Sunday 18 March 2012

See me, sue me?

When the internet swam into our vision (in my case in 1993), one of the first questions was whether putting up online content that is legal in one country risks exposure to the laws and enforcement of some other country in which the content might be illegal. 

That has happened.  The 1995 CompuServe raid, following which local German country manager Felix Somm was prosecuted and eventually acquitted on appeal, was an early example.  Others followed, such as the 2000 French litigation against Yahoo! Inc. and ultimately unsuccessful criminal prosecution of its then CEO Timothy Koogle, both over Nazi memorabilia on its US auction sites. 

Fast forward to today and we still have to ask the question.  Every so often someone in authority feels the urge to put on blinkers, engage tunnel vision and, casting the internet as chief villain, decide to view the rest of the world as an offshore haven that exists for the sole purpose of subverting his home laws.  This even happens at policy level.  EU and US authorities have both gained deserved reputations for trying to forcefeed other countries, and each other, with their pet legislative agendas.    

In the UK you could argue that we asked for it.  Our libel courts willingly adopted the startlingly parochial doctrine, first espoused in the Australian case of Gutnick v Dow Jones, that any website in the world that can be read and comprehended in the UK is published here.   Asserting our libel laws against the rest of the world on the basis of minimal UK publication provoked the US to pass the SPEECH Act, preceded by New York’s Libel Terrorism Prevention Act.

So is it any surprise if US authorities feel little compunction in trying to enforce their criminal copyright laws against UK-operated websites – even though in common with the USA we have one of the strongest sets of intellectual property laws in the world?  But in this jurisdictional race it is not judges and prosecutors but the everyday citizen who ends up in metaphorical or even real shackles.

Blinkers and tunnel vision come at a cost, most concretely the injustice suffered by unfortunate individuals who fall foul of overzealous local law enforcers in other countries.  The obvious defence is to build firewalls, cutting off the rest of the world from your content.  Even if that were possible it is the worst outcome, inhibiting every kind of discourse across borders.  The geolocation firewall does not discriminate.   

For the first time, thanks to the internet, the promise of Article 19 of the 1948 Universal Declaration of Human Rights – “to seek, receive and impart information and ideas through any media and regardless of frontiers" – has been made good.  That is to be treasured and protected, not destroyed by building walls in cyberspace.

But won’t the least restrictive jurisdictions win out and, in practice, export their values to every other country?  Won’t everyone set themselves up in the country with the fewest laws? 

Some may, and if they do it in order to evade the laws of a particular country, then it may be no surprise if that country’s legal system tries to do something about them.  But even then there is a case for restraint if, as is often the case, the suggested cure is worse than the complaint.  And within Europe, the ECommerce Directive recognises that it is more important to encourage online trade between EU states than to allow member states to enforce many types of national law against websites based in other EU countries.

But the essence of the internet is individual speech and publication.  The hundreds of millions of people who blog and tweet and contribute to discussion forums and set up innovative little websites are not about to migrate en masse to some exotic content haven.  They will stay exactly where they are in their student attics and their homes, with their schools and jobs and families and operate under their local laws.   That is exactly what they should reasonably expect to be able to do, without the fear of the police coming knocking on their door at the behest of some foreign government, and without the fear of being sued because someone somewhere else in the world can see a website that they think contravenes their own country's local law.

So does that mean that people in one country should, if they choose, be able to access material from other countries that might be unlawful at home?  Certainly.  That is the world created by the internet, there is no going back and the sooner governments recognise it the sooner we can bring some sense to all this. 

The important word is ‘choose’.  We can value the ability to choose; or every country can attempt forcibly to export its laws to every other country, resulting in a chaos of conflicting jurisdictions and perceived injustices.  It is one thing for people to have access to a choice of material created under different sets of laws.  It is quite another to extend state power across borders in an attempt to coerce people into complying with every other country’s content laws.

Wednesday 14 March 2012

Copyright extradition FAQ

In 10 days’ time I’ll be speaking at OrgCon on “Have warrant, will extradite – copyright cops go international”. In the meantime, here is a FAQ to whet your appetite.

Q. Surely copyright is a civil matter? How can someone be extradited for that?

UK copyright is both civil and criminal, and has been for many years. An infringer can be sued for infringement in the civil courts, or prosecuted in the criminal courts for a more limited range of criminal copyright offences – or both.

Most criminal copyright offences require a commercial ingredient. All of them require the defendant to have knowledge, or reason to believe, that (put roughly) what was done infringed copyright.

