1. Prentice Hall, 2002 1 Chapter 17 The Regulatory Environment of Electronic Commerce

2. Prentice Hall, 2002 2 Learning Objectives List and describe the major legal issues related to EC Understand the difficulties of protecting privacy and describe the measures taken by companies and individuals to protect it Describe the intellectual property issues in EC and the measures provided for its protection

3. Prentice Hall, 2002 3 Learning Objectives (cont.) Describe some of the ethical issues in EC and the measures taken by organizations to improve ethics Understand the conflict between Internet indecency and free speech and the attempts to resolve the conflict

4. Prentice Hall, 2002 4 Learning Objectives (cont.) Describe the issues involved in imposing sales tax on the Internet Differentiate between contracts online and off-line Discuss some legal issues of computer crimes Describe the measures available to protect buyers and sellers on the Internet

5. Prentice Hall, 2002 5 EC-Related Legal Incidents Contractual issues in EC ProCD sold a database program (SelectPhone) containing information from 3,000 telephone directories to: Commercial users Individual retail consumers Discount offered to noncommercial consumers based on an agreement (license) that restricted use of the program to noncommercial purposes

6. Prentice Hall, 2002 6 EC-Related Legal Incidents (cont.) Contract validity and software piracy Mr. Zeidenberg bought a retail version of the program and resold it over the Internet Argued the contract was not enforceable since he was unable to examine it until after he had purchased and opened the package (contract shrink-wrapped inside)

7. Prentice Hall, 2002 7 EC-Related Legal Incidents (cont.) Supreme Court ruled that shrink-wrap licenses are enforceable Placing terms on outside of box would require fine print, would diminish the function of the information Increasing number of software sales performed by wire where opportunity to review conditions may not be available until after receipt of product

8. Prentice Hall, 2002 8 EC-Related Legal Incidents (cont.) Copyright infringement on the Web MIT student offered free copies of software (Word, Excel, WordPerfect) free over his bulletin board system When sued, found not guilty because he had not benefited financially as per the Copyright Infringement Act This loophole has since been fixed, today it is illegal to do

9. Prentice Hall, 2002 9 EC-Related Legal Incidents (cont.) E-music sues MP3.com over copyrights MyMP3.com’s service allowed users to listen to their CDs from any computer with Internet connection EMusic.com sued MP3.com for infringing on copyright of some albums for which they owned the digital rights MyMP3.com was suspended, but is now running again as a subscription-based music service

10. Prentice Hall, 2002 10 EC-Related Legal Incidents (cont.) Julia Roberts domain name Movie star Julia Roberts claimed she owned her domain name Boyd, a dealer in celebrity names, felt there was no common law trademark to the names He auctioned off 50 sites using celebrity names World Intellectual Property Organization (WIPO) ruled that he had no rights or legitimate interest in the domain name and had registered in bad faith

11. Prentice Hall, 2002 11 Legal and Ethical Issues Privacy Intellectual Property Difficult to protect since it is easy and inexpensive to copy and disseminate digitized information Free Speech Internet provides the largest opportunity for free speech; but, some postings are offensive to people Taxation Illegal to impose new sales taxes on Internet business at the present time (U.S. and some other countries)

12. Prentice Hall, 2002 12 Legal and Ethical Issues (cont.) Computer crimes Usually refers to computer fraud and computer abuse Consumer Protection Many legal issues are related to electronic trade Other legal issues Validity of contracts, legality of public key encryption infrastructures, jurisdiction over trades, encryption policies

13. Prentice Hall, 2002 13 Figure 17-1 Evolution of Ethical Code and Legislation

14. Prentice Hall, 2002 14 Ethical Issues What is considered to be right and wrong? What is unethical is not necessarily illegal. Whether these actions are considered unethical depends on the organization, country, and the specific circumstances surrounding the scenarios.

15. Prentice Hall, 2002 15 Ethical Issues (cont.) Code of Ethics A collection of principles intended as a guide for its members Many companies and professional organizations develop their own codes of ethics A guide for members of a company or an association

16. Prentice Hall, 2002 16 A Framework for Ethical Issues Privacy—regarding information about individuals Collection Storage Dissemination Property Ownership and value of information and intellectual property

17. Prentice Hall, 2002 17 A Framework for Ethical Issues (cont.) Accuracy of: Authenticity Fidelity Information collected and processed Accessibility Right to access information Payment of fees for the access

18. Prentice Hall, 2002 18 Protecting Privacy Privacy The right to be left alone and the right to be free of unreasonable personal intrusions Information Privacy The “claim of individuals, groups, or institutions to determine for themselves when, and to what extent, information about them is communicated to others”

19. Prentice Hall, 2002 19 Protecting Privacy (cont.) Two basic rules The right of privacy is not absolute. Privacy must be balanced against the needs of society The public's right to know is superior to the individual’s right of privacy

