Copyright Unbalanced: From Incentive to Excess (5 page)

16
.  Evan Niu, “Don’t Mess with the Internet,”
DailyFinance
, January 12, 2012,
http://www.dailyfinance.com/2012/01/22/dont-mess-with-the-internet
/.

17
.  Sen. Al Franken, in the series “SOPA Opera: Where Do Your Members of Congress Stand on SOPA and PIPA?,”
ProPublica
, January 20, 2012,
http://projects.propublica.org/sopa/F000457
/.

18
.  Erica Orden and Geoffrey A. Fowler, “Hollywood Loses SOPA Story,”
Wall Street Journal
, January 19, 2012,
http://online.wsj.com/article/SB100014240529702045559045771688431
30020190.html
.

19
.  Press Office of Senator Mike Lee, “Lee Reaffirms Opposition to PROTECT IP Act,” press release, January 18, 2012,
http://www.lee.senate.gov//files/01/46/69/f014669/public/index.cfm/press-releases?ID=ba6375b8-e350-49da-aa62-ce84d4e95939
.

20
.  Larry Downes, “Who Really Stopped SOPA, and Why?,”
Forbes
, January 25, 2012,
http://www.forbes.com/sites/larrydownes/2012/01/25/who-really-stopped-sopa-and-why/2/
.

David G. Post

S
O WHAT WAS
all that fuss about? SOPA, PIPA, Internet Blackout Day, front-page stories in newspapers all across the country, 8 million or so emails pouring into the White House, 2 million #sopa tweets, and 10 million signatures added to online petitions opposing the bills—followed, of course, by the announcement that these various legislative proposals for combating online copyright and trademark infringement had all been taken off the table “for further study.”

As Larry Downes noted in
Forbes
, “Internet users have revolted before in the face of earlier efforts to regulate their activities, but never on this scale or with this kind of momentum.”
¹

What happened? How did it happen? And does it matter?

I’m not sure anyone can yet say exactly what happened or how it happened. But whatever it was—a spontaneous, grassroots outpouring of opposition to an attack on Internet freedom of expression, a bunch of information junkies who’ve gotten hooked on free music and free movies sticking it to The Man, or a plot by the giant technology companies to show Washington who’s boss—I’m here to tell you that it matters, and it matters a great deal.

It matters because the Internet matters. If the events of the Arab Spring didn’t finally persuade everyone of
that
, I can’t imagine what would or will. SOPA would have done serious damage to the technical infrastructure that allows the Internet to do the remarkable things that it does.

And it matters because the law matters. We are currently in the early years—the very beginning, really—of our efforts to construct a just, meaningful, and effective legal order for the global network. History tells us that many of the decisions we make today about how that legal order is to be constructed will have deep and possibly irreversible consequences for us down the road—especially when those decisions raise truly fundamental questions about what law is and how it is to operate. SOPA raised just such questions.

And, finally, it matters because the law enforcement regime that SOPA would have put into place reflects an underlying vision and an approach to the problems of “Internet law” and “Internet governance” that is outmoded, unworkable, and unjust.

Understanding what that underlying vision is, and how it was implemented in SOPA, is thus of some considerable importance, allowing us to recognize it (and, one hopes, to fight it off once more) when and if it rears its ugly head again.

SOPA’s objective was straightforward: to eliminate (or at least reduce) access to “foreign infringing Internet sites”—for example, offshore websites offering copyrighted music or movies for download, or selling counterfeit Rolex watches, without authorization from the rightsholders.
²

There are many such sites, a fact that we can attribute to two very fundamental characteristics of the global network.

First
and most obviously, digital information can be reproduced at nearly zero cost, and with nearly 100 percent accuracy, making it a simple matter to do something that was for all intents and purposes impossible a mere 20 or 30 years ago: say, produce 100,000 copies of the motion picture
Avatar
while on coffee break, and with a lower outlay of funds than is required for your cappuccino.

