing in search results. The court ruled in favor of Copiepresse and held that Google’s cached webpages and its reproduction and publication of headlines and snippets infringed owners’ copyrights. However, the court disagreed with Copiepresse’s contention that Google must obtain prior permission from copyright holders in order to display any portion of copyrighted webpages. According to the court, the onus is on copyright holders to contact Google to request removal of infringing material. Once notified, the search engine has 24 hours to remove the content or face a fine of €1,000 per day for each work allegedly infringed. (subscription required)

EXPERTS OFFER TIPS FOR AVOIDING BLOG LAWSUITS (Computerworld, 14 Feb 2007) -- As companies increasingly use blogs, wikis, podcasts and other Web 2.0 tools to form social networking sites for their customers, partners and employees, executives must keep track of the new medium’s myriad legal risks. Information posted on corporate blogs or wikis could prompt lawsuits charging the companies with libel, copyright infringement or trademark violations, according to several lawyers that specialize in technology issues. They said that notes posted on such sites could also violate securities laws. Dennis Kennedy, a St. Louis lawyer who specializes in IT issues, said that often companies often, and unwisely, treat emerging Web 2.0 technologies like “isolated new phenomena” that isn’t directly tied to corporate operations. “You need to look at what employees are doing ... in the context of your communications policy,” Kennedy added. Robert Clothier, an attorney at Fox Rothschild LLP in Philadelphia, noted that the legal risks associated with blogs are higher for posts written by a company’s employees than by those sent in by nonemployees. Companies are not likely to be sued for libel for posts on corporate blogs by outside users unless the company significantly alters the meaning of the content, said Clothier, who specializes in First Amendment issues. Clothier offers the following tips to avoid legal problems with forays into Web 2.0:
* Establish strict policies listing, which employees can post on a corporate blog, and what subjects they can write about.
* Assign an employee to monitor blogs to make sure that policies are followed.
* Discipline employees who violate the policies.
* Remove inaccurate blog items, and post a correction.
* Determine whether the company needs libel insurance, and if so, what kind. http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9011280&source=NLT_AM&nlid=1

U.K. COMPANY FINED OVER LAPTOP THEFT (CNET, 14 Feb 2007) -- Nationwide Building Society, a U.K. financial services provider, has been fined $1.9 million after a laptop containing sensitive customer data was stolen from an employee. The Financial Services Authority (FSA) hit Nationwide with the fine on Wednesday, following an investigation into the theft, which occurred in November 2006 at the employee’s house. According to the FSA, Nationwide was guilty of failing to have effective systems and controls in place to manage its information security risks. The FSA also discovered that Nationwide was not aware that the laptop contained confidential customer information and did not start an investigation until three weeks after the theft. “Firms’ internal controls are fundamental in ensuring customers’ details remain as secure as they can be and, as technology evolves, firms must keep their systems and controls up to date to prevent lapses in security,” said Margaret Cole, director of enforcement at the FSA. “The FSA took swift enforcement action in this case to send a clear, strong message to all firms about the importance of information security,” Cole added. http://news.com.com/2100-1029_3-6159349.html

CT SAYS ACCESS THAT EXCEEDS LICENSE BASIS FOR COPYRIGHT SUIT (BNA’s Internet Law News, 15 Feb 2007) -- BNA’s Electronic Commerce & Law Report reports that a federal court in California has ruled that a subscriber to a medical articles database who leveraged a single-user subscription to distribute to multiple persons copies of the licensed content may be liable for both copyright infringement and computer fraud. Case name is Therapeutic Research Faculty v. NBTY Inc.

NINTH CIRCUIT TAKES A MULLIGAN ON EMPLOYEE PRIVACY (Steptoe & Johnson’s E-Commerce Law Week, 15 Feb 2007) -- The Ninth Circuit last summer held in United States v. Ziegler that an employee had no reasonable expectation of privacy in his workplace computer where the employer had a policy and practice of regularly monitoring employees’ computer usage. Accordingly, it affirmed the district court’s denial of the employee’s motion to suppress evidence of child pornography seized by police from the employee’s workplace hard drive, even though that evidence was obtained by entering the employee’s locked private office. We criticized the court’s reasoning at the time, and suggested that the decision would have been on sounder footing if the court had based its judgment the employer’s consent to the search. Well, someone in chambers must be an ECLW fan, because on January 30 the Ninth Circuit panel rescinded its earlier opinion and issued a new one, reaching the same result but on the ground of employer consent. While some may think this decision is a big win for employee rights, in fact it is probably a more important victory for employers, since it preserves companies’ ability to control the terms of access to their network by both employees and the government. http://www.steptoe.com/publications-4252.html New 9th Circuit opinion at http://www.ca9.uscourts.gov/ca9/newopinions.nsf/1B9EE38656401781882572720080706B/$file/0530177.pdf?openelement

PRIVACY GROUPS HIT ISP DATA STORAGE BILL (InternetNews.com, 15 Feb 2007) -- Led by Rep. Lamar Smith of Texas, eight Republican U.S. House members have filed legislation that would give Attorney General Alberto Gonzales broad powers to require Internet service providers (ISPs) to retain customer data. Under the Internet Stopping Adults Facilitating the Exploitation of Today’s Youth Act of 2007 (SAFETY Act), the attorney general would be required to issue ISP data retention requirements, powers Gonzales has sought since last year as part of the Department of Justice’s (DoJ) campaign against online child pornography. According to the bill (H.R. 837), ISPs would be required to retain, at a minimum, subscriber names, addresses, telephone numbers and Internet protocol addresses to “permit compliance with court orders that may require production of such information.” The DoJ would determine the length of time the data must be retained. Most ISPs currently retain minimum customer data for six months or less. Gonzales has said he favors at least a two-year retention requirement. Privacy advocates worry that the vagueness of the bill’s language could allow the DoJ to expand upon the minimum data requirements to include more customer data such as most frequently visited websites, instant messages and e-mail correspondence. “This is a real First Amendment and privacy threat,” John Morris, director of Internet Standards at the Center for Democracy and Technology (CDT), told internetnews.com. “This proposal gives the attorney general unbounded discretion to create whatever data retention requirements he wants. There’s no restraint.” http://www.internetnews.com/bus-news/print.php/3660201

-- and --

JUSTICE DEPARTMENT TAKES AIM AT IMAGE-SHARING SITES (CNET, 2 March 2007) -- The Bush administration has accelerated its Internet surveillance push by proposing that Web sites must keep records of who uploads photographs or videos in case police determine the content is illegal and choose to investigate, CNET News.com has learned. That proposal surfaced Wednesday in a private meeting during which U.S. Department of Justice officials, including Assistant Attorney General Rachel Brand, tried to convince industry representatives such as AOL and Comcast that data retention would be valuable in investigating terrorism, child pornography and other crimes. The discussions were described to News.com by several people who attended the meeting. A second purpose of the meeting in Washington, D.C., according to the sources, was to ask Internet service providers how much it would cost to record details on their subscribers for two years. At the very least, the companies would be required to keep logs for police of which customer is assigned a specific Internet address. Only universities and libraries would be excluded, one participant said. “There’s a PR concern with including the libraries, so we’re not going to include them,” the participant quoted the Justice Department as saying. http://news.com.com/2100-1028_3-6163679.html

-- and --

EUROPE’S PLAN TO TRACK PHONE AND NET USE (New York Times, 20 Feb 2007) -- European governments are preparing legislation to require companies to keep detailed data about people’s Internet and phone use that goes beyond what the countries will be required to do under a European Union directive. In Germany, a proposal from the Ministry of Justice would essentially prohibit using false information to create an e-mail account, making the standard Internet practice of creating accounts with pseudonyms illegal. A draft law in the Netherlands would likewise go further than the European Union requires, in this case by requiring phone companies to save records of a caller’s precise location during an entire mobile phone conversation. Even now, Internet service providers in Europe divulge customer information — which they normally keep on hand for about three months, for billing purposes — to police officials with legally valid orders on a routine basis, said Peter Fleischer, the Paris-based European privacy counsel for Google. The data concerns how the communication was sent and by whom but not its content. But law enforcement officials argued after the terrorist bombings in Spain and Britain that they needed better and longer data storage from companies handling Europe’s communications networks. European Union countries have until 2009 to put the Data Retention Directive into law, so the proposals seen now are early interpretations. But some people involved in the issue are concerned about a shift in policy in Europe, which has long been a defender of individuals’ privacy rights. Under the proposals in Germany, consumers theoretically could not create fictitious e-mail accounts, to disguise themselves in online auctions, for example. Nor could they use a made-up account to use for receiving commercial junk mail. While e-mail aliases would not be banned, they would have to be traceable to the actual account holder. Mr. Fleischer said: “It’s ironic, because Germany is one of the countries in Europe where people talk the most about privacy. In terms of consciousness of privacy in general, I would put Germany at the extreme end.” In the Netherlands, the proposed extension of the law on phone company records to all mobile location data “implies surveillance of the movement of large amounts of innocent citizens,” the Dutch Data Protection Agency has said. The agency concluded in January that the draft disregarded privacy protections in the European Convention on Human Rights. Similarly, the German technology trade association Bitkom said the draft there violated the German Constitution. Internet and telecommunications industry associations raised objections when the directive was being debated, but at that time their concerns were for the length of time the data would have to be stored and how the companies would be compensated for the cost of gathering and keeping the information. The directive ended up leaving both decisions in the hands of national governments, setting a range of six months to two years. The German draft settled on six months, while in Spain the proposal is for a year, and in the Netherlands it is 18 months. http://www.nytimes.com/2007/02/20/business/worldbusiness/20privacy.html?ex=1329627600&en=7c382d290b81c578&ei=5090&partner=rssuserland&emc=rss

GOOGLE FIGHTS FOR RIGHT TO USE TRADEMARKED SEARCH KEYWORDS (Information Week, 15 Feb 2007) -- Is Google guilty of trademark infringement when one of its advertisers purchases a competitor’s trademark as a search keyword that triggers its ad, even though Google doesn’t present the trademarked term in the ad itself? That’s a question Google and Rescuecom has been litigating since September 2004. In September 2006, the judge in the case granted Google’s motion to dismiss, but Rescuecom appealed. Earlier this week, Google filed a brief in the ongoing case that makes a clear and compelling argument for why Google’s sale of trademarked search keywords as ad triggers is legitimate. Michael H. Page, an attorney representing Google on behalf of Keker & Van Nest LLP, asserts that businesses associate their products with competitors all the time and that doing so doesn’t create confusion in the minds of consumers -- which is what trademark law aims to prevent. “Generic brands are placed next to known brands on store shelves for the express purpose of diverting customers from the brand they are seeking to another, and their manufacturers pay for that placement,” explains Page in the brief. “Advertisers deliberately select magazine ad placements next to articles about their competitors. ... All manner of companies pay for coupon placements selected based on a customer’s purchase of their competitors’ products. And so on. Of course they are seeking to ‘hijack’ or ‘divert’ consumers who have indicated an interest in their competitors’ products. That’s the point of contextual advertising -- to target ads at consumers who are actively interested in your type of product, rather than indiscriminately at the world at large.” But none of these examples, Page points out, falsely identifies the source of goods or services and thus does not represent a violation of trademark law. Google isn’t using the term “Rescuecom” as actual text in its ads. It’s merely allowing advertisers to be seen when a searcher is inquiring about a competitor. Rescuecom’s counterargument doesn’t quite seem so strong. Rescuecom’s attorney, Edmund J. Gegan, suggests that consumers inured to cutthroat competition at the mall are essentially clueless online and see no distinction between paid placement on a search results page and organic search results. http://www.informationweek.com/showArticle.jhtml?articleID=197006579&articleID=197006579 Google’s brief at http://blog.ericgoldman.org/archives/2007/02/rescuecom_v_goo_1.htm