Q. If copyright is about copying, can linking infringe?

If a site links to infringing items elsewhere, it is true that the site will not store any copies of infringing copyright works. But that’s not the end of the story. Copyright legislation sets out a series of ‘restricted acts’, not all of which depend on copying. In particular, it is an infringement to make a work available to the public without the consent of the copyright owner.

In Newzbin, a civil case, the site operator was found to infringe by making movies available to the public, even though it did not store any copies of the infringing films on its own site. The NZB linking files in that case were not simple links, but made downloading practicable by aggregating hundreds or thousands of fragments into one user download. The judge, applying the European Court of Justice decision in Rafael Hoteles, said:
“This service is not remotely passive. Nor does it simply provide a link to a film of interest which is made available by a third party. To the contrary, the defendant has intervened in a highly material way to make the claimants' films available to a new audience, that is to say its premium members. Furthermore it has done so by providing a sophisticated technical and editorial system which allows its premium members to download all the component messages of the film of their choice upon pressing a button, and so avoid days of (potentially futile) effort in seeking to gather those messages together for themselves.”
The judge also found the defendant liable on the separate grounds that its particular behaviour amounted to authorising and inducing copyright infringement by the site’s users.

Newzbin suggests that simple linking does not of itself infringe the making available right. However there may be room for debate about where the line between simple linking and the Newzbin scenario is drawn.

Q. Didn’t the TV-Links case say that linking wasn’t a copyright offence?

TV-Links was a criminal prosecution. The site consisted of user submitted links. The judge said:

“The site operators would not know when a link was placed on its site by members of the public. When it learned, if it did, of a link that had been placed on its site, the defendants would not know what that link was, unless those who had placed the link onto TV-Links’ site also provided an accurate description of what the link was. The operation of the site was entirely in the hands of the public in the sense that they placed the links on the site that pointed the way to sites from which material could be accessed. … It was not disputed that when the attention of TV-Links was drawn to material on a site to which it had a hyperlink (and where such material was said to be in breach of copyright) the defendants took immediate steps to block access to such a site.”
On the question of making available, the judge found that it was the linked-to sites, not the linking site, that made works available to the public.

In the O’Dwyer case the prosecution sought to distinguish TV-Links on the basis of three aspects of the alleged conduct, recited by the district judge in the magistrates court as follows:

1. “Both TVShack websites were entirely in the hands of Richard O’Dwyer and his co conspirators requiring third parties to sign up to TVShack and be vetted before going further.”

2. “There was no attempt to protect copyright.”

3. “O’Dwyer knew materials were subject to copyright and actively taunted already cited efforts in June 2010 to seize TVShack.net.”

The prosecution also argued that O’Dwyer was “intimately involved in deciding who was allowed to post links on the TVShack website, which links would be posted…”.

O'Dwyer said that he was not guilty of the charges against him.  He stated that his site "worked exactly like the Google search engine ... (it) directed users through the use of searches to websites ... at no point was there any infringing material, such as movies or programmes on my server.  It just directed users to other websites by providing the link."

The judge concluded:
“there is much in the distinction factually, remembering that these matters are allegations of conduct which a trial court alone can resolve – that [the prosecution] contends between the instant matter and [TVLinks].”
He decided that the conduct alleged by the prosecution in the extradition request would be an offence in the UK. That conclusion is at the heart of the public controversy over dual criminality in the O’Dwyer case.

Q. How are the facts established in an extradition case?

Extradition cases are decided on the basis of the conduct alleged against the defendant. Reasonable grounds for suspicion have to be established. The court deciding on extradition is not supposed to conduct a mini-trial to decide whether the allegations are justified. That is the province of the trial court in the requesting country. For many requesting countries there is no requirement to produce evidence in the UK court to support the allegations.

Q. How can a country extradite someone who has never set foot there?

In the most typical extradition situation some at least of the defendant’s conduct has to have occurred in the requesting territory. However, the courts have recognised that crimes can be committed remotely. So someone who sends a letter bomb from one country to another commits an act in the territory to which the letter was sent. If the defendant intended the effects of his actions to be felt in another country, his conduct will be treated as having occurred there.

Q. Where does conduct occur on the internet?

For extradition purposes the existing “intended effects” principle may apply, or it may be argued that technical aspects of conduct in fact took place in the requesting territory. But either gives rise to a problem that is increasingly familiar in cross-border internet cases, whether civil or criminal.

By default a website is visible cross-border. Does that mean that the site owner is exposed to the law and jurisdiction of every country from which it can be accessed? In the language of extradition, is the website operator automatically taken to intend the effects of his actions to be felt in every country from which users can access the site? Or does there have to be more than that, and if so what?

