{"id":2368,"date":"2015-11-06T08:37:08","date_gmt":"2015-11-06T12:37:08","guid":{"rendered":"https:\/\/www.bu.edu\/bulawreview\/?page_id=2368"},"modified":"2019-11-28T18:17:49","modified_gmt":"2019-11-28T23:17:49","slug":"bambauer-cyber-exploitation","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/bulawreview\/bulronline\/bambauer-cyber-exploitation\/","title":{"rendered":"Cyber-Exploitation and Distributed Enforcement"},"content":{"rendered":"

Jane R. Bambauer<\/a> & Derek E. Bambauer<\/a>*
\n<\/a><\/strong>Online Symposium: Danielle Keats Citron’s\u00a0Hate Crimes in Cyberspace<\/em><\/b><\/span>
\n95 B.U. L. Rev. Annex 37 (2015)<\/strong><\/span><\/p>\n

PDF<\/a><\/p>\n

Many thanks to Danielle Citron and to the Law Review for inviting us to comment on her important and thought-provoking book, Hate Crimes in Cyberspace<\/em><\/a>. To us, the most striking finding in the book is that we lack not laws but law enforcement. In many cases, victims meet with indifference from police or prosecutors, despite clear-cut evidence of crime. Statutory prohibitions on Internet stalking<\/a>, harassment<\/a>, revenge porn<\/a>, and other violations provide little benefit if they lie unused. Successful enforcement actions are sufficiently rare to warrant significant<\/a> media<\/a> attention<\/a>. Part of Citron\u2019s solution is to shift perceptions and norms around these types of cyberspace attacks, using workplace sexual harassment<\/a> as a model<\/span>. This is valuable work, but it has a relatively long time horizon.<\/p>\n

In the near term, at least, we advocate for greater distributed enforcement, through measures such as tort claims and copyright litigation. If victims are given better tools to identify and bring claims against their harassers, a small subset who are willing to do so can perform effective work as \u201cprivate attorneys general.\u201d1<\/span><\/span><\/a><\/sup>\u00a0Such efforts can punish their individual harassers and deter the harassers of many others. Private actions theoretically should be an attractive part of the solution to the problems that Citron identifies, since they place blame and costs on the most culpable individuals. Such efforts, though, must grapple with the inevitable trade-off between privacy and personal security.2<\/span><\/span><\/a><\/sup>\u00a0We argue here that facilitating private litigation is worth its privacy costs. If it isn\u2019t, that finding is enlightening in itself\u2014if the most direct forms of legal accountability are hampered by countervailing policy considerations, the indirect forms will be even more challenging.<\/p>\n

First, consider the benefits of private actions. Tort claims provide a valuable model for how distributed enforcement against cyber-exploitation might work. First, torts benefit from a long common law history of evolution and adaptation, making them familiar and flexible for judges. Indeed, Citron\u2019s own work looks to tort law to solve information-based harms.3<\/span><\/span><\/a><\/sup>\u00a0Plaintiffs have drawn upon tort to deal with challenges unique to the information age, such as spam,4<\/span><\/span><\/a><\/sup>\u00a0Web site scraping by bots,5<\/span><\/span><\/a><\/sup>\u00a0and identity theft.6<\/span><\/span><\/a><\/sup>\u00a0Second, tort law includes limiting principles that help ensure liability attaches only for serious harms7<\/span><\/span><\/a><\/sup>\u00a0and that protect freedom of expression.8<\/span><\/span><\/a><\/sup>\u00a0Those features operate to police the dividing line between hate speech and hate crimes, ensuring that protected speech is not chilled. Third, tort law authorizes punitive damages for malicious or willful unlawful conduct. Punitive damages deter effectively by offsetting (at least partially) the risk of underdetection.9<\/span><\/span><\/a><\/sup>\u00a0And, they increase the victim\u2019s potential recovery, which makes her case more attractive to plaintiffs\u2019 lawyers. While federal law shields intermediaries from liability,10<\/span><\/span><\/a><\/sup>\u00a0tort claims empower victims to go after those who have violated their rights regardless of whether law enforcement or prosecutors see the case as worth their time.<\/p>\n