NIST RELEASES INFO SECURITY DOCUMENTS (Government Computer News, 16 Feb 2007) -- The National Institute of Standards and Technology has published two new interagency reports designed to help auditors, inspectors general and senior management understand and evaluate information security programs. NISTIR 7359, titled “Information Security Guide for Government Executives,” is an overview of IT security concepts that senior management should grasp. NISTIR 7358, titled “Program Review for Information Security Management Assistance (PRISMA),” lays out a standardized approach for measuring the maturity of an information security program. PRISMA is a methodology developed by NIST for reviewing complex requirements and posture of a federal information security program. It is intended for use by security personnel, as well as internal reviewers, auditors and IGs. Tools laid out in NISTIR 7358 should help identify program deficiencies, establish baselines, validate corrections and provide supporting information for Federal Information Security Management Act scorecards. It gives a maturity level in nine primary topic areas:
* Information security management and culture
* Information security planning
* Security awareness, training and education
* Budget and resources
* Life cycle management
* Certification and accreditation
* Critical infrastructure protection
* Incident and emergency response
* Security controls
http://www.gcn.com/online/vol1_no1/43141-1.html?topic=security&CMP=OTC-RSS
Reports at http://csrc.nist.gov/publications/nistir/ir7359/NISTIR-7359.pdf and http://csrc.nist.gov/publications/nistir/ir7358/NISTIR-7358.pdf

VIEWERS FAST-FORWARDING PAST ADS? NOT ALWAYS (New York Times, 16 Feb 2007) -- People with digital video recorders like TiVo never watch commercials, right? It turns out that a lot of people with digital video recorders are not fast-forwarding and time-shifting as much as advertisers feared. According to new data released yesterday by the Nielsen Company, people who own digital video recorders, or DVRs, still watch, on average, two-thirds of the ads. One big reason is that many people with DVRs still tune in to watch about half of their shows at the scheduled start time, meaning they must sit through commercials. And even when people watch recorded shows later, many are not fast-forwarding through the ads. On average, Nielsen found, DVR owners watch 40 percent of commercials that they could skip over — perhaps because they like ads, don’t mind them or simply can’t be bothered. “People are actually playing back more of the commercials than we thought,” said Steve Sternberg, executive vice president and director of audience analysis at Magna Global Media Research, an ad-buying agency. “People are buying DVRs not because they want to time-shift all of their viewing and skip all commercials, but because they want to time-shift some of their viewing.” While the new data may well be fodder for cocktail party chatter, it also has major financial implications. Largely because many advertisers thought that people with DVRs were not watching their ads, they have not been paying for time-shifted viewing on DVRs. Now the networks could use the new information to try to charge more. And advertisers may begin pressing networks to rethink commercial breaks — maybe making them shorter. http://www.nytimes.com/2007/02/16/business/16commercials.html?ex=1329282000&en=ac19fdde5f3cdef3&ei=5090&partner=rssuserland&emc=rss

DRIVER’S LICENSE EMERGES AS CRIME-FIGHTING TOOL, BUT PRIVACY ADVOCATES WORRY (New York Times, 17 Feb 2007) -- On the second floor of a state office building here, upstairs from a food court, three facial-recognition specialists are revolutionizing American law enforcement. They work for the Massachusetts motor vehicles department. Last year they tried an experiment, for sport. Using computerized biometric technology, they ran a mug shot from the Web site of “America’s Most Wanted,” the Fox Network television show, against the state’s database of nine million digital driver’s license photographs. The computer found a match. A man who looked very much like Robert Howell, the fugitive in the mug shot, had a Massachusetts driver’s license under another name. Mr. Howell was wanted in Massachusetts on rape charges. At least six other states have or are working on similar enormous databases of driver’s license photographs. Coupled with increasingly accurate facial-recognition technology, the databases may become a radical innovation in law enforcement. Other biometric databases are more useful for now. But DNA and fingerprint information, for instance, are not routinely collected from the general public. Most adults, on the other hand, have a driver’s license with a picture on it, meaning that the relevant databases for facial-recognition analysis already exist. And while the current technology requires good-quality photographs, the day may not be far off when images from ordinary surveillance cameras will routinely help solve crimes. Critics say the databases may therefore also represent a profound threat to privacy. “What is the D.M.V.?” asked Lee Tien, a lawyer with the Electronic Frontier Foundation and a privacy advocate. “Does it license motor vehicles and drivers? Or is it really an identification arm of law enforcement?” Anne L. Collins, the Massachusetts registrar of motor vehicles, said that people seeking a driver’s license at least implicitly consent to allowing their images to be used for other purposes. The databases are primarily intended to prevent people from obtaining multiple licenses under different names. That can help prevent identity theft and stop people who try to get a second license after their first has been suspended. “We don’t look at hair,” Ms. Conlon said. “We do look at lips, noses, ears.” The database’s second function, as a resource for law enforcement agencies, is growing in popularity. Police chiefs from around the state e-mail digital photographs for comparison with the database, sometimes several times a day. Other sorts of images are not useful — yet. “A video surveillance camera is probably not going to give it to you,” Mr. Smith said. In time, though, the combination of facial recognition and other information — from financial records, mobile phones, automobile positioning devices and other sources — may do away with the ability to move anonymously through the world, Mr. Tien, the privacy advocate, said. “The real question with biometrics,” he said, “is that they are part of a cluster of technologies that will allow for location tracking in both public and private places.” http://www.nytimes.com/2007/02/17/us/17face.html?ex=1329368400&en=8782b7320b2e7a40&ei=5090&partner=rssuserland&emc=rss

BROADBAND ADOPTION PASSES HALFWAY MARK IN U.S. (CNET, 18 Feb 2007) -- U.S. residential broadband penetration is expected to exceed 50 percent in 2007--and the U.K. isn’t far behind. By the end of 2007, more than 60 million U.S. households will be connected--around 55 percent--according to market researcher Parks Associates. During 2006, broadband subscriptions grew by more than 20 percent in the U.S. and by the end of the year around 50 million households had fat pipes. The U.K. isn’t far behind, though, as around 49 percent of households have a broadband connection, according to Point Topic figures from the third quarter of 2006. In Europe there are still large discrepancies in broadband penetration rates that are exacerbating the digital divide. Residential broadband uptake varies from 73 percent in Iceland to 1.4 percent in Moldova. Worldwide, the country with the greatest residential broadband connectivity is South Korea. More than 88 percent of Korean households had a broadband connection by the third quarter of last year. http://news.com.com/2110-1034_3-6160422.html

EBAY FIGHTS PLAN TO REPORT USERS TO IRS (Financial Times, 19 Feb 2007) -- Ebay is fiercely resisting a Bush administration plan it says will force it to snitch on customers who are not paying tax on billions earned on the popular online auction site. The Treasury estimates it could collect $2bn in unpaid tax if companies such as eBay reported American users who carry out more than 100 transactions worth at least $5,000 a year to the Internal Revenue Service. But an eBay spokesperson said: “We do not believe it is our responsibility to serve as the go-between. We believe that it is the seller’s responsibility.” The company pointed out that many users file self-employment and business tax returns based on their eBay income. Ebay said it would co-operate with IRS investigations into specific persons but would not voluntarily report its customers’ sales “en masse”. http://www.ft.com/cms/s/33e0a1e0-c026-11db-995a-000b5df10621,_i_rssPage=81cea682-52a8-11da-8d05-0000779e2340.html

LEGAL DEPARTMENTS TELL FIRMS: GET ON THE TECH TRAIN (Law.com, 21 Feb 2007) -- When Aon Corp. slashed its outside counsel roster from about 400 to 23 law firms in 2005, it quizzed the firms about their tech offerings. “We asked them about extranets, e-billing and litigation management,” says David Cambria, director of legal operations at the Chicago-based insurance giant. But Cambria says that he didn’t really care whether firms had all of those products. He had another agenda: “I wanted to know if [the firms] were playing in the same pool as me,” says Cambria. When they crafted the tech section of their request for proposal, Cambria and his colleagues started from the assumption that all the firms they were interviewing had experienced, capable lawyers. But “we wanted to take it to a higher level, and the most successful firms were the ones that told us how they’d help us do what we do better, with technology,” he says. What’s changed? Traditionally a cost center, legal departments have come under increasing pressure to keep costs down at the same time that they’re struggling to keep their technology current. “General counsel are being held to budgets,” says Woods Abbott, senior manager of legal operations-corporate at Raytheon Co. This year’s survey, our fourth in which we queried the technology heads of Fortune 500 corporations, shows that in many respects, law departments have had a technical awakening, and finally are getting the goodies everyone else in corporate America takes for granted. http://www.law.com/jsp/ihc/PubArticleIHC.jsp?id=1171965782119

MUSIC COMPANIES TARGET COLLEGES IN LATEST DOWNLOADING CRACKDOWN (SiliconValley.com, 21 Feb 2007) -- Cracking down on college students, the music industry is sending thousands more complaints to top universities this school year than it did last year as it targets music illegally downloaded over campus computer networks. A few schools, including Ohio and Purdue universities, already have received more than 1,000 complaints accusing individual students since last fall -- significant increases over the past school year. For students who are caught, punishments vary from e-mail warnings to semester-long suspensions from classes. The trade group for the largest music labels, the Recording Industry Association of America, identified at the request of The Associated Press the 25 universities that received the most copyright complaints it sent so far this school year. The trade group long has pressured schools to act more aggressively against online pirates on campus. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16746514.htm

VIRTUAL CHILD PORN MAY BE A CRIME IN NETHERLANDS (CNET, 21 Feb 2007) -- Virtual enactments of child pornography may be a crime under Dutch law if it encourages child abuse, the public prosecutor said Wednesday. In the virtual world of Second Life, a popular Internet destination, everyone under the age of 18 is supposed to be limited to a “teen grid.” However, it would be relatively easy for children to get onto the adult grid if they wished since there is no proof of age required. In the adult section, some users participate in “age play,” in which adult users can create child-like characters and have virtual sex that would be illegal in the real world. “There are possibilities to prosecute because it possibly incites child abuse,” said Kitty Nooij, the spokesman for public prosecutor, who is in charge of national vice cases. With the increasing popularity of virtual worlds, there are fears people may turn to them to carry out activities considered illegal in the real world. There is no Dutch case law about virtual child pornography in writing, drawings or computer animation. In the United States, where Second Life creator Linden Lab is based, the U.S. Supreme Court struck down a law in 2002 which would ban computer-generated images that depict minors engaged in sexual conduct. http://news.com.com/2100-1028_3-6161025.html

FLA. BAR OKS CLIENT TESTIMONIALS ON LAW FIRM WEB SITES (Law.com, 22 Feb 2007) -- After nearly four years of debate, The Florida Bar board of governors has tentatively approved a proposed rule on law firm Web sites that would let lawyers publish client testimonials and claims about their past successes. The proposed rule would largely free law firm Web sites from the state’s restrictive rules governing lawyer advertising in such media as television, radio, direct mail and Yellow Pages. But lawyer Web sites still would have to comply with general Bar rules regarding truthfulness and lack of deception. The proposal still must be passed by the board of governors in a second reading and approved by the Florida Supreme Court. Under the proposed rule approved late last month, the inside pages of law firm Web sites -- but not the home page -- could include testimonials, references to past results and statements characterizing the quality of the services, as long as the statements are truthful, not misleading and come with disclaimers. The disclaimers must say that past results do not guarantee a future success. http://www.law.com/jsp/article.jsp?id=1172052183457&rss=newswire

