The Future of Internet Law: Internet-related Crimes

“Courts around the world are creating Internet law right now–a process that is both exciting and frightening to watch. Unlike other areas of commerce that can turn to historical traditions to help settle disputes and guide the development of the law, the law of the Internet has no history to fall back on.

“Cyber law” is, instead, being developed by judges who must do their best to fit legal disputes on the Internet into pre-existing legal frameworks. As a result, the legal principles governing conduct and commerce in cyberspace are still in a state of flux. Claims of trademark and copyright infringement have already become common place items on the World Wide Web.”

Critically analyze the development and the future of Internet law in the light of Internet related crimes and relevant case law.

1. INTRODUCTION

The end of the twentieth century has been radically changed by the World Wide Web[1], with the Internet and email both effecting and affecting the future of technological development accorded to the upsurge of globalisation in today’s fiscal marketplace [2] and potential opportunities filtering through to the legal profession worldwide[3]. Freely available in the West are all manner of legal documents available for downloading from the Web [4]. Data have become freely accessible in both paper and electronic formats world-wide [5], although not currently obtainable in the People’s Republic, much suppressed if not acceptable to the government [6].

An increasing importance over the burgeoning usage of the latest electronic and communications’ technologies has been realised with significant importance on networks and information systems being maintained. A fundamental vulnerability precludes existing legislation from being applicable, or even adaptable, as revealed in the continuous flow of information through global broadband connections, across state and country boundaries. Clearly, the necessity for increased security measures requires an innovative approach to reflect these sophisticated technological developments.

Differing legislation around the world requires a unilateral system of principles, legal rules and institutions to provide adequate protection against potentially intrusive or inflammatory material that evades the ubiety [7] of existing laws [8]. Particular terminology could also be misconstrued, or interpreted in terms of breaching privacy, human, civil and constitutional rights depending whereabouts in the world a particular violation occurred. As technology continues to advance, intrusive information could be deemed to overwhelm existing legislation where cross-border internet regulation laws provide totally inadequate protection of a society’s constitutional rights and those associated personal rights inherent for each individual.

Ubiquitous legislation based on the ‘Country of Origin’ rule could have considerable consequences in respect of individual countries’ security, especially relevant in the inexorable threat of terrorism. Many omniscient surveillance programmes would be proscribed, subsequently escalating the jeopardy to individual security. According to the Annual Review published by the US State Department, illicit surveillance transpired in virtually 100 countries, with a French exposé edifying over 100,000 surveillance contraventions habitually exploited by government agencies, including the monitoring, from the United Kingdom mainland, of Irish telephone communications’ networks [9]. The UK, United States, Australia, Canada and New Zealand are all known to use the Echelon Surveillance System to ‘track the activities of dissidents, human rights activists, journalists, student leaders, minorities, trade union leaders, and political opponents’ [10].

Latent security risks exponentially increase as wireless technology, such as Apple’s ‘Airport Extreme’ wire-free technology, with data download speeds of 802.11g in 2003 [11] become universally available, accessible from any location without the restrictions of internet points, wires or cables [12]. The risks to security are enormous, not least in the potential for ‘crackers’ [13] to maliciously prevent electronic equipment from functioning, or networks and information systems from maintaining the optimal functions: this involves every single individual around the world. Major malfunctioning of technological equipment has the potential to affect every business, administration and transport link around the globe. Terrorism potential is colossal. Equally substantial is the complexity surrounding adequate and acceptable cyber security in terms of both technological integrity and the sensitive

International issues.

Legislation needs to be introduced that not only adequately incorporates data protection and telecommunications, but also trademark and copyright infringement, e-commerce, defamation and obscenity. Moreover, this needs to be acknowledged as a global issue with legislation recognised and respected globally, a concept ultimately introducing differing definitions of social acceptability and impermissibility. The relevance of potential cyber-crime highlights differences in criminal legislation in dissimilar jurisdictions around the world and creates a new archetype for globally accepted cyber-law to be introduced. No longer are the historical traditions of law likely to facilitate disputes being reconciled due to the unique ethos of cyber-space and the inability for legal disputes on the Internet to be ascribed within a pre-existing legal context.