There are almost as many different answers to these questions as there are different types of liability and countries. Answers that veer towards the ‘mere accessibility’ end of the spectrum are tempting as a means of asserting local law, but have severe extra-territorial consequences. Maximising cross-border exposure to multiple jurisdictions carries a high risk of chilling the free flow of legitimate information across borders.

Q. Does the alleged conduct have to be a criminal offence in the UK as well?

In many extradition cases, including to the USA, yes - dual criminality has to be shown. This can be a highly technical exercise. The result may depend critically on how the court constructs the hypothetical scenario in which the alleged conduct is geographically transposed, so as to determine whether it would be an offence here.  It is particularly important to get that right in a copyright case, since copyright is itself a territorially limited right.

Q. What if the UK can also prosecute?

Historically the paradigm extradition case was someone who committed a crime in one country, then fled to another. Only the requesting country would have jurisdiction to prosecute. As communications improved, so it became possible for a crime in one country to be plotted, and possibly committed, remotely from another. Criminal jurisdiction rules and extradition place of conduct rules became less strict in response, enabling a person to be extradited from the country in which he carried out most or all of the physical acts.  In that situation the authorities in both countries may have the ability to prosecute.

Many argue that where significant conduct takes place in the UK, then the UK court should be able to consider refusing extradition if the requesting territory is an inappropriate forum for trial.

At present, if the connection with the requesting country is sufficiently tenuous that it amounts to exorbitant jurisdiction, then the UK court can refuse extradition on human rights grounds. Otherwise it cannot consider forum.

The internet takes forum concerns to a new level. Far from the paradigm of one obvious victim country, a website is by default available worldwide. If any extradition partner can seek extradition from the website operator’s home country simply because users have accessed the site from the requesting country, then the site operator faces extradition exposure to any one of a series of countries, none of which has as close a connection with the alleged offence as the home country. Any protection then offered by dual criminality is scant comfort. It is unlikely to be at all obvious that any requesting country has the main interest in prosecuting and is best placed to do so.

The Extradition Act 2003 in fact contains provisions, not brought into force, that if a significant part of the conduct alleged to constitute the extradition offence is conduct in the UK, then extradition should be barred if in view of that and all the other circumstances it would not be in the interests of justice for the person to be tried in the requesting territory.

The Scott Baker Extradition Review currently being considered by the Home Secretary recommended against bringing these provisions into force. The word ‘internet’ appeared not once in the report’s entire 486 pages.

Sunday 4 March 2012

Hello Tamiz, goodbye Godfrey

Last Friday, in Tamiz v Google Inc, Google successfully challenged the English court’s jurisdiction to hear a libel claim against it founded on comments posted to a blog hosted on its Blogger platform.  Mr Justice Eady held that Google was not a publisher of the comments, even after notification of the complainant’s objections. 

Tamiz marginalises Godfrey v Demon Internet, the original English internet defamation case decided in 1999.  Godfrey held that an ISP that hosted Usenet newsgroups, since it had chosen to store the newsgroup in question on its servers and was able to obliterate postings to the newsgroup, was a publisher at common law.
Determining the defamation liability of an internet platform is now becoming a much more fact-sensitive and nuanced affair, heavily influenced by the need to have regard to the fundamental right of freedom of expression secured under Article 10 of the European Convention on Human Rights.  The decision in Tamiz moves a step further away from the rigid traditional doctrine that for defamation purposes anyone who participates in publication is liable as a publisher, unless saved by any specific defences available to intermediaries. 
In Tamiz the claimant over a three month period sent Google a series of complaints about a total of six different comments on a blog article.  He also complained about the original blog article, but ultimately did not sue over that.  Some three weeks after the last complaint, Google notified the blog owner who removed the article and comments within a few days.
Google argued that it neither could nor should be expected to investigate and determine the truth or falsity of allegations made by bloggers. With half a trillion words on the Blogger platform, and 250,000 new words added every minute, it would be unrealistic to attribute responsibility for publication of material on any particular blog to Google, whether before  or after notification of a complaint.
The judge commented:
“The position may well be fact-sensitive. Liability may turn upon the extent to which the relevant ISP entity has knowledge of the words complained of, and of their illegality or potential illegality, and/or on the extent to which it has control over publication.”
He agreed that notification of a complaint did not immediately, automatically or necessarily convert Google’s status or role into that of a publisher.  Likening Google’s position to that of the owner of a wall which has been festooned overnight with defamatory graffiti, he observed that Google was not required to take any positive technical step in the process of continuing the accessibility of the offending material, whether notified of a complainant’s objection or not.  On the evidence Google’s role as a platform provider was purely passive.  It was not a publisher at common law and so had no need to rely on any defence. 

