Enforcing laws in a borderless Web

Disagreements over how to apply local laws to the Net have simmered for years but are now reaching a boil, with executives landing in foreign courts for conduct legal in another country.

7 min read
Former Yahoo CEO Tim Koogle could find himself cuffed if he sets foot on French soil. His alleged crime: Allowing the posting of Nazi collectibles on Yahoo's U.S.-based site--an action Holocaust survivors say violates France's war crimes laws.

In another case, Russian software programmer Dmitry Sklyarov was jailed after entering the United States last year. The charges related to providing software that could be used to crack e-books, an action that is not a crime in his homeland but that violates U.S. copyright law, federal authorities say.

These are only two examples of companies and executives that do business online and are being dragged into foreign courts for selling products or posting materials that are legal in their own countries but that offend the sensibilities or violate the laws of another land. Such challenges increasingly include criminal charges.

"That is the scariest prospect for people who are either posting or doing business on the Internet," said Mike Godwin, a policy fellow at the Center for Democracy and Technology. "If you operate a Web site that's accessible in France or even if you're an (Internet service provider) who provides services in France, you might find yourself touching down at the airport there and being served."

Disagreements over how to apply local laws to the Internet have simmered for years but are now reaching full boil. A French court this month set a January 2003 trial date in the case against Yahoo and Koogle. The United States, meanwhile, will take on Sklyarov's employer, ElcomSoft, in a trial scheduled to begin Aug. 26. Charges against Sklyarov were dropped in exchange for his testimony in the pending suit against his employer.

Both cases underscore burgeoning rifts in efforts to craft international agreements in key areas of law enforcement.

Several nations are trying to sort out cross-border Net issues with treaties, but it's been a divisive battle. So far, copyright is one of the few areas where nations have reached some consensus, such as through a World Intellectual Property Organization (WIPO) copyright agreement ratified in 1996.

The United States used the WIPO agreement to lay the groundwork for the Digital Millennium Copyright Act, the law U.S. prosecutors used to charge Russia-based ElcomSoft. The United States and 34 other countries signed the WIPO treaty, which went into effect this March. Several states in the former Soviet Union have signed on; Russia has not.

Treaties that would govern other areas are even more contentious, partly because of conflicts over cultural issues such as privacy and free speech. For example, Europe has strict rules about consumer privacy and the posting of material that could be considered racist, meaning sites based in the United States and elsewhere risk crossing the line by posting certain content, even if it's legal in their home countries.

Members of the Council of Europe have spent years hammering out a cybercrime treaty, which is still awaiting approval by member nations. Critics of the plan argue that it may, among other things, prevent the use of any tool that could be used for hacking or severely restrict speech.

On Friday, members of a Council of Europe committee signed off on a provision that would make it a crime to distribute racist or xenophobic material via computer systems, a move legal experts say could lead to more cases like Yahoo's.

"What you're likely to see is more and more countries around the world adopting hate-speech laws and enforcing them," said Jonathan Band, an attorney with Morrison Foerster who has advised the United States on the treaty. "That could really create a big problem for the Internet."

Meanwhile, the United States and several other nations around the world are still working out details of a Hague Convention treaty that would require nations to enforce each other's laws on a variety of topics, a plan critics say could stifle speech and commerce on the Web.

So far, the lack of sound international cyberlaws has hampered at least one major criminal case. Prosecutors dropped charges against the student who allegedly released the mischievous I Love You virus, which wreaked havoc by multiplying and distributing itself across millions of computers around the globe. The student lived in the Philippines, which at the time had no specific laws preventing the action.

No borders here
Certainly, conflicts over jurisdiction have been around for centuries, but the Internet introduces a new set of questions about how to apply cross-border laws. In the physical world, the ground rules are relatively well established, bolstered by years of international treaties, case law and agreements between specific nations that dictate how such laws are applied and enforced.

For example, a person hawking girlie calendars in a conservative Muslim land is clearly violating the laws there, as is someone who knowingly ships wine to a dry county. Generally, laws governing such issues have considered whether the seller was actively trying to promote products to a population that's banned from buying them.

But the Web changes the dynamics. When you put up a Web site, virtually anyone can stop by and shop. And often, sites aren't selling items but are merely posting speech that some might find objectionable.

