Feeds

Madonna's borderline MP3 tactics

Deceptive trade practice

  • alert
  • submit to reddit

Internet Security Threat Report 2014

The material girl's foul-mouthed revenge on music traders could be interpreted as a deceptive trade practice, or even outright fraud, says Mark Rasch, SecurityFocus columnist.

Virginia's new anti-spam law makes it a criminal offense to send e-mail with inaccurate and deceptive source or header information. The new PROTECT Act signed by President Bush similarly makes it a federal offense for online pornographers to obtain or use misleading domain names to induce individuals to surf unwittingly to porn sites. At the same time, the U.S. Federal Trade Commission filed a series of civil complaints against "porn-spammers" alleging that spoofed source information and misleading subject lines constitutes a deceptive trade practice.

Can this mean that Madonna goes to jail?

The recording industry won and lost in a series of cases in late April. In separate decisions, they won the ability to subpoena the names of p2p users from Verizon's online services, but they lost the ability (at least for now) to pursue direct or contributory infringement lawsuits against the distributors of p2p software.

One method of "self-help" employed by the record and motion picture companies is to attempt to flood the p2p networks with bogus material -- files that are labeled as, and appear to be, genuine copyrighted work (they are the correct format and file size), but contain either no data, or, in the case of Louise Veronica Ciccone (a/k/a "Madonna"), contain a voice file asking, "What the f*ck do you think you are doing?"

One response of the p2p users has been to hack back -- defacing the RIAA website, or hacking Madonna's webpage and inserting copies of her own music for download. Another is to use IP filtering to block p2p downloads from known RIAA or MPAA sites.

Here's how it would work: The FTC's theory of liability in the "porn-spammer" cases is that the header information or subject line of a mass e-mail is deceptive or fraudulent, and is intended to induce the recipient to open the file, and thereby see the advertisement that they would not otherwise have seen. The FTC does not -- at least not in these complaints -- allege that the underlying advertisement itself is false or deceptive; just the descriptions.

Similarly, the PROTECT act makes it a federal crime to use a misleading domain name to trick people into viewing obscene materials or to trick children into viewing materials that are "harmful to minors."

The message from these laws (and various anti-spam laws across the country) appears to be that using fictitious headers, names, or descriptions in interstate or foreign commerce in order to induce someone to act is an offense -- either a crime or, at a minimum, a "deceptive trade practice."

This may be bad news for those who post fake files on Kazaa.

Unclean Hands
The FTC has general authority over false or misleading advertisements, derived from Title 15 USC Section 45(a)(1), which says that "... [u]nfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." This grant of jurisdiction is remarkably broad, and is limited only to a showing that the act or practice is "deceptive" and is either "in commerce" or "affects commerce" -- not that the act itself be commercial.

While Congress has limited the FTC's jurisdiction in areas that come under the regulation of other agencies (e.g., FCC, DOJ) its powers to act are unquestionably broad. The FTC has used this grant of authority to punish companies that do not adhere to their own stated privacy policies, that engage in mislabeling of goods or services, and to go after people who engage in "pretext calling" -- pretending to be someone other than who they are to get people's financial or medical information.

In other words, the FTC has general jurisdiction over fraud, false statements, fraudulent pretexts, hucksters, con-artists, and most things deceptive. If it smells bad (and isn't delegated to another agency) and affects commerce, it probably violates the FTC Act.

The actions of RIAA and MPAA in placing files on p2p networks to deceive users of those networks into thinking they're actual music or video files, to waste their time, resources, energy and bandwidth (not to mention hard drive space and CPU cycles) quite likely is "deceptive" and undoubtedly "affects commerce."

Foul!, you shout. Why should downloaders, freeloaders, pirates and copyright felons be entitled to the protection of the law? Druggies who buy talcum powder from undercover cops can't sue the police because they were "deceived," can they? What about the legal doctrine of "unclean hands" -- you can't complain about somebody else's wrongdoing if you are engaged in wrongdoing yourself?

In fact, law, policy and tradition have all held that law enforcement agencies are entitled to use trickery in connection with criminal investigations. But there is no such body of case law with respect to copyright holders.

Moreover, there is nothing in the FTC Act that says "deceptive trade practices" are permitted if done for a good reason, or against people we don't like.

Imagine if a person was in midtown Manhattan selling what you assumed were pirated DVD's -- say X-Men 2. You plunk down your $5 (such a deal) and voila! -- a blank CD-ROM.

The seller would be liable for fraud or deception -- even though you thought you were purchasing a pirated disc.

What about the idea that the record and film companies aren't "selling" the fakes, but just putting them up for free? For FTC jurisdictional purposes, it makes no difference -- it's still deceptive, and it still affects commerce. The FTC Act doesn't even require proof of damages, though if it did, computer crime laws have already established that waste of computer time, hard drive space, memory, processor time, network resources or user time are all cognizable "losses."

Sadly, the FTC Act does not provide for individual remedies: a victim of the material girl's foul-mouthed trickery could only file a complaint with the FTC and try to get them to go after her. This is not a very likely prospect. But many states do have their own consumer protection statutes that allow victims to sue individually for deceptive or fraudulent trade practices, so it's not inconceivable that someday the recording industry might find itself on the wrong end of a p2p lawsuit -- maybe even from one of the Verizon customers the RIAA is attempting to identify.

© SecurityFocus logo

Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and now serves as Senior Vice President and Chief Security Counsel at Solutionary Inc.

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.