Politics and Law

Web sites involved in defamation suits are not required to immediately hand over the identities of readers who leave anonymous comments, a Maryland court has ruled, laying out guidelines for future suits involving online anonymity.

The Maryland Court of Appeals on Friday overturned (PDF) an earlier ruling that would have forced Independent Newspapers, which runs the online forum NewsZap.com, to turn over the names of three unknown Internet posters who posted negative remarks regarding the cleanliness of a Dunkin' Donuts in Centreville, Maryland. The owner of the Dunkin' Donuts, Zebulon J. Brodie, claimed the anonymous posters defamed his store.

The appeals court decided Brodie was not entitled to learn the identities of the posters because in his complaint he misidentified the forum participants responsible for the critical comments.

The court used its ruling to set for trial courts a "standard that should be applied to balance the First Amendment right to anonymous speech on the Internet with the opportunity on the part of the object of that speech to seek judicial redress for alleged defamation."

In a defamation case involving anonymous speakers, the ruling said, courts should first require the plaintiff to try to notify the anonymous posters that they are the subject of a subpoena. That notification could come in the form of a message posted to the online forum in question, and the posters must be given sufficient time to respond.

The plaintiff must then hand over the exact statements in question, so the court can decide whether the comments are obviously defamatory. Finally, the ruling says, the court must weigh the anonymous poster's right to free speech against the strength of the defamation case and the necessity of disclosing the poster's identity.

The Virginia Supreme Court on Friday overturned the conviction of a notorious AOL spammer, the first spamming defendant to be convicted of a felony, saying the state junk e-mail law is too broad and violates the First Amendment.

This is a remarkable decision (PDF). But a close reading of the Virginia statute shows that it is the right one.

The law in question is kind of the state equivalent of the Can-Spam Act, though with exclusively criminal penalties. It says:

A. Any person who: 1. Uses a computer or computer network with the intent to falsify or forge electronic mail transmission information or other routing information in any manner in connection with the transmission of unsolicited bulk electronic mail through or into the computer network of an electronic mail service provider or its subscribers...is guilty of a Class 1 misdemeanor.

If someone violates section (A) by transmitting unsolicited bulk e-mail to 10,000 attempted recipients in a 24-hour period, 100,000 attempted recipients in a 30-day period, or 1 million attempted recipients over one year--well, then the criminal penalties jump from a misdemeanor to a felony.

What's notable about this law, and what made it vulnerable to First Amendment challenge, are two characteristics. The first is that it applies to the falsification of e-mail information, which could sweep in both spammers and, say, someone using a pen name or pseudonym. And we know, despite efforts under way at a United Nations agency, that the First Amendment clearly protects anonymous speech.

The second characteristic is that the law regulates both commercial and noncommercial e-mail, meaning that political speech would be covered as well. (Now, it's not clear that commercial speech deserves to be treated as a second-class citizen, but courts have generally said it's OK to slap more regulations on it.)

Let me stipulate at this point that, especially as someone who runs his own mail server, I have no love for spammers. The defendant here, Jeremy Jaynes, has been estimated to be the world's 8th most prolific spammer, believed to have received up to $750,000 a month from his efforts. Horsewhipping is too good for these knaves.

But when tech-impaired politicos devise measures to imprison spammers (a worthy goal, that), those laws must not go too far and sweep in legitimate activities too. Virginia's did, as the state Supreme Court concluded, with some help from the ACLU's Virginia affiliate. Excerpts:

Jaynes does not contest the Commonwealth's interest in controlling unsolicited commercial bulk e-mail, as well as fraudulent or otherwise illegal e-mail. Nevertheless, Code § 18.2-152.3:1 is not limited to instances of commercial or fraudulent transmission of e-mail, nor is it restricted to transmission of illegal or otherwise unprotected speech, such as pornography or defamation speech.

Therefore, viewed under the strict scrutiny standard, Code § 18.2-152.3:1 is not narrowly tailored to protect the compelling interests advanced by the Commonwealth.

