Infosys 204

Information Law and Policy – Part One

Larry Downes

Comments on Written Assignment #1

I don’t promise to debrief all four of the assignments, but I thought there were enough common issues in your papers to warrant it in this case.

On the whole, most of you did quite a nice job with a difficult and unfamiliar kind of text. Many of you engaged in “active reading” with S.563 and, regardless of your personal view of spam, analyzed the text and its likely impact in practical terms, which is exactly what I wanted. Below, I’ll summarize what I found to be the points made in the best papers, to give you a sense of what you may have missed.

General Comments

But first, a few less substantive issues…

1. Look and Feel. As your second grade teacher must have told you, neatness counts! Some of you need to change your toner cartridges, as your papers were so light as to be barely readable. Also, when handing in a paper that you want to be read carefully and taken seriously, you must double-space and leave ample margins (on the left AND on the right), and use a font that can be read by a human being--at least 12 point. There was even a question in class about double-spacing, yet many of you handed in single-spaced copy. It is very difficult for an employer—or an instructor—not to notice a slapdash approach to user interface, regardless of how solid the underlying content may be. An unattractive paper suggests, whether rightly or wrongly, that you don’t especially care what the reader thinks. Not a good idea, and not something graduate students should need to be told.

2. Proofreading. Spell-checking does not ensure that you used the right word or that your sentences make sense, only that you spelled the words you did use correctly. Even then, Bill Gates is not perfect. There were a surprising number of incomplete sentences, misused punctuation, verb/subject disagreements, and so on. Beyond spell-check, you need to proofread the paper after you print it out. Better still, read it out loud, as often doing so will make it clear when a sentence is wrong or makes no sense. Many of you would also benefit from using the grammar checker, but this is no substitute for checking your own work.

Most of you could benefit from a review of the correct use of the semi-colon, the comma, the colon and quotation marks. For example, when a quotation or quoted expression ends with punctuation, the end quote mark goes AFTER the punctuation mark in most cases (question mark and exclamation mark excluded):

This is typically referred to as “spam.” (correct)

This is typically referred to as “spam”. (incorrect)

With “spam,” the user receives email from someone he or she doesn’t know. (correct)

With “spam”, the user receives email from someone he or she doesn’t know. (incorrect)

I hate “spam”! (correct)

What do we mean by “spam”? (correct)

If you aren’t sure when to use a comma (many of you err on the side of overuse), find a good grammar handbook and read through it. No time like the present.

3. Audience and Tone. You need to be aware of who you are writing for, and the posture in which you are writing. Here I told you that you were giving testimony to a Senate committee. So including in your comments a diatribe about how corrupt politicians have become is probably not going to prove very persuasive, and will detract from your real argument. Likewise, most Senators (and their staff) happen to be lawyers, so lawyer jabs will likely fall flat. At the same time, testimony is intended to be persuasive—you are making an impassioned plea to the highest level of U.S. government to do or not do something, so you had better sound like you believe what you are saying. Passive voice won’t cut it. I asked you to include in your comments an appreciation for the opposing views to your own not in the interest of journalistic “fairness” but because that is an effective way of convincing an audience that you ought to be taken seriously when you argue your own view.

4. Ambiguity. There was a built-in ambiguity to the assignment as given. I asked you to read the entire bill, but it should have been clear enough from the rest of the handout that the part I wanted you to comment on was Section 5, the anti-spam provisions. I wanted you to read the entire bill largely to note what wasn’t there—e.g., definitions for terms like “unsolicited,” “marketing” and so on. Some of you spent most of your time talking about the Computer User’s Bill of Rights, which I was not interested in. You should learn to expect ambiguous assignments and either figure out what is really being asked for from the context or, if that isn’t enough, ASK! Indeed, there was a question asked in class about the non-spam elements of the bill, but still many of you didn’t quite get it.