For good measure the judge went on to consider the position if he was wrong about Google’s status, holding that if Google was a publisher at common law it would still have been able to rely on the intermediary defences under both the Defamation Act 1996 and the ECommerce Directive.
From the perspective of what the law ought to be, cutting back the broad common law doctrine of participation in publication is to be welcomed.   The doctrine cast too wide a net in pre-internet days, let alone post-internet.
Godfrey v Demon Internet represented an application of unvarnished traditional doctrine to the internet.  Eady J in Tamiz noted that Godfrey was decided 18 months before the Human Rights Act 1998 came into effect.  He stressed, as he did in Metropolitan International Schools (the case in which Google was held not to be a publisher of search engine snippets), the need to take into account the fundamental right of freedom of expression.  It was important to guard against imposing legal liability in restraint of Art 10 ECHR where it is not necessary or proportionate to do so.   
However, where does Tamiz leave the state of the law on common law publication?  Eady J acknowledged that:
“It is probably fair to say that none of the decisions so far relating to the role of Internet service providers (ISPs) has definitively established, in general terms, exactly how such entities fit into the traditional framework of common law principles”
and that he was ‘striving to achieve consistency in the court’s decision-making’. 

Indeed only two months ago in Davison v Habeeb, another case concerning the Blogger platform in which Google Inc challenged jurisdiction, HHJ Parkes QC held that Google was arguably a publisher of the blog articles complained of.  In that case, as in Tamiz, Google notified the blogger of the complaint after it was received.  The blogger did not remove the articles.  Google did so on a voluntary basis once proceedings were commenced. 
Notwithstanding Eady J’s striving to achieve consistency, much remains unclear.  In Tamiz and Davison we now have two first instance decisions concerning the Blogger platform which have reached different conclusions as to common law publication by Google, on facts which while not identical have much in common.  Are we to conclude that the fact that Davison related to blog articles, whereas Tamiz concerned comments posted in response to a blog article, is a significant point of factual distinction?  Or should we regard the decisions as inconsistent? 

While Tamiz tells us that notification is not necessarily sufficient for a host of a blogging platform to be a publisher, it does not go so far as to say that it could never become a publisher, or give much guidance as to when (if ever) the line might be crossed.  In Tamiz the judge appears to have set some store by Google’s forwarding of the complaint to the blogger (as it also did in Davison), but did not say whether the position would have been different had it not done so.
It is common ground in all the decisions that publication has to involve a mental element.  A merely passive role as a platform provider does not suffice.  In Bunt v Tilley Eady J held that the crucial consideration was whether a person had ‘‘knowing involvement in the process of publication of the relevant words.  It is not enough that a person merely plays a passive instrumental role in the process.’  In order to impose legal responsibility upon anyone under the common law for the publication of words, it was essential to demonstrate that they had a degree of awareness that such words existed, or at least an assumption of general responsibility.

On the basis of Tamiz, while a degree of awareness of the existence of the relevant words may be necessary for legal responsibility, it is not necessarily sufficient.
In Godfrey, Demon Internet as the ISP hosting the Usenet newsgroup to which the defamatory statement was posted was held to have had a more than passive role: 

“I do not accept [counsel’s] argument that the Defendants were merely owners of an electronic device through which postings were transmitted. The Defendants chose to store ‘soc.culture.thai’ postings within their computers. Such postings could be accessed on that newsgroup. The Defendants could obliterate and indeed did so about a fortnight after receipt.”
The main factual basis on which Godfrey is said to be distinguishable from Tamiz seems to be that Demon chose to host the Usenet newsgroup in question.   That now appears to be an increasingly slender point of distinction, the more so since soc.culture.thai would have been only one of many thousands of newsgroups hosted by Demon at that time.  The judgment contains no discussion of the extent to which Demon may or may not have selected which newsgroups to host.  Further, there would have been many postings within each newsgroup, in which case it is debatable how choosing to host a newsgroup can amount to knowing involvement in the process of publication of the relevant words.

Final resolution of the issues raised by Tamiz and Davison will have to await a decision of an appellate court.  It should also be remembered that in those cases and also in Bunt v Tilley the claimant acted in person, without legal representation. 
However, it does seem increasingly clear that Godfrey v Demon Internet represents the high water mark in mechanistically applying the traditional pre-Human Rights Act defamation rules regarding publication.  Notwithstanding the attempts of later courts to distinguish Godfrey on its facts, if Tamiz is right then it must now be doubtful whether Godfrey would be decided the same way today.  If not already flatlining, Godfrey may fast be approaching its terminal phase.