Second
, physical proximity in realspace no longer bears any significant relationship to
accessibility
or to “proximity” on the network. In realspace—the world of atoms and tangible matter—it’s harder to do business in London if you’re in Lima than it is if you’re in Liverpool, and it’s harder to cause harm in Seattle from Seoul than from Spokane. But in the world of bits, that’s just not true anymore; web servers in all those cities are effectively “equidistant” from one another, as “close to,” and as accessible to, a user
anywhere
on the global network as the server down the street.

That’s the good news! It’s an astonishing engineering achievement—perhaps
the
astonishing engineering achievement—that helps to explain the Internet’s extraordinary power and scope: (pretty much) everything that is available in digital form (pretty much) anywhere is now accessible to (pretty much) everyone (pretty much) everywhere.

The bad news, though, is that our existing legal infrastructure is, just as one would expect it to be, built for the world of atoms. (How could it have been otherwise?) Our legal system reflects the world within which it was designed to operate; precisely because physical location and physical proximity matter so much in realspace, they are indispensable components of many doctrines central to the operation of realspace law: “jurisdiction,” “citizenship,” the “locus” of a contract or a tort, and dozens of other similar notions. The physical distance between actors matters in our existing legal world because it matters in our realspace world; the more physically distant the relevant actors the more difficult it is, generally speaking, to enforce one’s law on them.

To put it bluntly but not inaccurately: law (by and large) respects borders; the Internet (by and large) does not.

Mix together the infinite and inexpensive reproducibility of valuable digital goods, the irrelevance of physical location and physical proximity, and border-respecting law, and the results are fairly predictable; many people saw this coming.

That it was predictable does not, however, mean that it is not a profoundly difficult challenge: How do we bring law to this border-disrespecting place? Should we be striving to reconstruct those legally significant physical boundaries on the net? And if so, how do we do
that
? Should we be striving to develop a legal regime that abandons physicality altogether—and if so, how do we do that? We will, somehow, have to solve this problem—at least, if we want the net to be a lawful place, as I take it we all do (and should). It will take considerable creative and innovative thinking to solve it in a just and sensible way.

SOPA reflects some creative and innovative thinking; indeed, it embodies a radical new plan for the way that law enforcement will proceed on the Net. But that plan is anything but just and sensible; it is deeply flawed, and would set us on precisely the wrong course for dealing with this most difficult challenge. While SOPA was defeated, the ideas it embodied have not gone away and will likely resurface in future legislative proposals.

SOPA would have targeted the activities of “foreign infringing websites,”
³
but not by imposing any sanctions on the offending websites, on the servers on which those websites are hosted, or even on the operators of those websites. Instead, SOPA would have imposed its sanctions on the
domain names
used by those websites.

More specifically, SOPA would have authorized federal prosecutors, and private rightsholders in certain circumstances, to bring
in rem
actions against the domain names associated with these sites—allowing the court, in effect, to “seize” the domain names for purposes of adjudicating the claims related to them. These
in rem
actions would be permitted whenever the owner or operator of the allegedly infringing website either (a) cannot be located (after “due diligence” on the complainant’s part) or (b) is found but has no address “within a judicial district of the United States.”
⁴
Having asserted jurisdiction over the
res
—the domain name—the court could proceed to a hearing at which it would evaluate the claim that the site in question is a “foreign infringing site,” or one “dedicated to the theft of US property.”
⁵
The court, on completing its evaluation of the evidence, could then issue an order to any US-based Internet Service Provider—a category that includes hundreds of thousands of entities, from giants like Comcast, Verizon, and AT&T to any business or educational institution that offers Internet access to users—to remove the offending domain names from the its “routing tables,” the databases of Internet domain names and Internet addresses used by all ISPs to get messages from one place to another over the net.
⁶

Every day, the Internet accomplishes an astonishing feat, many hundreds of billions of times over: It takes an address on a message (like the URL that you type into your web browser, or the e-mail address you put into the appropriate field of an e-mail message), and, from among the 700 or 800 million machines out there on the Internet, it finds the right one to deliver it to. And it does all this, generally speaking, in no more than a second or two.

