THE CASE OF DMITRY SKLYAROV

On 13 August 2001, www.ft.com reported on the Russian hacker Dmitry Sklyarov, who faces trial in the USA for allegedly violating new copyright legislation. He was detained by FBI agents on his way back to Moscow from a hackers' conference in Las Vegas, where he had explained how to circumvent a security system on software sold by the US company Adobe. His Moscow-based company, Elcomsoft, sold a program that broke Adobe's code which prevented users copying documents published in Adobe format. Sklyarov's detention caused outrage across the cyber community, and special Internet sites and banners proclaiming 'Free Dmitry Sklyarov' and attacking Adobe were rapidly created. Adobe was surprised by the outcry and asked the US authorities to drop the charges. However, prosecutors have resolved to pursue the case, which will be a pioneering test for the 1998 Digital Millennium Copyright Act (DMCA), which makes it illegal to evade copyright-protecting technology.

Sklyarov has been released on bail, but faces a fine of up to $500,000 if found guilty. Elcomsoft argues that its program highlighted weaknesses in Adobe's security, and was not designed to allow infringement of copyright. The mainstream Russian media have followed the case extensively, and the interior ministry has said that it will not prosecute Sklyarov on his return. In the USA, libertarian groups such as the Electronic Frontier Foundation (EFF) have also argued in his defence. The case has other implications that could paradoxically lead to the potential for widespread computer damage from hackers. There is a long-standing tradition within the US technology community of 'white-hat hackers' whose hobby is finding security weaknesses within computer systems used in business applications, then publicizing them to allow computer companies to plug the security holes. Internet legal experts have expressed concern that advances in technology, together with legislation such as DMCA, is granting copyright holders too much power.

Data protection

The UK's Data Protection Act 1984 (and later amendments) focuses on the information that companies hold on customers and how individuals can access it and ensure it is correct. Although of course this act pre-dates the Internet, the principles involved are exactly the same. More detail about the implications of recent changes in the Data Protection Act is available at www.dataprotection.gov.uk. Basically, there are eight key principles of good practice enshrined in the Act which can be summarized as follows:

Data must be:

1 fairly and lawfully processed;

2 processed for limited purposes;

3 adequate, relevant and not excessive;

4 accurate;

5 not kept longer than necessary;

6 processed in accordance with the data subject's rights;

7 secure;

8 not transferred to countries that do not have adequate protection.

The Information Commissioner's Office has produced four free introductory seminars to help both individuals and organizations that hold personal information (data controllers) to understand the Data Protection Acts. Each seminar consists of a voice-over recording accompanied by a power-point presentation. The seminars can be downloaded from www.dataprotection.gov.uk/seminars. htm.

CPExchange (www.cpexchange.org) offers an independent and open standard that allows approved customer data to be shared between disparate computer systems. This means that different areas of an organization, reliant on separate data sources and even whole computer systems, are able to obtain an integrated picture of customer information that complies with data collection criteria to be used for marketing purposes.

Online Marketing Legal Developments

Although this chapter is divided into one section dealing with 'legal' and another with 'ethical' issues, it should become clear as you read through that the two areas are very much interrelated.

A comprehensive international legislation system that applies to global online trading does not exist at present and is not expected in the foreseeable future. Even within the USA, which is comparatively advanced in its use of the Internet, legal issues such as the validity of digital signatures have caused significant disagreements. While waiting for federal legislation, many states have set up their own laws, which have differed widely from state to state. Organizations such as the United Nations or bodies dealing with international trade law have been actively calling for global co-ordination of appropriate legal structures.

Copyright protection

Because the copyright legislation on the Internet is complex and vague, many Web site operators are reusing information from other sites. Comparison-shopping sites such as www.moneysupermarket.com, for example, rely heavily on aggregating information existing on other sites and presenting it in a comparative format. While this is acceptable in the USA, which allows data to be extracted and compiled in this way, there are indications that Europe may impose certain restrictions on what one site can do with another's information.

Another contentious issue concerns domain name conflict. There have been a number of cases whereby individuals (known as `cybersquatters') have registered domain names that resemble established brands or generic terminology and thenattempted to sell the right to use that name to the company concerned. For example, Chen (2001) notes that the address `business.com' was sold for $7.5 million and `wine.com' for $3 million. The author goes on to describe the case of Marks and Spencer v. One in a Million Limited and Others, in which Marks and Spencer sued for infringement of its trademark after the defendant registered the domain name marksandspencer.com and demanded money in exchange for handing it over. The courts found in favour of Marks and Spencer, and One in a Million was prevented from using the name or trying to sell it to anyone else. Chen also describes the problem of character string conflicts that arise when there is more than one legitimate user of a certain combination of letters. Finally, remember the case of www.untied.com that was described in Chapter 6? This site was set up by an online 'vigilante' to publicize the customer service failings of www.ual.corn (United Airlines), and accurately mimics the logo, style and layout of the original site.

This example also illustrates that copying anything from a Web site is very easy — merely a matter of cutting and pasting the code — so that protection of any intellectual property is very difficult. A famous example concerns the ongoing dispute over the piracy of music on MP3 sites, which are file compression formats allowing songs to be freely transmitted over the Web and downloaded to an individual's computer. Peer-to-peer (P2P) sites such as www.napster.com allow

users to share the content of their computers, hard drives, and this technological innovation makes the worldwide sharing of music files even easier.

While legislation continues to lag behind technological developments, one of the few protections currently available to businesses is to patent innovative techniques that they have devised. In the case of Amazon v. Barnes and Noble in 1999, Amazon won a lawsuit against Barnes and Noble, which had tried to copy the famous 'one-click' ordering system pioneered by Amazon.

Contractual agreements

Electronic contractual agreements are part and parcel of e-Commerce. The registration procedure is part of the purchasing process and requests the buyer to scroll through a set of contract terms. The purchase sequence is completed only when the buyer has clicked his or her agreement to the terms and conditions presented. The validity of such an electronic contract has been tested already through the US courts, but it is not certain that it is globally acceptable. Consumer protection laws vary from country to country and the global operator must be aware of differing obligations that could impact on the validity of the transaction performed.

The importance of keeping track of changes in legislation that will affect e-Business cannot be underestimated. Certain legislation such as the law passed recently by the European Union regarding email marketing could have far reaching consequences. Effective from 1 March 2001, this law states that if a dispute occurs between a consumer and an online retailer in any of the fifteen countries of the EU, the consumer may file a suit in his or her own country. Small firms that have thrived from the freedom the Internet is offering may well find it harder now to maintain control over their direct email marketing campaigns in this increasingly legislative environment.