At the same time, some things were not ambiguous. It was clear what elements I wanted to see in your papers: (1) an unambiguous statement on whether or not to vote for the bill, (2) an appreciation for the opposing view’s best argument, and (3) at least one recommended improvement. If you had written that and nothing more, you would have been done. Some of you did not include these three elements in your papers; others wasted a lot of space talking about the purposes of legislation in general, or of the hardships caused by spam, or other excess material.

If you would like to talk about any specific issues in your paper (or you have trouble reading my handwriting), please feel free to come by my office—with your paper—and I’d be happy to give more specific pointers. In grading, I generally did not penalize for these “technical” violations, but in the future I will (indeed, I must!). With that, as the great Stan Lee would say, “‘nuff said.”

Substantive Comments

On the substance of the assignment, needless to say, there was no right or wrong answer. I was really interested in getting to know you as a writer and a thinker, to see how you would engage with a new kind of text, and to look for early signs of what I called “active reading.” I was generally more interested in seeing thoughtful analysis about a proposed law aimed at solving a problem associated with new technology than in reading anti-spam rhetoric.

As an aside, however, I asked you each to say whether or not you wanted the bill voted out of committee or killed, and the numbers were roughly equal. What surprised me was that those of you who wanted to kill the bill were nearly unanimous in the view that the bill was not strong enough—that it did not do enough regulating, did not give enough power to the FTC to enforce the provisions prohibiting unsolicited marketing emails, or did not provide sufficient controls on the use of the database of “do not email” addresses.

No one seriously doubted that there should be any federal law regarding spam.

No doubt spam is a serious problem, but not every serious problem can be or ought to be solved with a federal law enforced by a federal agency. I would have thought at least someone would have objected to the idea of the federal government going into the business of keeping a database of active email addresses, or of reviewing millions of emails submitted by consumers to determine which ones constitute an unsolicited or marketing email, either on civil liberties grounds or on free market economic grounds. It makes me feel old to find that my skepticism about increased federal power in such intimate matters is a relic of a bygone age!

Seriously, though, one of the things I hope you will consider in any question about information law is the institutional trade-offs of various forms of “law.” When, in other words, should information flow be regulated by legislators (local, state, national, global, or some combination), by courts, by agencies, by the market, by technology--or not regulated at all? Each institution has costs and risks that need to be considered in evaluating a proposed solution; each is optimized for certain kinds of problems; each has a history that can be queried to show what it does well and what it does poorly. As an exercise, look at S.563 again at the end of the semester and see if your view has changed.

Though I didn’t expect you to know this, I think it is unquestionable that S.563 as currently drafted is unconstitutional. The Supreme Court has made crystal clear that commercial speech is protected under the First Amendment, though not as rigorously as political speech. (Remember Barlow’s outrage at the “indecency” language of the Communications Decency Act? The Court agreed, see ACLU v. Reno, 117 S.Ct. 2329 (1997).) Without a definition for “marketing” (which many of you objected to), S.563 would run afoul of both the “vagueness” and “overbroad” doctrines, which disfavor laws affecting speech that make it impossible for people to know what has been banned (vagueness) or which ban more speech than is necessary to meet a compelling governmental purpose (overbroad). When it comes to free speech, the background rule is to be dubious of government regulation, however well-intended.

As I said, the best papers were those that put aside the (understandable) frustration and annoyance with spam and looked at the solution being proposed. Some of the best points raised both by those who liked and didn’t like S.563 included:

• The breadth of coverage. Section 5(d) makes it illegal to send any “unsolicited marketing email” to any computer whose address is registered with the FTC. You will look high and low and find no definition for either “unsolicited” or “marketing.” Is any email that does not respond to one I send “unsolicited”? Does every message that advances some position or asks me to take some action a “marketing” message or does it have to be one that specifically invites me to buy a product or service? (Much spam just invites me to click on a link at no charge, so be careful how you define marketing.)

• The all-or-nothing registry. What if I am eager to receive messages from companies I already do business with (say The Gap, Overstock, Amazon, EBay, Microsoft, McAfee, Intuit)—perhaps to let me know about upgrades, or sales, or coupons, or items I may be interested in based on past purchases? How can I register with the database and still get “good” marketing emails, even ones I don’t explicitly request? The registry seems to be all-or-nothing, depending again on the missing definitions of marketing and unsolicited. Put another way: is there a difference between “unsolicited” and “unwanted” emails?

