| Dear [Legislator],
[I am] writing to you today on the subject of House Bill 6981, "An Act Concerning social networking internet sites and Enforcement of Electronic Mail Phishing and Identity Theft Laws." Specifically, this letter addresses the Joint Favorable Substitute made by the General Law Committee on 8-March-2007 – Attorney General Blumenthal's proposed additions concerning social networking internet sites, which are contained in Section 3 of the bill.
[I am] writing to request that you oppose the bill in its present form, as the proposed regulations of social networking sites:
• cannot be consistently met by content providers,
• will impact a far greater number of internet sites than intended, due to overly broad language in the definition of "social networking internet sites,"
• will limit protected speech online, including the right to communicate and access information anonymously
By seeking to regulate a wide swath of internet communication in an effort to order to prosecute crimes conducted in the physical world – namely, sexual violence against minors – HB 6981 will limit the ability of Connecticut residents to access information online, force non-commercial content providers to cease their online operations, and may have serious and unintended ramifications for internet-based commerce and communications of all kinds in- and outside the State of Connecticut.
If these concerns can be addressed through the amendment process, the bill – especially its provisions concerning electronic mail phishing and identity theft – may provide the Attorney General with appropriate legal authorities to enforce crimes conducted via the internet.
Additionally, it may be possible for the General Assembly to achieve the desired effect of the Sec. 3 provisions by formalizing a process by which parents are provided with the tools and information necessary to restrict their child's access to social networking websites. The Attorney General's office has been cultivating an educational program informally for several years, and it is [my] belief that establishing and funding a state program along the lines of this educational model would not only be the most successful method for protecting minors from contact with child predators online, but would fully protect the ability of adults to access information and communicate via the internet without additional and unintended interference by the state.
Signed,
I: The proposed regulations in HB 6981 (Sec. 3) cannot be consistently met by content providers.
The language in HB 6981 requires that the owner or operator of any web site meeting the definition of a "social networking internet site" prevent any minor located within the State of Connecticut from creating or maintaining a profile on their website. The relevant text is as follows:
(b) No owner or operator of a social networking web site shall allow a minor using a computer located in this state to create or maintain a profile web page on such web site without first obtaining the written permission of the minor's parent or guardian and without providing such parent or guardian access to such profile web page at all times.
(c) An owner or operator of a social networking web site shall adopt and implement procedures to utilize independently obtainable information to confirm the accuracy of personal identification information collected from members, parents and guardians at the time of registration on such web site.
The first requirement this places on the owner or operator of such a website is that they must either a) determine the physical location of each computer accessing the website in question, or b) subject every visitor regardless of location to identity, age, and parental consent verification processes.
Unfortunately, it is not technologically possible to determine the precise location of a computer operating on the internet:
• Home computers generally connect to the internet through a commercial internet service provider, each of which has its own standard for reporting the location of the user to a website when that user requests data from that website. The request generally appears to originate from the nearest central facility of that internet service provider, which is often a great distance away.
In practice, users connecting to the internet via DSL appear to be located within several miles of their physical location, while those connecting to the internet by way of a cable modem or satellite internet service often appear to be connecting from a greater distance away. Internet users in Fairfield and Litchfield Counties routinely appear to be connecting from New York State, while internet users in Hartford, Tolland, and Windham Counties routinely appear to be connecting from Massachusetts.
Dial-up services, in particular America Online, generally do not report the geographic location of their users to websites – only the country of origin. Using traffic in April 2007 to the website www.myleftnutmeg.com as an example, 4.2% of the visits from a location in the United States contained no more specific location data than simply "United States."
• Those browsing the internet by way of a mobile device such as a Blackberry – in particular government employees who are issued devices that access email and the internet through a state- or federally-operated internet server – would appear to be connecting to websites from the location of that server. As such, a mobile device from the Connecticut government would appear to be operating in-state even if it were physically located elsewhere, and Federal employees such as Congressional staffers would appear to be operating their devices from Washington, D.C. even if they were physically located in Connecticut.
• Computers accessing the internet from U.S. military facilities will sometimes only report the command in which that computer is operating: NORTHCOM for locations in North America, CENTCOM for the Mideast, etc.
