On Friday [07/17/09], it was “1984” and another Orwell book, “Animal Farm,” that were dropped down the memory hole — by Amazon.com.
In a move that angered customers and generated waves of online pique, Amazon remotely deleted some digital editions of the books from the Kindle devices of readers who had bought them.
An Amazon spokesman, Drew Herdener, said in an e-mail message that the books were added to the Kindle store by a company that did not have rights to them, using a self-service function. “When we were notified of this by the rights holder, we removed the illegal copies from our systems and from customers’ devices, and refunded customers,” he said. [NYT, 07/17/09]
(1st Post)
ISSUES:
See 18 U.S.C. § 1030, relevant parts of which are quoted below.
1. Is a Kindle a “computer” within the meaning of 18 U.S.C. § 1030 (e)(1)? Isn’t it clear it’s a “high speed data processing device [capable of] performing logical, arithmetic [and] storage functions”? Or might Amazon successfully argue that it is instead a device “similar” to a portable hand-held calculator or an automated typewriter or typesetter?
2. When the deletion occurred was Amazon accessing the Kindle “without authorization,” or merely “exceeding authorized access”? More fundamentally, must each instance of “access” find its own “authorization”? If a connection between a client device and a server system is established, is each transmission from server to client an instance of the server “accessing” the client? Must each transmission therefore fall within the scope of what the client has explicitly or implicitly authorized? Or are all transmissions within a given operation one instance of “access”? All operations within a transaction? All transactions conducted during a session? If the client initiates the connection, does its user thereby implicitly authorize the server to “access” every part of the client, for any and all purposes?
Presumably, even if the user initiated the connection or session during which the Amazon server instructed the client Kindle to delete the Orwell books, the deletion was a distinct transaction initiated on the server side. Was that transaction, or the initiation of it, a separate instance of “access”? If Amazon initiated the connection or session for the purpose of accomplishing this deletion, then it would seem clear the session was an instance of “access.” Either way, was such access “authorized”?
Much might depend on the precise manner in which the “access” that resulted in the deletion of the Orwell books took place, and on exactly what language, if any, is contained in Amazon’s Kindle user agreement that might be interpreted as authorizing Amazon to initiate access for the purpose of removing content from the Kindle after it has been sold and delivered by Amazon.
3. Of interest for purposes of the user’s civil cause of action under sub-section g, only: has the user suffered any “economic damages” besides loss of the value of the deleted content, for which Amazon has already issued a refund? Note that a negative answer to this question would have no bearing whatever on the criminal liability of Amazon and all of its employees and agents involved in the deletions.
4. Of civil and incidental interest only, if the user agreement does authorize Amazon to initiate access to the Kindle for the purpose of removing content from the Kindle after it has been sold and delivered by Amazon, does that render the contract pursuant to which the content was sold by Amazon and bought by user illusory?
5. Some states have laws against unauthorized access to or tampering with computers that are more stringent than 18 U.S.C. § 1030. Assuming one or more Kindle users (and their devices) were located in such a state at the time of the deletion, do we face (in addition to the usual Internet locus delicti issues) a question of possible federal preemption?
NON-ISSUES:
1. That Amazon might have been trying in effect to undo its own prior violations of copyright law – by making and selling the copies that it caused to reside on the users’ Kindles – has absolutely no bearing on its criminal or civil liabilities. Amazon obviously has no privilege to violate laws or trespass upon personal property in an attempt to “mitigate” anybody’s, much less its own, infringement of its own, much less some third party’s, copyright.
2. Similarly, Amazon’s refund of the $ 0.99, while it must be applied to reduce (if not eliminate) the user’s civil damages, does not necessarily eliminate such damages. Like any other chattel, the deleted content had a value at the time when and place where Amazon destroyed it. The price for which Amazon had previously sold it would only be some evidence of that value. The refund clearly has no bearing whatever on Amazon’s criminal liability; its and its agents’ actions either violated 18 U.S.C. § 1030 or they did not. If it committed a crime, Amazon could give every affected user $1,000,000 in cash and it would still be the same criminal.