This essay focuses on the development and future of Internet law in the light of Internet related crimes, together with case law, and discusses how the historical traditions of law are ill-equipped to deal with the modern concepts associated with cyber-law. The first section of this essay discusses the growth of EU legislation surrounding the development in technology, after which the broader issue surrounding the disparity of legislation in different jurisdictions is examined. The implications of the Country of Origin Rule is examined, followed by a discussion on network and information security. One major problem with the internet is that, apart from traversing boundaries, it infringes personal privacy and these violations of cyber-space are a global problem.

Internet legislation and other laws relating to evolving technology relate to a number of countries and this essay has addressed that situation by investigating developing cyber-law in countries other than the UK, especially in view of the continuing debate in the US over the lack of consensus between the First Amendment and new copyright laws. Internet legislation in China is also evolving as the People’s Republic attempts to find a niche within the global economy. The internet laws in these countries have been discussed within the section devoted to global jurisdictions. Trademark and copyright infringement is now relatively common place and a section has been devoted to each of these areas with the conclusion summarising many details introduced in this essay.

2. DISCUSSION

2.1 EU Data Protection Directive

The burgeoning growth in cyber-crime required new policies to be considered. Improvements in network and information security also need to be addressed. Interestingly, it was this emphasis on the inception of the EU Data Protection Directive that, in April 2000, encouraged the Lord Chancellor’s Department in the UK to permit their judges to officially use the internet [14], a liberty previously denied them due to potential security risks in them doing so. It was reported that the Lord Chancellor’s Department considered it increasingly imperative for their judges to be able to access the official EU website following the introduction of the Human Rights Act in October 2001 and to be able to research the internet case law available on the European Court of Human Rights’ website [15].

A proposal for an Electronic Commerce Directive was issued in November 1998 with amendments added on 1^st September 1999, following extensive consultation into regulatory principles for assuring communication security. A European Network and Information Security Agency became imperative, along with various Action Plans being considered by the EU. A limited Data Protection Directive was introduced in July 2003, designed to encompass all modes of electronic communications, including the Internet. In accordance with these new data protection provisions which were to be implemented in all Member States from October 2004 operators are now required to ensure all electronic communications are secure, with infringement proceedings instituted against any Member States that have yet to comply.

Attempts have been made by the EU to avoid any distinction between the dissemination of traditional methods of information and IP-based routes. The Data Protection Directive incorporates all information been transmitted through any means, by any individual to any location, including unsolicited communications such as Spam, which is prohibited, although small businesses continue to be exempt despite its perception as a continuing security issue. The new legislation relates to both SMS and MMS, together with emails, and depends on an ‘opt-in’ system whereby prospective receivers must clarify their interest by agreement prior to receipt of unsolicited data.

Whilst this has been designed to ensure freedom of choice and protection of privacy, additional Protocols are considered in a further attempt to reduce the amount of unsolicited data being transferred. This problem, however, is an international one and needs to be enforced globally by the Internet Community. Article 25(1) EC requires assurance that an adequate level of protection is available between Member States for data being submitted for processing between countries.

2.2 Defamation and Obscenity

The Data Protection Principle in the 1998 Act [Schedule 4] has been updated a number of times, with the eighth edition containing nine exemptions, some of which are mandatory: two of these omissions, however, require prior approval of the Data Protection Commissioner. The Obscene Publications Act 1959 [Section 1] (1) relates to any material that could “…if taken as a whole, such as to tend to deprave and corrupt persons who are likely …to read, see or hear the matter contained or embodied in it” [16]. However, a disparate interpretation is attributed to the perception of obscenity in the United States, with acceptability differing between actual States.