• Some computer users, in the interest of anonymity, choose to access the internet by way of an "anonymous proxy," a computer located in a remote location which does not report any geographic location when requesting information from a website on the internet.
• An increasing number of computer users access the internet through an anonymizing service, which generally works by forcing the data requested by the internet user to travel over a significantly more complex path than technically required. To the owner or operator of a social networking website, computers located in Connecticut using such a service would likely appear to be located in a different state or country, while a computer located in a different state or country could potentially appear to be located in Connecticut.
As it is not technologically feasible to determine with any degree of certainty the geographic location of a computer on the internet, website owners or operators whose websites meet the definition of a social networking internet site who wish to comply with the regulations mandated by HB 6981 will have to apply the identity, age, and parental consent verification processes to every person that accesses the website.
Such a verification process would, at a minimum, require the website owner or operator to:
• collect detailed personal information for every individual using the website, for both adults and (in the case of a minor using the website) minors with their parents or legal guardians,
• maintain access to a current database of personal information to compare against the information submitted by website users,
• maintain access to a cross-referenced list of minors and their parents or legal guardians
With these requirements, the owner or operator of a website meeting the definition of a social networking internet site would be forced to limit access to the website to those for whom absolute confirmation of identity is possible. HB 6981 as written does not provide any detail as to what measures would suffice to confirm a user's identity, but if the standard is similar to the requirements for establishing one's identity for the purpose of voting or obtaining a state identity card, doing so would almost certainly require government facilitation. (And possibly require the individual seeking to register for such a site to present in-person to confirm their identity visually or to confirm the validity of documents establishing their identity.)
Additionally, HB 6981 does not outline the responsibilities of website owners or operators in the cases of:
• Users registering using false or stolen data
• Users registering using a third party's personal information, with that third party's knowledge and consent
• Minors using their parents' or guardians' personal information without the parents consent
• Users who would be eligible to use the website in question in another location (for example, a user confirmed to be a 16-year-old without parental consent who lives in New York) who registered with the website in one location, and later accesses the website from within Connecticut
To comply absolutely with HB 6981, the owner or operator of any website meeting the definition of a social networking internet site would not be able to allow any user to register for whom they could not establish a positive identity, which would preclude usage by any person from a state or country unwilling to make the personally-identifying information of their populace available to private website owners.
Ironically, insofar as data which can absolutely establish the identify of private citizens is accessible to those operating social networking sites, "An Act Concerning social networking internet sites And Enforcement Of Electronic Mail Phishing And Identity Theft Laws" could potentially open a Pandora's Box of identity theft by unscrupulous website operators. Should such a situation arise, the State would be put in the unenviable position of seeking – with State laws – to regulate and license those who wish to own or operate a social networking site in the first place.
HB 6981 was written because end-user license agreements – web-based contracts to which an internet user must consent before proceeding to use a website – did not effectively limit access to confirmed adults and minors with the permission of their parents. However, establishing a significantly higher certainty of identity for an internet-using population which crosses state and national borders is simply not practical.
Should HB 6981 become law, websites which fall under its purview will be forced to either consider one count of unfair trade practices per day the cost of doing business, or – if they are unwilling or unable to defend themselves in court against such charges – limit the features they offer or shut down.
II: HB 6981 (Sec. 3) will impact a far greater number of internet sites than intended
The language of HB 6981 requires that a website meet every item on a long list of criteria, and while [I] appreciate that its authors sought to define a social networking internet site as narrowly as possible for the purpose of this legislation, its definition still will capture a large number of commercial, community, and political websites that are not ordinarily considered to be social networking sites.
Specifically, HB 6981 requires that a site:
• contain profile web pages of members of the web site,
- including the name or nickname of such members
- photographs placed on the profile web pages by such members
- other personal information about such members
- links to other profile web pages on social networking web sites of friends or associates of such members that can be accessed by other members or visitors to the web site,
• provide members of or visitors to such web site the ability to leave messages or comments on the profile web page that are visible to all or some visitors to the profile web page
• may include a form of electronic mail for members of such web site.
While this language does capture social networking sites like myspace.com and facebook.com, these sites are in a way just recent examples of a type of website which utilizes user-generated content and interactivity to engage frequent users or members of the site, whether for socializing, commerce, political activity, or other purposes. This type of website is commonly referred to as a "Web 2.0" site, and several popular sites other than MySpace and Facebook have either sprung up or incorporated "Web 2.0" features that would likely bring them under the purview of H.B. 6981.
