Feeds

Madonna's borderline MP3 tactics

Deceptive trade practice

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

The material girl's foul-mouthed revenge on music traders could be interpreted as a deceptive trade practice, or even outright fraud, says Mark Rasch, SecurityFocus columnist.

Virginia's new anti-spam law makes it a criminal offense to send e-mail with inaccurate and deceptive source or header information. The new PROTECT Act signed by President Bush similarly makes it a federal offense for online pornographers to obtain or use misleading domain names to induce individuals to surf unwittingly to porn sites. At the same time, the U.S. Federal Trade Commission filed a series of civil complaints against "porn-spammers" alleging that spoofed source information and misleading subject lines constitutes a deceptive trade practice.

Can this mean that Madonna goes to jail?

The recording industry won and lost in a series of cases in late April. In separate decisions, they won the ability to subpoena the names of p2p users from Verizon's online services, but they lost the ability (at least for now) to pursue direct or contributory infringement lawsuits against the distributors of p2p software.

One method of "self-help" employed by the record and motion picture companies is to attempt to flood the p2p networks with bogus material -- files that are labeled as, and appear to be, genuine copyrighted work (they are the correct format and file size), but contain either no data, or, in the case of Louise Veronica Ciccone (a/k/a "Madonna"), contain a voice file asking, "What the f*ck do you think you are doing?"

One response of the p2p users has been to hack back -- defacing the RIAA website, or hacking Madonna's webpage and inserting copies of her own music for download. Another is to use IP filtering to block p2p downloads from known RIAA or MPAA sites.

Here's how it would work: The FTC's theory of liability in the "porn-spammer" cases is that the header information or subject line of a mass e-mail is deceptive or fraudulent, and is intended to induce the recipient to open the file, and thereby see the advertisement that they would not otherwise have seen. The FTC does not -- at least not in these complaints -- allege that the underlying advertisement itself is false or deceptive; just the descriptions.

Similarly, the PROTECT act makes it a federal crime to use a misleading domain name to trick people into viewing obscene materials or to trick children into viewing materials that are "harmful to minors."

The message from these laws (and various anti-spam laws across the country) appears to be that using fictitious headers, names, or descriptions in interstate or foreign commerce in order to induce someone to act is an offense -- either a crime or, at a minimum, a "deceptive trade practice."

This may be bad news for those who post fake files on Kazaa.

Unclean Hands
The FTC has general authority over false or misleading advertisements, derived from Title 15 USC Section 45(a)(1), which says that "... [u]nfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." This grant of jurisdiction is remarkably broad, and is limited only to a showing that the act or practice is "deceptive" and is either "in commerce" or "affects commerce" -- not that the act itself be commercial.

While Congress has limited the FTC's jurisdiction in areas that come under the regulation of other agencies (e.g., FCC, DOJ) its powers to act are unquestionably broad. The FTC has used this grant of authority to punish companies that do not adhere to their own stated privacy policies, that engage in mislabeling of goods or services, and to go after people who engage in "pretext calling" -- pretending to be someone other than who they are to get people's financial or medical information.

In other words, the FTC has general jurisdiction over fraud, false statements, fraudulent pretexts, hucksters, con-artists, and most things deceptive. If it smells bad (and isn't delegated to another agency) and affects commerce, it probably violates the FTC Act.

The actions of RIAA and MPAA in placing files on p2p networks to deceive users of those networks into thinking they're actual music or video files, to waste their time, resources, energy and bandwidth (not to mention hard drive space and CPU cycles) quite likely is "deceptive" and undoubtedly "affects commerce."

Foul!, you shout. Why should downloaders, freeloaders, pirates and copyright felons be entitled to the protection of the law? Druggies who buy talcum powder from undercover cops can't sue the police because they were "deceived," can they? What about the legal doctrine of "unclean hands" -- you can't complain about somebody else's wrongdoing if you are engaged in wrongdoing yourself?

In fact, law, policy and tradition have all held that law enforcement agencies are entitled to use trickery in connection with criminal investigations. But there is no such body of case law with respect to copyright holders.

Moreover, there is nothing in the FTC Act that says "deceptive trade practices" are permitted if done for a good reason, or against people we don't like.

Imagine if a person was in midtown Manhattan selling what you assumed were pirated DVD's -- say X-Men 2. You plunk down your $5 (such a deal) and voila! -- a blank CD-ROM.

The seller would be liable for fraud or deception -- even though you thought you were purchasing a pirated disc.

What about the idea that the record and film companies aren't "selling" the fakes, but just putting them up for free? For FTC jurisdictional purposes, it makes no difference -- it's still deceptive, and it still affects commerce. The FTC Act doesn't even require proof of damages, though if it did, computer crime laws have already established that waste of computer time, hard drive space, memory, processor time, network resources or user time are all cognizable "losses."

Sadly, the FTC Act does not provide for individual remedies: a victim of the material girl's foul-mouthed trickery could only file a complaint with the FTC and try to get them to go after her. This is not a very likely prospect. But many states do have their own consumer protection statutes that allow victims to sue individually for deceptive or fraudulent trade practices, so it's not inconceivable that someday the recording industry might find itself on the wrong end of a p2p lawsuit -- maybe even from one of the Verizon customers the RIAA is attempting to identify.

© SecurityFocus logo

Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and now serves as Senior Vice President and Chief Security Counsel at Solutionary Inc.

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.