Code § 18.2-152.3:1 would prohibit all bulk e-mail containing anonymous political, religious, or other expressive speech. For example, were the Federalist Papers just being published today via e-mail, that transmission by Publius would violate the statute.

Such an expansive scope of unconstitutional coverage is not what the Court in Williams referenced "as the tendency of our overbreadth doctrine to summon forth an endless stream of fanciful hypotheticals."

We thus reject the Commonwealth's argument that Jaynes' facial challenge to Code § 18.2-152.3:1 must fail because the statute is not "substantially overbroad."

That statute is unconstitutionally overbroad on its face because it prohibits the anonymous transmission of all unsolicited bulk e-mails, including those containing political, religious, or other speech protected by the First Amendment to the United States Constitution. Accordingly, we will reverse the judgment of the Court of Appeals and vacate Jaynes' convictions of violations of Code § 18.2-152.3:1.

Jaynes, at the time a North Carolina resident using the pseudonym "Gaven Stubberfield," was indicted in Virginia in December 2003. In 2005, he was sentenced to nine years in prison; our coverage at the time said prosecutors estimated that he raked in up to $24 million in sales, some of which he invested in a restaurant and a chain of gyms. When police originally searched his home, they found CDs more than 176 million full e-mail addresses and 1.3 billion e-mail usernames.

It's not clear what happens next. Virginia could appeal. Companies that had their servers clogged, such as AOL, could sue. Other state prosecutors may be interested in targeting Jaynes. But action under the Can-Spam Act may be unlikely; it wasn't signed until December 2003, when Jaynes was already being arrested.

So what's the moral of this story? If you're a state legislator writing an antispam law, be very careful. Target only commercial e-mail, and be careful about wording that might make courts think you're trying to ban perfectly innocuous use of e-mail pseudonyms. If you do it right, the next Jaynes may actually stay in prison.

Google is taking issue with reports saying that it "voluntarily" turned over information about a Blogger.com user to someone who filed a libel lawsuit in Israel.

An article published Tuesday on an Israeli news site said that the search company had "agreed to supply the IP address" of a blogger sued for alleged defamation, marking "the first time that Google forewent legal action in such a case." That was quickly echoed in headlines saying Google "voluntarily" divulged user data and "Google dishes out IP address of anonymous blogger."

Google spokesman Steve Langdon sent this in e-mail to me late Tuesday night:

Google's approach to personal data is clear -- we only ever hand over information about our users to third parties (such as law enforcement agencies) when they have been through the proper legal process. This ensures that we are able both to protect the privacy of our users and act responsibly where people may have used Google's products to break the law.

In terms of Blogger, we have clear terms and conditions, which users agree to when they sign up for the service. These make clear that: violent, hateful or copyright infringing content, for example, is against our rules; violation of our terms of service may lead not only to the termination of the users' account but also "state and federal penalties and other legal consequences"; and Google may investigate any violations to "comply with any applicable law, regulation, legal process or governmental request."

In terms of this case, we handed over the IP address of the Blogger after an Israeli court order required us to do so. Google has not blocked the blog or taken it down. Google gave the IP address to the court (the court handed it over to the complainant).

So what really happened? Without seeing the original court documents, it's hard to know for sure. But the story seems a bit more complicated than saying Google did this "voluntarily." Langdon, as you can see in the portion of his response I put in boldface above, says Google was "required" by law to do so -- which would make this a less interesting and more commonplace situation.

One last thought: Blogger.com appears to have its servers located in California, where libel is a civil offense but not a crime (criminal libel laws have been largely abandoned in the U.S. since the 1964 Supreme Court ruling in Garrison v. Louisiana). Libel is a crime in Israel, and this judge reportedly noted the criminal overtones. So we have a situation where there's an apparent conflict of criminal laws related to free expression. I've asked Google to explain its policy in these circumstances, so check back in a few hours for an update.

[Disclosure: Declan McCullagh is married to a Google employee.]