This post was originally posted on Harold Feld's personal blog, Tales from the Sausage Factory, on WetMachine.com. It has been very lightly edited.

In my last post, took the four most famous net neutrality violations to see how they would come out under the current rules adopted in 2015 v. how they would come out under the regulatory framework following the Federal Communications Commission vote to repeal net neutrality rules, based on the draft Order. To condense the approximately 5500-word analysis: all four incidents are addressable under the 2015 rules. None of the incidents are addressable under the combined Federal Trade Commission and antitrust regime that remains after the vote to repeal the rules, with the exception of Comcast’s deliberate deception about their blocking peer-2-peer protocols in 2007-08.

Since most folks won’t plow through 5500 words of legal analysis, I’ve gotten some requests to specifically address the claims by FCC Chairman Ajit Pai and others that the FTC can address blocking as easily as the FCC and prevent any Internet Service Provicer (ISP) from blocking any content or application. My short answer is: “No. The FTC CANNOT have a ‘no blocking’ rule like the FCC has today.” The FTC may stop an ISP from blocking content or services when it can prove that the blocking violates the antitrust laws, or that the blocking violates the ISP’s published terms of service, or if the ISP blocking causes (or is likely to cause) substantial harm to consumers and is not outweighed by countervailing benefits. And, as I covered extensively in my previous post, proving these things can be hard.

My somewhat longer answer, laid out in more detail below, is that Section 5 of the Federal Trade Commission Act (FTCA), 15 USC 45, simply cannot do what Section 201(b) and Section 202(a) of the Communications Act (47 U.S.C. 201(b) & 202(a)) can do. The two statutes are designed and interpreted very differently. The FTC has very broad jurisdiction but fairly limited authority because it is a very generalist agency. More importantly, it is purely an enforcement agency — designed to prosecute companies from doing what I will refer to here as “bad stuff.” Note, it is not even designed to prevent companies from doing the bad stuff in the first place. It is designed purely to enforce a fairly general consumer protection statute. In particular, the FTC Act Amendments of 1994 severely limited the FTC’s enforcement authority by adding Section 5(n), which requires the FTC to overcome certain obstacles before it can find conduct “unfair” and thus unlawful under Section 5(a).

By contrast, Congress designed the FCC to ensure that our critical communications infrastructure functions in a consistent and stable manner and to explicitly promote all kinds of industrial policy like innovation, universal service, and affordability, and to ensure that telecommunications services operate in a manner that serves “the public convenience and necessity.” This is critical because we don’t generally require businesses to serve the public interest; we limit this requirement to a fairly small number of specific industries that are absolutely critical to the functioning of our economy and important in our daily lives. As a result, in contrast to the FTC, the FCC has very broad authority over telecommunications services but virtually no authority over other stuff — like information services.

As I explain below, this makes it literally impossible for the FTC to simply prohibit blocking (let alone prohibit “fast lanes” or “slow lanes”) as the FCC does. To the contrary, under the FTCA, the FTC cannot prevent a broadband carrier from blocking any website, application, or service it chooses unless it can prove that this blocking (a) causes (or is likely to cause) “substantial injury” to consumers, (b) there is no other way the consumer could reasonably avoid the harm, and (c) there are no countervailing consumer benefits. While Section 5(n) does allow the FTC to consider “established public policies as evidence to be considered with all other evidence. Such policy considerations may not serve as the primary basis” for a finding of unfairness. So even if we assume that there is an “established public policy” against blocking, that alone does not allow the FTC to stop a broadband provider from blocking content or applications.

And all this, of course, assumes the FTC even has authority to deal with broadband carriers reclassified as information services, which remains up in the air at the moment pending the Ninth Circuit resolution of the en bancrehearing of FTC v. AT&T Mobility.

To understand why the FTC cannot prohibit blocking content or services, we first must understand why the FCC can — and why the FCC had to reclassify broadband as a Title II telecommunications service to do it.

Why the FCC Can Absolutely Prohibit Any Blocking of Lawful Content or Services

The Communications Act Title II requires all telecommunications services to serve anyone who wants service in the same way as any similarly situated customer. (47 USC 201(a)). That’s what being a “common carrier” telecommunications service means. You have to serve everyone, and you can’t block anyone. So when a customer says “I want to download information from over here,” the carrier can’t say “nope, sorry, don’t want to do that.” Additionally, Section 201(b) prohibits any “unjust or unreasonable” charges or practices, and Section 202 prohibits a common carrier from “any unreasonable discrimination.” So a common carrier can’t pick and choose who it wants to serve or what kind of applications it wants to permit — as long as it treats similar services or customers the same.

So blocking is right out — by statute. If you would like to see some real world examples in the traditional telephone world, check out when the various phone companies refused to complete phone calls to free conference call services. The FCC promptly issued a declaratory ruling telling carriers that they did not have a choice about completing phone calls. Similarly, when we began to have problems with rural call completion, the FCC issued a bunch of declaratory rulings and orders to make sure that phone calls to rural Americans would be completed and work properly. This is the statutory authority the FCC uses for its “no blocking” rule — as well as for its no paid prioritization, no throttling, and general conduct rules.

Without defining broadband as a Title II telecommunications service/common carrier, even the FCC would not be able to enforce an ironclad “no blocking” rule. That’s why the DC Circuit threw out the FCC’s 2010 rules adopted pursuant to its Title I and Section 706 authority. As the court found in Verizon v. FCC, a rule requiring a carrier to carry all traffic is the “essential hallmark” of common carriage. So either classify broadband as a Title II common carrier telecommunications service subject to Sections 201 & 202 or forget about an absolute ban on blocking. Which is why the FCC finally bit the bullet and did the right thing and classified broadband as common carrier telecommunications under Title II of the Communications Act.

The FTC Does Not Work This Way

The FTC cannot assume that a provider is a “common carrier” and therefore not allowed to refuse to provide service. Just the opposite, under Section 5(a)(2), the FTC is prohibited from enforcing Section 5 prohibition on “unfair or deceptive methods of competition,” or “engaging in unfair or deceptive acts or practices” against federally regulated common carriers. (That’s what the whole FTC v. AT&T Mobility case is about. For more info see my old blog post here.) So the FTC, under the terms of its own jurisdictional statute, cannot impose an absolute ban on blocking. Period. Full stop.

I cannot repeat this loudly and often enough. Anyone who says the FTC could prevent any and all blocking by an ISP either does not understand the law or is selling something. There is utterly no way under the FTC’s existing statute that the FTC could prevent all ISP blocking the way the 2015 rules do now. Claims to the contrary are — bluntly — big fat lies. Falsehoods. Untruths. Contrary to fact. Because if the FTC could prevent a broadband provider from blocking all lawful content, that would be regulating the broadband provider as a common carrier, which the FTC is expressly prohibited from doing.

This is why Chairman Ajit Pai and his fellow conservatives whine about how Twitter is the real enemy of the open internet for supposedly blocking conservative messages. If the FTC could prevent all blocking, it would say: “Yo! Twitter, and the rest of you liberal Silicon Valley companies with your left-wing socialist agenda to destroy America. Stop blocking all those important real Americans who are defending our values, like The Daily Stormer!” But they can’t. As long as these platforms reserve the right to kick off anyone who they determine violates their terms of service (which includes no promoting racism and such), as long as they aren’t violating antitrust law, and as long as no customers suffer any harm in the process, then they can block whoever they damn well please.