RAISING, AND LOWERING, THE BAR ON CELL PHONE PRIVACY (Steptoe & Johnson’s E-Commerce Law Week, 22 Feb 2007) -- When can police search an electronic communications device that is owned by an employer, but is used daily by an employee? As we previously reported, the Ninth Circuit’s recent ruling in United States v. Ziegler left open the possibility that, given an employer’s policy of monitoring computer use, the user of a computer kept in a common space might not have a reasonable expectation of privacy in the device. But, in United States v. Finley, the Fifth Circuit recently found that an employee “had a reasonable expectation” that the call records and text messages on his cell phone would remain private from law enforcement and the general public, even though his employer owned the phone and could have read the messages on it after it was returned. Nonetheless, because the government’s search of the phone was conducted incident to a lawful custodial arrest, the court concluded that no search warrant was required and the search was “reasonable” under the Fourth Amendment. Combined with recent cases holding that Customs agents at the border can search the contents of a laptop with little or no reason, this case suggests that when the government wants to “reach out and touch someone,” it can reach the content on one’s electronic gadgets, too. http://www.steptoe.com/publications-4265.html Finley case at http://www.ca5.uscourts.gov/opinions%5Cpub%5C06/06-50160-CR0.wpd.pdf

FEDERAL COURT REAFFIRMS IMMUNITY OF BLOGGERS FROM SUITS BROUGHT AGAINST COMMENTERS (ACS blog, 26 Feb 2007) -- Section 230 of the Communications Decency Act provides that “[no] provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider,” and that “[n]o cause of action may be brought and no liability may be imposed under any State or local law that is inconsistent with this section.” A recent decision of the First Circuit has reaffirmed the broad protection this statute provides to bloggers and message board administrators. In Universal Communication Systems v. Lycos, a company who had allegedly been victimized by defamatory statements on a message board regarding the value of its stock sued Lycos, which operated the board. The message board allowed users to post comments with minimal moderation, and no one from Lycos was responsible for the allegedly defamatory statements. Examining the impact of Sec. 230 on this case, the court noted that “Congress intended that, within broad limits, message board operators would not be held responsible for the postings made by others on that board,” adding that allowing bloggers and message board operators to be sued for the statements of commenters on their sites would have an “obvious chilling effect” on speech. Accordingly, the court dismissed the complaint against Lycos. http://www.acsblog.org/economic-regulation-employment-federal-court-reaffirms-immunity-of-bloggers-from-suits-brought-against-commenters.html Opinion at http://www.ca1.uscourts.gov/pdf.opinions/06-1826-01A.pdf

ADDING TO SECURITY BUT MULTIPLYING THE FEARS (New York Times, 26 Feb 2007) -- Foreigners arriving at the American border must present both index fingers for fingerprinting, but that will soon change. The Department of Homeland Security now wants 10 fingers. The two-print system was largely a biometric backup, an added level of security to supplement and verify a passport or a visa. The 10-print system adds a powerful investigative tool. “When we have a fingerprint of a terrorist who has left behind a bomb or an I.E.D. in Iraq or has left his fingerprint in a safe house somewhere, we don’t always have the two index fingers,” Paul Rosenzweig, a Department of Homeland Security official, said at a briefing in December. “It could be the pinkie or the thumb. And thus by moving to a 10-print system, we will enhance our ability to use biometrics to enable us to identify threats before they occur in the United States.” Call it biometric mission creep. People concerned about privacy and civil liberties say they fear the creation of gigantic biometric databases ripe for data-mining abuse. They note that Mr. Rosenzweig was a supporter of the Total Information Awareness program at the Defense Department, which had planned, as the Pentagon put it, to create “ultralarge all-source information repositories.” The program was shut down in 2003 because it scared people. The administration’s last-ditch defense of that effort was telling, too. It changed the name to the Terrorism Information Awareness program. There is a pattern here, said Marc Rotenberg, the executive director of the Electronic Privacy Information Center. “These techniques that are sold to us as necessary to identify terrorists inevitably become systems of mass surveillance directed at the American people,” Mr. Rotenberg said.

****RESOURCES****
BADWARE WEBSITE CLEARINGHOUSE (stopbadware.org) -- Badware doesn’t just appear on users’ computers out of thin air - instead, much of it (maybe even most of it) is hosted on websites that then distribute it to consumers who visit those sites. Given the importance of websites as a means of spreading badware to unsuspecting users, StopBadware.org has expanded our mission to include shining a light on websites themselves, not just on the applications they host for download. In that vein, we’ve launched the Badware Website Clearinghouse -- a collaborative effort to build a comprehensive list of websites that host, link to, or otherwise distribute badware. Websites can host or distribute badware in a variety of ways. They may be sites that intentionally distribute bad applications for profit; or sites featuring ads, often provided by third parties, that - if clicked on - will attempt to automatically install harmful software; or sites that have been hacked and can download dangerous code onto visitors’ computers without the site owner even knowing the badware is there; and a whole range of sites in between. For a comprehensive definition of what constitutes a badware website, check out our Website Guidelines. Although the list of websites in this Clearinghouse is hosted by StopBadware.org, we’re not the only ones contributing to it. This list contains both websites that StopBadware itself has tested and found to contain badware or badware links, as well as thousands of sites that trusted third parties have independently examined, found to be hosts or distributors of badware, and provided to us for posting. Sites that StopBadware has tested itself and determined to contain or link to badware are marked with a [Red_smaller]; sites marked with a [Undetermined_smaller] were reported to StopBadware by one or more trusted third parties whose name(s) appear in a separate column to the left of the site’s url. http://stopbadware.org/home/clearinghouse

WIKIS FOR THE LEGAL PROFESSION (ABA Law Practice Management, Feb 2007) -- If you hang around lawyers talking about “Web 2.0” long enough or read our articles, the word “wiki” is eventually bound to pop out. In fact, it’s hard to have a discussion about Web 2.0 and the new Internet technologies without discussing wikis; they may be one of the oldest tools of the Web 2.0 phenomenon. It’s also a safe bet that few of you reading this article have any real experience with using a wiki, or how a wiki might be useful to the practicing lawyer. Why should lawyers use wikis? They may help lawyers both as consumers and as producers. Most lawyers will get the most value from using wikis created by others. The classic example is the Wikipedia. Wikis can be seen as constantly updated collections of useful information arranged in an encyclopedic or similarly organized way, with hyperlinks to related internal and external information. On the producer side, perhaps the greatest potential of the wiki tool for lawyers is its use as a collaborative tool or even an information or knowledge platform, especially as a way to gather and manage “unstructured” information easily and quickly. The key feature of wikis in this regard is that multiple authors and editors are able to work together to create a collection of information or even collaborative documents. This month The Strongest Links focuses on wikis. We’ve scoured the Net for some of the best links on wikis -- we’ll discuss and point you to resources about what a wiki is and how it works, how to pronounce “wiki,” how a lawyer can use one in his or her practice, and how this tool is an extremely powerful platform for collaborating with others on the Internet…. http://www.abanet.org/lpm/lpt/articles/slc02071.shtml

SOURCES:
1. The Filter, a publication of the Berkman Center for Internet & Society at Harvard Law School, http://cyber.law.harvard.edu.
2. Edupage, http://www.educause.edu/pub/edupage/edupage.html.
3. SANS Newsbites, sans@sans.org.
4. NewsScan and Innovation, http://www.newsscan.com.
5. Internet Law & Policy Forum, http://www.ilpf.org.
6. BNA’s Internet Law News, http://ecommercecenter.bna.com.
7. Crypto-Gram, http://www.schneier.com/crypto-gram.html.
8. McGuire Wood’s Technology & Business Articles of Note, http://tinyurl.com/ywsusp
9. Steptoe & Johnson’s E-Commerce Law Week, www.steptoe.com
10. Readers’ submissions, and the editor’s discoveries.

PRIVACY NOTICE: E-mail addresses of individuals who subscribe to this periodic e-newsletter by sending email to Vince Polley with “MIRLN” in the subject line are kept by Vince Polley; this listing will not be provided to any other persons.

MIRLN -- Misc. IT Related Legal News [20 January – 10 February 2007; v10.02]

**************Introductory Note**********************

MIRLN (Misc. IT Related Legal News) is a free product of the American Bar Association’s Cyberspace Law Committee and Dickinson Wright PLLC. Please feel free to distribute this message. Dickinson Wright’s IT & Security Law practice group is described at http://tinyurl.com/joo5y.

Members of the ABA Cyberspace Law Committee automatically receive MIRLN postings (about every third week); members can manage their subscriptions at http://www.abanet.org/dch/committee.cfm?com=CL320000 (find the “Listserves” box; MIRLN comes through the CLCC-MEMS listserve). Others who wish to be added to the MIRLN distribution list should send email to Vince Polley with the word “MIRLN” in the subject line, and similarly will be removed from the distribution list after sending email to Vince with the words “MIRLN REMOVAL” in the subject line.

Recent MIRLN editions are archived at www.vip-law.com and blogged at http://mirln.blogspot.com/.

**************End of Introductory Note***************

IT DEALS SURGE TO HIGHEST LEVEL IN 6 YEARS (FT, 21 Jan 2007) -- Global merger and acquisition levels in the technology sector broke through the €100bn barrier in 2006, for the first time since the height of the dotcom boom in 2000. According to figures published on Monday by PriceWaterhouseCoopers, merger and acquisition values were boosted by 18 mega deals, transactions with a value of more than €1bn. The largest of these was the €11.1bn merger of France’s Alcatel with Lucent Technologies of the US. The number of top level deals was up from 14 in 2005. Aggressive bids from private equity investors also helped boost deal values in 2006. The second largest tech deal of the year was the €7.4bn acquisition of Philips Semiconductor by an investment group fronted by Kohlberg Kravis Roberts. http://www.ft.com/cms/s/96b8ec14-a965-11db-9185-0000779e2340,_i_rssPage=81cea682-52a8-11da-8d05-0000779e2340.html

-- and --

SIX WAYS TO PROTECT YOUR SYSTEMS IN A MERGER (ComputerWorld, 16 Jan 2007) -- Mergers and acquisitions present extra challenges for IT network security. Inevitably, a merger combines security organizations with different security philosophies, policies, technologies and needs. “If one company has a policy that all security needs to stay in-house and the other has outsourced its security apparatus, obviously they have a conflict,” says Chris Ellerman, national security practice director at Dimension Data North America. And that presumes that the merging organizations are in the same vertical industries. When the merger crosses verticals, the differences can be even greater and in some cases aren’t completely reconcilable. “I’ve seen mergers that resulted in two divisions permanently operating on different security levels on a single IT backbone due to the requirements of their vertical industries,” Ellerman said. Ellerman offered the following tips for organizations that are either preparing for possible mergers in the coming year or are now involved in a merger process… http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9008080&source=NLT_SEC&nlid=38

TECH FIRMS, RIGHTS GROUPS TO FORM WEB CONDUCT CODE (CNET, 19 Jan 2007) -- Technology companies Microsoft, Google, Yahoo and Vodafone are in talks with human rights and press freedom groups to draw up an Internet code of conduct to protect free speech and privacy of Web users. The parties said in a statement Friday that they aim to produce a code by the end of this year that would counter such trends as the increased jailing of Internet journalists, monitoring of legitimate online activity, and censorship. Talks are being led by the Washington-based Center for Democracy and Technology and San Francisco nonprofit Business for Social Responsibility. They are trying to craft a code to hold companies accountable if they cooperate with governments to suppress free speech or violate human rights. “Technology companies have played a vital role building the economy and providing tools important for democratic reform in developing countries,” said Leslie Harris, executive director of the Center for Democracy and Technology. “But some governments have found ways to turn technology against their citizens--monitoring legitimate online activities and censoring democratic material,” Harris said. http://news.com.com/2100-1025_3-6151708.html