To adequately address the quandary of overlapping jurisdictions’ contradictory content in respect of laws on defamation and obscenity, an appropriate and acceptable definition needs to be endorsed. However, an innocuous paradigm within one community could be construed as totally deleterious within another, as illustrated in the case of United States v Thomas [17] illustrating the disparity between legislation in Tennessee and those in California [18]. In this particular situation it was ruled that the offensive material was received and viewed in Tennessee even though, by Californian standards, no contravention had occurred.

This does illustrate the conundrum attached to a lack of consensus as to what constitutes ‘obscenity’, with no taxonomy or international criterion unanimously acceded [19]. The publication ‘The Working Party on the Protection of Individuals with Regards to the Processing of Personal Data’ [20] does advocate some directive on acceptable levels of protection. Further limited appraisal is also exemplified in EU Article 25(2) with EU Articles 26 and 31 designed to elucidate the procedures.

The ruling given in the 1997 case [22] in the United States Pennsylvania District Court states:

“…the Internet makes it possible to conduct business throughout the world…our review of the available cases and materials reveals that the likelihood that personal jurisdiction can be constitutionally exercised is directly proportionate to the nature and quality of commercial activity…This sliding scale is consistent with well developed personal jurisdiction principles…”.

“Vilification, disparagement, denigration”: all of these terms are either libellous or slanderous. Encarta^© defines libel as ‘a false and malicious published statement that damages somebody’s reputation’, whilst slander is defined as ‘the act of saying something false or malicious that damages somebody’s reputation’ [23]. Many courts still rely on the existing difference in the law of Tort to establish libel or slander through the Internet [24], as in a High Court case in 1999 [25]. The inter-jurisdictional aspect of the internet compounds any cross-border regulation infringement [26].

Case law in the UK extends the application of obscenity to publications pertinent to drug misuse [27] and also explicit violence [28]. Conversely, a Court of Appeal in Canada sustained a previous verdict that ‘the federal child pornography rule as currently drafted breached constitutional rights…constitutes an extreme invasion of the values of liberty, autonomy and privacy protected by the rights and freedoms enshrined in the Charter’ [29]. Clearly, with the perception of obscenity and defamation varying so significantly between countries, illuminating tolerability in overlapping jurisdictions’ and cross-border internet regulations will present persistently multifarious and tortuous liabilities. Guidance has been offered by the British Computer Society, with existing legislation, such as the UK Telecommunications Act 1984 [30] which already incorporates a prohibition on issuing ‘material which is grossly offensive or of an indecent, obscene or menacing character’, now a criminal offence [31], with certain actions acknowledged as a criminal offence.

The Obscene Publications Act and the Ethics Collaborative Open Group are to be reviewed, along with Section 84 of the Criminal Justice and Public Order Act 1994 being updated to include a specific definition of ‘pseudo-photograph’ transmission involving technology and relating to pornographic or obscene material. At present the UK Protection of Children Act 1978 [Section 1] and the Criminal Justice Act [UK] 1988 covers this aspect in Schedule 9 (Section 3), but this is due to be reviewed and incorporated with the Obscene Publications Act 1959 to specify and incorporate ‘publication’ [32].

The Electronic Commerce (EC Directive) Regulations 2002, incorporating the Electronic Commerce Directive, was accepted into UK law. Specifically relevant to regulation of cross-border defamation and obscenity is Articles 12 – 15 which correlate directly with the transmission of information. This includes defamation, along with pornography and indecency laws, with an ‘internal Market clause’ [Article 3] identifying ISSPs as being subject to their own country’s laws, i.e. ‘Country of Origin’. The intention is to bring existing legislation up-to-date, including the 1968 Brussels Convention and the 1980 Rome Convention.

2.3 Country of Origin

The ‘Country of Origin’ rule could well provide a remedy to the perennial predicament of overlapping jurisdiction. New legislation relating to the ‘Country of Origin’ rule should have been implemented by the United States in September 2002. It was severely criticised by Australia, and a number of other countries, with Canada being especially vocal. The EU considered it to be a potential “unwarranted impediment to trade” [33], possibly in response to US criticism of their GMO policy being inconsistent with this ‘Country of Origin’ legislation. A prerequisite of a successful growth in e-commerce is the knowledge that an adequate system of protection has been established, illuminating the need for a satisfactory response to the ‘Country of Origin’ rule.