Since one of the supposed points of this exercise is to regulate edge providers and broadband providers the same — even though everyone outside of DC has no trouble distinguishing between these two — the same rule will apply to broadband carriers under the FTC. As long as they behave in a manner consistent with their published terms of service, as long as they aren’t violating antitrust, and as long as the conduct is not otherwise “unfair” as the term is defined in Section 5 of the FTCA, then broadband carriers can block whoever they want. Period. Full stop.

But Why Isn’t It Unfair?

As I spent lots and lots of time explaining in my previous blog post, it’s not “unfair” for a business (absent some special law, like the Communications Act) to decide to limit its inventory or limit the type of goods it wants to offer or types of customers it wants to serve. So if a broadband company says “I am going to block certain websites like 4Chan because I get lots of complaints about them,” they can totally do that without violating Section 5. That’s not unfair, because — absent a statute giving you a right to access 4Chan, it’s not unfair for a broadband provider to say “not going to offer it.” Similarly, if a carrier says “I’m going to respect the request from law enforcement to degrade messages from mobile devices in areas undergoing what law enforcement characterizes as illegal activity or incitement, like say the protest out at Standing Rock, that’s not “unfair” as that term is used in Section 5 of the FTCA.

Sure, I can argue that we have a valuable social policy not to censor and to promote diversity of views and so forth. But there are two problems. First, those are policies associated with telecommunications. They are not, generally, associated with plain old information services. Granted I can make an argument under Packingham v. NC, but that is hardly a sure thing.

But even more important, Section 5(n) explicitly states that while the FTC can consider public policy along with other evidence of unfairness, the FTC is absolutely prohibited from finding something unfair based solely on public policy. The FTC still has to find substantial injury (or likelihood of substantial injury), not otherwise avoidable, and without countervailing benefits.

It is hard to find the legally cognizable “substantial injury” I suffer from not getting access to 4Chan. Furthermore, is addressing customer complaints about the awfulness of some websites a countervailing benefit? How about assisting law enforcement to prevent “incitement” and “maintain civil order?” Obviously, it is a case-specific inquiry. But by definition “case specific” means “cannot have an absolute ban on blocking.

Conclusion

Unlike the FCC, the FTC cannot have a categorical ban on blocking. Heck, even the FCC could not have an absolute categorical ban on blocking until it classified broadband as a Title II common carrier telecommunications service. That is, after all, the difference between a common carrier and a regular business.

Once again, if you think broadband providers should be able to block content, then cool beans. But then own what you’re saying. It’s not that the FTC can prevent a carrier from blocking. It’s that the FTC can, probably, stop a carrier from blocking in cases where you think that would be appropriate. It’s a rather important difference.

After years of failed negotiations, the European Union now appears close to reaching a trade agreement with the South American political and economic bloc, Mercosur. This was confirmed by the European Union Trade Commissioner Cecilia Malmström during a press conference last month. The announcement came a day after the European Union Vice-President, Jyrki Katainen, met in Buenos Aires with the Argentinian President, Mauricio Macri, to work on unspecified “difficult issues” still pending.

The European Union Copyright Proposal

In addition to topics like sanitary standards in agriculture or car tariffs, these European Union-Mercosur trade talks will likely include provisions regulating the internet. Particularly, this agreement may expand the length and scope of copyright protection. Last year, the European Union announced its intellectual property proposal for this agreement. Although several negotiation rounds have taken place, this draft chapter remains our primary source of information for scrutinizing the copyright negotiations since both groups have barred civil society and the general public from participating in this process.

Many of the intellectual property provisions raised by the European Union in this agreement are bad for internet users. The European Union proposal seeks to erode the public domain by extending the copyright term of protection to life plus 70 years, which prominent scholars characterize as unwise and unjustified. It also seeks to ban the circumvention of technological protection measures, which would limit a user’s autonomy over legitimately purchased digital content and devices. Additionally, it aims to restrict public policies on mandatory disclosure of source code, therefore impeding measures that could strengthen cybersecurity. Finally, it fails to include strong language on copyright exceptions and limitations, a standard that even the Trans-Pacific Partnership (TPP) met.

In October the European Union reported that the copyright negotiations were “almost closed.” In the same report, the European Union admitted that “further work on exceptions” is still necessary and that “there remains a general divergence of positions regarding the level of ambition in this area.” It is unclear whether or which aspects of the reportedly “almost closed” copyright section are among the “difficult issues” that the European Union and Mercosur political leadership are trying to resolve. 

Impact for Mercosur Countries

If adopted, many of the European Union copyright proposals will require legal reforms that would further restrict the public domain and user rights in Argentina, Brazil, Paraguay, and Uruguay.

For example, the term of copyright protection in Uruguay is life plus 50 years, the minimum required by the World Trade Organization (WTO) Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS). Uruguay may have to extend the length of copyright terms of protection in order to comply with the new European Union-Mercosur obligations. Similarly, Argentina may have to introduce penalties against users that circumvent technological protection measures, a sanction that in its current form the national copyright law 11,723 lacks.

In other cases, these proposals will lock in existing norms, undermining sound policy debates around them. An example of this is the copyright term of protection in Argentina, Brazil, and Paraguay, which is unnecessarily above the minimum required by the TRIPS Agreement.

Beyond Mercosur

The European Union and Mercosur are hoping to announce an agreement during the WTO Ministerial Conference in Buenos Aires, happening now. This is hardly a coincidence. With the Trade in Service Agreement (TiSA) negotiations, the European Union is candidly pursuing a “modular approach” strategy for international harmonization: while the first phase is negotiating a plurilateral agreement, the ultimate goal is to make these norms multilateral. Prior U.S. administrations have also explicitly recognized that they too implement a similar strategy. The idea is that ambitious multilateral harmonization is difficult to accomplish, but it may be feasible if negotiated modularly through bilateral or regional agreements that can later be docked all together into the WTO system.

Although this modular approach might not have been an intended objective when the interregional talks were launched around 17 years ago, it probably is an additional benefit for the EU now. The four Mercosur members are among the few Latin American countries that have not yet signed bilateral or regional TRIPS-Plus commitments with either the U.S. or the EU. This means that they still have strong motives to oppose multilateral norms that would impose additional intellectual property obligations. However, if Mercosur countries agree to adopt higher intellectual property standards with the EU, they will lose a great deal of political leverage to continue opposing those same provisions at the WTO. Binding Mercosur to TRIPS-Plus standards may therefore facilitate future harmonization efforts at the WTO.

A very problematic trend in copyright law has emerged during a series of cases these last few years. Courts have held that creating a copy of website code in a browser’s cache constitutes a copyright violation. The issue here is that copying site code into a browser is the only way you can browse the internet. This leaves us with an absurd outcome: The current legal scheme essentially makes browsing the web a copyright violation.