AFTER COURT CHALLENGE TO GOOGLE, BELGIAN NEWSPAPERS TAKE ON YAHOO (SiliconValley.com, 19 Jan 2007) -- A group of Belgian newspapers has asked Yahoo! Inc. to remove links to their archived stories from its Web search service, claiming they infringe copyright laws, their lawyers confirmed Friday. The move follows a legal challenge by the group against Google Inc. that has seen Belgian newspaper content stripped from Google News pending a court ruling expected early this year. In a statement, Yahoo! France insisted it “respects the copyright of content owners” and said it would “respond in an appropriate manner” to the complaint. The legal warning was sent to Yahoo! France by lawyers acting for Copiepresse, a copyright protection group representing 19, mostly French-language, newspapers. They complain that the search engine’s “cached” links offered free access to archived articles that the papers usually sell on a subscription basis. http://www.siliconvalley.com/mld/siliconvalley/business/technology/16499279.htm

GAMBLING SUBPOENAS ON WALL ST. (New York Times, 21 Jan 2007) -- The Justice Department has issued subpoenas to at least four Wall Street investment banks as part of a widening investigation into the multibillion-dollar online gambling industry, according to people briefed on the investigation. The subpoenas were issued to firms that had underwritten the initial public offerings of some of the most popular online gambling sites that operate abroad. The banks involved in the inquiry include HSBC, Credit Suisse, Deutsche Bank and Dresdner Kleinwort, these people said. While online gaming sites like PartyGaming and 888 Holdings operate from Gibraltar and their initial public offerings were held on the London Stock Exchange, companies that do business with them and have large bases in United States have come under scrutiny by regulators in Washington. None of the biggest United States banks like Goldman Sachs or Citigroup underwrote the initial public offerings in London, in part because of the legal ambiguity of the sites; they are illegal in the United States, but still accessible to residents. The subpoenas, earlier reported by The Sunday Times of London, appeared to be part of an indirect but aggressive and far-reaching attack by federal prosecutors on the Internet gambling industry just two weeks before one of its biggest days of the year, the Super Bowl. The prosecutors may be emboldened by a law signed by President Bush last October that explicitly defined the illegality of running an Internet casino. “It appears that the Department of Justice is waging a war of intimidation against Internet gambling,” said I. Nelson Rose, a professor of law at Whittier Law School in Costa Mesa, Calif., who is an expert on Internet gambling law. Another lawyer, Lawrence G. Walters of Altamonte Springs, Fla., said the development was disconcerting because the prevailing wisdom had been that investment in a company that is legal and licensed in its jurisdiction was not grounds for prosecution. But he cautioned that the subpoenas could be part of a government fact-finding effort and might not signal a plan to prosecute banks. http://www.nytimes.com/2007/01/22/business/22gaming.html?ex=1327122000&en=952d8b02cee0a300&ei=5090&partner=rssuserland&emc=rss

ITALIAN COURT RULES DOWNLOADING ISN’T A CRIME IF NOT FOR PROFIT (SiliconValley.com, 22 Jan 2007) -- Italy’s top criminal court has ruled that downloading music, movies and software over the Internet isn’t a crime if profit wasn’t the motivation, though analysts questioned Monday whether the ruling would have much effect on copyright laws. The court’s decision, issued earlier this month but reported over the weekend by the Italian media, overturns earlier convictions against two former Turin Polytechnic Institute students who set up in 1994 a peer-to-peer, file-sharing network that was shut down within months. They were found guilty of illegal duplication and given a one-year sentence, which was reduced to three months on appeal, defense lawyer Carlo Blengino said. The top criminal court in Rome threw out the convictions, ruling that it was not a crime to download computer files from such networks if there was no financial gain. But analysts said violating a copyright, for example by breaking copy-protection technologies in place, remained illegal even if downloading the material had been decriminalized. ``I consider this sentence as a very intermediate step in clarifying what is legal and what is not legal,” said analyst Carlo Alberto Carnevale Maffe, the president of Assodigitale, a think-tank on digital technology. ``This sentence marks an important step in that peer-to-peer per se is not an illegal activity. What stays and remains illegal is copyright infringement by cracking copyright files, and distributing it for commercial purposes.” http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16520198.htm

E-MAIL FROM THE GRAVE? MICROSOFT SEEKS PATENT ON ‘IMMORTAL COMPUTING’ (Seattle PI, 22 Jan 2007) -- In this culture of instant information, some Microsoft Corp. researchers are pursuing a radical notion -- the concept of saving messages for delivery in decades, centuries or more. The project, dubbed “immortal computing,” would let people store digital information in physical artifacts and other forms to be preserved and revealed to future generations, and maybe even to future civilizations. After all, when looking that far in the future, you never know who the end users might be. One scenario the researchers envision: People could store messages to descendants, information about their lives or interactive holograms of themselves for access by visitors at their tombstones or urns. And here’s where the notion of immortality really kicks in: The researchers say the artifacts could be symbolic representations of people, reflecting elements of their personalities. The systems might be set up to take action -- e-mailing birthday greetings to people identified as grandchildren, for example. The previously undisclosed project came to light through a newly surfaced patent application in which the researchers explain some of the concepts they’re exploring. The project seeks to address the fact that large amounts of valuable information are stored on media with limited life spans, in formats that could be rendered obsolete. Consider how quickly floppy disks disappeared. But the researchers aren’t just thinking about the informational legacies of individuals. “Maybe we should start thinking as a civilization about creating our Rosetta stones now, along with lots of information, even going beyond personal memories into civilization memories,” said Eric Horvitz, a Microsoft principal researcher who also is working on the project. http://seattlepi.nwsource.com/business/300636_msftimmortal22.html

APPEALS COURT RULING FAVORS PRIVACY FOR INTERNET USERS (NJ.com, 23 Jan 2007) -- In the first ruling of its kind in New Jersey, a state appeals court said yesterday computer users can expect the personal information they give their Internet provider will be considered private. A three-judge panel said a computer user whose screen name hid her identity has a “legitimate and substantial interest in anonymity.” The court based its decision in a Cape May County computer crime case on the state Constitution, recognizing a right to “informational privacy.” “This is terrific,” said Grayson Barber, a Princeton-based attorney and privacy advocate. She said the appeals court essentially updated a 1967 U.S. Supreme Court ruling that found a person conducting illegal gambling in a closed telephone booth had a right to expect privacy. “What this means is that under the state Constitution law enforcement and Internet service providers cannot just randomly listen in on Internet communications,” Barber said. “They must have some kind of subpoena or warrant before they can gather information to use against somebody.” http://www.nj.com/news/ledger/jersey/index.ssf?/base/news-6/1169534953304830.xml&coll=1 [Editor: This also might affect a body of law that has found lowered/non-existent privacy entitlements to information shared with other third-parties, such as financial institutions. See Steptoe analysis here: http://www.steptoe.com/publications-4221.html]

-- and --

PARENTS PREVAIL OVER BIG BROTHER IN FIGHT OVER KIDS’ IDENTITIES (Steptoe & Johnson’s E-Commerce Law Week, 3 Feb 2007) – [A] federal court in Connecticut recently held that parents have a constitutionally protected privacy interest in their children’s identity. In Securities Industry and Financial Markets Association v. Garfield, the court granted the plaintiff Association’s motion for a preliminary injunction barring the Connecticut State Elections Enforcement Commission (SEEC) from posting the names of state contractors’ dependent children to a public website, as required under a Connecticut campaign finance reform law. The court reasoned that the Association was likely to succeed in showing that the required posting of children’s names violated parents’ “fundamental right to privacy” under the U.S. Constitution. While the decision does not directly affect web site operators or e-commerce companies, it does reflect a growing desire by courts to establish some limit to the widespread disclosure of personal information over the Internet. And though limited to the identity of children, the court’s reasoning could be used to justify protection of other information courts deem to be “personal” based on the risk of harm, embarrassment, or just plain “discomfort” that disclosure might cause someone. http://www.steptoe.com/publications-4221.html Case at http://www.steptoe.com/assets/attachments/2841.pdf

NEW NEW YORK RULES ON LAWYER ADVERTISING (ABA e-news, 23 Jan 2007) -- On January 4, 2007, the New York State Unified Court System adopted several amendments to the advertising rules in Canon 2 of the New York Code of Professional Responsibility (hereinafter the Code) that are due to take effect on February 1, 2007. Many of these amendments relate to lawyer advertising on the Internet. A redlined version of Canon 2 showing the amendments is located here: http://www.nysba.org/Content/ContentGroups/Announcements/RedlinedAdvertisingAmendments010407.pdf, and a memorandum produced by the New York State Bar Association highlighting the significant changes is located here: http://www.nysba.org/Content/ContentGroups/Announcements/Advertisingamendmentssynopsis.pdf. At the outset, the new Code sections provide definitions of advertisements and “computer accessed communications.” An advertisement is defined as any public or private communication made by or on behalf of a lawyer or law firm where the primary purpose is the retention of the lawyer or law firm. It specifically exempts communications to existing clients or to other lawyers. A computer accessed communication encompasses: “...any communication made by or on behalf of a law firm that is disseminated through the use of a computer device including but not limited to websites, weblogs, search engines, electronic mail, banner advertisements, pop-up and pop-under advertisements, chat rooms, list servers, instant messaging, or other internet presences and any attachments or links related thereto.” DR 2-101(g) of the Code states that a lawyer shall not use a pop-up or pop-under advertisement in connection with computer accessed communications, other than on the lawyer’s own website or other internet presence or any meta tags (keywords that represent the web page’s content), that would violate a disciplinary rule if displayed. DR 2-101 (k) states that a lawyer must keep copies of all advertisements for three years following its initial dissemination. Any advertisement contained in a computer accessed communication must be retained for one year. “A copy of the contents of any website deemed to be an advertisement ...shall be preserved upon the initial publication of the web site, any major web site redesign, or a meaningful and extensive content change, but in no event less frequently than once every 90 days.” http://www.abanet.org/media/youraba/200701/article10.html

ONLINE NORDIC BANKING THEFT STIRS TALK OF RUSSIAN HACKER (New York Times, 25 Jan 2007) -- Word has started spreading in Sweden about the discovery last week of a $1 million online banking theft traced to a Russian hacker who goes by the sobriquet “the Corpse.” The case opens a window into the dark world of Russian programming and underlines risks in online banking. Nordea Bank, the Scandinavian financial services company involved, emphasized that only customers whose computers were not protected by antivirus programs had become victims. The Swedish police said the virus was distributed with spam e-mail and programmed to infiltrate home computers of customers at several European and American banks. Police officers have arrested Swedish nationals and foreigners who withdrew cash from Nordea branches after making online transfers. The Corpse’s identity is unknown to computer virus specialists. The virus in question, a so-called Trojan horse program, surreptitiously logged keystrokes while banking customers entered their passwords. The police identified the program as a variant of the Haxdoor Trojan. The Corpse is thought to be the author of the original Haxdoor program and several iterations, under names including A311 Death and Nuclear Grabber. Those are offered for sale on a Russian Web site at prices ranging from several hundred dollars to several thousand dollars, depending on the version. Thieves using the program in Sweden defrauded 250 customers of Nordea’s online banking service over a period of 15 months. The bank has compensated its clients. The case has drawn new attention to the bizarre world of Russian hacking. Russia’s weak laws and a strong tradition of scientific education have combined to create a flourishing culture of computer hacking, specialists in the programming industry say. The prevalence of pornography and fraud on the Russian Internet has contributed to the country’s image as a digital Wild West of spammers and hackers. And foiling Western banking security resonates with Russian programmers, technology specialists say. Russian hackers are driven by “curiosity, greed or the desire to prove they are clever,” said Denis Kalinin, chief executive of Rambler, a successful Russian search engine company. This latest version of the Haxdoor Trojan program was activated when a customer typed the bank’s address into a browser. The rogue software then recorded keystrokes to capture passwords. Later, money was transferred to newly opened accounts and cash was withdrawn at bank branches. The Corpse’s site carries a disclaimer in rough English that the programs are to be used “exclusively in the educational purposes.” Questions mailed to the site were not answered on Wednesday. http://www.nytimes.com/2007/01/25/technology/25hack.html?ex=1327381200&en=5699048fce2742b2&ei=5090&partner=rssuserland&emc=rss

