An article in CNET caught my attention – it was a damning review of a new piece of legislation in the US, the (awkwardly named) Securing Adolescents From Exploitation-Online Act (SAFE for short, of course – therefore preventing the development of the Anti-SAFE Coalition 😉 ). Declan McCullagh’s piece opened with this:
The U.S. House of Representatives on Wednesday overwhelmingly approved a bill saying that anyone offering an open Wi-Fi connection to the public must report illegal images including “obscene” cartoons and drawings–or face fines of up to $300,000.
Ah, good, I said to myself. This will be a useful addition to the debate on wifi sharing, which I’ve been thinking about (here, here). And so I read on. And there is some criticism of the proposal and some discussion of the type of images that would be covered. And yes, there’s an attempt to talk about those brought within the scope of the legislation, like this:
That broad definition would cover individuals, coffee shops, libraries, hotels, and even some government agencies that provide Wi-Fi. It also sweeps in social-networking sites, domain name registrars, Internet service providers, and e-mail service providers such as Hotmail and Gmail, and it may require that the complete contents of the user’s account be retained for subsequent police inspection.
That seems even more promising (in terms of understanding the legal position of various types of Internet industry players as well as individuals), although there is a further article including rebuttal from the proposer of the legislation.
There’s a big problem with all of this, though. The definition in the bill (HR 3791) relates to those who act
“while engaged in providing an electronic communication service or a remote computing service to the public through a facility or means of interstate or foreign commerce”.
This sounded awfully familiar, and it wasn’t just the use of ECS in European law that rang a bell. And yes, it turns out that this is a pre-existing legislative formula (see for example 18 USC 2703 on the disclosure of customer records); the definitions themselves are contained in 18 USC 2510 (ECS) and 18 USC 2711 (RCS).
So, no new definition. Got that?
Now, next question. How significant of a legal change is this proposal??
Well, let’s look at the existing provisions of Title 18, §13032b:
(1) Duty to report.— Whoever, while engaged in providing an electronic communication service or a remote computing service to the public, through a facility or means of interstate or foreign commerce, obtains knowledge of facts or circumstances from which a violation of section 2251, 2251A, 2252, 2252A, 2252B, or 2260 of title 18, involving child pornography (as defined in section 2256 of that title), or a violation of section 1466A of that title, is apparent, shall, as soon as reasonably possible, make a report of such facts or circumstances to the Cyber Tip Line at the National Center for Missing and Exploited Children, which shall forward that report to a law enforcement agency or agencies designated by the Attorney General.
And now back to this new legislation
(a) Duty To Report.—
(1) In general.—Whoever, while engaged in providing an electronic communication service or a remote computing service to the public through a facility or means of interstate or foreign commerce, obtains actual knowledge of any facts or circumstances described in paragraph (2) shall, as soon as reasonably possible—
(A) complete and maintain with current information a registration with the CyberTipline of the National Center for Missing and Exploited Children, or any successor to the CyberTipline operated by such center, by providing the mailing address, telephone number, facsimile number, electronic mail address of, and individual point of contact for, such electronic communication service provider or remote computing service provider; and
(B) make a report of such facts or circumstances to the CyberTipline, or any successor to the CyberTipline operated by such center.
(2) Facts or circumstances.—The facts or circumstances described in this paragraph are any facts or circumstances that appear to indicate a violation of—
(A) section 2251, 2251A, 2252, 2252A, 2252B, or 2260 that involves child pornography; or
(B) section 1466A.
See the italicised sections there? Yes, they duplicate the existing legislation – and I accept that the reporting obligations etc are being beefed up, in a way that I disagree with, but it is totally unfair to accuse the drafters of a sloppy definition – they are carefully following the existing template and cannot be faulted for that.
This type of approach to legislation on technology is deeply harmful to a proper understanding of technological issues by parliamentarians and drafters. When such outrage is voiced over a particular aspect that is not being amended, simply because many bloggers or activists don’t check the existing law before slamming the new one (see here for a previous rant of mine on this topic – I think focusing criticism on reenacted sections rather than broader problems gives a free pass to governments), how can we expect any kind of serious conversation between the more legally inclined and the more technologically inclined?
I don’t mean to dismiss McCullagh’s second article – he does refer to the existing Title 18 provisions and clearly did more background research for this piece than for the original – and my real worry is with the chatter that followed his original article, the assumption that there was a nasty piece of legislation creating new terrible obligations for WiFi sharers. If there is a problem (and I think there are many), the problems are with the existing body of law and even if this particular law was abandoned, they would still exist. Indeed, even the lead paragraph of the second article, raising fear on $300,000 fines for failure to report, spectacularly misses the point that failure to report the exact same alleged offences under existing legislation already carries a penalty of up to $100,000. With no change in the definition of who needs to deal with this.
I agree that the definitions of potentially illegal material are too broad but these definitions, too, are (a) existing definitions from other legislation and (b) already covered in the reporting obligations in their broad form. Again, failure of this proposal will not change one comma of the overreaching definition. So all those articles about cartoons and family photos and more have a point – it’s just that many of them have the wrong point!
By the way, for some interesting examples (from caselaw) of what is and isn’t an ECS or RCS, see this helpful page from CyberTelecom here, based on Dept. of Justice information.