Ethics, Week 13, December 1 Ellen's situation: * deleting records is very dicey, although if they're just data you were experimenting with things might be different. * Talking to her boss is more or less inevitable * Real issue is what she *says* Final exam: next Monday, Dec 8 Paper will be accepted up through Friday, Dec 12, but then I need to get grades in. ============================================================================= Trust with all the concern about online theft, why do we trust online merchants at all? For that matter, why do we trust people we've met on facebook, etc? Why we trust online sites: * we check out companies (at least some of us do) * lack of bad experiences * belief bad things won't happen to us * CREDIT CARD LIMITED LIABILITY Technological issues & trust: Old-style PGP (Pretty Good Privacy) trust: You need to VERIFY people's public keys (that the key matches the person). Otherwise you can get a bad key, write to them using it, and be victim of a man-in-the-middle attack. (public key crypto: each person has a public key and a private key. If someone encrypts a message to you with your public key, you can decrypt it with your private key. Similarly, if you encrypt something with your private key, anyone can decrypt it with your public key, **and in the process verify that it was encrypted with your private key**. That last bit means that the message can act as your DIGITAL SIGNITURE.) How can we be able to TRUST our keys? Alice needs Bob's key. 1. She can meet Bob at a key-signing party. Bob can give her his key hash. 2. She can ask Chuck. Chuck says Bob's online keyhash is legit. 3. She can decide NOT to trust Chuck, at least about Bob, and ask Dora instead. Dora has never met Bob, but got Bob's keyhash from Ernie, who has. 4. She can ask someone who has a large group of signed verifications of keys. Three of them are signed verifications of Bob's key. SSL certificates (TLS certificates) SSL = secure socket layer, old name TLS = transport-layer security, new name Any pair of entities can negotiate a session key: * each gets others public key * each chooses some bits at random, encrypts with others' public key * exchange these; other side decrypts * now pick one key, or xor them, or concatenate them, or whatever. BUT: how do you know you're not about to give your credit card to a bad guy with whom you've just created a session key? ask landsend.com for cert get it. It includes signatures by well-known CAs. It also includes DNS name. CHECK it by using known public key from one of the CAs. These keys are preinstalled in your browser. prevents man-in-the-middle attacks won't help if router or DNS is hacked their SSL server uses public-key encryption to sign something with the current date/time; replay isn't feasible either. What does this have to do with TRUST? Do you trust the CAs listed in your browser? Huh? Edit => Preferences => Advanced => Encryption => View Certs ================================================== Note this is powerless against phishing attacks Although the new Extended Valuation SSL Certs *might*. *Might*. ================================================== Back to why we trust online vendors: * we check out companies (at least some of us do) * lack of bad experiences * belief bad things won't happen to us * credit card limited liability (not applicable to debit cards!) * ??? Overall, it seems that lack of bad past experience has the most to do with why we trust. What about personal sites? (Not necessarily dating, but those too.) How do we form online friendships (eg at discussion sites)? What makes us think people aren't completely deceiving us? What about in *face-to-face* settings? Is that any different???? ======================================================================= ======================================================================= Jurisdiction online jurisdictional issues: where did the sale take place? This one is big! lawsuit jurisdiction Traditional three rules: * PURPOSEFUL AVAILMENT: did defendant receive any benefit from the laws of the jurisdiction? If you're in South Dakota and you sell to someone in California, the laws of California would protect you if the buyer tried to cheat you. Generally, this is held to be the case even if you require payment upfront in all cases. * where act was done * whether the defendant has a reasonable expectation of being subject to that jurisdiction ================== eHarmony lawsuits, for alleged discrimination against homosexuals eHarmony is headquartered in California New Jersey lawsuit by Eric McKinley, 2005 California lawsuit by Linda Carlson, 2007 How does jurisdiction apply? Should it have applied in New Jersey? Is the fact that users must enter their address the deciding factor? ================== sales trademarks libel/defamation criminal law ================================== laws governing sales: seller can sue in his home state/country This is more or less universal. ================================== laws governing trademarks: Trademark scope blue note cafe: NYC The Blue Note, St Louis St Louis blue note won; NY agreed its court did NOT have jurisdiction. St Louis club had a purely passive web site, although it did sell online tickets. ****** Decided on JURISDICTIONAL grounds NY did *not* have jurisdiction Domain names zippo v zippo zippo lighters v zippo.com trademark infringement filed under PA *state* law PA "long arm" statute zippo.com had email customers in PA, and two ISP customers. (1) the defendant must have sufficient "minimum contacts" with the forum state, (2) the claim asserted against the defendant must arise out of those contacts, and (3) the exercise of jurisdiction must be reasonable. We find Dot Com's efforts to characterize its conduct as falling short of purposeful availment of doing business in Pennsylvania wholly unpersuasive. At oral argument, Defendant