Similarly, copyright law is principally enforced by private parties. And, because copyright remedies include injunctive relief and operate against third parties,11<\/span><\/span><\/a><\/sup>\u00a0it is particularly potent as a tool for attacking the unauthorized release of intimate media, including revenge porn. As much as 80% of revenge porn images are selfies, enabling victims to file take-down notifications with Internet platforms, sue intermediaries that ignore the notices, and enjoin violators from re-distributing the pictures.12<\/span><\/span><\/a><\/sup>\u00a0In some cases, victims will be able to obtain statutory damages for successful copyright infringement claims, creating deterrence and increasing access to counsel.13<\/span><\/span><\/a><\/sup>\u00a0Copyright is an underrated tool<\/a> in the arsenal for combatting cyber-exploitation.<\/p>\n

Citron urges Web site operators to design for better, more civil interactions among users. Web sites that are designed for accountability of their users will also assist harassment victims who decide to bring private actions against their tormenters. But these changes to Web sites have privacy implications that Citron and others might find unpalatable.14<\/span><\/span><\/a><\/sup>\u00a0To police user-generated content effectively, sites will have to focus on users, not just the material they post<\/a>. Anonymous comment threads are the bane of the Internet, and on pseudonymous sites, users easily bounce among names and identities. Banning trolls requires knowing some information about them\u2014an IP address, e-mail address, Facebook log-in, or the like. That data helps both sites and users impose consequences for bad behavior: blocking a particular account from posting, downvoting their comments, and initiating litigation. Trolls can be more easily banished back under their bridges and hence may be less likely to crawl out in the first place.<\/p>\n

However, measures that make users more identifiable apply to travelers and trolls equally. Privacy advocates worry about the aggregation of personally identifiable information, the use of that data to engage in activities such as targeted advertising, and the ability of governments to access those details. For good and ill, designing sites or applications to enhance identity-driven consequences links a user\u2014or at least information that can lead to him\u2014to his content. That is helpful when it unmasks someone vile on Reddit<\/a>. It is worrisome when the information is used to track Black Lives Matter protesters on behalf of police<\/a>. Retaining this identifying information over time can be useful in spotting users who switch names or accounts. But, if enough data is kept, it can turn into one of the reservoirs of danger that Citron highlights in earlier work, exemplified by the data breaches at the Office of Personnel Management<\/a>, Anthem<\/a>, and Experian<\/a>. Private sector abuses of personal information worry us less than governmental misuse. Storing this data makes it accessible to the state, often with far less process or justification than the probable cause that would support a warrant.15<\/span><\/span><\/a><\/sup>\u00a0While some firms are trying to mitigate this problem through transparency measures such as warrant canaries, those methods are crude at best\u2014they do not help an individual user assess her risks in using the site.<\/p>\n

Thus, architectural decisions present us with hard choices. Tor enables both dissidents and pedophiles to exchange information free from surveillance. Yelp\u2019s requirement to register before posting deters overblown reviews, but also leaves consumers with negative experiences vulnerable to lawsuits<\/a> from aggrieved businesses<\/a>. Building sites that reduce cyber-exploitation comes at a cost that we ought to acknowledge. Indeed, our proposals here to use private, distributed enforcement depend in part on access to some identifying information to be effective. While some architectural changes can be effective without accumulating data on identifiable users, tort and copyright solutions unquestionably rely on the victims\u2019 ability to identify their perpetrators, conjuring up all the trade-off described above.<\/p>\n

Danielle Citron\u2019s book both generates and marks an important shift in the discussion over cyber-exploitation on-line. We seek to enrich that debate by focusing on the potential for robust self-help through distributed legal enforcement, and by pointing up the hard choices that architectural changes require.<\/p>\n

 <\/p>\n

\n

 <\/p>\n

 <\/p>\n

*<\/span><\/a> Associate Professor<\/a> and Professor of Law<\/a>, University of Arizona James E. Rogers College of Law. The authors welcome comments at <janebambauer@email.arizona.edu> and <derekbambauer@email.arizona.edu>.<\/p>\n

1<\/span><\/span><\/a>\u00a0Assoc. Indus. v. Ickes, 134 F.2d 694, 704 (2d Cir. 1943).<\/p>\n

2<\/span><\/span><\/a>\u00a0On the distinction between the two, see<\/em> Derek E. Bambauer, Privacy Versus Security<\/em><\/a>, 103 J. Crim. L. & Criminology 667 (2013).<\/p>\n

3<\/span><\/span><\/a>\u00a0Danielle Keats Citron, Reservoirs of Danger: The Evolution of Public and Private Law at the Dawn of the Information Age<\/em><\/a>, 80 S. Cal. L. Rev. 241 (2007).<\/p>\n