20. Prentice Hall, 2002 20 How is Private Information Collected? Reading your newsgroups’ postings Finding you in the Internet Directory Making your browser record information about you Recording what your browsers say about you Reading your e-mail

21. Prentice Hall, 2002 21 Web-Site Self-Registration Registration Questionnaires Type in private information in order to receive a password to participate in a lottery, to receive information, or to play a game Uses of the Private Information collected: For planning the business May be sold to a third party Must not be used in an inappropriate manner

22. Prentice Hall, 2002 22 40% of all users have falsified information when registering online 66% of all U.S. and European respondents don’t register as they don’t know how the information is going to be used 63% don’t feel that registration is worthwhile considering the content of the sites 58% don’t trust the sites collecting this information from them From the Eighth User Survey by GVU (1998)

23. Prentice Hall, 2002 23 Cookies A software program that allows a Web site to record one’s comings and goings Web sites can “remember” information about users and respond to their preferences on a particular site, process is transparent to users Web sites can maintain information on a particular user across HTTP connections

24. Prentice Hall, 2002 24 Cookies (cont.) Why vendors are using cookies To personalize information To improve online sales/services To simplify tracking of popular links or demographics To keep sites fresh and relevant to the user’s interests To enable subscribers to log in without having to enter a password every visit To keep track of a customer’s search preferences Personal profiles created are sometimes more accurate than self-registration

25. Prentice Hall, 2002 25 Cookies (cont.) Solutions to unwanted cookies Users can delete cookie files stored in their computer Use of anti-cookie software (e.g., Cookie cutter and anonymous cookie)

26. Prentice Hall, 2002 26 Privacy Protection 5 basic principles 1.Notice/Awareness Customers must be given notice and be able to make informed decisions 2.Choice/Consent Customers must be made aware of their options as to how their personal information may be used. Consent may be granted through “opt- out” clauses requiring steps to prevent collection of information

27. Prentice Hall, 2002 27 Basic Principles (cont.) 3.Access/Participation Consumers must be able to access their personal information and challenge the validity of the data 4.Integrity/security Consumers must be assured that the data is secure and accurate

28. Prentice Hall, 2002 28 Basic Principles (cont.) 5.Enforcement/Redress There must always exist a method of enforcement and remedy. The alternatives are government intervention, legislation for private remedies, or self-regulation

29. Prentice Hall, 2002 29 Protecting Your Privacy Think before you give out personal information on a site Track the use of your name and information Keep your newsgroups’ posts out of archives Use the Anonymizer when browsing Live without cookies Use anonymous remailers Use encryption Reroute your mail away from your office Ask your ISP or employer about a privacy policy

30. Prentice Hall, 2002 30 Legislation The Consumer Internet Privacy Act The Federal Internet Privacy Protection Act The Communications Privacy and Consumer Empowerment Act The Data Privacy Act

31. Prentice Hall, 2002 31 Federal Trade Commission (FTC) Audit FTC examined these practices: Notice of site of information-gathering and dissemination policies Opportunity for users to exercise choice over how personal information is used User control over personal information Verification and oversight of claims made by the site Recourse for resolving users’ complaints

32. Prentice Hall, 2002 32 Internet Privacy Protection Movement of advocate groups and industry Private sector is apathetic regarding information protection Businesses prioritize business profits by collecting private information without disclosure Business strategy is to reduce consumers’ privacy concerns

33. Prentice Hall, 2002 33 Electronic Privacy Information Center EPIC is a public-interest research center established to focus public attention on: Emerging civil liberties issues Protecting privacy First Amendment Constitutional values Proposed regulation of use of cookies

34. Prentice Hall, 2002 34 Electronic Surveillance Tens of millions of computer users are monitored, many without their knowledge Employees have very limited protection against employers’ surveillance

35. Prentice Hall, 2002 35 Personal Information in Databases Databases of: Banks and financial institutions Cable TV Telephones Employers Schools Insurance companies Online vendors

36. Prentice Hall, 2002 36 Personal Information in Databases (cont.) Concerns Under what circumstances will personal data be released? Do you know where the records are? How are the data used? How are data protected?

37. Prentice Hall, 2002 37 Privacy Policy Basics Data collection Data should be collected on individuals only to accomplish a legitimate business objective Data should be adequate, relevant, and not excessive in relation to the business objective. Individuals must give their consent before data pertaining to them can be gathered

38. Prentice Hall, 2002 38 Privacy Policy Basics (cont.) Data accuracy Sensitive data gathered on individuals should be verified before it is entered into the database Data should be accurate and, where and when necessary, kept current The file should be made available, so an individual can ensure that the data are correct If there is disagreement about the accuracy of the data, the individual’s version should be noted and included with any disclosure of the file