The fact is that website owners almost never pursue copyright claims on the basis of browser caching. Perhaps this shows that this type of copying does not create a harm. It would be impossible for the internet to function if website owners regularly sued site visitors for merely having visited their content. But some companies have selectively leveraged the copyright law when it suits them.

Loading a Website Requires Making a Copy of the Website

In order to surf the web, you probably load up your browser (Firefox, Chrome, etc.) and type in the URL you want to visit. When you do this, your browser calls up the address you want to see and loads a copy of the website into its temporary memory. This is called “caching.” The caching process speeds up your browsing experience because the next time you go to the same page, your browser will already have pre-loaded the content, meaning your page loads faster.

Some browsers have privacy settings that will automatically delete these temporary files when a user leaves the webpage. Others hold onto them until the files are replaced by other ones when the user visits new pages. Regardless, all browsers load a copy of a website in order to display it to the user in the first place. And most users are unaware this even occurs. It is simply an automatic process that allows users to access webpages.

With that in mind, one would never think that the core mechanism of how websites are universally accessed would be copyright infringement. However, prior court decisions have suggested that the opposite is true. There have been many court decisions that come to the unreasonable conclusion that loading pages into the browser cache somehow constitutes copyright infringement. These conclusions are especially harmful when they affect new information gathering technologies, including web scraping.

What Is Web Scraping?

A web scraper is an automated script that visits a website and collects certain types of data while throwing out the rest. For example, imagine if you wanted to know the prices of all the cars being sold by a local dealership. One way of doing this would be to visit every single page and manually write down the prices. A faster way of doing this would be to run a web scraping program to find all the prices and automatically record them for you. Web scraping allows for more efficient collection and analysis of information.

Recently, some websites have complained to courts about this practice, suggesting that web scrapers are a violation of the copyright for their web content -- even when the information being gathered is not copyrighted (or even eligible for copyright). In one recent case, a web scraper run by HiQ labs gathered information from individuals’ public LinkedIn profiles, analyzed the data, and generated user reports. LinkedIn demanded that HiQ stop accessing LinkedIn profiles to gather this information, claiming that doing so constituted a copyright violation. In a similar case, a program run by Power Ventures scraped Facebook users’ data after being given permission to do so by the users. In its initial complaint, Facebook alleged that Power Ventures infringed on its copyright by loading a copy of Facebook’s site code when the web scraper visited the pages.

This is faulty reasoning -- every single web browser makes a copy of site code when accessing a website. Every person browsing the web makes copies of the site in their browser, even if they aren’t using a scraper.

The Legal History of Web Caching

The legal issues revolving around web caching actually began with case involving computer repair and software loading. In 1993, a case called MAI Systems Corp. v. Peak Computer Inc. established that temporarily loading a computer’s hard drive software into another computer’s memory to run the program constituted copyright infringement.

This outcome was so problematic that Congress passed an act that revised the copyright laws in order to ensure that temporarily loading software for repair purposes did not result in a violation. The courts also attempted to address the MAI problem as it applies to television in a case called Cartoon Network v. CSC Holdings by concluding that temporarily making copies of content for streaming purposes does not violate copyright. However, neither of these remedies resolved the overarching issue caused by the MAI conclusion. Both the repair act and the Cartoon Network outcome only addressed copies of media that are temporary. Neither instance resolved the fundamental issue that Congress did not intend copyright to prohibit necessary mechanical functions that allow for content access, regardless of how long the copies last. Both the Congressional act and the Cartoon Network case still leave out important issues like browser caching, because cached websites exist for a longer period of time than loading memory for repair or cable video buffering.

Unfortunately, courts applied the conclusion from MAI to web browsing in a case called Ticketmaster LLC v. RMG, where the court decided that cached copies of websites constituted copyright infringement. The outcome in MAI was problematic on multiple fronts, but in particular, it should simply have not been applied to web browsing. The very nature of a public website is to invite visitors at large. And in order for visitors to answer this invitation, visitors must load a copy of the website into their cache. Thus, creating and publishing a website is, by definition, an invitation to all visitors to load a copy of the site’s code into their computer’s memory. You cannot put up a public website without inviting users to copy it. Software on the other hand usually exists in discrete copies and access is only directed toward particular authorized users. These two subjects are inherently different in how they are accessed and what their intended purposes are. It was therefore incorrect to apply the MAI reasoning to web browsing. And the outcome in Ticketmaster affected many future technologies that involve browser caching, particularly web scraping.

Cached Copies of a Site Should Not Be Copyright Infringement

Common sense dictates that the nature of a particular medium be taken into account when considering whether something should be copyright infringement. The point of copyright is to protect the creative rights of people who create work, not to prevent people from visiting webpages.

A person can walk by a store window and write down the prices he sees. This is the same thing as visiting an online store and writing down the prices. There is no real difference other than the fact that visiting the website inherently requires loading the site code into the browser. It is simply unreasonable to apply copyright to browser caching because it’s a basic function of how web browsing works. As such, technologies like web scraping should not be unlawful on the basis that it requires making a copy of code in the browser cache.

Image credit: Wikimedia Commons user Fabio Lanari

Last year, the Federal Communications Commission voted to modernize the Lifeline program for the digital age to help low-income families, veterans, and children gain access to the internet. Tomorrow, FCC Chairman Ajit Pai is poised to initiate steps to drastically roll back the program, ultimately leaving millions of Lifeline subscribers and eligible families without a service provider. 

Some background: The Lifeline program is a universal service program aimed at making basic telecommunications service (historically, telephone service, and now, broadband) affordable for the poor as part of America’s longstanding commitment to universal service. Lifeline was created by the Reagan-era FCC, updated to support wireless service during the George W. Bush Administration, and updated again by the Obama-era FCC to support broadband.

The 2016 update was lauded because it recognized that internet access is a basic necessity in American life -- with access often a prerequisite for children to do homework, job seekers to fill out job applications and acquire skills, and caregivers to access health information resources and use telemedicine to reach health care professionals and improve health outcomes. The 2016 Lifeline update also took critical steps to improve program integrity while also encouraging more widespread provider participation, with the goal of maximizing the value of every dollar spent in the Lifeline program and removing administrative overhead, uncertainty, and roadblocks to carriers that provide Lifeline-subsidized service.

Unfortunately, the Lifeline program’s critics at the FCC couldn’t be persuaded to vote to bring Lifeline into the 21st Century without demanding concessions that would’ve threatened the long-term viability of the program. This week, those same critics, now in charge at the agency, are back to kneecap Lifeline and affordable telecommunications for the millions of families, veterans, and children that use the program.

Under the guise of promoting network investment and deployment and enhancing consumer choice, Chairman Pai’s attack on the Lifeline program does the complete opposite. His plan proposes to kick all non-facilities-based service providers out of the Lifeline program, which includes wireless carriers like Tracfone’s Safelink Wireless or Virgin Mobile’s Assurance Wireless, that don’t have their own networks but lease capacity from facilities-based providers (e.g., AT&T, Sprint) and serve approximately 70 percent of Lifeline subscribers. In many states, facilities-based providers have opted out of offering Lifeline-supported service altogether and prefer to allow non-facilities-based wireless providers to serve Lifeline subscribers and the low-income segments of the wireless market. The largest wireless carriers profit from this arrangement by leasing excess network capacity rather than letting it sit unused. Instead of promoting new network deployments and consumer choice, Chairman Pai’s plan would eliminate a profitable revenue stream for wireless carriers, while also eliminating non-facilities-based providers as a choice for Lifeline subscribers.