The dynamic endorsement of unrestricted movement of resources and people epitomises the ethos of the EU. Utilising the concept of a ‘Country of Origin’ rule, the draft Directive recognised that, in eliminating impediments that could inhibit trans-border electronic transactions, consumers would enjoy optimal access to commodities and services throughout the EU Member States. Conversely, instigation of a ‘Country of Reception’ rule would actually diminish consumer protection and could not, for that reason be sanctioned by the EU. Internet access is in the public domain and is synonymous with freedom of communication and information, with the resultant correlation between protection of end users and maintenance of freedom of expression.

2.4 Network and information security

In 1990 the Computer Misuse Act [34] was introduced in an attempt to combat cyber-crimes such as hacking and specifically defined three areas in which criminal liability was recognised:

1. Unauthorised access to computer material

2. Unauthorised modification of computer material

3. Unauthorised access with intent to commit, or facilitate commission, of

further offences.

Hackers break through security codes to attempt entry into another person’s computer, whilst Crackers do so with the intention of creating harm, often becoming involved in computer-related crimes involving vandalism or tagging. Many Crackers become involved in more sophisticated damage, intending to shut down network servers and alter databases through the introduction of self-replicating automated programmes, some of which irreparably destroy data, although the true cost of an average virus attack could cost a business in excess of £4,000 [35].

As a result of personal data increasingly being stored on computers the Data Protection Act was introduced attempting to limit the misuse of personal data and provide certain rights to any person to whom that information relates. Certain Data Protection Principles need to be adhered to by Data Controllers who must apply to the Data Commissioner specifying the nature of the data. An extension of the Data Protection Act was needed, relating specifically to software piracy which costs the software industry in excess of £3,000 million each year, with the result that the Copyright, Design and Patents Act was introduced. This ensures that it is a criminal offence to copy or steal software, or to distribute software or accompanying manuals without permission or licence from the copyright owner. The licence will state whether it is permissible to run copyrighted software on more than one machine concurrently.

The Kok Report [36] and the Spring Council 2004 Report [37] highlighted the “Information for All” strategies and implemented the eEurope Initiatives as a direct outcome of the Lisbon Strategy [38]. The Directive on Electronic Signature was implemented in 1999 in all Member States with electronic standardisation realised in the idea for a Smart Card Action Proposal being considered in the e-Europe 2002 Action [39]. Moreover, through an EU concept to introduce a mandatory European standardisation programme for all security measures, a joint report from CEN [40] and ETSI [41] is awaited whilst standardisation for biometric identifiers has already been identified and a Proposal on Biometrics in Visa and Residency Permits for Third Country Nationals was considered in September 2003 by ISO with an additional Proposal in Passports considered in February 2004.

The EU is endeavouring to introduce a “culture of security” in its Action Plan 2005 [42], with an emphasis on protected infrastructure between organisations, as recognised by the Lord Chancellor’s Department in the UK [43] and realised through the European Network and Information Security Agency [44] [ENISA], an independent corporation based at Heraklion in Greece [45] and functioning through the Management Board through which the legislative powers lie, and a Permanent Stakeholders’ Group through which legislation will be identified and enforced. The role of ENISA as an agency will focus on risk management in relation to security and provide a centralised information and advice administration to tackle all issues likely to present a breach of security within the Member States, leading to the 2010 European Information Society

Initiative “i2010” [46].

2.5 Privacy Violations

One of the Members of Privacy International, Professor Ruth Gavison stated:

“I share the feeling that invasions of privacy through computers and surveillance will become more important in the future, and that an international organisation may have some relative advantage in dealing with these problems than national civil rights groups, committed as they may be” [47].