Without treaties or consistent case law, the question remains: What constitutes doing business on the Web?

Is putting up a Web site enough to warrant prosecution? Or must you target it to specific populations? What about disclaimers? Is it a deterrent to plaster a warning across your site saying "these pages are for U.S. residents only"?

So far, such questions have for the most part gone unanswered. But the legal tangle will surely be unraveled as conflicting laws governing issues such as gambling, obscenity and copyright clash on the borderless Web.

Perhaps no case highlights the confusing thicket of jurisdictional issues on the Web more than the Yahoo imbroglio. The saga began two years ago when two French human rights groups sued Yahoo, arguing that the posting of historical Nazi items on the company's U.S.-based site violated French law prohibiting the display of racist material. A French judge sided with the groups, ordering Yahoo to block French citizens from accessing the site or face steep fines. However, Yahoo turned to the U.S. courts and asked a judge to declare the French law unenforceable here. He did.

Now, the company is facing another set of charges that it, along with former CEO Koogle, violated the country's war crime laws by displaying the items. In perhaps the most curious aspect of the case, the American Yahoo site at issue had no physical presence in France.

That's in contrast to ElcomSoft, whose employees traveled to the United States, and which allegedly was offering the disputed software via some U.S.-based servers.

Yahoo has pulled the disputed items from its site and says it will no longer allow such postings. Furthermore, the company has a host of local sites tailored to many countries--including France--that obey the laws of each land and have never allowed posting of items illegal in those countries.

The case is scheduled to go to trial early next year. Koogle could face jail time as a result of the charges. He did not return calls seeking comment.

Having it both ways
Some fear jurisdictional disputes could set off a firestorm of recrimination, where prosecution of a foreign company in one country prompts retaliatory laws in another, escalating isolated scuffles into all-out war.

"If we do it with the DMCA, another country is going to do it with another law," said Joseph Burton, an attorney with Duane Morris who's representing ElcomSoft. "It's a pretty horrible situation."

Meanwhile, some countries seem to want to have it both ways. Take the United States, for example. Courts and law enforcement here have repeatedly reached across borders and clamped down on foreign companies accused of violating U.S. copyright law on the Web.

In addition to U.S. prosecutors filing criminal charges against ElcomSoft, a U.S. judge ordered Canadian company iCraveTV.com to shutter its site after American broadcasters complained it was stealing their copyrighted works. An Italian Web site had to block U.S. citizens' access to its site on orders from a U.S. court.

However, when the shoe is on the other foot, U.S. courts have sometimes said foreign laws do not apply here, such as when a U.S. judge decided that the French ruling ordering Yahoo to block French citizens' access to its site is not enforceable in America.

"There is a certain hypocrisy," said Doug Isenberg, an Atlanta-based Internet lawyer who publishes the GigaLaw.com site and is not involved in the cases. "I don't know that you can ultimately have it both ways."

Many of those who track such jurisdictional issues think the problems prompted by the borderless Web eventually could be resolved by treaty, but how such a pact will look is anyone's guess, given the conundrums already posed by the Hague and the Council of Europe's cybercrime treaty.

Some have argued that the Web should be regulated as an international resource.

"Indeed, the places most analogous to the Internet, in a jurisdictional sense, are outer space and the international waters," ElcomSoft attorneys wrote in one of their briefs.

While parties on both sides of such cases wage debates over whose laws apply, there is one thing they can agree on: The confusing snarls over jurisdiction will continue for years. Indeed, most of the cases so far have involved the United States, France and Canada, regions hardly known for restrictive laws governing speech and commerce.

What happens when countries with harsher laws--such as those governed by dictators or strict religious rules--weigh in with judgments of their own and reach across borders to try to enforce them?

"These things are going to continue around the world because, as near and dear as the First Amendment is to us, other countries have different histories and different cultural sensitivities," said Richard Jones, an attorney with Coudert Brothers representing French human rights groups that have sued Yahoo over the Nazi paraphernalia.

Organizations including the American Civil Liberties Union wrote in their brief supporting Yahoo: "The French court's order is but one example of the sort of judgment that this and other American courts can expect to see with increasing frequency as Internet use expands throughout the world."