4<\/span><\/span><\/a>\u00a0CompuServe v. Cyber Promotions, 962 F. Supp. 1015 (S.D. Ohio 1997).<\/p>\n

5<\/span><\/span><\/a>\u00a0Register.com v. Verio, 356 F.3d 393 (2d Cir. 2004).<\/p>\n

6<\/span><\/span><\/a>\u00a0Doe v. Friendfinder Network, 540 F. Supp. 2d 288 (D.N.H. 2008).<\/p>\n

7<\/span><\/span><\/a>\u00a0For example, the tort of Intentional Infliction of Emotional Distress, which can cover a wide range of harassing behavior that does not fit nicely into the elements of other intentional torts, requires \u201csevere\u201d distress caused by \u201coutrageous\u201d conduct. Restatement (Second) of Torts \u00a7 46 (1965). Although the standard for outrageous conduct is variable and unpredictable, it is supposed to go well beyond garden variety slights and mean-spirited behavior that people inevitably experience in the social world. Daniel Givelber, The Right to Minimum Social Decency and the Limits of Evenhandedness: Intentional Infliction of Emotional Distress by Outrageous Conduct, <\/em>82 Colum. L. Rev. 42 (1982).<\/p>\n

8<\/span><\/span><\/a>\u00a0See, e.g.,<\/em> Roberts v. Saylor, 230 Kan. 289, 293 (Kan. 1981) (\u201cIt should be understood that liability does not arise from mere insults, indignities, threats, annoyances, petty expressions, or other trivialities.\u201d). However, at times, the Supreme Court has had to rein in tort law when state court interpretations have run afoul of constitutional protections for free speech. See<\/em> Hustler Magazine v. Falwell, 485 U.S. 46 (1988); N.Y. Times v. Sullivan, 376 U.S. 254 (1964).<\/p>\n

9<\/span><\/span><\/a>\u00a0A. Mitchell Polinsky & Steven Shavell, Punitive Damages: An Economic Analysis, <\/em>111 Harv. L. Rev. 869, 874-875 (1998).<\/p>\n

10<\/span><\/span><\/a>\u00a047 U.S.C. \u00a7 230.<\/p>\n

11<\/span><\/span><\/a>\u00a017 U.S.C. \u00a7\u00a7 502(a), 512(j).<\/p>\n

12<\/span><\/span><\/a>\u00a0See<\/em> Amanda Levendowski, Using Copyright to Combat Revenge Porn<\/em><\/a>, 3 N.Y.U. J. Intell. Prop. & Ent. L. 422 (2014).<\/p>\n

13<\/span><\/span><\/a>\u00a017 U.S.C. \u00a7 412.<\/p>\n

14<\/span><\/span><\/a>\u00a0Data collection on Web users may later become accessible to the government or be part of an algorithmic scoring system. David Gray & Danielle Citron, The Right to Quantitative Privacy, <\/em>98 Minn. L. Rev. 62 (2013); Danielle Keats Citron & Frank Pasquale, The Scored Society, <\/em>89 Wash. L. Rev. 1 (2014).<\/p>\n

15<\/span><\/span><\/a>\u00a0Jane Bambauer, Other People\u2019s Papers, <\/em>94 Tex. L. Rev. __ (forthcoming 2015).<\/p>\n","protected":false},"excerpt":{"rendered":"

Jane R. Bambauer & Derek E. Bambauer* Online Symposium: Danielle Keats Citron’s\u00a0Hate Crimes in Cyberspace 95 B.U. L. Rev. Annex 37 (2015) PDF Many thanks to Danielle Citron and to the Law Review for inviting us to comment on her important and thought-provoking book, Hate Crimes in Cyberspace. To us, the most striking finding in […]<\/p>\n","protected":false},"author":10081,"featured_media":0,"parent":1990,"menu_order":55,"comment_status":"closed","ping_status":"closed","template":"page-templates\/no-sidebars.php","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/pages\/2368"}],"collection":[{"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/users\/10081"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/comments?post=2368"}],"version-history":[{"count":5,"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/pages\/2368\/revisions"}],"predecessor-version":[{"id":4708,"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/pages\/2368\/revisions\/4708"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/pages\/1990"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/bulawreview\/wp-json\/wp\/v2\/media?parent=2368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}