Infringements of cyber-space remain a global problem and inimical to democratic reforms, with individuals needing to be protected from privacy violations regardless of which country they live in [48]. Mexico’s constitution refers to ‘individual guarantees’ as a euphemism for ‘privacy rights’ which attracts no specific citation. Colloquially, however, prevailing vernacular expresses an individual’s prerogative to privacy: derechos de privacfa or derecho a la privacidad in response to frequent violations within their social strata [49] with no single entry for ‘privacia’ in the Nuevo Diccionario Juridico Mexicano, 2001 edition.

Privacy International was formed in the UK in 1990 to combat this ever increasing threat to civil liberties as the result of electronic surveillance techniques and human rights issues. This organisation is the result of a concerted effort by “more than a hundred leading privacy experts and Human Rights organisations from forty countries” [51] with the threat becoming an ever-increasing problem, revealed in some of the worst offenders being nominated for the “Worst Corporate Invader Award” at a ceremony in Seattle. The 2005 Award went to Brittan Elementary School [52] due to the principal who ‘took pleasure in spying on the whereabouts of the students in direct opposition to parents concerns’ [53].

An Interim Report was published [54] by the London School of Economics & Political Sciences following an investigation into the implications of the UK Identity Card Bill which, it was announced on 6^th April by Home Secretary, Charles Clarke, has now been scrapped due to the General Election and, although it was intended to become part of the election manifesto [55], other priorities appear to have intervened. However, this 117 page Interim Report highlighted serious problems that could result from the use of biometrics in the use of individual security and an individual’s privacy [56]. One of the biggest worries was that “Once information is stolen there is no way to change it”. The excerpt below illustrates just how much concern has been expressed to the Privacy International Organisation:

2.6 Trademark Infringement

Since the insurgence of cyber-space into nearly every aspect of life it has become increasingly necessary to address the issue of trademark and copyright infringement, the responsibility of the Patent Office in the UK and, since 1994, international infringements coming within the jurisdiction of the WIPO Arbitration and Mediation Centre based in Geneva [57]. It was not until 1876, however, that the first Tradesmark Registry was opened in London.

Figure 1: An excerpt from The Identity Project: An assessment of the UK

Identity Cards Bill and its Implications, Page 96 [58]

The Mathys Report on British Trade Mark Law and Practice [59] was published in 1974 [60], following which the Trades Mark Act 1994 set out specific legislation [60]^[1] relating to EC Measures Relating to Counterfeit Goods [61], Part IV of the Patents and Trade Marks (World Trade Organisation) Regulations 1999 [62], Section 6 of the Copyright etc and Trade Marks (Offences and Enforcement) Act 2002 [63], and the Trade Marks (Proof of Use etc) Regulations 2004 [64], all of which comply with the latest EC Directives in accordance with their eEurope 2005 Action Initiative [65].

A particularly recent case was heard on 17^th February 2005 in which the judge, Mr Peter Prescott, QC identified two important legal principles, the first of which he referred to the Secretary of State after Ex Parte Salem [66]. The second principle related to a Derogation under Article 234 and was therefore referred to the European Court of Justice for a preliminary hearing. This particular case revolved around whether Regulation 12 of the Registered Design Regulations 2001 could be considered ultra vires, in which case the judge would rule in favour of Oakley’s Patent Registration. However, if this was not the case then Regulation 12 would retain validity under the old law of Registered Designs Act 1949 [amended 1988] and would result in the Registered Design 2,059,677 being declared invalid in terms of registration because Oakley had actually used the design commercially prior to applying for this particular registration. In other words, under the 1949 Act there was no clause allowing a 12-month “period of grace” between using the design and arranging for it to be registered. However, in the 2001 Act there is such a clause [i.e. Regulation 12].

It was noted that “The Secretary of State had purported to make the 2001 Regulations pursuant to the powers of Section 2(2) of the European Communities Act 1972”. If this was, indeed, the case then EU Directive 98/71 [13 October 1998] would be the deciding legislation in this case as it would have superseded the 2001 Act of Parliament and would, according to Derogation, recognise the validity of the 1949 Act. However, in order to change a specific policy it would have been necessary to make a change to primary legislation in order to impose Section 2(2) on the Registered Designs Regulations 2001, in order to amend clauses within the Registered Designs Act 1949 to reflect the 2001 Act.