Rather than incentivizing wireless carriers to enter the market, Chairman Pai actually proposes to erect barriers to entry, leaving Lifeline subscribers with vastly fewer choices. In 2016, the FCC listened to facilities-based providers like AT&T, which said a prerequisite to entering the Lifeline market was a streamlined, centralized certification process. Chairman Pai’s proposal eliminates this centralized process, while also raising additional barriers to entry and disincentives to offer Lifeline-supported service.

The Chairman’s plan would drive out both subscribers and providers by creating a hard spending cap on the Lifeline program, proposing automatic cuts when spending appears on pace to exceed the cap. Additionally, the Chairman floats the idea of implementing a co-pay requirement for Lifeline subscribers. Both proposals are counterproductive to the Lifeline program’s mission of closing the digital divide by making broadband affordable for low-income families. First, the Chairman’s “self-enforcing” budget would require either slashing the subsidy amount, creating waiting lists for new enrollees, or kicking existing subscribers out of the program. Second, the co-pay requirement would create significant attrition in the program since most subscribers are on plans that provide no-cost service and many Lifeline subscribers lack bank accounts and access to basic financial services. These consequences stand in contrast to the goal of the program -- to make basic telecommunications service, like broadband, affordable to those that need it most, and to be available to those that need it during times of economic distress. Further, in his rush to slash the social safety net, the Chairman’s plan would not only eliminate broadband access for needy families, but it would create significant uncertainty about the program’s funding on a year-to-year, or even a month-to-month basis, and require participating facilities-based carriers remaining in the program to establish costly new new payment processing systems to comply with the co-pay mandate.

Altogether, facilities-based providers will see the elimination of a profitable funding stream, coupled with increased administrative burdens, barriers to entry, and higher costs to serve a customer segment that generates low margins. Rather than increasing customer choice, Chairman Pai’s plan is likely to strand millions of Lifeline subscribers without a service provider and push the remaining facilities-based carriers out the door.

There is already widespread consensus in the FCC’s docket by consumer advocates, civil rights organizations, Tribal groups, and telecommunications service providers that the FCC’s new anti-Lifeline proposals are wrongheaded and counterproductive to Chairman Pai’s oft-stated goal to close the digital divide. Of the 50+ filings in the docket in the three weeks since the FCC published its Lifeline proposal, there is no support for the FCC’s plan, and dozens of filings from veterans, senior citizens, civil rights organizations, Tribes, and the wireless industry explicitly urge the FCC not to move forward with its plan to stifle affordable broadband access for America’s most vulnerable. Rather than attempting to undermine Lifeline and reject America’s historic commitment to universal service, this Commission instead should begin in earnest to make broadband affordable and available for all.

In a World Where the Media Ownership Rules are Eliminated

Imagine living in a town where the only local daily newspaper, two of the top four television broadcasters, and some local radio stations are all owned by the same entity. An owner might promote one political ideology or favor particular beliefs, leaving different viewpoints simply unheard. This poses many dangers, and runs contrary to the principles of a country that prides itself on the First Amendment and the benefits of robust public dialogue. This Twilight Zone-esque hypothetical may now become reality when the Federal Communications Commission moves to scrap central portions of its historic media ownership rules at the Open Meeting on Thursday. The current media ownership rules limit any one entity from owning too many of the newspaper, radio, and/or television entities within a local market, in order to ensure viewpoint diversity. These rules are under attack.

Background

Historically, Americans have received their news and information from newspapers, radio, and television broadcasters. Even with the rise of cable news, social media, and other sources of information, these traditional sources remain the primary sources of local information. If you want to learn about local politics, development plans, new restaurants, or matters of public safety, you’re still more likely to turn to the local TV broadcast station than to CNN. In fact, the FCC itself branded broadcast radio and television as “distinctly local media.” Keeping communities informed on local news and in emergencies was a significant responsibility, so the FCC created its media ownership rules to reflect the demands of those responsibilities.

Elimination of the Rules Poses Problems to Localism

How do all of these changes lead to a world where potentially all of our information is the same and there is not viewpoint diversity? The Order before the FCC next Thursday rolls back rules that have protected the public interest and fostered diversity of voices in our communities, locally created content, and competition.

The current rules are imperfect: they need to be modernized to reflect the changing media landscape, and enforcement needs to be improved. But they should not be eliminated. The current FCC plan would simply roll most of these rules back, leading to a media consolidation and local news catastrophe.

What the FCC Proposes to Do: Mostly Eliminate

The overarching theme of the Order is to simply eliminate the current rules. However, the FCC did not eliminate everything; it declined to change the Local Radio Ownership Rule and disclosure requirements for shared services agreements (SSAs). Tacked on at the end, the FCC suggests adopting an incubator program, which is really a poorly concocted consolation prize with its own set of problems.

The Newspaper/Broadcast Cross-Ownership Rule and Radio/Television Cross-Ownership Rule

The FCC established the Newspaper/Broadcast Cross-Ownership (NBCO) Rule in 1975 to promote diversity of viewpoints at a local level, noting the rule was “essential to a democracy that its electorate be informed and have access to divergent viewpoints on controversial issues.” The NBCO Rule prohibited common ownership of a full-power broadcast station (TV, AM, or FM) and a daily print newspaper if the newspaper’s publication was encompassed by the station’s service contour. The Radio/Television Cross-Ownership (RTCO) Rule prohibits an entity from owning one radio station and more than two TV stations in the same market, unless the market meets specific size criteria. The Order repeals both of these rules.

The Local Television Ownership Rules: Eight-Voices Test and Top-Four Prohibition

The FCC is also revising its Local Television Ownership Rules, which include the Eight-Voices Test and Top-Four Prohibition. The Eight-Voices Test requires that any time two TV stations combine ownership, at least eight independently owned TV stations remain in the market. The Top-Four Prohibition restricts a single entity from owning two of the top-four ranked television stations in the same market. The Order repeals the Eight-Voices Test, stating that the rationale behind it is unsupported in the record. The Order does keep the Top Four Prohibition, but adds a hybrid approach, which allows the FCC the option to review possible ownership combinations on a case-by-case basis depending on the competitive conditions of those local markets. So even though the Top-Four Prohibition is still in effect, the Commission has the flexibility to waive the rule.

The Attribution Rule for TV Joint Sales Agreements

JSAs are agreements between stations where one station, the brokering station, sells advertising time on another station, the brokered station, for a fee or percentage of revenues. If a JSA includes more than 15 percent of the weekly advertising time of a brokered station by another in-market station, then the brokering station is deemed to have an attributable interest in the brokered station. This would count towards the brokering station’s permissible ownership totals, because in theory the brokering station would be able to exercise considerable influence over the brokered station’s operations. If the Attribution Rule for TV JSAs are eliminated, brokering stations will be able to exert more control over the programming decisions of brokered stations without that control being attributed to them.