FOX SUBPOENAS YOUTUBE AFTER “24” CLIPS POSTED (Hollywood Reporter, 25 Jan 2007) -- 20th Century Fox served YouTube with a subpoena Wednesday demanding the Google-owned viral video site disclose the identity of a user who uploaded copies of entire recent episodes of primetime series “24” and “The Simpsons”. The subpoena, which first came to light on the blog Google Watch (http://googlewatch.eweek.com/index.html), was granted by a judge in U.S. District Court for the Northern District of California after being filed by the News Corp.-owned studio on January 18. It is not yet known whether YouTube has complied with the request. In addition, a second, lesser-known video site, LiveDigital, was also served with a similar subpoena. A Fox spokesman confirmed the subpoena was filed to both YouTube and LiveDigital and served but declined further comment. A spokesman for YouTube declined comment. The “24” episodes in question actually appeared on YouTube prior to their primetime January 14 premiere on the Fox broadcast network, which spread four hourlong episodes of the hit drama over two consecutive nights. Fox became aware the episodes were on YouTube on January 8, according to the subpoena. Filed on the basis of the Digital Millennium Copyright Act, the subpoena includes testimony of Fox Entertainment Group vp Jane Sunderland suggesting Fox has been unable to determine the users’ identities on its own. The uploaded material could cause Fox “irreparable harm”, Sunderland said, but it was not immediately clear if the episodes in question still were posted on the site or perhaps had been removed. http://uk.news.yahoo.com/25012007/80-91/fox-subpoenas-youtube-24-clips-posted.html

-- and --

VIACOM TELLS YOUTUBE: HANDS OFF (New York Times, 3 Feb 2007) – In a sign of the growing tension between old-line media and the new Internet behemoths, Viacom, the parent company of MTV and Comedy Central, demanded yesterday that YouTube, the video-sharing Web site owned by Google, remove more than 100,000 clips of its programming. Viacom, along with other major media companies, including the News Corporation and NBC Universal, has become increasingly frustrated with YouTube as it has amassed a vast library of copyrighted clips, placed on the site by its users. While such companies regularly ask YouTube to remove their material, Viacom’s demand, which it disclosed in a statement circulated by e-mail, was the most militant and public move of its kind so far. As it has with the similar request from other companies, Google removed the Viacom clips from the YouTube site yesterday. Google hopes to strike deals that will give it the rights to mainstream programming and also wipe away its potential liability for any violations of copyright law by YouTube so far. Despite intense negotiations in recent months, Google has not been able to announce any such deals with media companies. YouTube is supported by advertising, but in most cases it does not share that revenue with copyright holders. http://www.nytimes.com/2007/02/03/technology/03tube.html?ex=1328158800&en=c8c09534e2252d31&ei=5090&partner=rssuserland&emc=rss and http://www.ft.com/cms/s/0e225e60-b2d6-11db-99ca-0000779e2340,_i_rssPage=81cea682-52a8-11da-8d05-0000779e2340.html

BLOGGER TRIES TO BAIT ‘SECOND LIFE,’ GETS A HUG INSTEAD (SiliconValley.com, 24 Jan 2007) -- A lawyer for the virtual world ``Second Life” has responded to a parody with something that’s quite different from the usual corporate cease-and-desist letter. Vancouver-based blogger Darren Barefoot had put up a one-page site, GetAFirstLife.com, that imitates the look of SecondLife.com but promotes a real-life existence where you can work, reproduce and perish -- all for free. The site purports to answer frequently asked questions such as ``Why can’t I build a dirigible with my mind?” That’s a dig at ``Second Life,” where users with sufficient skill in three-dimensional modeling can build almost anything. The site includes a logo that’s a modified version of Second Life’s logo. With a link, Barefoot invited cease-and-desist letters, the type lawyers often send threatening lawsuits if a site doesn’t pull down objectionable material. Sunday’s note from Ginsu Yoon, a lawyer for San Francisco-based Second Life, started out with the legalese of a standard nastygram -- Internet slang for a cease-and-desist letter -- but went on to say that ``your invitation to submit a cease-and-desist letter is hereby rejected.” Second Life representative Alex Yenni confirmed the note, delivered as a comment on Barefoot’s blog, was authentic. ``Linden Lab objects to any implication that it would employ lawyers incapable of distinguishing such obvious parody,” Yoon wrote. ``Linden Lab is well-known for having strict hiring standards, including a requirement for having a sense of humor, from which our lawyers receive no exception.” The note even gives Barefoot a ``nonexclusive, nontransferable, nonsublicenseable, revocable, limited license” to use the modified logo on T-shirts he sells. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16536797.htm

-- and --

SWEDEN TO SET UP EMBASSY IN SECOND LIFE (The Local, 26 Jan 2007) -- Sweden is to become the first country to establish diplomatic representation in the virtual reality world of Second Life, officials said on Friday. “We are planning to establish a Swedish embassy in Second Life primarily as an information portal for Sweden,” Swedish Institute (SI) director Olle Wästberg told AFP. The embassy would not provide passports or visas but would instruct visitors how to obtain such documents in the real world and act as a link to web-based information about the Scandinavian country. “Second Life allows us to inform people about Sweden and broaden the opportunity for contact with Sweden easily and cheaply,” Wästberg said. The Swedish Institute is an agency of the Swedish foreign ministry tasked with informing the world about Sweden. The ministry fully backed the initiative, he added. http://www.thelocal.se/6219/20070126/

-- and --

EBAY BANS AUCTIONS OF VIRTUAL GOODS (CNET, 29 Jan 2007) -- By proactively delisting auctions for property from virtual worlds and online games, eBay may be effectively forcing players who participate in such trades into the hands of giant third-party operations that buy and sell virtual goods. Given that a significant slice of the multi-hundred-million-dollar business took place on eBay until now, the move portends a significant shift in who controls the market for virtual goods. eBay on Monday confirmed its decision to ban auctions for the characters, currency, weapons, attire and accounts of online games such as World of Warcraft, City of Heroes and others. The move was first reported on Slashdot. The ban does not affect the virtual world Second Life. In most cases, publishers of online games include in their terms of service a prohibition on so-called real-money trades (RMTs), in which people buy and sell online games’ virtual assets for real money. Players who violate such rules can be banned. But because eBay has dominated the auction market for RMTs, there’s little question that the short-term winner in this latest circumstance will be sites like the Internet Gaming Entertainment of the world, which control the third-party market. While there is no universally agreed-upon value for the RMT market, it is assumed to be worth somewhere between $250 million and $880 million a year, according to experts. eBay said its decision--which is essentially a move to begin enforcing rules against virtual-item trades already under way--stems from a desire to protect users. http://news.com.com/2100-1043_3-6154372.html

U.S. FACES NEW LOSS IN NET GAMBLING CASE (Reuters, 26 Jan 2007) -- The United States has suffered a new setback in a four-year legal battle with Antigua and Barbuda over U.S. restrictions on Internet gambling, a U.S. trade official said. At issue is an April 2005 World Trade Organization ruling against U.S. prohibitions on online horse-race betting. Since then, the U.S. Congress has passed additional legislation to ban betting over the Internet. Gretchen Hamel, a spokeswoman for the U.S. Trade Representative’s office, confirmed Thursday the press reports that a WTO panel “did not agree with the United States that we had taken the necessary steps to comply” with that ruling. “The panel’s findings issued today involve a narrow issue of federal law” and the United States will have opportunity to submit comments to the WTO before it issues its final, public report in March, Hamel said. Antigua and Barbuda, a Caribbean island nation with few natural resources, has sought to build up an Internet gambling industry to provide jobs to replace those in its declining tourist industry. It argued in a case first brought to the WTO in 2003 that U.S. laws barring the placing of bets across states lines by electronic means violated WTO rules. An April 2005 ruling by the WTO’s Appellate Body, which both sides claimed as vindication, focused on the narrower issue of horse racing, saying that foreign betting operators appeared to suffer discrimination. Antigua and Barbuda complained the United States had not complied with the decision. The WTO agreed in July 2006 to look into the matter, resulting in the ruling on Thursday. http://news.com.com/2100-1028_3-6153682.html

-- and --

EU MAY CHALLENGE U.S. ONLINE GAMBLING LAW (Reuters, 30 Jan 2007) -- U.S. restrictions on online gambling may be challenged by the European Union, the bloc’s top financial regulator said on Tuesday. “In my view it is probably a restrictive practice and we might take it up in another fora,” EU Internal Market Commissioner Charlie McCreevy told the European Parliament. The United States was protecting its own gambling industry by stopping foreign companies from entering the online betting sector, McCreevy said. “It’s not my intention to bring forward a harmonised piece of legislation on gambling in the European Union,” McCreevy added. The United States has introduced rules to stop card companies from dealing with foreigners for online bets, McCreevy said. He has launched legal actions against several EU countries to tackle obstacles to foreign competition. http://uk.news.yahoo.com/30012007/80-91/eu-challenge-u-s-online-gambling-law-mccreevy.html

CORPORATE BLOGGING PAYS FOR GM (TechWeb, 26 Jan 2007) -- General Motors’ auto business hasn’t been great of late, but its blogging strategy is paying off handsomely. In 2006, the company’s FastLane blog delivered an estimated $410,470 worth of customer insight and marketing at an approximate cost of $255,675 -- a return on investment of 67% -- according to a newly released report from Forrester Research. Compare that to 2005, when GM’s blog generated an estimated $578,374 worth of information and publicity at an approximate cost of $291,196. That’s a 99% return on investment. Forrester analysts Charlene Li and Chloe Stromberg chose GM as the subject of their case study to demonstrate that companies can and should measure the ROI of blogging. “As blogging becomes more visible -- and expensive in terms of both time and money -- supporting blogging with informal budgets and borrowed resources just won’t cut it,” their report says. “Instead, marketers need to understand how and why blogging will affect their particular businesses, and calculating the ROI of blogging is the process by which marketers can obtain this understanding.” http://news.yahoo.com/s/cmp/20070127/tc_cmp/197001026

VIDEO BLOGGING SPURS NEW BRAND OF POLITICS (Washington Post, 26 Jan 2007) -- The YouTube era of politics, which helped to bring down George Allen (R) in last fall’s U.S. Senate election, has come to the Virginia General Assembly. Upset that Republicans are killing bills without recording the vote, a Democratic operative is trolling the halls of the State Capitol with a video camera to put Republicans on the defensive. The videos are uploaded on blogs or YouTube, a popular Internet video sharing site. On Thursday, after House Republicans killed several proposals to increase the state’s minimum wage in an unrecorded vote, furious Democrats put a video of the proceedings on http://www.assemblyaccess.com, a party blog. Democrats have made changing the hourly wage to $7.25 a key part of their agenda. http://www.washingtonpost.com/wp-dyn/content/article/2007/01/25/AR2007012501891.html

EMPLOYERS WINNING BLOG SUITS -- SO FAR (Law.com, 26 Jan 2007) -- Litigation over employees blogging negatively about their jobs or bosses has been sparse, but most cases so far have come down on the side of the employer. Yet observers predict that a pro-employer trend in litigation won’t stop the growth of legal fights over blogs. The spontaneity and immediacy of computer blogging makes it as appealing as water cooler gossip only with a bigger watering hole, prompting companies to pony up policies controlling the practice. “This is a challenge that has never before been confronted by the corporate environment,” said Jerome Coleman, labor and employment litigator at Nixon Peabody’s New York office. The potential is there to disclose trade secrets, defame the company or create problems with co-workers and discrimination, he said. “But you can’t put an outright ban on blogging,” Coleman added. Although the law is developing in the area, the few court rulings that have come down have been almost exclusively favorable to employers, according to Michael Fox in Ogletree, Deakins, Nash, Smoak & Stewart’s Austin, Texas, office, who has had his own employment law blog for several years, “Employerslawyer.” http://www.law.com/servlet/ContentServer?pagename=OpenMarket/Xcelerate/View&c=LawArticle&cid=1169719347007&live=true&cst=1&pc=0&pa=0&ll=4&ll=2&ll=5&showsummary=0&h=9323E411A07AE264630B2CC8C1C125D9