• Enforcement problems. Enforcement seems to be impossible. Spam, unlike junk mail, junk fax, or junk telephone calls, is easy to hide or move offshore, not necessarily out of reach of U.S. jurisdiction but for practical purposes unstoppable. We don’t even know if the telemarketing registry will have any impact, only that lots of people have signed up for it.

• Unintended consequences. The registry has to be made public. Otherwise, how is a “marketer” (potentially everyone who sends an email) to know who doesn’t want to receive unsolicited marketing emails? Once it’s public, though, it becomes a boon to those who intend to ignore the law—a database of live email addresses maintained by the FTC. Those who thought access should be restricted or encrypted may not have thought through how contacting someone on a secret list could be the basis for a violation.

• Odd terminology. Sen. Dayton does not understand how email works. The law calls for the registration of the addresses of “computers” rather than the email addresses of users of computers. Many people have multiple email addresses (and may want a different spam profile for different addresses), and computers don’t have an address at all (at least not in the sense that S. 563 seems to imply). What does he mean here? (This error, though, is the kind of thing the FTC could “correct” in the course of writing the actual regulations, but that too reminds us that administrative agencies in the U.S. have broad law-making powers not subject to the same level of deliberation as bills, another risk to consider in delegating the power to implement S. 563 to the FTC.)

• Odd penalties. The penalties are based on each “day” of violation, which seems an odd way to calculate harm and damages. What is a “day” in email? Why not assess penalties based on the number of violations, or the frequency of violations, or something more closely connected to the problem the bill seeks to solve?

• Practical difficulties. Another enforcement problem may be the limited budget of the FTC. The law envisions the FTC assessing penalties using its existing enforcement powers, which means litigation—a very expensive and resource-intensive process. (Those who argued that individuals should have the right to private enforcement might want to consider how that would work—what individuals have the incentive to spend the time and cost to pursue such litigation? Some proposed class actions, but class actions are generally brought by law firms as a source of revenue, and could clog up the federal courts pretty quickly, a cost borne by taxpayers.) The bill also envisions the FTC allowing anyone to pass along potential violations either by email or by telephone. How will the FTC manage what will surely be millions of complaints from consumers?

To do the job effectively, the FTC will need enormous increases in its budget, which again must come from tax revenues. If we let the FTC use the fines it collects to fund its enforcement, their incentive will be to go after Spammers with the deepest pockets, not necessarily the ones causing the most trouble. (That, at least, has been the experience of forfeiture laws in local policing activities. The police in many cities won’t undertaken a major enforcement initiative without a “budget” that suggests the value of seized assets will be more than the cost of the operation.)

In fact, why not evaluate the spam problem from a purely economic vantage point? Let’s say that today spam is costing you $5/day in lost productivity, annoyance, uncertainty, and so on (any number will do here). A rational consumer should be willing to spend any amount less than $5/day to make spam go away; let’s say $4/day. You’d spend $4/day to save $5/day, right?

So the real question is not a moral one, or an ethical one, or a legal one, but one of dollars and sense (sorry). The real question is: who would make the best use of that $4/day/consumer? Would it be the FTC (in the form of higher taxes, or of reallocated taxes away from something else you also care about)? Local police to chase down and arrest Spammers where they live? Your ISP to spend on better filtering technology? The Internet Society and the backbone providers to rework the email protocols to eliminate address spoofing by validating all mail transfers en route? Microsoft, Yahoo, McAfee and others to underwrite the creation of more effective screening software? The Spammers themselves to go away (assuming there was some practical way to do this, can you set aside your moral disgust if that turns out to be the cheapest and most effective solution, or would you rather spend more money and retain the moral high ground?)?

That is what I mean by institutional trade-offs. If you had to spend the money yourself, whom would you give it to?

Thanks for being such good sports! Assignment #2 will be distributed soon.