The Diversity/Incubator Program

There is a Notice of Proposed Rulemaking at the end of the Order that proposes the adoption of an incubator program that seeks to promote diversity in broadcasting. The program is aimed at providing sources of capital and support to entities that lack the requisite experience or financing. The incubator program suggests established companies could help new owners by providing “technical assistance, loan guarantees, direct financial assistance through loans or investments, training, or business planning assistance” in exchange for a waiver to an ownership rule (or other similar benefit). This essentially means that a big company can show up and help some new, small companies in exchange for a waiver of media ownership rules. The major caveat here is that there will no longer be many ownership rules that need waiving, so there is little incentive for an established company to step into this role.

Conclusion

Broadcasters are spectrum licensees, and without some strong public interest requirements on spectrum licensees, we are at risk of losing local, community-centric information. If the goal of broadcasting is no longer to be public trustees providing local service, then the FCC needs to take some time to seriously reflect on whether broadcasters should continue to have exclusive use of valuable spectrum resources.

It’s almost axiomatic that independent artists face unique difficulties in the digital environment. Unlicensed commercial use of creative works is not uncommon, and the money that those uses theoretically represent in unpaid licensing fees can be substantial. So it’s understandable that artists would push for a system that makes it cheaper and easier for them to recover royalties for infringements of their copyrights.

But tweaking the legal system to produce better results in such a narrow set of cases is like playing high-stakes Jenga. One wrong move, and the whole incentive system of copyright litigation can topple. The latest attempt to streamline -- the CASE Act -- takes the table and threatens to flip it right over.

The Act establishes a “small claims” court tasked exclusively with adjudicating copyright cases. But, unlike most small claims courts, the Copyright Claims Board (aka the “CCB”):

• Would be run by the Copyright Office and not answerable to the regular court system;
• Could assign damages up to $30,000 -- when the national average for small claims courts is only one fifth of that; and
• Would be an “opt-out” system (more on that later).

Why do any of these matter? We’ll go in order. 

1. The CCB is not meaningfully answerable to traditional federal courts

The CCB would not be a traditional court. It would exist within the Copyright Office, with the Register of Copyrights overseeing its day-to-day function. Judges (or, in the bill’s parlance, “Copyright Claims Officers”) would be appointed by the Librarian of Congress, and while the Librarian theoretically could remove them, the bill specifically prohibits removal based on the “substantive result of any individual determination reached by the Copyright Claims Board.” While the Act’s drafters advertise this as a provision to guarantee independence, it calls into question whether the Librarian could fire a judge who routinely exhibited bias toward one class of parties, even in the face of opposing law. Given the systemic bias issue at the Office, this hypothetical doesn’t seem so remote.

Meanwhile, the decisions of CCB judges could only be appealed to the Register of Copyrights. A party who wanted to appeal a decision because they disagreed with the judge’s interpretation of the law could not legally appeal their case to a federal court. Cases could only be transferred to federal court in instances of “fraud, corruption, misrepresentation, or other misconduct”; where a party failed to appear for an excusable reason; or where the CCB “exceeded its authority” (a provision whose definition is unclear, at best). The bill would not allow parties to move their case to federal court when the CCB has erred in interpreting the law.

All of which underscores the importance of housing any small claims system within the federal judiciary. Unlike the Copyright Office -- a small office for which these kinds of complex, individual damages calculations are uncharted territory -- the judiciary has meaningful experience adjudicating individual claims for damages. Moreover, the Copyright Office is currently facing a mountain of other challenges (such as modernizing its famously outdated IT infrastructure), even without absorbing a new mandate like this. 

2. The CCB can assign 5x the national average for small claims damages

Small claims courts are nothing new; they exist in all 50 states, and have an average limit on damages of around $6,000. The CCB, in contrast, can assign up to $30,000 in damages, in part because the court isn’t limited to actually providing what are called “actual damages” (i.e. the money the artist would have received if the infringer had just paid the license in the first place, plus attorney’s fees). No, the CCB can provide statutory damages, a much higher amount set specifically for the CCB that can be used to punish parties accused of infringement. The CCB can assign up to $15,000 in damages per infringement, with up to $30,000 in damages total. For comparison, that’s higher than any small claims court in the nation, and more than double the small claims limit in 49 states.

As the CCB illustrates, statutory damages in general are dangerous (and contentious) in copyright cases. The general principle behind them is to deter defendants by allowing plaintiffs to recover large sums even when it would be difficult to prove actual damages under traditional proof standards. In copyright cases, however, statutory damages are set at an eye-popping $150,000 per file. These inflated claims have no connection to financial reality -- such as a (theoretical) $8 billion iPod.

Why, then, would deterrence-oriented statutory damages be necessary in an alternative tribunal whose essential purpose is for lower-cost resolution of smaller claims? If the CCB was designed to succeed as a low-cost forum, then it needs to be economical for claimants to bring and recover claims based on their actual damages, without the need for the deterrent factor of statutory damages. 

3. The opt-out system could create a default-judgment mill for copyright trolls

The CCB operates on an “opt-out” system. What this means, in practice, is that if individuals are accused of infringing a creative work, they will (in theory) receive a notice, and unless they respond that they want to use federal court as a venue, they are sucked into the CCB’s jurisdiction. The CCB becomes the default venue unless the defendant -- who may not have an understanding of what is happening or what to do -- chooses otherwise. Failing to respond means that the defendant is subject to the CCB’s jurisdiction, its process, and its statutory limits. (It also means that they’re required to fly to Washington, D.C., since the CCB will only sit in one place.)  

So what happens when you have a court that is (a) not answerable to the judiciary, (b) capable of assigning steep damages, and (c) capable of subjecting people to its jurisdiction by default? If you guessed “litigation mill,” you’d be right.

Imagine for a moment that you own a few copyrights. You’re not an artist, but you claim to have a handful of copyrights that you’d like to make some money off of. (You may not even own those copyrights, but you can make a facial claim that you do.) You can find “your” material online, and you’re relatively certain that the person behind posting the material can’t be found, or if they can, won’t respond. You can send a complaint to the CCB, and when the defendant doesn’t respond, ask for a default judgment for full statutory damages. That damages award is now enforceable by the police power of the state. The procedural bar is so low that you can do this 10 or maybe even 100 times over the course of a few weeks, and if you get even one default judgment, that’s up to $30,000 in your pocket. The CCB starts to look like a mighty attractive business model.

Of course, few sophisticated businesses will allow themselves to be sued in the CCB; it’s better to be a defendant in the federal courts, where defendants have set procedural rights and the costs of pursuing a case may deter many plaintiffs. Sophisticated defendants -- the kind of repeat infringers that artists express the most concern about -- probably won’t be common in the CCB. Instead, the typical claims to proceed will likely be against less sophisticated defendants, such as individual households and small businesses. After all, it is these defendants -- not big businesses or sophisticated mass infringers -- who will be far less likely to opt out, in many cases because they fail to understand and properly respond to the complaint, and therefore end up defaulting. Unfortunately, these are the sorts of cases where the risks of abuse are the highest. Thus, it’s not hard to see how trolls and default judgments could come to dominate the system.