repeatedly characterized its actions as merely "operating a Web site" or "advertising." Dot Com also cites to a number of cases from this Circuit which, it claims, stand for the proposition that merely advertising in a forum, without more, is not a sufficient minimal contact. [FN7] This argument is misplaced. Dot Com has done more than advertise on the Internet in Pennsylvania. Defendant has sold passwords to approximately 3,000 subscribers in Pennsylvania and entered into seven contracts with Internet access providers to furnish its services to their customers in Pennsylvania. ****** Decided JURISDICTIONAL issue, plus others PA had jurisdiction ================================================== Cybersquatting: See www.networksolutions.com/legal/dispute-policy.jsp Uniform Domain Name Dispute Resolution Policy -- ICANN Evidence of Registration and Use in Bad Faith. For the purposes of Paragraph 4(a)(iii), the following circumstances, in particular but without limitation, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith: (i) circumstances indicating that you have registered or you have acquired the domain name primarily for the purpose of selling, renting, or otherwise transferring the domain name registration to the complainant who is the owner of the trademark or service mark or to a competitor of that complainant, for valuable consideration in excess of your documented out-of-pocket costs directly related to the domain name; or (ii) you have registered the domain name in order to prevent the owner of the trademark or service mark from reflecting the mark in a corresponding domain name, provided that you have engaged in a pattern of such conduct; or (iii) you have registered the domain name primarily for the purpose of disrupting the business of a competitor; or (iv) by using the domain name, you have intentionally attempted to attract, for commercial gain, Internet users to your web site or other on-line location, by creating a likelihood of confusion with the complainantŽs mark as to the source, sponsorship, affiliation, or endorsement of your web site or location or of a product or service on your web site or location. ======== Also AntiCybersquatting Consumer Protection Act. Some form of bad faith is usually necessary. But not always, if the effect is to resemble a famous trademark and if you have good lawyers. Sometimes the only "bad faith" or "intent to profit" is the offer of the domain holder to settle the case by selling the domain to the plaintiff. ****** All this is really about trademarks, not about jurisdiction vw.net: virtual works http://www.news.com/2100-1023-238287.html Peculiarity: vw.net offered to sell the name to volkswagen, and threatened to auction the name off if volkswagen did not buy. This triggers a presumption of domain-name squatting. "A federal appeals court in Virginia [2001] affirmed a lower court's ruling that online service provider Virtual Works Inc. violated the 1999 Anticybersquatting Consumer Protection Act when it registered the domain vw.net with the intent to sell it to Volkswagen of America." "Grimes' deposition reveals that when registering vw.net, he and Anderson specifically acknowledged that vw.net might be confused with Volkswagen by some Internet users," Wilkinson wrote. "They nevertheless decided to register the address for their own use, but left open the possibility of one day selling the site to Volkswagen 'for a lot of money'." See vwx.com Also, virtual works never used the abbreviation "vw" except in the domain name. They (vw.net) lost. american.com: cisco, now a private 'zine (the airline is aa.com) gateway 2000 v gateway.com gateway.com was a computer consulting firm, run by Alan Clegg. There was absolutely no evidence that Clegg foresaw that in the year 2000 the name gateway2000.com would become obsolete, and reserved gateway.com in anticipation of a domain sale. yahoo.com v yahooka.com [which see] Case was actually never filed ================================================================= state-law libel A state court in Clayton v. Farb, 1998 Del. Super. LEXIS 175 (Del. April 23, 1998), found that Delaware's long arm statute did NOT reach the defendant, who posted allegedly libelous and slanderous false statements about the plaintiff on his Internet site. The statute provided for jurisdiction over tortious activity outside of Delaware ONLY if defendant regularly conducted business in the state. The court found that access in Delaware to defendant's Internet posting did not constitute sufficient contact to support the exercise of personal jurisdiction. ****** Decided on JURISDICTIONAL grounds DE did *not* have jurisdiction Laws governing libel: Truth is a defense, but can be expensive to prove. If you say something false about a public figure, they have to prove actual malice. If you say something false about anyone else, all they have to prove is that you were negligent. We've seen Batzel v Cremers. Cremers *lost* on the jurisdiction issue. But what if the legal climate in the Netherlands was different for libel lawsuits? What if in the Netherlands the burden of proof lay with the plaintiff to prove something false, and Cremers was sued in a jurisdiction (eg England, which *still* has pro-plaintiff libel laws) where the burden of proof lay with the defendant? ========================================================================= ========================================================================= ============================================================== Trusting software: how do we do this? What responsibility do vendors have? is there an obligation for software to work on our behalf? a "fiduciary obligation"? Trusting your email software; trusting your browser See stopbadware.org Badware is software that fundamentally disregards a user’s choice regarding how his or her computer will be used. You may have heard of some types of badware, such as spyware, malware, or deceptive adware. Common examples of badware include free screensavers that surreptitiously generate advertisements, malicious web browser toolbars that take your browser to different pages than the ones you expect, or keylogger programs that can transmit your personal data to malicious parties. What about DRM? What about Windows? Most is spyware or viruses or some inappropriate "control" software (eg Sony's) stopbadware.org definition 1. If the application acts deceptively or irreversibly. 