In other words, according to the 1949 Act, no clause existed to specify whether a specific design could be used commercially prior to it being registered. However, according to the 2001 Act this was no longer allowable because an additional clause had been included without additional primary legislation being passed in effect, unilaterally, altering policy. In terms of the Derogation contained in EU Directive Article 11.8 “It permitted, but did not require, Member States to keep their old national law on the validity of existing design registrations” [67].

Additionally the Registered Designs Regulations 2001 contravened the Directive because the dates of enactment were the 8^th and 9^th December 2001 when it was a mandatory requirement, according to Article 19, that EU Directive 98/71 was reconstituted into national law before 28^th October 2001, i.e. it had exceeded the deadline set by EU legislation by 5 weeks, invalidating the ‘default’ provision according to Article 6.2 of EU Directive 98/71.

Accordingly, the Derogation allowed that, as long as an Act of Parliament was made prior to 28^th October, 2001 then that would set a future precedent and would become incorporated into the ‘harmonisation of national registered designs’ legislation’. However, in view of the fact that this 2001 Act had been passed outside of the Derogation period then, in accordance with the ethos of EU ‘transparency and legal certainty’ the validity of the 2001 Act could be challenged and the 1949 Act would be the lawfully recognised law.

As he referred this case to the ECJ for a further hearing, Mr Peter Prescott, QC stated:

“If Regulation 12 was valid it would mean that the grace period was not available in favour of Oakley’s registered design, because the 1949 Act contained no such provision. But if Regulation 12 was invalid then the grace period would apply, because the “default” provision as required by the Directive would kick in. That is Article 6.2, see paragraph 53 of my main judgement” [68].

This case is not the only case by any means, with claims of trademark infringement already common place. Just to complicate matters, EU Council Regulation Reference (EC) No 6/2002 on Community Designs was adopted on 12^th December 2001. In accordance with the EU harmonisation programme, all unregistered designs became protected from 6^th March 2002 and, since 1^st January 2003 all registered designs would now be administered from the Office for Harmonisation in the Internal Market, Trade Marks and Designs in Spain.

2.7 Copyright Legislation

Copyright law is by no means a new concept. In the UK maps, books, charts and other literary material have been covered by statute since 1710, when the Statute of Anne included copyright law in an Act of Parliament for the first time, although a Licensing Act covering printed material was passed in 1662 [69].

The Director General of the Federation Against Software Theft stated recently that:

“Copyright protection for software is really the Cinderella in comparison with how copyright protects other works and trademark law. While the Police are able to invoke of Section 109 of the Copyright, Designs and Patents Act 1988 [70], resources from central and local government are simply not being made available. This means that rampant misuse of software continues unabated very often in corporate Britain putting jobs on the line” [71].

One of the benefits of this Act is the fact that it does clearly specify what is, and what is not allowable. Section 32 relates to work that is copied for academic purposes and states:

“Copyright in a literary, dramatic, musical or artistic work is not infringed by its being copied in the course of instruction or of preparation for instruction, provided the copying is (a) done by a person giving or receiving instruction; (b) not done by means of a reprographic process; and (c) accompanied by a sufficient acknowledgement” [72].

The response by the Labour Party was an agreement that copyright laws, together with all intellectual property rights needed to be modernised to ensure that they remain pertinent as technology continues to evolve, implying, however, that the EU should be the organisation to fulfil this criteria. It has been suggested that the UK has one of the highest piracy rates in Western Europe and that “Piracy of film, music and software not only fuels violent crime, but causes enormous economic damage and is fuelled by weak laws that allow copyright to be infringed with impunity” [73].

Whilst piracy might be escalating, it was recently announced that the UK was to be the first country to standardise online gambling regulations through the introduction of a new Internet Gaming Bill to be introduced during 2006/2007. Following the introduction of this new Bill US citizens will be able to take advan