SECRECY IS AT ISSUE IN SUITS OPPOSING SPY PROGRAM (New York Times, 26 Jan 2007) – The Bush administration has employed extraordinary secrecy in defending the National Security Agency’s highly classified domestic surveillance program from civil lawsuits. Plaintiffs and judges’ clerks cannot see its secret filings. Judges have to make appointments to review them and are not allowed to keep copies. Judges have even been instructed to use computers provided by the Justice Department to compose their decisions. Lawyers suing the government and some legal scholars say the procedures threaten the separation of powers, the adversary system and the lawyer-client privilege. Justice Department officials say the circumstances of the cases, involving a highly classified program, require extraordinary measures. The officials say they have used similar procedures in other cases involving classified materials. In ordinary civil suits, the parties’ submissions are sent to their adversaries and are available to the public in open court files. But in several cases challenging the eavesdropping, Justice Department lawyers have been submitting legal papers not by filing them in court but by placing them in a room at the department. They have filed papers, in other words, with themselves. At the meeting this month, judges on the United States Court of Appeals for the Sixth Circuit asked how the procedures might affect the integrity of the files and the appellate records. Some cases challenging the program, which monitored international communications of people in the United States without court approval, have also involved atypical maneuvering. Soon after one suit challenging the program was filed last year in Oregon, Justice Department lawyers threatened to seize an exhibit from the court file. This month, in the same case, the department sought to inspect and delete files from the computers on which lawyers for the plaintiffs had prepared their legal filings. Nancy S. Marder, a law professor at the Chicago-Kent College of Law and an authority on secrecy in litigation, said the tactics were really extreme and deeply, deeply troubling. In August 2004, the Treasury Department’s Office of Foreign Assets Control, which was investigating an Oregon charity, al-Haramain Islamic Foundation, inadvertently provided a copy of a classified document to a foundation lawyer, Lynne Bernabei. That document indicated, according to court filings, that the government monitored communications between officers of the charity and two of its lawyers without a warrant in spring 2004. Ms. Bernabei circulated the document to two directors of the charity, at least one of them in Saudi Arabia, and to three other lawyers. She discussed them with two more lawyers. A reporter for The Washington Post, David B. Ottaway, also reviewed the document. The full significance of the document was apparently not clear to any recipient, more than a year before The New York Times disclosed the existence of the N.S.A. program in December 2005. The F.B.I. learned of the disclosure almost immediately in August 2004, Judge King said at a court hearing last year, but made no effort to retrieve copies of the document for about six weeks. When it did, everyone it asked apparently returned all copies of the document. In a statement reported in The Post in March, for instance, Mr. Ottaway said he the F.B.I. had told him that the document had “highly sensitive national security information.” In a sworn statement in June, a lawyer who had the document, Asim Ghafoor, said the bureau took custody of his laptop computer “in order that the document might be ‘scrubbed’ from it.” The computer was returned weeks later. In February 2006, the charity and the two lawyers who say they were wiretapped sued to stop the program, requesting financial damages. They attached a copy of the classified document, filing it under seal. They have not said how they came to have a copy. Three weeks later, the lawyers for the foundation received a call from two Justice Department lawyers. The classified document “had not been properly secured,” the lawyers said, according to a letter from the plaintiffs’ lawyers to the judge. As Mr. Eisenberg recalled it, the government lawyers said, “The F.B.I. is on its way to the courthouse to take possession of the document from the judge.” But Judge King, at a hurriedly convened hearing, would not yield it, and asked, “What if I say I will not deliver it to the F.B.I.?” A Justice Department lawyer, Anthony J. Coppolino, gave a measured response, saying: “Your Honor, we obviously don’t want to have any kind of a confrontation with you. But it has to be secured in a proper fashion.” The document was ultimately deposited in a “secure compartmented information facility” at the bureau office in Portland. In the meantime, copies of the document appear to have been sent abroad, and the government concedes that it has made no efforts to contact people overseas who it suspects have them. “It’s probably gone many, many places,” Judge King said of the document at the August hearing. “Who is it secret from?” A Justice Department lawyer, Andrew H. Tannenbaum, replied, “It’s secret from anyone who has not seen it.” He added, “The document must be completely removed from the case, and plaintiffs are not allowed to rely on it to prove their claims.” Judge King wondered aloud about the implications of that position, saying, “There is nothing in the law that requires them to purge their memory.” In a decision in September, Judge King ruled that the plaintiffs were not entitled to review the document again but could rely on their recollections of it. In October, they filed a motion for summary judgment, a routine step in many civil litigations. In a sealed filing, they described the classified document. Government lawyers sent Judge King a letter saying the plaintiffs had “mishandled information contained in the classified document” by, among other actions, preparing filings on their own computers. In a telephone conference on Nov. 1, Judge King appeared unpersuaded. “My problem with your statement,” he told Mr. Tannenbaum, “is that you assume you are absolutely correct in everything you are stating, and I am not sure that you are.” Mr. Boyd of the Justice Department said the government “continues to explore with counsel ways in which the classified information may be properly protected without any intrusion on the attorney-client privilege.” http://www.nytimes.com/2007/01/26/washington/26nsa.html?ex=1327467600&en=252c10a6b678989e&ei=5090&partner=rssuserland&emc=rss

-- and --

FBI TURNS TO BROAD NEW WIRETAP METHOD (30 Jan 2007) -- The FBI appears to have adopted an invasive Internet surveillance technique that collects far more data on innocent Americans than previously has been disclosed. Instead of recording only what a particular suspect is doing, agents conducting investigations appear to be assembling the activities of thousands of Internet users at a time into massive databases, according to current and former officials. That database can subsequently be queried for names, e-mail addresses or keywords. Such a technique is broader and potentially more intrusive than the FBI’s Carnivore surveillance system, later renamed DCS1000. It raises concerns similar to those stirred by widespread Internet monitoring that the National Security Agency is said to have done, according to documents that have surfaced in one federal lawsuit, and may stretch the bounds of what’s legally permissible. Call it the vacuum-cleaner approach. It’s employed when police have obtained a court order and an Internet service provider can’t “isolate the particular person or IP address” because of technical constraints, says Paul Ohm, a former trial attorney at the Justice Department’s Computer Crime and Intellectual Property Section. (An Internet Protocol address is a series of digits that can identify an individual computer.) That kind of full-pipe surveillance can record all Internet traffic, including Web browsing--or, optionally, only certain subsets such as all e-mail messages flowing through the network. Interception typically takes place inside an Internet provider’s network at the junction point of a router or network switch. The technique came to light at the Search & Seizure in the Digital Age symposium held at Stanford University’s law school. Ohm, who is now a law professor at the University of Colorado at Boulder, and Richard Downing, a CCIPS assistant deputy chief, discussed it during the symposium. In a telephone conversation afterward, Ohm said that full-pipe recording has become federal agents’ default method for Internet surveillance. “You collect wherever you can on the (network) segment,” he said. “If it happens to be the segment that has a lot of IP addresses, you don’t throw away the other IP addresses. You do that after the fact.” related blog DOJ takes issue with wiretapping story Justice Department spokesman responds to CNET News.com report. “You intercept first and you use whatever filtering, data mining to get at the information about the person you’re trying to monitor,” he added. “What they’re doing is even worse than Carnivore,” said Kevin Bankston, a staff attorney at the Electronic Frontier Foundation who attended the Stanford event. “What they’re doing is intercepting everyone and then choosing their targets.” http://news.com.com/FBI+turns+to+broad+new+wiretap+method/2100-7348_3-6154457.html

VISTA’S LEGAL FINE PRINT RAISES RED FLAGS (Toronto Star, 29 Jan 2007) -- Vista, the latest version of Microsoft’s Windows operating system, makes its long awaited consumer debut tomorrow. The first major upgrade in five years, Vista incorporates a new, sleek look and features a wide array of new functionality, such as better search tools and stronger security. The early reviews have tended to damn the upgrade with faint praise, however, characterizing it as the best, most secure version of Windows, yet one that contains few, if any, revolutionary features. While those reviews have focused chiefly on Vista’s new functionality, for the past few months the legal and technical communities have dug into Vista’s “fine print.” Those communities have raised red flags about Vista’s legal terms and conditions as well as the technical limitations that have been incorporated into the software at the insistence of the motion picture industry. The net effect of these concerns may constitute the real Vista revolution as they point to an unprecedented loss of consumer control over their own personal computers. In the name of shielding consumers from computer viruses and protecting copyright owners from potential infringement, Vista seemingly wrestles control of the “user experience” from the user. Vista’s legal fine print includes extensive provisions granting Microsoft the right to regularly check the legitimacy of the software and holds the prospect of deleting certain programs without the user’s knowledge. During the installation process, users “activate” Vista by associating it with a particular computer or device and transmitting certain hardware information directly to Microsoft. Even after installation, the legal agreement grants Microsoft the right to revalidate the software or to require users to reactivate it should they make changes to their computer components. In addition, it sets significant limits on the ability to copy or transfer the software, prohibiting anything more than a single backup copy and setting strict limits on transferring the software to different devices or users. Vista also incorporates Windows Defender, an anti-virus program that actively scans computers for “spyware, adware, and other potentially unwanted software.” The agreement does not define any of these terms, leaving it to Microsoft to determine what constitutes unwanted software. Once operational, the agreement warns that Windows Defender will, by default, automatically remove software rated “high” or “severe,” even though that may result in other software ceasing to work or mistakenly result in the removal of software that is not unwanted. For greater certainty, the terms and conditions remove any doubt about who is in control by providing that “this agreement only gives you some rights to use the software. Microsoft reserves all other rights.” For those users frustrated by the software’s limitations, Microsoft cautions that “you may not work around any technical limitations in the software.” http://www.thestar.com/Business/article/175801