At the end of the day, the CASE Act wouldn’t do what it set out to do. Instead of creating a reliable, fair mechanism for independent artists to pursue scaled infringement claims online, it would establish an opaque, unaccountable legislation mill that will likely get bogged down by copyright trolls and questionable claimants looking for a payout. This isn’t the solution artists need, and it isn’t the solution the public wants.

Image credit: Flickr user SalFalko

On his very first day as the Chairman of the Federal Communications Commission, Ajit Pai dedicated himself to closing the digital divide and to “work to bring the benefits of the digital age to all Americans.” Sounds promising for America, right? Unfortunately, Chairman Pai hasn’t followed through with this promise. Instead, the Trump-appointed FCC Chairman has rubberstamped the elimination of several policies and protections that are critical to closing the digital divide.

Among these now-battered policies is an item that will be decided on in November and will give telecom giants a green light to abandon their rural customers.

Under the current FCC rules, legacy telecom providers must notify their customers 180 days before making changes to their existing copper network to either maintain the current service offered or to upgrade the infrastructure for potentially faster, better internet service. Chairman Pai is calling for a vote to gut this requirement altogether, calling it an “unnecessary regulatory encumbrance.” This means that areas still operating on the traditional copper network, like much of rural America, could lose or see a change in their current service without advanced notice, and might not get an adequate replacement. Millions of Americans rely on the copper network every single day in states like Pennsylvania (1,304,000 consumers and 995 businesses), Illinois (800,000 consumers and 1,459,000 businesses) and Texas (1,381,000 consumers and 1,814,000 businesses). Without the FCC rules as security between rural consumers and profit-driven broadband providers, many in rural America could lose access to important services and receive less reliable internet than urban areas. This would in turn widen the already troubling digital divide; 39 percent of America’s rural population lacks access to high-speed internet connection.

The draft Order that will be voted on by the Commissioners in November was circulated last week by the Commission. It eliminates several copper retirement notice requirements including those that currently go directly to consumers, government entities, and tribal nations. The Order also eliminates the Functional Test, a safeguard implemented by the FCC in 2015 that requires companies to evaluate the effects a change in broadband infrastructure would have on a single community. Chairman Pai instead offers the “Tariff Test” as a replacement, a lackluster guide that will empower companies to change infrastructure according to their best business interests rather than what’s best for consumers. This could mean catastrophic abandonment for rural communities as companies bail on their decomposing copper networks in favor of fiber lines that bring higher speeds at unaffordable costs. In some cases, companies may forego replacing copper networks at all simply because it doesn’t benefit their bottom line. Even where communities do receive replacement infrastructure for their copper networks, the service offered may not be of the same quality, let alone an improvement. All of these scenarios are a downgrade for rural Americans, who are already less likely than Americans overall to have at home broadband.

Providers should continue to be held accountable to consumers, not given a free pass to downgrade Americans for more profit.

Perhaps the most troubling part of Chairman Pai’s recent attack on the digital divide is how disguised and under the radar this proceeding has been. The Chairman openly prides himself on implementing regulations that bridge the digital divide, yet consistently proposes and votes against that very interest. His friendly demeanor and legal gymnastics may make it look like he is fighting on behalf of consumers, but in reality, his agenda only hurts the American public, particularly communities that require the most help. Chairman Pai has even gone so far as to name the current proceeding Accelerating Wireline Broadband Deployment by Removing Barriers to Infrastructure Investment; a name that, to the naked eye, screams “I’m helping Americans upgrade their services!” However, underneath this facade, it is crystal clear that this is just another industry-backed plan to downgrade rural America.

Broadband deployment, specifically rural broadband deployment, is a nonpartisan issue; from Capitol Hill to Silicon Valley, the public wants connectivity for all. But America’s move from copper to fiber should be an upgrade for all, not just those of us who live in the “right” ZIP code.

Today, the Federal Communications Commission voted to approve a Notice of Proposed Rulemaking (NPRM) that will undo years of the FCC’s work to improve wireless deployments in rural areas, close the digital divide, and promote spectrum use by a wide range of users with diverse and innovative business models in the 150 megahertz between 3550-3700 MHz (the 3.5 GHz Band or Band). Adopting the NPRM is the first step to undermining the FCC’s work in the 3.5 GHz Band, and represents a rare lose-lose-lose scenario in spectrum policy making.

The draft NPRM explores expanding the geographic size of 3.5 GHz Band Priority Access Licenses (PALs) from the size of census tracts to Partial Economic Areas (PEAs), extending the license term from three years to 10 years, and to making PALs renewable. Currently, it appears the Commission (thanks to Commissioner Mignon Clyburn) may have resisted its worst impulses and walked back its draft proposal to license all PALs by PEA. However, If eventually adopted as the licensing scheme for the 3.5 GHz Band, the NPRM’s proposals would make licenses unaffordable for rural broadband providers seeking to serve targeted, unserved communities, and other innovative wireless uses (e.g., an Internet of Things network on a corporate campus or distribution warehouse, or a wireless network to serve an airport, shopping center, arena, or stadium), and make it unlikely that the 3.5 GHz Band is actually put to use closing the digital divide in rural America.

2015 3.5 GHz Order

The NPRM proposes to overturn the licensing framework for the 3.5 GHz Band the FCC adopted in 2015. The 2015 Order incorporated recommendations from the President’s Council of Advisors on Science and Technology and viewpoints and data collected through three rounds of notice and comment. At the time, the FCC explained that it anticipated its rules for the Band created flexibility that “should make the 3.5 GHz Band hospitable to a wide variety of users, deployment models, and business cases, including some solutions to market needs not adequately served by our conventional licenses or unlicensed rules.”

The 3.5 GHz Band was envisioned as an “innovation band,” with frequencies well-suited to explore next generation of shared spectrum technologies and drive greater productivity and efficiency in use of spectrum. The Commission adopted three year license terms to provide flexibility to allow a wider variety of uses for the band, encourage efficient use of spectrum by a diverse range of users, and create low barriers to entry for investment and competition in the Band.

Further, the FCC adopted census tracts for the license size, as opposed to larger geographic areas, to allow for more targeted and flexible network deployments, promote intensive and efficient use of the spectrum throughout the license area, and allow for easy aggregation so carriers interested in building a larger network footprint could do so.

The largest wireless companies and their trade associations opposed small license sizes and short license terms during each stage of the FCC’s deliberation on the 3.5 GHz Band. However, the Commission found time and again that the benefits of making licenses more broadly accessible to small providers interested in serving targeted rural markets, as well as new users interested in IoT or smart manufacturing uses of the Band, outweighed designing the licensing rules to coincide with the business model of the four national wireless carriers. However, new leadership at the FCC appears to be more amenable to servicing the desires of the largest stakeholders first, with the public interest and innovative and efficient use of the spectrum far behind.