It is a truly incredible (and largely invisible and unappreciated) feat of engineering, a finely tuned system (to put it mildly) comprising, among other things, hundreds of thousands of copies of these routing table databases circulating around the Internet from ISP to ISP at all times.
⁷

All that complicated engineering rests on a fundamental principle:
universal addressing
. The Internet routing tables should be the same wherever you are, and by and large they are. That’s why, in a world in which there are thousands upon thousands upon hundreds of thousands of networks and inter-networks, there’s only one “Internet,” the single network that looks the same whether you access it from Birmingham or from Boston or from Brazzaville.

The principle, to be sure, is not sacrosanct, and is not always obeyed; the Internet most assuredly does not look the same in Beijing, or Belarus, as it does elsewhere. But while we have no choice but to tolerate these deviations, we need not, and we should not, emulate them. Court interventions ordering the selective removal of entries from these routing databases would have done just that with potentially severe and possibly catastrophic effects.

Don’t take my word for it: a number of people who know a great deal more about these engineering matters than I do, several of whom were instrumental in creating the original design for the Internet’s domain name system and who continue to manage and operate critical portions of the infrastructure, have warned about this in no uncertain terms. In their words, SOPA’s court-ordered manipulation of the domain name system would

    1.    be “evaded easily” and “likely prove ineffective at reducing online infringement”;

    2.    “threaten the security and stability” of the Internet, “harming efforts that rely on [Domain Name System] data to detect and mitigate security threats and improve network performance” and “posing significant risk of collateral damage”; and

    3.    “weaken important efforts now underway to improve Internet security [by] enshrining and institutionalizing the very network manipulation that [such security measures] must fight in order to prevent cyberattacks and other malevolent behavior on the global Internet, thereby exposing networks and users to increased security and privacy risks.”
⁸

As Internet Blackout Day approached, the Obama administration finally got the message. On January 14, in the face of mounting public pressure, the White House announced that it was reconsidering its support for SOPA, in part because

proposed laws must not tamper with the technical architecture of the Internet through manipulation of the Domain Name System (DNS), a foundation of Internet security. Our analysis of the DNS filtering provisions in some proposed legislation suggests that they pose a real risk to cybersecurity and yet leave contraband goods and services accessible online. We must avoid legislation that drives users to dangerous, unreliable DNS servers and puts next-generation security policies, such as the deployment of DNSSEC, at risk.
⁹

Reassuring words—though one might ask why they hadn’t been uttered earlier in the SOPA debate.

But the damage SOPA would have imposed on the Internet goes beyond this (though this is serious enough), extending beyond the Internet’s technical infrastructure and deep into its legal infrastructure.

Two of SOPA’s provisions are especially troubling. First, SOPA would have authorized the issuance of domain-name-removal orders after nothing more than summary ex parte proceedings—proceedings in which only the prosecutor and the judge, and not the individual or individuals responsible for the websites’ activities, are present.

What this means is that some Korean, or Brazilian, or Russian website operator wakes up one morning to discover that his domain has been “seized” by the US government, and that US ISPs are now removing it from their routing tables, and making it invisible to their subscribers. His website is still up and running—but fewer and fewer people can reach it.

Additionally, some of his credit card accounts seem to have been deactivated, the pop-up advertisements he paid for (possibly in connection with an entirely unrelated business venture) have stopped appearing, and he seems to be unable to collect the contracted-for payments for the advertisements that are appearing on his site. If he can figure out what is going on (which may be no small task, even for someone who speaks English; see note 4) he can challenge all this—perhaps on the grounds that his website is
not
“dedicated to infringing activities” at all, perhaps on the grounds that under Korean, or Brazilian, or Russian law his actions are entirely lawful, or perhaps on the grounds that the prosecutor or the complaining intellectual property rightsholder just got it wrong, as prosecutors and rightsholders sometimes do. But to do so, he’ll have to come to the United States and get legal representation (if he wants to contest the court’s seizure of his domain name) or navigate through the section 103(b)(5)(A) counter-notification procedures to do so, in either case subjecting himself to the personal jurisdiction of the US courts.
¹⁰