For illustrations of how these non-social networking sites meet the criteria laid out by HB 6981, please see the attachments to this letter.
• Amazon.com
&bull ;Ebay.com
• MyLeftNutmeg.com
• YouTube.com
[I] do not believe it is the intention of the legislature or the Attorney General to limit participation or access to the wide variety of commercial websites, political blogs, or community-generated video sites that meet the definition of a social networking internet site, but passage of HB 6981 will have a significant impact on these developing businesses and forums – and short of naming the specific sites the State would like to regulate, it seems unlikely that any definition would leave this broader list of sites untouched.
III: The proposed regulations in HB 6981 (sec. 3) will limit protected speech online
Two recent Federal laws – the Communications Decency Act of 1996 and the Child Online Protection Act of 1998 – sought to address exposure by minors to potentially harmful information via the Internet by placing age-specific restrictions on website owners and operators, and it bears mentioning what those laws sought specifically to achieve, and how they fared in the context of legal challenges.
The first, the Communications Decency Act of 1996 (S.652), was intended to extend regulation of obscene and indecent speech from the realm of broadcast media (such as network television and radio) to the developing media such as cable television and the internet. The relevant language is as follows:
Whoever, (1) in interstate or foreign communications knowingly (A) uses an interactive computer service to send to a specific person or persons under 18 years of age, or (B) uses any interactive computer service to display in a manner available to a person under 18 years of age, any comment, request, suggestion, proposal, image, or other communication that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs, regardless of whether the user of such service placed the call or initiated the communication; or (2) knowingly permits any telecommunications facility under such person's control to be used for an activity prohibited by paragraph (1) with the intent that it be used for such activity, shall be fined under title 18, United States Code, or imprisoned not more than two years, or both.
Following the passage of the Communications Decency Act, a number of online content providers – represented by the American Civil Liberties Union – asserted that such limitations would limit adults from accessing or engaging in speech protected under the First Amendment, and would have a "chilling effect" on the availability of medical information appropriate for adults and minors alike. On these grounds, an injunction was granted by the US District Court of Eastern Pennsylvania (Reno v. American Civil Liberties Union, et al, 1997), and was upheld in a 9-0 decision by the Supreme Court.
The Supreme Court also noted that "[t]he Government offered no evidence that there was a reliable way to screen recipients and participants in such fora for age," and that "using credit card possession as a surrogate for proof of age would impose costs on non-commercial Web sites that would require many of them to shut down," and that such a requirement "would completely bar adults who do not have a credit card and lack the resources to obtain one from accessing any blocked material."
Interestingly, Section 230 of the Communications Decency Act – which for all intents and purposes immunizes internet service providers and website operators from liability for obscene content produced or illegal actions taken by users of their service – remains a part of the law today. This section states that:
"No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider"
A more recent Federal law – the Child Online Protection Act ("COPA") – was written and passed in 1998 to address some flaws of the Communications Decency Act. COPA was designed to be enforced by the Federal Trade Commission, and like HB 6981, it includes a civil penalty for internet service providers or website operators for each day that minors may access prohibited material.
However, despite the fact that the Act was somewhat narrowly tailored – unlike HB 6981, it included an affirmative defense for content providers, applied only to commercial services, and only applied to US providers – injunctions against the enforcement of COPA were granted and upheld by the U.S. District Court of Pennsylvania, the Third District Court of Appeals, and the U.S. Supreme Court. The final, permanent injunction against enforcement of COPA (ACLU et al. v. Gonzales, No. 98-5591), was granted on grounds that:
COPA facially violates the First and Fifth Amendment rights of the plaintiffs because: (1) COPA is not narrowly tailored to the compelling interest of Congress; (2) defendant has failed to meet his burden of showing that COPA is the least restrictive and most effective alternative in achieving the compelling interest; and (3) COPA is impermissibly vague and overbroad.
Additionally, while many of the findings in the permanent injunction concern the broadness of the definition of indecency (which are relevant primarily in the context of content-based restrictions on speech), in the Conclusions of Law, Judge Lowell Reed addressed the privacy concerns similar to those which have prompted this letter.
