Feeds

Madonna's borderline MP3 tactics

Deceptive trade practice

  • alert
  • submit to reddit

Seven Steps to Software Security

The material girl's foul-mouthed revenge on music traders could be interpreted as a deceptive trade practice, or even outright fraud, says Mark Rasch, SecurityFocus columnist.

Virginia's new anti-spam law makes it a criminal offense to send e-mail with inaccurate and deceptive source or header information. The new PROTECT Act signed by President Bush similarly makes it a federal offense for online pornographers to obtain or use misleading domain names to induce individuals to surf unwittingly to porn sites. At the same time, the U.S. Federal Trade Commission filed a series of civil complaints against "porn-spammers" alleging that spoofed source information and misleading subject lines constitutes a deceptive trade practice.

Can this mean that Madonna goes to jail?

The recording industry won and lost in a series of cases in late April. In separate decisions, they won the ability to subpoena the names of p2p users from Verizon's online services, but they lost the ability (at least for now) to pursue direct or contributory infringement lawsuits against the distributors of p2p software.

One method of "self-help" employed by the record and motion picture companies is to attempt to flood the p2p networks with bogus material -- files that are labeled as, and appear to be, genuine copyrighted work (they are the correct format and file size), but contain either no data, or, in the case of Louise Veronica Ciccone (a/k/a "Madonna"), contain a voice file asking, "What the f*ck do you think you are doing?"

One response of the p2p users has been to hack back -- defacing the RIAA website, or hacking Madonna's webpage and inserting copies of her own music for download. Another is to use IP filtering to block p2p downloads from known RIAA or MPAA sites.

Here's how it would work: The FTC's theory of liability in the "porn-spammer" cases is that the header information or subject line of a mass e-mail is deceptive or fraudulent, and is intended to induce the recipient to open the file, and thereby see the advertisement that they would not otherwise have seen. The FTC does not -- at least not in these complaints -- allege that the underlying advertisement itself is false or deceptive; just the descriptions.

Similarly, the PROTECT act makes it a federal crime to use a misleading domain name to trick people into viewing obscene materials or to trick children into viewing materials that are "harmful to minors."

The message from these laws (and various anti-spam laws across the country) appears to be that using fictitious headers, names, or descriptions in interstate or foreign commerce in order to induce someone to act is an offense -- either a crime or, at a minimum, a "deceptive trade practice."

This may be bad news for those who post fake files on Kazaa.

Unclean Hands
The FTC has general authority over false or misleading advertisements, derived from Title 15 USC Section 45(a)(1), which says that "... [u]nfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." This grant of jurisdiction is remarkably broad, and is limited only to a showing that the act or practice is "deceptive" and is either "in commerce" or "affects commerce" -- not that the act itself be commercial.

While Congress has limited the FTC's jurisdiction in areas that come under the regulation of other agencies (e.g., FCC, DOJ) its powers to act are unquestionably broad. The FTC has used this grant of authority to punish companies that do not adhere to their own stated privacy policies, that engage in mislabeling of goods or services, and to go after people who engage in "pretext calling" -- pretending to be someone other than who they are to get people's financial or medical information.

In other words, the FTC has general jurisdiction over fraud, false statements, fraudulent pretexts, hucksters, con-artists, and most things deceptive. If it smells bad (and isn't delegated to another agency) and affects commerce, it probably violates the FTC Act.

The actions of RIAA and MPAA in placing files on p2p networks to deceive users of those networks into thinking they're actual music or video files, to waste their time, resources, energy and bandwidth (not to mention hard drive space and CPU cycles) quite likely is "deceptive" and undoubtedly "affects commerce."

Foul!, you shout. Why should downloaders, freeloaders, pirates and copyright felons be entitled to the protection of the law? Druggies who buy talcum powder from undercover cops can't sue the police because they were "deceived," can they? What about the legal doctrine of "unclean hands" -- you can't complain about somebody else's wrongdoing if you are engaged in wrongdoing yourself?

In fact, law, policy and tradition have all held that law enforcement agencies are entitled to use trickery in connection with criminal investigations. But there is no such body of case law with respect to copyright holders.

Moreover, there is nothing in the FTC Act that says "deceptive trade practices" are permitted if done for a good reason, or against people we don't like.

Imagine if a person was in midtown Manhattan selling what you assumed were pirated DVD's -- say X-Men 2. You plunk down your $5 (such a deal) and voila! -- a blank CD-ROM.

The seller would be liable for fraud or deception -- even though you thought you were purchasing a pirated disc.

What about the idea that the record and film companies aren't "selling" the fakes, but just putting them up for free? For FTC jurisdictional purposes, it makes no difference -- it's still deceptive, and it still affects commerce. The FTC Act doesn't even require proof of damages, though if it did, computer crime laws have already established that waste of computer time, hard drive space, memory, processor time, network resources or user time are all cognizable "losses."

Sadly, the FTC Act does not provide for individual remedies: a victim of the material girl's foul-mouthed trickery could only file a complaint with the FTC and try to get them to go after her. This is not a very likely prospect. But many states do have their own consumer protection statutes that allow victims to sue individually for deceptive or fraudulent trade practices, so it's not inconceivable that someday the recording industry might find itself on the wrong end of a p2p lawsuit -- maybe even from one of the Verizon customers the RIAA is attempting to identify.

© SecurityFocus logo

Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and now serves as Senior Vice President and Chief Security Counsel at Solutionary Inc.

Mobile application security vulnerability report

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.