The NPRM’s Proposals Undermine Rural Deployment & Uses

License Area Size

Expanding the size of 3.5 GHz PALs from census tracts to PEAs, as proposed by the draft NPRM, would undermine the goal for the 3.5 GHz Band to provide opportunities for targeted rural deployment of high speed mobile broadband networks. If the Commission ultimately expands license sizes to PEAs, it would become unlikely that rural broadband providers and new entrants intent on serving communities that have been long overlooked and unserved could afford to invest in the Band.

A quick comparison of the size and population of PEAs compared to census tracts is helpful to understand the difference between the likely uses for PALs with the current versus the proposed license size. According to the Census Bureau, Census tracts cover between 1,200 to 8,000 people, and have an optimum population of 4,000. Meanwhile, PEAs cover vastly more people; 334 of 416 PEAs cover a population of more than 100,000, 117 PEAs cover a population of over 500,000, and 62 PEAs cover a population of more than 1 million. PEAs are also significantly larger that census tracts. For example, the PEA that includes Los Angeles stretches across all of California to the Nevada border. Nearly the entire state of Maine is a single PEA, and Montana has six PEAs, but 271 census tracts. Puerto Rico is included in a single PEA as well.

The consequence of expanding the size of the PAL licenses from census tracts to PEAs is that carriers that want to serve small, targeted, rural communities with low population density would almost assuredly be unable to afford the licenses, let alone actually provide service. For example, a rural wireless broadband provider that wanted to cover small towns between Los Angeles and Las Vegas would need to purchase a license that covered the desired markets, but also the entire city of Los Angeles.

As a result, changing the PAL size from census tracts to PEAs would practically ensure that the largest nationwide wireless carriers will be the only providers that can acquire licenses. Those carriers would then deploy in accordance with their current business plans -- building networks in densely populated and wealthier areas and neglecting smaller and poorer communities, and leaving them further behind.

License Length & Renewability

This foreclosure effect in rural America would be compounded by the NPRM’s plan to increase the length of the license term from three years to 10 years, along with automatic renewal of the licenses and limited or no build-out requirements.

Like larger license sizes, longer license terms will serve to increase the initial cost of the licenses, likely keeping rural serving, smaller, and new providers from investing altogether.

By combining proposals backed by the major wireless carriers to drastically expand the PAL license terms and size, the NPRM will effectively drive small providers, start-ups, new market entrants, innovators, small businesses, and local institutions (e.g., schools, libraries, public parks, airports, train stations, etc.) out of the PAL market entirely. As a result, new uses, efficiencies, and innovation that may be inconsistent with the business models of the the largest wireless carriers will go unrealized, and communities that are starved for mobile broadband service will continue to languish on the wrong side of the digital divide.

Conclusion

Residents of rural areas and mobile broadband providers would all be better served by maintaining the current census tract license size. Large national carriers could acquire the spectrum they need to densify their networks in targeted census tracts, and aggregate licenses across numerous connected census tracts to replicate the large PEA-size coverage areas they want. Small carriers could acquire PALs in smaller areas, at a price that is reasonable given their business model to serve less profitable and less densely populated areas that would likely go unserved by larger wireless carriers. All stakeholders would likewise be best served by keeping the existing PAL term of three years. It is very unlikely that large wireless providers would be outbid to renew their PALs, stranding prior investments, and the miniscule risk of stranded investment is far outweighed by the harms that longer license terms will have on reducing the likelihood of new rural wireless deployments and innovative new uses of the 3.5 GHz Band.

The Commission should resist the urge to snatch defeat from the jaws of victory in the 3.5 GHz Band.                                   

Last week, Congress held four hearings to investigate the Equifax data breach, which jeopardized the highly sensitive data of 145 millions Americans. The exposed consumer information includes social security numbers, prior addresses, student loans, credit card numbers, and other pieces of private data compiled into credit reports that determine if a consumer qualifies for employment, loans, or new lines of credit. For days, members of Congress questioned former Equifax CEO Richard Smith as to how the breach could have occurred and what steps the company was taking to protect consumers. Mr. Smith resigned in September after the extent of the breach was fully disclosed. During the hearings, he offered little in terms of solutions on how to protect consumers going forward, but his answers revealed significant problems with our current data security regime that Congress must address.

Consumers Have Little Control Over Their Own Data

One of the biggest problems the Congressional hearings highlighted is how little control consumers have over their own data. Several members of Congress expressed concern that many of their constituents were surprised to find out they were affected by the data breach because they had no idea Equifax had access to their data to begin with. As we’ve explained in the past, many of Equifax’s customers are third parties such as mortgage banks who share their own customers’ sensitive information with the credit reporting agency. Mr. Smith himself explained that Equifax is part of a financial data sharing ecosystem where banks and other third parties share data with credit reporting agencies to assess their customers’ credit risk. In other words, sharing consumers’ sensitive information between third parties is simply business as usual for credit reporting agencies and the financial industry at large. Unfortunately, the current system doesn’t give consumers notice of who has access to their sensitive information nor does it impose any liability on third parties who share their customers’ personal sensitive information.

Members of Congress were also concerned over the sheer amount of data Equifax collects on each individual. One Congressman mentioned that Equifax had collected ten years of sensitive personal information on his staffer dating back to her time in high school. The truth is credit reporting agencies collect vast amounts of information on individuals often exceeding what is necessary to determine creditworthiness. Given their core business model is based on selling consumer data to third parties, credit reporting agencies are incentivized to collect as much data as possible. As a result, consumers are often left at the mercy of these agencies, and are unaware of what data is being collected on them and who has access to it.

It is critical for consumers to have control over their own data, and members of Congress should make this a priority as they consider upcoming steps for data breach protection. Consumers should have notice over what information is being collected on them, who is maintaining their personal information, and the right to remove their personal information.

A National Data Breach Notification Standard Is Necessary

No matter how sophisticated a security system may be, data breaches are bound to happen. There are a number of state data breach notification laws in place, but we lack a national standard. Equifax found out about the data breach in mid-May but failed to provide any notice until September. For months, affected consumers were completely unaware that their sensitive information was exposed and  could not take any steps to mitigate the potential harms.

Several members of Congress questioned Mr. Smith over the timing of the breach and why it took the company so long to provide notice. The former CEO tried to explain the extended time was needed to understand the extent of the breach and what information was compromised. While companies do need time to assess, they don’t currently have incentive to provide timely notice to consumers. The more consumers affected by a breach, the more credit reporting agencies have to gain by offering remedial services and products. In fact, Mr. Smith was quoted a few weeks before Equifax disclosed the breach as saying that “fraud is a huge opportunity for Equifax.”

Without a national data breach notification standard that provides a timely and clear notice to consumers, credit reporting agencies can continue to delay notifying consumers of breaches while profiting off of affected consumers.

Consumers Expect Adequate Protections After a Breach

Unfortunately, Equifax has offered a number of substandard protections after the breach occurred. Equifax initially offered a one year credit-monitoring service for affected consumers. After facing public outrage for the limited-time service, Equifax is now offering a credit freeze until January 31, 2018, after which they will offer affected consumers a ‘credit lock’ that will be free for life. However, several members of Congress questioned the potential harms associated with this new service. One member questioned whether Equifax’s credit lock will force participating consumers to share their data with third parties for marketing purposes. Other members questioned Mr. Smith as to why Equifax was offering a lifetime credit lock as opposed to a credit freeze, which is seen as a greater protection for consumers.