The affirmative defenses also raise their own First Amendment concerns. For example, the utilization of those devices [such as credit-card age verification] to trigger COPA's affirmative defenses will deter listeners, many of whom will be unwilling to reveal personal and financial information in order to access content and, thus, will chill speech. See Denver Area Educ. Telecomms. Consortium, Inc. v FCC, 518 U.S. 727, 754 (1996) (striking down an identification requirement because it would "further restrict viewing by subscribers who fear for their reputations should the operator, advertently or inadvertently, disclose the list of those who wish to watch the `patently offensive' channel"); Findings of Fact 171, 172-181. [...]
Web users are especially unlikely to provide a credit card or personal information to gain access to sensitive, personal, controversial, or stigmatized content on the Web. As a result of this desire to remain anonymous, many users who are not willing to access information non-anonymously will be deterred from accessing the desired information. Web site owners such as the plaintiffs will be deprived of the ability to provide this information to those users.
Finally, the Federal courts have shown a willingness to weigh in on the constitutionality of state laws regulating internet communication: in ACLU of Georgia v. Zell Miller (1996), the U.S. District Court of Northern Georgia granted an injunction against enforcement of Georgia Act No. 1029, which would have prevented the use of anonymous or pseudonymous communications over computer networks, finding that:
On its face, the Act prohibits such protected speech as the use of false identification to avoid social ostracism, to prevent discrimination and harassment, and to protect privacy, as well as the use of trade names or logos in non-commercial educational speech, news, and commentary--a prohibition with well-recognized first amendment problems.[6] Therefore, even if the statute could constitutionally be used to prosecute persons who intentionally "falsely identify" themselves in order to deceive or defraud the public, or to persons whose commercial use of trade names and logos creates a substantial likelihood of confusion or the dilution of a famous mark, the statute is nevertheless overbroad because it operates unconstitutionally for a substantial category of the speakers it covers.
With this in mind, it appears that HB 6981 faces an additional legal hurdle that doesn't arise unintentionally from its vagueness, but rather is central to the Act's design: the purpose of the law is clearly to prevent adults and minors from accessing information through interactive forums anonymously.
However, like the Georgia law which was struck down in 1996, HB 6981 doesn't take into account the variety of legitimate reasons why one might wish to communicate or access such information anonymously - security and identity theft concerns, or fear of stigmatization by internet users wishing to access sensitive medical, sexual, political, or cultural information. Even if a selective enforcement approach were used to exclude sites such as Amazon.com or Ebay.com from prosecution under HB 6981, websites which are designed primarily for "social networking" purposes are often used to solicit help or medical advice anonymously: for example, many private groups exist on MySpace.com and Facebook.com sponsored by rape crisis centers, cancer or AIDS support groups, and battered women/children's shelters, and the ability to contact and obtain information from such organizations privately and anonymously is enjoyed by many users of these forums.
Unless the legislature takes into account the past failure of internet-based age verification to survive judicial scrutiny, as well as legitimate uses by adults for anonymity and pseudonymity on the internet, HB 6981 will most likely meet a similar end in the courts, while perhaps doing serious damage to the right of Connecticut residents to engage in protected speech in the process.
IV: Conclusion & Compromise
In his testimony to the General Law Committee on March 8, 2007, Attorney General Blumenthal stated, with respect to social networking sites, that "[p]arents are the first and last line of defense. Recognizing that key fact, I have worked with local police chiefs, schools and community groups to conduct community outreach programs for parents and others on Internet safety."
We also recognize that key fact: we oppose the social networking portion of HB 6981 because it penalizes a broad swath of legitimate and protected internet communication in an attempt to make internet service providers, rather than parents, the first and last line of defense.
The method used in HB 6981 Sec. 3 to regulate social networking sites is technologically unrealistic, so vague in its defintions and broad in its scope as to offer substantial room for selective enforcement and prosecution, and fails to address the flaws which have rendered earlier, similar laws unconstitutional. Its enactment would cause irreperable injury to internet service providers from blogs to commercial websites to sites more commonly understood as "social networking sites," who would be forced to limit their offerings, close their doors, or face significant damages under CUTPA statutes. And, should a case relying upon HB 6981 Sec. 3 find its way to the courts, either from providers seeking injunctive relief or from the Attorney General seeking prosecution, the Act would be unlikely to survive even the most basic of constitutional challenges.