FOOD FOR THOUGHT:
1. Was this an incident of “copyright vigilantism,” prompted by Amazon’s (somewhat panicky) assessment of its potential liability for up to $150,000 per copyright infringement (i.e., per unauthorized Kindle copy of each Orwell book) under 17 U.S.C. § 504? If so, does it indicate that the copyright-law standard of “willfulness” is too vague? (One “willfulness” maxim – that the actor is always presumed to have willed the natural and probable consequences of his act – would leave Amazon hanging out to dry.) In making its analysis of “willfulness,” which could give it discretion to assess damages up to $150,000 per copy, the court would not be not obliged to take into account anything that took place after Amazon infringed the copyright.
More to the point, has Amazon done itself any good? The failure of its “clearance” department with regard to these Orwell works took place, had its consequences and cannot be undone. Orwell’s literary estate can still sue and demand statutory minimum damages of $750 per copy (while arguing that it really should get the $150K max) – and why wouldn’t it do so, now?
2. Even though very strong arguments can be made that, on the undisputed facts, Amazon committed criminal violations of both copyright and computer-tampering laws, does anybody really expect to see a bunch of Amazon executives led away in handcuffs? Can we take away the lesson that white collar crime comes in different shades of white?
LAW:
18 U.S.C. § 1030. Fraud and related activity in connection with computers
(a) Whoever —
(5)(C) intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.
shall be punished as provided in subsection (c) of this section.
(c) (4)(A) except as provided in subparagraphs (E) and (F), a fine under this title, imprisonment for not more than 5 years, or both, in the case of —
(i) an offense under subsection (a)(5)(B), which does not occur after a conviction for another offense under this section, if the offense caused (or, in the case of an attempted offense, would, if completed, have caused) —
(I) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;
(e) As used in this section —
(1) the term "computer" means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;
(2) the term "protected computer" means a computer —
(B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States;
(6) the term "exceeds authorized access" means to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter;
(8) the term "damage" means any impairment to the integrity or availability of data, a program, a system, or information;
(11) the term "loss" means any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service; and
(g) Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief. A civil action for a violation of this section may be brought only if the conduct involves 1 of the factors set forth in subclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation involving only conduct described in subsection (c)(4)(A)(i)(I) are limited to economic damages. No action may be brought under this subsection unless such action is begun within 2 years of the date of the act complained of or the date of the discovery of the damage.
(2nd Post)
With a little more information, the legal picture becomes much more clear. (1.) Kindles have advanced capabilities, such as facilities for annotating text, that pretty clearly resolve the “computer vs. hand-held calculator” question. (2.) Amazon did systematically initiate access to affected Kindles for the purpose of deleting the Orwell texts. (3.) Amazon’s Kindle user agreement contains nothing that even arguably authorized such access.
But there’s also another fact question: Were at least 5,051 of these $0.99 texts deleted?
If that question is answered in the affirmative, then there is no doubt at all: Amazon and all of its employees and/or contractors involved in these deletions are guilty of a federal felony. Will anything be done about prosecuting them?
With regard to civil liability under 18 U.S.C. § 1030 (g), in the general case the user may have suffered no “economic damages” beyond the $0.99-per-text value that Amazon has refunded. However, it appears that in deleting the texts Amazon also deleted user’s annotations associated with the text. (As noted, the capability of creating and storing such annotations is one of the advanced features – and selling points – that leave the Kindle clearly in the “computer” category.) Conceivably, some graduate student just lost a year’s work, the hope of completing his thesis, and a brilliant academic career. (Can you say "damage$"?)
(3rd Post)
The reason for the question, “Were at least 5,051 of these $0.99 texts deleted?” is that each violation was a felony if the prohibited conduct caused loss aggregating at least $5,000 in value during any 1-year period. Even if the aggregate loss amounted to only a few dollars, Amazon’s acts would be classified as federal misdemeanors. In that event, Amazon could still be subject to a fine of up to $200,000 per deletion. 18 U.S.C. §§ 1030 (c)(4)(G), 3559 (a)(6), 3571 (c)(5).
Bonus question: As a publicly traded company, what is Amazon’s reporting obligation with respect to this potential liability?
No comments:
Post a Comment