As we’ve previously discussed, Equifax’s use of forced arbitration agreements in their services also continues to be fundamentally unfair to consumers. Equifax initially required people to waive their right to sue simply to find out whether or not their data had been breached. Although Equifax eventually waived the clause, many consumers had already given up their right to sue just to get notice. Further, Mr. Smith conceded that Equifax continues to implement forced arbitration clauses in its other products, which would include its upcoming credit lock service. Ultimately, forced arbitration clauses limit the ability of consumers to seek relief for the misuse of their data.

At the end of the day, Equifax’s services are not enough to make consumers whole after the company failed to secure their data. Some members of Congress weighed whether Equifax should pay fines to each consumer whose data was exposed or set up a compensation fund for consumers who suffer financial harm from the breach. Overall, it’s clear that consumers expect better protections than notice of the breach combined with a credit monitoring service.

Credit Reporting Agencies Face Little Accountability

In all four hearings, Mr. Smith testified that the data breach happened on his watch, and he took full responsibility by stepping down. But it’s obvious that multiple people in the company were responsible for failing to protect consumer data. This raises another significant issue -- companies face very little accountability when there’s a data breach. Several members of Congress questioned Mr. Smith as to why senior executives including the CFO would sell their stock just days after the company discovered the breach. Other lawmakers asked Mr. Smith whether it’s fair for him to receive an $18 million pension despite stepping down from the company. Mr. Smith dodged these questions by responding there was no connection between the executives selling their stock and the company’s data breach, and his own compensation was what he was owed. But his responses highlighted that those responsible often go unscathed while consumers suffer the consequences of the data breach.

Lawmakers also questioned Mr. Smith on the integrity of Equifax’s security system and how it could have suffered a massive breach. The former CEO explained that the breach was a result of a “human error” and a “technology error.” In simple terms, an employee did not properly communicate the system was vulnerable and needed to be patched, and the scanning technology failed to detect that the vulnerability was unpatched. Members of Congress expressed concern that a massive data breach could be caused by one person and questioned why the company did not set up additional safeguards.

Mr. Smith’s explanations only highlight the need to hold companies that have access to our data to a higher standard. One way to do this is by establishing an independent audit regime that can assess whether companies that hold sensitive data are adequately protecting it. Given the steps that lead to Equifax’s data breach, it’s clear more accountability is needed across the board.

Congress Should Take A Comprehensive Approach To Address These Problems

As Congress navigates how to address the Equifax data breach and provide consumers with better protections, lawmakers should consider all of the problems that lead to the breach as well as the lack of adequate remedies consumers have after the breach. Consumers need more control over their data and stronger remedies to hold companies that inadequately protect their data accountable. We may not be able to stop the next data breach, but policymakers should work to deter such sloppy corporate misbehavior in the future, and a comprehensive approach to improving data security systems should provide consumers with the tools they need to mitigate any damages they suffer. 

Last week, Public Knowledge and the Organization of American States (OAS) organized a joint roundtable on “Cybersecurity and Civil Society in the Americas,” which took place at the OAS headquarters in Washington, D.C. Thanks to the support of Open Society Foundations, the roundtable included civil society organizations from all over the Americans: Derechos Digitales, Instituto Brasileiro de Defesa do Consumidor (IDEC), ADC Asociación por los Derechos Civiles (ADC), Centro de Estudios Legales y Sociales (CELS), Karisma, TEDIC, Red en Defensa de los Derechos Digitales (R3D), CodingRights, InternetLab, Datos Protegidos, Ipandetec, Hiperderecho, Access Now, New America, and more.  It also included the active participation of high-ranking members of the Canadian, American, Colombian, and Guatemalan governments, the Brazilian Armed Forces, and private organizations.

The two-day event was live-streamed and presented in both English and Spanish. We hosted conversations on the following crucial topics:

• Cybersecurity governance
• Human rights
• The role of the OAS and civil society in the development of national cybersecurity strategies
• Transnational organized networks
• The common challenges for cybersecurity in the western hemisphere
• The importance of an inclusive approach to cybersecurity
• The relation between cybersecurity and development

Here are the highlights of the roundtable:

The event kicked off with opening remarks from Sebastien Sigouin, Deputy Head of Mission (Washington, D.C.) of the Government of Canada; Claudia Paz y Paz, Secretary of Multidimensional Security of the OAS; and Chris Lewis, Vice President of Public Knowledge.

Michael Walma, Director of Foreign Policy Planning of Global Affairs Canada; Ona Flores, Human Rights Specialist (IACHR); and Robyn Greene, Policy Counsel and Government Affairs Lead, Open Technology Institute introduced their approach on how to achieve a free and open internet. The OAS Cybersecurity team, lead by Belisario Contreras and assisted by Kerry-Ann Barrett and Barbara Marchiori, explained OAS’s experiences on the development of National Cybersecurity Initiatives.

Turning to the challenges for the multistakeholder participation on the national cybersecurity development process, Juanita Rodriguez, Director of IT and Standards, Ministry of ICT of Colombia; Andres Rengifo, Director of the Digital Crime Unit and Intellectual Property Matters; and Daniela Schnidrig, Project Manager at Global Partners Digital debated how to improve and guarantee civil society engagement in cybersecurity governance.

Albert Rees, Computer Crime & Intellectual Property Section from the U.S. Department of Justice; Gabriel Juarez, Vice-minister of Interior of Guatemala; and Megan Stifel, Cybersecurity Director of Public Knowledge carried a conversation on cybersecurity and transnational organized networks.

Liesyl I. Franz, Senior Policy Advisor, Office of the Coordinator for Cyber Issues U.S. Department of State; Alison August Treppel, Executive Secretary of OAS’ CICTE Secretariat; and Tim Maurer, Co-Director Cyber Policy Initiative at Carnegie Endowment for International Peace presented their visions on the many challenges for cybersecurity in the Americas.

Amalia Toledo, Project Coordinator and Researcher at the Karisma Foundation; Pablo Viollier, Public Policy Analyst at Derechos Digitales; and Amie Stepanovich, U.S. Policy Manager at Access Now presented closing remarks on the first day. To wrap up the day, the civil society delegation joined the Inter-American Development, OAS, and the Colombian Government in the launch of a report on cybersecurity in Colombia.

On the second day, a team lead by New America’s Ian Wallace guided a debate about the role of Multilateral Development Banks in cybersecurity. The civil society delegation then participated in the launch of OAS’s Cybersecurity Awareness Month in the OAS ceremonial building.

Public Knowledge is grateful to OAS, OSF, and all other participants for enabling a fruitful conversation about the future of civil society engagement in cybersecurity governance in the Americas. Democratic societies that wish to preserve a free, open, and dynamic internet need multistakeholder governance mechanisms for meeting cybersecurity challenges. Public Knowledge’s cybersecurity and global programs will keep working with all our partners to make cybersecurity governance truly multistakeholder in the Americas and elsewhere.

See the image above and more photos from the event here on the OEA - OAS Flickr page.