2. If the application engages in potentially objectionable behavior without: * First, prominently disclosing to the user that it will engage in such behavior, in clear and non-technical language, and * Then, obtaining the user’s affirmative consent to that aspect of the application. See also stopbadware.org/home/guidelines Also see stopbadware.org/home/alerts: RealPlayer!!! KaZaa Spyware Striker Pro (ironically, this is NOT "fake" spyware-removal software!) We've seen that people form trust relationships based on a fairly limited set of positive experiences (though a limited set of negatives, as well). Sometimes it seems that software has a lot to live up to, in that we trust it because we don't *see* bad experiences, but it is so easy for software to take advantage of us. * collecting personal information * sony "rootkit" cd driver Email: who is responsible for keeping you safe from spam? From embedded tags in html that reveal to the sender if you've viewed the email? The images issue has been around for almost a decade; many email vendors (and many freemail providers) have been reluctant to support image-blocking until the last year or two. (There may be non-conflict-of-interest reasons for that: it may be perceived as a hard-to-understand option.) Browsers: browsers do all sorts of identification of themselves when they connect. Some of that is important; some is questionable. Most browsers do not leak "private" information. Try http://www.jms1.net/ie.shtml, with internet explorer. What about cookies? Many browser PLUGINS *do* leak some degree of private information. When you register a plugin, you connect some personal information to that plugin. Also, some plugins contact the mothership at regular intervals. See spywareremove.com/remove-BrowserPlugins SEVERAL media players (plugin or otherwise) may do some checking of licenses or with mothership before allowing play. Perhaps most players from media companies behave this way. What about compatibility lock-in? ======== To what extent should your OS be required to act on your behalf? Palladium (aka Next-Generation Secure Computing Base): locks you out of lots of things. Trusted side: can't be reached by debuggers or viruses Problem: machine now is autonomous; vendor has complete control. Software updates, file compatibility, ================================================================ SONY case has the rights of users front and center. Sony's 2005 copy-protection scheme : that installs a private CD driver AND a hidden "r00tkit" that conceals itself and hides some registry keys. Is this legit? How does it compare with Palladium (secure-computing platform)? Users *do* click on a license agreement. Were they sufficiently warned? (Software may have been installed before the EULA came up; clearly the EULA did not explain just what was going on.) Note from Mark Russinovich, via wikipedia: He also mentioned that the XCP software installed silently before the EULA appeared, that the EULA does not mention the XCP software, and that there was no uninstaller, all of which are illegal in various ways in various jurisdictions. Several comments to the entry recommended a lawsuit against Sony BMG. There is now a virus/worm out that takes advantage of the sony kit. Sony issued an uninstall utility that didn't actually uninstall the software, but did make it visible. However, users had to supply an email address, which by Sony's privacy policy was eligible for spamming. This or a later removal kit ADDED a bad ActiveX control. ====================================================================== Trusting voting machines If we trust our phones and calculators, why on earth shouldn't we trust voting machines? Because nobody will *gain* from secretly having our phones and calculators give incorrect results. (And there *are* now phone viruses) Show the video at itpolicy.princeton.edu/voting/videos.html Question to think about and for discussion: Who are we trusting when we use these machines in an election? How is this trust different with paper ballots? Why did they make the video (versus just writing a paper)? Notes: just booting with a clean memory card does NOT necessarily clear the machine! The bootloader in flash memory may have been corrupted. Machine loads a new bootloader from every card with a file fboot.nb0 seals (which Diebold recommends) are often ignored, and if not then breaking them constitutes an effective DoS attack. ================================================== ====================================================================== ============================================================== What about linking? * is a link to a defamatory site a form of defamation? (It probably depends on the context) * is a link to "illegal" software forbidden? 2600 case: * what about linking to other sites: bandwidth trademark avoidance of advertising cussedness/control search engines do this CONSTANTLY. For a while this was a serious issue, but it seems to be flaming out. Lots of sites still have bizarre linking policies, though. dontlink.com Universal v Reimerdes: from wikipedia: In particular the Second Circuit ruled that linking on the Internet happened so fast that it could be restrained in ways that might not be constitutional for traditional media. ===================================================