COURTS TURN TO WIKIPEDIA, BUT SELECTIVELY (New York Times, 29 Jan 2007) -- When a court-appointed special master last year rejected the claim of an Alabama couple that their daughter had suffered seizures after a vaccination, she explained her decision in part by referring to material from articles in Wikipedia, the collaborative online encyclopedia. The reaction from the court above her, the United States Court of Federal Claims, was direct: the materials “culled from the Internet do not — at least on their face — meet” standards of reliability. The court reversed her decision. Oddly, to cite the “pervasive, and for our purposes, disturbing series of disclaimers” concerning the site’s accuracy, the same Court of Federal Claims relied on an article called “Researching With Wikipedia” found — where else? — on Wikipedia. (The family has reached a settlement, their lawyer said.)A simple search of published court decisions shows that Wikipedia is frequently cited by judges around the country, involving serious issues and the bizarre — such as a 2005 tax case before the Tennessee Court of Appeals concerning the definition of “beverage” that involved hundreds of thousands of dollars, and, just this week, a case in Federal District Court in Florida that involved the term “booty music” as played during a wet T-shirt contest. More than 100 judicial rulings have relied on Wikipedia, beginning in 2004, including 13 from circuit courts of appeal, one step below the Supreme Court. (The Supreme Court thus far has never cited Wikipedia.) “Wikipedia is a terrific resource,” said Judge Richard A. Posner of the United States Court of Appeals for the Seventh Circuit, in Chicago. “Partly because it so convenient, it often has been updated recently and is very accurate.” But, he added: “It wouldn’t be right to use it in a critical issue. If the safety of a product is at issue, you wouldn’t look it up in Wikipedia.” Many citations by judges, often in footnotes, are like Judge Posner’s, beside the main judicial point, appear intended to show how hip and contemporary the judge is, reflecting Professor Sunstein’s suspicion, “that law clerks are using Wikipedia a great deal.” The Supreme Court of Iowa cites Wikipedia to explain that “jungle juice” is “the name given to a mix of liquor that is usually served for the sole purpose of becoming intoxicated.” In the Florida case, the court noted that booty music has “a slightly higher dance tempo and occasional sexually explicit lyrical content.” As opposed to these tangential references, Wikipedia has also been used for more significant facts. Such cases include a Brooklyn surrogate court’s definition of the Jewish marriage ceremony and the Iowa Court of Appeals’ declaration that French is the official language of the Republic of Guinea. In 2004, the Court of Appeals for the 11th Circuit, in Georgia, referred to a Wikipedia entry of the Department of Homeland Security’s threat levels in a ruling concerning magnetometer searches of antiwar protesters. In a recent letter to The New York Law Journal, Kenneth H. Ryesky, a tax lawyer who teaches at Queens College and Yeshiva University, took exception to the practice, writing that “citation of an inherently unstable source such as Wikipedia can undermine the foundation not only of the judicial opinion in which Wikipedia is cited, but of the future briefs and judicial opinions which in turn use that judicial opinion as authority.” Recognizing that concern, Lawrence Lessig, a professor at Stanford Law School who frequently writes about technology, said that he favored a system that captures in time online sources like Wikipedia, so that a reader sees the same material that the writer saw. He said he used www.webcitation.org for the online citations in his amicus brief to the Supreme Court in Metro-Goldwyn-Mayer Studios v. Grokster Ltd., which “makes the particular reference a stable reference, and something someone can evaluate.” http://www.nytimes.com/2007/01/29/technology/29wikipedia.html?ex=1327726800&en=92bbe5fe41874778&ei=5090&partner=rssuserland&emc=rss

SONY BMG SETTLES FTC CHARGES OVER ANTI-PIRACY CDS (SiliconValley.comm, 30 Jan 2007) -- U.S. regulators said Tuesday that Sony BMG Music Entertainment agreed to reimburse consumers up to $150 for damage to their computers from CDs with hidden anti-piracy software. According to the Federal Trade Commission, which announced the settlement, Sony BMG’s anti-piracy software limited the devices on which music could be played to those made by Sony Corp., Microsoft Corp. or other Windows-compatible devices. The software also restricted the number of copies of the music that could be made to three, the agency said, and ``exposed consumers to significant security risks and was unreasonably difficult to uninstall.” ``Installations of secret software that create security risks are intrusive and unlawful,” FTC Chairman Deborah Platt Majoras said. The focus of the FTC action is not the limits themselves, Majoras said, but the lack of notification. ``Ordinary experience with CDs would not lead consumers to expect these limits,” she said. ``This was a case about disclosure.” The settlement requires the company to allow consumers to exchange through the end of June the affected CDs purchased before Dec. 31, 2006, and reimburse them up to $150 to repair damage done when they tried to remove the software. It also requires Sony BMG to clearly disclose limitations on consumers’ use of music CDs and prohibits it from installing software without consumer consent. For two years, Sony BMG also must provide an uninstall tool and patches to repair the security vulnerabilities on consumers’ computers and must advertise them on its Web site. The company also is required to publish notices describing the exchange and repair reimbursement programs on its Web site. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16581257.htm [Editor: There’s a good article on-point in the current issue of the ABA’s Business Law Today: “The ‘Agreement’ That Sparked A Storm”. It’ll be available online after February at http://www.abanet.org/buslaw/blt/.]

NFL TO OFFER SUPER BOWL HIGHLIGHTS ON ITUNES (SiliconValley.com, 30 Jan 2007) -- For the first time ever, football fans will be able to download video highlights of the Super Bowl, and they will be offered exclusively through Apple Inc.’s online iTunes Store. The National Football League said Tuesday it will make highlights from Sunday’s game available for purchase online the following day. The download, in English or Spanish, will cost $1.99 and will be viewable on computers or iPods. A 90-minute video of the NFL’s coverage of the Super Bowl will also be sold for $1.99. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16583085.htm

NAVIGATING SALES TAX LAWS (Internet.com, 30 Jan 2007) -- According to the U.S. Census Bureau, 33 percent of state revenues come from sales ta. xAnd each year, state and local governments lose billions of dollars of potential revenue due to uncollected tax on online sales — a figure that the Center for Business and Economic Research says could add up to as much as $33.8 billion by 2008. No wonder states are cracking down on online businesses that don’t collect and submit sales tax — and angling for new federal guidelines that would simplify and standardize sales tax rates and collection. Determining whether or not your online business needs to be collecting sales tax from customers can be tricky, however, and the information available online can be intimidating and confusing. (For example, those of you saying, “Hey, what about the Internet Tax Freedom Act?” According to the Act, Internet access charges cannot be taxed, not merchandise sold online to customers in states where you have a physical presence.) To sort out the facts from the fiction, Ecommerce-Guide.com scoured the Web and spoke with the experts. What we discovered could not only potentially save you thousands of dollars in back taxes, interest and penalties, but keep you out of jail. http://www.ecommerce-guide.com/resources/article.php/3656806

GOOGLE MOVES TO DISARM SEARCH ‘BOMBS’ (Washington Post, 30 Jan 2007) -- For many years, Google said it wouldn’t rectify the antics of pranksters who rigged search terms, like having “miserable failure” bring up a White House biography of George W. Bush as a top result on its search engine. But Google last week reversed its position, changing its algorithms to eliminate so-called “Google bombs” that yield political or humorous results. On its blog targeted at Web engineers, Google disclosed that it made changes to minimize the impact of the most popular Google bombs. Too many people started to think the results reflected the company’s political opinion, it said. “We’ve seen a lot of misconceptions. People thought Google was behind these or was endorsing these” Google bombs, said Matt Cutts, the software engineer at Google who posted an explanation of the company’s decision on the Google Webmaster blog. “It’s not the case. Most of these can be considered pranks, and the direct impact on all search results is minuscule. But it is good to correct our search quality.” Because of the changes Google made to its formula, searching for “miserable failure” on Google now pulls up a news story by the BBC about Google bombing as the first result, followed by a Wikipedia entry on the topic and another article in an industry publication. The White House page no longer appears in the top 100 results. The search engine uses many factors to determine the ranking of a Web site in the search results. One factor influencing that ranking is how many other Web sites link to the targeted site, so if many sites use the term “miserable failure” and use it as a link to the White House site, the White House site rises in the rankings. The White House Web page does not contain the words “miserable failure,” but the obscurity of the phrase made it easier to rise quickly in the rankings. Other search engines use similar variations on search technology. Google isn’t the only one affected. Yahoo’s search, for example, still brings up the president’s profile as its top result. George Johnston, a Bellevue, Wash., man who claims to be the architect of the “miserable failure” Google bomb, said he started his campaign in 2003 because it would be “fun” and “easy.” He e-mailed a number of popular bloggers and asked them to use the phrase and create a link to the White House Web site. It quickly took off. “It spawned a whole class of jokes when people understood how easy it was,” Johnston said in an e-mail. “Google bombing as a blogger sport hit its peak in 2004,” then receded as the novelty wore off, he said. http://www.washingtonpost.com/wp-dyn/content/article/2007/01/29/AR2007012901891.html

APPEALS COURT ADJUSTS PRIVACY-AT-WORK RULING WORKERS HAVE RIGHT TO EXPECT SECURE PCS UNLESS GIVEN NOTICE (SFGate.com, 31 Jan 2007) -- A federal appeals court changed course Tuesday and said employees have a right of privacy in the contents of their workplace computers -- but employers who have an established policy of monitoring those computers retain the right to seize the files and turn them over to police. The Ninth U.S. Circuit Court of Appeals revisited its ruling of August in a Montana child pornography case, and again upheld an employee’s conviction for receiving obscene material that his employer found on his computer during a late-night raid. But Tuesday’s ruling set a more employee-friendly precedent for future cases than the August decision, which found that workers had no constitutional privacy rights in computers that their companies owned. Under that ruling, all employers, regardless of established policies, could have taken the computer files and given them to authorities, and police who managed to gain access to the files on their own could also have seized them. Under past Supreme Court rulings, “in the private employer context, employees retain at least some expectation of privacy in their offices,” Judge Diarmuid O’Scannlain, author of the August ruling, said in Tuesday’s decision by the same three-judge panel. He said the employee in this case, Jeffrey Ziegler, had a reasonable belief that his electronic files would be private in a password-protected computer kept in a locked office not shared by co-workers. http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2007/01/31/MNGK4NS23M1.DTL&feed=rss.news [Editor: Lesson-learned? Make sure you have communicated company policy reserving inspection/monitoring rights; defeat this “expectation” of privacy.]

FIRST SALE DOCTRINE APPLIED TO AUDIOBOOKS (BNA’s Internet Law News, 1 Feb 2007) -- BNA’s Electronic Commerce & Law Report reports that the 6th Circuit Court of Appeals has ruled that a publisher of educational audiobooks who repackaged and resold audiobooks produced by a rival did not infringe the copyrights in the audiobooks. The court held that the first sale doctrine applies to those repackaged copies, rejecting the application of the Record Rental Amendment of 1984, which excludes sound recordings from the reach of the first sale doctrine. The court considered an issue of first impression: whether the record rental exception to copyright’s first sale doctrine applied to all sound recordings, or only sound recordings of musical works.
Case name is Brilliance Audio Inc. v. Haights Cross Commc’ns Inc. Decision at http://caselaw.findlaw.com/data2/circs/6th/051209pv2.pdf

TRADE GROUP GIVES FEDS LOW CYBERSECURITY GRADE (ComputerWorld, 31 Jan 2007) -- The Cyber Security Industry Alliance has given the U.S. government D grades on its cybersecurity efforts in 2006, and renewed its call for Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government D grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. “Government needs to take these issues very seriously,” said Liz Gasster, the CSIA’s acting executive director and general counsel. http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9009905&source=rss_topic146 Report at: https://www.csialliance.org/resources/pdfs/CSIA_06Report_07Agenda_US_Govt.pdf

ADWARE FUNDERS FINED FOR MALWARE CONTRIBUTIONS (VNUnet, 31 Jan 2007) – Priceline, Travelocity, and Cingular Wireless have agreed to pay a fine for advertising through an illegal adware application. The companies had purchased advertisements on DirectRevenue, a notorious maker of adware that is the target of a separate lawsuit for fraudulent software installations and serving illegal pop-up ads. The fines of $30,000 to $35,000 settle a lawsuit filed by New York Attorney General Andrew Cuomo. “Advertisers will now be held responsible when their ads end up on consumers’ computers without full notice and consent,” said Cuomo. Companies whose banner ads show up on adware networks often hide behind the premise that they outsourced the media buying to ‘outsiders’. Cuomo warned, however, that he will hold the advertiser responsible nonetheless. Anti-adware activists published a list last year containing the names of 12 vendors that had funded adware operations for a DirectRevenue competitor. Three of the named vendors subsequently cut their ties with the company in question. http://www.vnunet.com/vnunet/news/2173818/adware-funders-fined-supporting