The problem the General Assembly and the Attorney General are attempting to address is an important one: Connecticut's children interacting with other internet users - including possible child predators - without their parents' knowledge or consent. But in crafting a law to address this problem, you should take care to allow adults to communicate with other adults, and you should take care to protect the rights of free speech and free assembly - including anonymity and pseudonymity - enjoyed by minors and adults alike on the internet.
HB 6981 does not take care to do any of these things. As such, we ask you to oppose the bill in its current form, or amend the bill in a way that accomplishes the interest of the state without compromising the rights of its citizens.
Variations on one phrase appear time and again in court decisions on matters of internet speech, and [I] believe that any bill which would successfully address the problem at hand will be "narrowly tailored to promote the compelling state interest." And approaches do exist which have either survived constitutional challenge or failed to arouse first- or fifth-amendment concerns to begin with.
One example is the "Children's Internet Protection Act" (or CIPA), which became law in 2000, and was upheld by the Supreme Court in 2003. CIPA conditions Federal internet service discounts and technology grants to libraries on the use of a "a technology protection measure" - most commonly in the form of locally-installed internet filtering software - which would block "visual depictions that are obscene, child pornography, or harmful to minors," providing that such filters be disabled for adults performing research or engaged in other lawful activities. These filters were upheld as a sufficiently narrow tailoring of the state interest in preventing children from accessing adult content.
The application of this approach could be informed by Attorney General Blumenthal's educational program - the office of the Attorney General has produced materials and conducted seminars educating parents on how to block access to or limit their children to appropriate usage of internet sites like MySpace.com, and with appropriate funding, this educational program could be routinely offered to parents of Connecticut children as a part of public or private school enrollment, or as a condition of allowing a parent to educate their children at home. Furthermore, such funding could be used to purchase additional licenses to the filtering software already required by the Federal CIPA law for home usage, or to provide parents with physical copies of the free "BlueCoat K9 Web Protection" software currently recommended to parents in the Attorney General's educational materials. Due to Connecticut's compulsory education law, such an approach would allow the General Assembly to educate and provide filtering tools to parents of every child in state from the age of five to seventeen.
Another well-known example of a Federal law which sought to prevent children from accessing inappropriate content without their parents' consent was Section 551 of the Telecommunications Act of 1996, which required all television monitors 13" or larger sold after January 1, 2000 to contain "V-Chip" technology. A recent FCC study ("In the Matter of Violent Television Programming and Its Impact on Children," 2007) found that of parents who have purchased a television since the year 2000, 20% use the V-Chip to block their children from viewing certain content, 26% choose not to use the technology, and 53% were not aware that their television contains a V-Chip.
Applied to computers and the filtering of potentially unwanted internet content and communication, a similar law in Connecticut might mandate the inclusion of parental control software on computers sold within the state. At present, the current versions of both the Windows and Macintosh operating systems on newly-manufactured computers include parental controls by which specific websites can be blocked or limited for specific users of the computer. And, recognizing that the technological knowledge-gap of parents is the key obstacle preventing the adoption of filtering software (as it has been with the V-Chip), it might be appropriate to require that computers sold in Connecticut also prominent instructions regarding the activation and usage of such controls.
* * *
We all want to prevent children from dangerous contact with predators, but we also want to live in a society where we can enjoy our constitutional rights. We ask you to consider the words of Judge Lowell Reed - who, in striking down the Child Online Protection Act of 1998, noted that "perhaps we do the minors of this country harm if First Amendment protections, which they will with age inherit fully, are chipped away in the name of their protection."
By adopting an approach which combines methods found to be "narrowly tailored to promote the compelling state interest" in protecting children from inappropriate or harmful content on the internet, the foundational work done by the Attorney General in expanding the knowledge and ability of parents to regulate what their children can do and see online, and the funding to expand such a program to all parents or all computer-users in the state, the General Assembly has the opportunity to make Connecticut into a national model for protecting children while it protects our rights.
Please amend or oppose HB 6981 when it comes before you for a vote. Thank you. |
MLN is powered by