A few weeks ago, the highly anticipated video game Borderlands was released on video game consoles. Many PC gamers were also eagerly awaiting the release, but were forced to wait a little longer when the PC version was delayed for a week. Despite the delay, some industrious gamers were able to purchase copies from stores selling the boxed PC version ahead of its release date. These gamers excitedly returned home, popped in the disc, and installed the game. However, when they tried to play, the online servers refused to authenticate their copies before the release date, so the game did not work.

Why did this happen? According to Hal Halpin of the Entertainment Consumers Association (ECA), unlike console copies of the game, where a purchaser is buying the actual product, purchasers of the PC game are buying a license. The disc that a gamer purchases is only a means of providing the game’s data, not a product in itself. In purchasing a license, one is restricted to the terms that the publisher includes in the End-User License Agreement, or EULA. In this case, the EULA states that the game requires activation, and that the activation will not be made available until the release date. By agreeing to the EULA, consumers are agreeing to these conditions.

Inevitably, early purchasers of the PC version of Borderlands were quite surprised that their copies were temporarily useless. According to 2K Games, the publisher of Borderlands, they shouldn’t have been—the restrictions on activation were outlined in the game’s EULA, presented to the player during the installation process. Then again, who actually reads the EULA? This particular case speaks to a larger problem involving EULAs. They tend to be long, complicated documents that most people skip right over in their eagerness to install and try out the new application or game that they’ve just purchased. However, these documents are important to the consumer, as they outline the terms of the legally binding license that the consumer is entering into by clicking “yes” (hence the term clickwrap).

Publishers should make these EULAs more user-friendly, by simplifying the language used in them, putting the most important parts at the top (where users are most likely to see them without scrolling), and possibly moving towards some type of standardized EULA. Fortunately, the ECA is working to push publishers to create more open, standardized EULAs. If the EULA is made more accessible to the average consumer, then he or she will be more likely to spend a few moments reading it to understand the terms of the license, rather than automatically hitting “yes” to avoid the complicated and lengthy document.

From the Oxford English Dictionary online:

cybersecurity n. – security relating to computer systems or the Internet, esp. that intended to protect against viruses or fraud.

Protecting yourself is hard. Nothing we do in the real world is ever perfectly safe and secure, and yet for some reason people expect that when information has been digitized, it should be safe. Maybe the thought is that if you can’t see what happens to your credit card information when you buy things online, then no one else can either. Wireless internet is almost like magic – you type things into your computer, click a button, and poof! The information just sort of whizzes through the air from your computer to someone else’s computer! Look, ma, no strings!

… Right?

Obviously not, but that’s the way most of us treat digital information. Since we don’t see what happens to it, we think that no one else can.

There have always been hackers. There will always be hackers. There exist protection measures we can take to protect our personal information, and they are pretty good. They are not, however, perfect. MD5, designed in 1991 by Ron Rivest, was one of the most widely-used cryptographic hash functions. A flaw was discovered in 1996, and then in 2004, further analysis revealed that it was much less collision-resistant than it had previously been thought to be. A weakness has also been discovered in SHA1, the other widely-used cryptographic hash function. Because of this, these hash functions are being phased out of use (MD5 is no longer used for protocols like digital signatures, which rely on low collision rates), and will be replaced with a similar function, SHA2. Currently, the National Institute of Standards and Technology is in the middle of selecting a new hash function (SHA3) that will replace SHA2 if – or really, when – its weaknesses are discovered. Similarly, AES (having replaced Triple-DES, which replaced DES) will eventually need to be replaced as its weaknesses are revealed and exploited.

Ultimately, there is no perfect technological solution to cybersecurity: we can implement all the provably correct programs we want, but this will not protect us from people standing behind us as we enter our private information. Even so, this doesn’t mean we can’t do anything. Just because someone might take a sledgehammer to your door doesn’t mean you shouldn’t lock it – there is no reason to grant people easy access to your belongings, whether physical or digital. Just because we can find strings that produce collisions doesn’t mean that it’s easy to find a collision for a specific string. Security (read, “cryptographic”) measures exist. Use them. Don’t be stupid. Sometimes bad things happen. Remember that secrecy does not equal security. And enable https on Gmail, lest Brad read your chat logs.

When I was a sophomore in high school, I turned on my computer one day and realized I couldn’t access the Internet. An error message appeared that said the FCC had shut down Internet access for our household. When we called the number listed on the error message, we learned that one of the computers in our house had been sending out thousands of pornographic images, and some of them included child pornography. After an FCC official examined all the computers in our house, we learned that the source of these images was my 11-year-old sister’s desktop computer. She never used the desktop computer because it was slow and her laptop was faster. Some Russian hacked her computer and used it to distribute large amounts of pornography. So, my sister was technically in possession of child pornography.