THE TJX SECURITY BREACH. THIS ONE’S DIFFERENT. WAY DIFFERENT. (CIO Magazine, 1 Feb 2007) -- If you haven’t noticed, there is something different about the security breach disclosed last month by TJX Cos. Some Massachusetts banks have linked fraudulent credit card purchases to the security breach at TJX, during which hackers nabbed possibly millions of credit card numbers. Not such a big deal, you say? Well, as far as most security experts I have talked to in the past couple of years have said, matching a specific incident of credit card fraud to a specific security breach incident is unprecedented. Has any bank ever been able to prove that a significant number of fraudulent credit card purchases came from a specific corporate security breach? So far, no. But it is exactly this kind of “connecting the dots” that security experts say needs to happen for companies to begin to take information security more seriously. The Massachusetts Bankers Association (TJX is based in Framingham, Mass.) claims it has connected the dots. A small bank that is an MBA member linked a spike in fraudulent credit card purchases last month to the TJX break in. How did they do it? MBA execs won’t give details and won’t release the name of the bank, but MBA spokesman Bruce Spitzer says that last month that small undisclosed bank noticed 22 incidents of fraudulent credit card purchases on an undisclosed number of their customers’ accounts. That may not sound like a lot, but for the small bank, it represented a big spike in fraudulent purchases. Bank officials contacted the customers and asked if they had shopped at a TJX store. All said they had. Spitzer says the MBA, which has 250 member banks, intends to pursue the recovery of any costs from the fraudulent purchases and says it can directly link the credit card misuse to the TJX breach. If so, that’d be huge. Until now, there has been no smoking gun, and it remains to be seen whether the MBA, or a bank acting on its own, or Visa or Mastercard can make such a connection. http://blogs.cio.com/node/681?source=nlt_cioleader

ARIZONA COURT APPLIES SUMMARY JUDGMENT STANDARD TO EFFORT TO UNMASK WEB POSTERS (Steptoe & Johnson’s E-Commerce Law Week, 1 Feb 2007) -- Following the Delaware Supreme Court’s seminal ruling in Doe v. Cahill, another court has found that a plaintiff “must show that its claim would survive a Motion for Summary Judgment before being entitled to discover the identity of an anonymous speaker through any compulsory discovery process.” In McMann v. Doe, an Arizona trial court found that Massachusetts real estate developer Paul McMann had not made out a prima facie claim, and therefore could not subpoena domain name registrar GoDaddy.com or anonymization service Domains by Proxy, Inc., for the identity of the creator of an allegedly defamatory web site. With Cahill and the Arizona court’s ruling in McMann, these cases suggest that courts may be approaching a consensus that plaintiffs must meet something akin to the “summary judgment standard” before courts will require Internet service providers to disclose the identity of anonymous posters. http://www.steptoe.com/publications-4200.html

‘ELECTRIC SLIDE’ ON SLIPPERY DMCA SLOPE (CNET, 3 Feb 2007) -- The inventor of the “Electric Slide,” an iconic dance created in 1976, is fighting back against what he believes are copyright violations and, more importantly, examples of bad dancing. Kyle Machulis, an engineer at San Francisco’s Linden Lab, said he received a Digital Millennium Copyright Act takedown notice about a video he had shot at a recent convention showing three people doing the Electric Slide. “The creator of the Electric Slide claims to hold a copyright on the dance and is DMCAing every single video on YouTube” that references the dance, Machulis said. He’s also sent licensing demands to The Ellen DeGeneres Show, Machulis added. Indeed, Richard Silver, who filed the copyright for the Electric Slide in 2004, said on one of his Web pages that the DeGeneres Show had been putting up a legal fight as he tried to get compensation for a segment that aired in February 2006 in which actress Teri Hatcher and other dancers performed the popular wedding shuffle. http://news.com.com/2100-1030_3-6156021.html

OFFICIAL QUITS AFTER REMARK ON LAWYERS (New York Times, 3 Feb 2007) -- The senior Pentagon official who set off a controversy last month with remarks suggesting that corporations should consider severing business ties with law firms that represent Guantánamo Bay detainees has resigned. The official, Charles D. Stimson, deputy assistant secretary for detainee affairs, said that it was his decision to resign and that he was not asked to leave by Defense Secretary Robert M. Gates, said Bryan Whitman, a spokesman for the Pentagon. On Jan. 24, the Bar Association of San Francisco requested that the State Bar of California investigate Mr. Stimson for possible violations of California ethics rules, the San Francisco group’s Web site says. The president of the American Bar Association, Karen J. Mathis, said that she could not comment on the resignation, but that by reacting to his comments “the American public reaffirmed its commitment to a core principle of our justice system: that every accused person deserves adequate legal representation.” http://www.nytimes.com/2007/02/03/washington/03gitmo.html?_r=1&oref=slogin

GOOGLE EARTH PROMPTS INDIAN FEARS (BBC, 5 Feb 2007) -- Google is in talks with India about sensitive sites viewable via the Google Earth service. Citing security worries the Indian government has asked Google to reduce the detail in a selection of images. The government is drawing up a list of places it considers sensitive, which is expected to include military bases and government buildings. Many other areas in Google Earth have been blurred by governments keen to stop people seeing sensitive sites. The talks about blurring some locations viewable via Google Earth came out of a meeting between science and technology ministers from the Indian government and the search firm. In a report in the Times of India, the Indian government said that detailed plans of buildings and accurate maps could prove a boon to extremists. India’s fears were first aired in 2005 - soon after the service launched. In “exceptional” circumstances Google said it too would blur images making up the virtual Earth. This has prompted many people to scour Google’s virtual Earth looking for the places where this blurring has occurred. http://news.bbc.co.uk/2/hi/technology/6331033.stm

GERMAN POLICE BARRED FROM SECRETLY SEARCHING COMPUTERS OVER INTERNET (SiliconValley.com, 5 Feb 2007) -- Police cannot secretly search suspects’ computer hard drives over the Internet, a German court ruled Monday. The decision of the Federal Court of Justice in Karlsruhe bars police from using software to search through remote hard drives unless parliament passes a law explicitly allowing the technique. Police, however, still will be allowed to seize evidence from PCs when conducting searches in person. Arguing that stealth searches were indispensable to investigating criminals and terrorists, Interior Minister Wolfgang Schaeuble, the country’s top security official responsible for police, called on the government to seek swift changes in the law. ``It is indispensable for criminal investigators to be able to carry out online searches secretly and with a corresponding order from a judge,” he said in a statement. The decision came in response to a request by the Federal Prosecutor’s Office, which had sought to use Trojan horse programs to investigate a possible terrorist group. Prosecutors argued the legal reasoning used to allow telephone surveillance and other electronic eavesdropping techniques should be applicable to gathering evidence over the Internet. http://www.siliconvalley.com/mld/siliconvalley/news/editorial/16628932.htm
-- and – “TJX to Take 4Q Charge for Computer Hack” http://biz.yahoo.com/ap/070201/tjx_outlook.html?.v=2

FBI FREEZES FUNDS OF ‘VIRTUAL WALLET’ WEB PAYMENT FIRM (The Guardian, 6 Feb 2007) -- The FBI has frozen funds held in customer accounts at Neteller, the “virtual wallet” payment processor, as part of its case against the firm’s two Canadian founders who were last month arrested and charged with racketeering and money laundering. Neteller refused to disclose how much had been frozen but company filings make clear huge sums were flowing between its US customers’ “e-wallets” and online merchants - particularly gambling websites - up until the firm was pressured to close its American operations in the wake of last month’s arrests. Over a six-month period last year the company processed transactions worth $5.1bn (£2.6bn), with about 85% involving US customers. Less than three weeks ago, Neteller said in a statement to the stock exchange: “The funds of US resident customers are held in segregated trust accounts and are fully secure and will be available for withdrawal by customers on demand.” Since then, advice on the group’s website makes clear customer withdrawals have now been blocked. “As a top priority, we are working to resolve all withdrawal issues but in the meantime we continue to maintain these funds in trust on your behalf,” customers are told. “Please check this page regularly for more updates.” http://technology.guardian.co.uk/news/story/0,,2006709,00.html

**** RESOURCES ****
CORNELL LAW LIBRARY ANNOUNCES LAUNCH OF LEGAL RESEARCH ENGINE (Cornell, 2 Feb 2007) -- The Cornell Law Library is pleased to announce its new Legal Research Engine This specialized search engine helps users easily find authoritative online legal research guides on every subject. It searches approximately 20 different web sites that either prolifically publish guides, or index and link to guides. Engine at: http://library.lawschool.cornell.edu/guides/researchengine.asp

REPORTERS WITHOUT BORDERS ISSUES 2007 ANNUAL PRESS FREEDOM SURVEY (RSF, 1 Feb 2007) -- The survey, published on 1 February, reports on press freedom in 98 countries and includes the main violations of journalists’ rights in 2006 and regional aspects of media and Internet freedom...The report lists the worst violations in repressive countries, including major culprits North Korea, Eritrea, Cuba and Turkmenistan, but also looks at democracies, where progress needs to be made too,” the organisation says. Report at http://www.rsf.org/IMG/pdf/rapport_en_md-2.pdf

SUPERIOR LEGAL WEB SITES TO WATCH (Law.com, 22 Jan 2007) -- We delve into our browser’s bookmarks this month, to review the recently launched Web sites of interest to individuals in the legal profession. Topic: BLAWG SEARCH: Several sites help you search the content of blogs, but offer no way to limit your search to law-related blogs. A new tool solves this search shortfall by indexing only the content of legal blogs. Called BlawgSearch, it is the creation of Tim Stanley and his team at the Web site design company Justia. (If Stanley’s name sounds familiar, it’s because he was cofounder of the original FindLaw). It launched in November, with an index of some 600 blawgs, and as of this writing, has more than 1,000, with more being added regularly. The site includes a directory of blawgs arranged by categories and locations, as well as a directory of other blawg directories. The site’s front page lists the most popular blawgs, highlights recent blawg posts and highlights a “featured blawger.” Clouds display tags and search terms. Other topics: Supreme Summary, Trail By Mock Jury, Judicial Profiles, Judicial Profiles, Demographic Data, Legal Reporting. http://www.law.com/jsp/legaltechnology/pubArticleLT.jsp?id=1169028148850

RAPID OPEN SOURCE GROWTH PREDICTED (Eversheds.com, 6 Feb 2007) -- A report on open source software (“OSS”) (software which is intended to be freely shared, improved and redistributed by others) has been published by the European Commission. Carried out by UNU-MERIT (a joint research and training centre of United Nations University and Maastricht University), the 300-page report details the economic impact of OSS globally. The report further recommends (a) avoiding penalising OSS in innovation and R&D incentives, public R&D funding and public software procurement (which it sees as often anti-competitive); (b) supporting OSS in pre-competitive research and standardisation; (c) avoiding vendor lock-in in educational systems by teaching students skills, rather than specific applications; (d) encouraging participation in OSS communities; and (e) providing equitable tax treatment for OSS creators. Report at http://ec.europa.eu/enterprise/ict/policy/doc/2006-11-20-flossimpact.pdf

SOURCES:
1. The Filter, a publication of the Berkman Center for Internet & Society at Harvard Law School, http://cyber.law.harvard.edu.
2. Edupage, http://www.educause.edu/pub/edupage/edupage.html.
3. SANS Newsbites, sans@sans.org.
4. NewsScan and Innovation, http://www.newsscan.com.
5. Internet Law & Policy Forum, http://www.ilpf.org.
6. BNA’s Internet Law News, http://ecommercecenter.bna.com.
7. Crypto-Gram, http://www.schneier.com/crypto-gram.html.
8. McGuire Wood’s Technology & Business Articles of Note, http://tinyurl.com/ywsusp
9. Steptoe & Johnson’s E-Commerce Law Week, www.steptoe.com
10. Readers’ submissions, and the editor’s discoveries.

PRIVACY NOTICE: E-mail addresses of individuals who subscribe to this periodic e-newsletter by sending email to Vince Polley with “MIRLN” in the subject line are kept by Vince Polley; this listing will not be provided to any other persons.