In Flores-Figueroa v. United States, the United States Supreme Court examined a pivotal case involving mens rea. The petitioner, Ignacio Flores-Figueroa, was an illegal immigrant who worked in the United States. When his employer asked for his social security number, he made one up. It turned out that the social security number he wrote belonged to someone else, and he was charged with identity theft (he was also charged with illegal entry into the United States and misuse of immigration documents, to which he pleaded guilty). In 2006, a federal grand jury found him guilty of identity theft. Ignacio Flores-Figueroa’s lawyers argued in appeal that he was unaware that the social security number was someone else’s. The Eighth Circuit upheld his original sentence, arguing that knowledge of whether the number belonged to someone else or not was irrelevant. The Supreme Court overturned the Eighth Circuit’s decision. It held that the government has an obligation to prove that Mr. Flores-Figuerona intended to commit identity theft. Justice Bryer’s majority opinion emphasized that in criminal law, courts apply mens rea to every statute. Bryer wrote, “to the extent that Congress may have been concerned about criminalizing the conduct of a broader class of individuals, the concerns about practical enforceability are insufficient to outweigh the clarity of the text.” The Court’s findings in this pivotal case are inconsistent with current laws about child pornography.

In Osborne v. Ohio, the United States Supreme Court explained that laws making possession of pornography a crime, regardless of the circumstances, were constitutional. It is terrifying to think that you might commit a crime without the intent to do so or even knowing that you committed a crime. Laws regarding child pornography have no clause about intent to receive or intent to distribute it. This has troubling consequences. People who didn’t intentionally acquire porn could be punished for having it. A teenager who receives a picture from his girlfriend without requesting it could be prosecuted. Someone who receives an email with child pornography in it would be in violation of the law. Someone who is trying to download a video on Limewire that has a fake label and turns out to be child porn could be prosecuted.

My sister wasn’t charged with possession of child porn, because prosecutors use discretion when deciding who to prosecute. But due process rights should not be contingent upon the discretion of a prosecutor. The Supreme Court decided long ago that the right of every citizen to due process overrides the risk that the guilty should go free.

Of course, it is sometimes difficult to prove intent to possess the pornography. The result of changing the law to require intent to possess child porn (or perhaps even applying a lower level of mens rea to child pornography, like negligent possession) puts the burden on prosecutors to prove beyond a reasonable doubt that people in possession of pornography intended to be in possession of it. The result is that some people who intentionally acquired child porn will walk free. Still, this is a price we must pay. We should not let prosecutors be the arbiters of who is committing egregious crimes and who is not worth prosecuting. Even though it may be difficult to prove mens rea, it should still be the essential element of any criminal act.

In New York v Ferber, the Supreme Court unanimously held that the First Amendment right to free speech does not prevent states from restricting the distribution of child pornography. Indeed, in this uncontroversial decision the Supreme Court held that the “psychological, emotional, and mental health of the child” is of such paramount importance that child pornography need not even be deemed obscene per the test established in Miller v California for regulation to be justified. Public sentiment favoring child pornography laws as applied to adult predators remains strong. Indeed, public sentiment on the issue is so strong that a “my cat did it” defense can seem more likely to succeed than challenging that the behavior is wrong. More controversial however has been the recent application of child pornography laws to protect children from themselves.

Public awareness of “sexting” can perhaps be traced back to the infamous “Swiffer Girl” incident, which involved an eighth grade girl at the Horace Mann School in New York City. The girl filmed herself in three videos engaged in a variety of sexual acts with a Swiffer mop and sent them to a male classmate on whom she had a crush to show him what he was missing. Her classmate, more amused than stimulated by the videos, proceeded to forward the videos to his friends and soon the videos had spread like wildfire, first among the private school elite of New York City and then eventually nationally. The drama that ensued was so severe that the girl was forced to drop out of Horace Mann and move to Florida.

While “Swiffergate” as it became known should have been sufficient evidence of the dangers of “sexting” it seemingly had no such effect. Indeed, according to a survey conducted by the National Campaign to Prevent Teen and Unplanned Pregnancy, one in five teenagers indicated that they have sent or posted naked pictures of themselves. While various educational campaigns such as “Think Before You Click” have been created, police in Greensburg, PA and other localities have taken matters into their own hands and charged teenagers with crimes under the very same child pornography laws meant to protect them. Indeed, while Rick Salomon did not violate any pornography laws by releasing 1 Night in Paris (he did perhaps violate other laws as evidenced by Paris Hilton’s successful civil suit), a child who distributes videos or photographs of sexual acts involving other children can technically be charged as having violated child pornography laws. Interestingly however, the public reaction has been decidedly against this application of child pornography laws.

Despite public opposition, certain applications of child pornography laws to charge children are consistent with both the letter and the spirit of the laws. The “spirit” of child pornography laws that punish dissemination and possession is to protect the child depicted in the pornography (the “victim”) by punishing the distributor or possessor (the “offender”). The application of child pornography laws in the Greensburg, PA case was inconsistent with the “spirit” of the law insofar as it punished, rather than protected, the “victim” creating a sort of “double-victimization” akin to charging runaway children forced into the sex industry with prostitution. Similarly, charging the boyfriends with possession did nothing to protect the “victim” insofar as there was no evidence that they were active instigators, rather than passive recipients. While it is difficult to establish a brightline standard, charging children who have sent a couple of photos of themselves to a couple of people with disseminating child pornography does not make sense.

The application of child pornography laws against children can however be consistent with both the letter and spirit of the law as in the case of Philip Albert of Orlando, Florida. In this case, Albert, after breaking up with his girlfriend, decided to get back at her by maliciously mass e-mailing photos she had “sexted” him. Punishing Albert (the “offender”) is clearly consistent with the objective of protecting his ex-girlfriend (the “victim”). While his ex-girlfriend undoubtedly put herself in a compromising position by “sexting” in the first place, this does not excuse Albert’s behavior any more than a mugger’s behavior would be excused by the fact that his victim opted to take a stroll in a dangerous part of town late at night. Similarly, the fact that Albert is himself a child does not excuse the behavior insofar as we punish children all the time for violating the law (though it might warrant some leniency).

While we should undoubtedly continue campaigns to educate children, so they don’t put themselves in compromising situations in the first place, punishing children who maliciously disseminate child pornography is justifiable as well. Indeed, in the spirit of protecting the victim, charging children who maliciously disseminate child pornography is necessary. If the law were applied as such, “Swiffer Girl’s” crush may have thought more carefully before maliciously forwarding the videos and “Swiffergate” may have been a private learning opportunity, rather than a national life destroying event.

At the end of September, FCC Chairman Julius Genachowski unveiled a plan for net neutrality.  This set of rules solidifies the role of internet service providers as pizza guys and not as news networks—that is to say it explicitly disallows blocking or slowing access to specific applications or services.  Net neutrality keeps the “tubes” free from the prying eyes and interests of those who deliver the info packets to consumers, thus allowing free speech to not only occur but to be disseminated.  The proposed rules uphold the four pillars of network neutrality, which allow consumers to access any lawful online content, application, or services with any legal device in an environment that has sufficient competition among network, content, application, and service providers.  It also adds two more basic principles: ISPs will not be able to discriminate against certain applications or information and they must be transparent about their network management practices.

Senator Olympia Snowe and Senator Byron Dorgan are teaming up with Chairman Genachowski, and have begun to discuss legislation that would help scoot along the proposed net neutrality rules.  Dorgan, the senior member of the Commerce Committee, suggested that the congressional contribution to the initial network neutrality efforts could include some deadlines, to help move the process of adoption along.  The good political feelings might extend across the aisle, thanks to an olive branch extended by Chairman Genachowski which halted the development of a Republican-sponsored amendment that would tie up FCC funding.  That bill however, produced in angry response to the GOP’s disapproval of net neutrality, didn’t have much of a chance because of the Democrat’s hold on the senate majority.

Senate support has also been joined with a thumbs up from representatives of corporate world as Amazon, Facebook, and Google have voiced their approval of these rules in a letter to the FCC earlier today.  They make a pretty good point about net neutrality, suggesting that it will allow more applications to be developed and shared because creators will not be deterred by the possibility of having their content blocked or sidelined.  However, the approval is not universal.  AT&T, Comcast, and Verizon have spearheaded the opposition force, citing, among other things, the difficulties of net neutrality in a wireless interface.

We’re in dire need of some governmental commentary on free speech and the web, as the Red Lion v. FCC case becomes increasingly obsolete.  This case, as Prof. Jack Balkin described today in class, relies heavily on the fact that sound information policy is premised on people’s role as passive information consumers.  Before Web 2.0, they didn’t have the opportunity to easily become active producers of knowledge with a readily accessible audience which includes other content producers.  With the entire business model of today’s new media grounded strongly in a participatory consumer culture, we can no longer apply the rules of the game from when media was a one-sided discussion.