39. Prentice Hall, 2002 39 Privacy Policy Basics (cont.) Data confidentiality Computer security procedures should be implemented to provide reasonable assurance against unauthorized disclosure of data Third parties should not be given access to data without the individual’s knowledge or permission, except as required by law

40. Prentice Hall, 2002 40 Privacy Policy Basics (cont.) Data confidentiality (cont.) Disclosures of data, other than the most routine, should be noted and maintained for as long as the data are maintained Data should not be disclosed for reasons incompatible with the business objective for which they are collected

41. Prentice Hall, 2002 41 European Union Directive on Internet Privacy EU privacy directive reaffirming principles of personal data protection on Internet Aims Regulate activities of data user (person or company that controls collecting, holding, processing, use of personal data on Internet) Covers any data relating to data subject (a living subject)

42. Prentice Hall, 2002 42 EU Directive on Internet Privacy (cont.) Data subjects Know where personal data is held Access, erase or block access to data Object to usage Oppose automated individual decision making Obtain judicial remedy and compensation for privacy infringement

43. Prentice Hall, 2002 43 EU Directive on Internet Privacy (cont.) Data users ensure personal data on Internet is: Collected fairly and lawfully Used only for specific, explicit legitimate purpose with consent of subject Accurate, current, secure Retained no longer than necessary for fulfilling original purpose of collection

44. Prentice Hall, 2002 44 Protecting Intellectual Property Copyright A statutory grant that provides the creators of intellectual property with ownership of it for 28 years Trade Secret Intellectual work such as a business plan, which is a company secret and is not based on public information Patent A document that grants the holder exclusive rights on an invention for 17 years (U.S.)

45. Prentice Hall, 2002 45 Copyrights Protects original expression of ideas Literary works Musical works Dramatic works Artistic works Sound recordings, films, broadcasts, cable programs Published editions of literary and musical works

46. Prentice Hall, 2002 46 Copyright Protection Techniques Digital watermarks Embedding of invisible marks Can be represented by bits in digital content Hidden in the source data, becoming inseparable from such data

47. Prentice Hall, 2002 47 Legal Perspectives of Copyrights Electronic Theft (NET) Act Imposed criminal liability for individuals who reproduce or distribute copies of copyrighted works even if no commercial advantage or financial gain exists

48. Prentice Hall, 2002 48 Legal Perspectives of Copyrights (cont.) Digital Copyright Clarification and Technology Education Act Limits the scope of digital copyright infringement by allowing distance learning exemptions

49. Prentice Hall, 2002 49 Legal Perspectives of Copyrights (cont.) Online Copyright Liability Limitation Act Seeks to protect internet access providers from liability for direct and vicarious liability under specific circumstances where they have no control or knowledge of infringement

50. Prentice Hall, 2002 50 Legal Perspectives of Copyrights (cont.) Digital Millennium Copyright Act Reasserts copyright in cyberspace Makes illegal most attempts to defeat anti-copying technology Requires the national telecommunications and information administration to review the effect the bill would have on the free flow of information and makes recommendations for any changes two years after it is signed into law

51. Prentice Hall, 2002 51 Legal Perspectives of Copyrights (cont.) Digital Millennium Copyright Act Lets companies and common citizens circumvent anti-copying technology when necessary to make software or hardware compatible with other products, to conduct encryption research or to keep personal information from being spread via internet “cookies” or other copy-protection tools Forbids excessive copying of databases, even when those databases contain information already in the public domain

52. Prentice Hall, 2002 52 International Aspects of Intellectual Property The World Intellectual Property Organization More than 60 member countries come up with an international treaty Part of the agreement is called the “database treaty” Its aim is to protect the investment of firms that collect and arrange information

53. Prentice Hall, 2002 53 Patents Patent— a document that grants the holder exclusive rights on an invention for 17 years Satisfy following legal criteria Novel—does not already exist as part of the public domain Involves sufficiently “inventive step” Capable of individual application (be put to practical use)

54. Prentice Hall, 2002 54 Trademarks Trademarks—graphical sign used by businesses to identify their goods and services Gives exclusive rights to: Use trademark on goods and services registered to that sign Take legal action to prevent anyone from using trademark without consent

55. Prentice Hall, 2002 55 Domain Names Domain name refers to the upper category of Internet address (URL) Three controversies Whether top-level domain names (similar to com, org and gov) should be added The use of trademark names by companies for domain names that belong to other companies If companies in different countries have the same name, who can use it as the domain name?

56. Prentice Hall, 2002 56 Domain Names (cont.) Network Solutions, Inc. Contracted by the government to assign domain addresses (had a monopoly until 2000) Increase top level names Idea is that an adult-only top-level name will be created to prevent pornographic material getting into the hands of children Arbitration can be done via an international body to resolve conflicts

57. Prentice Hall, 2002 57 Domain Names (cont.) Trade Name Disputes Companies are using trade names of other companies as their domain address to help attract traffic to their Web site

58. Prentice Hall, 2002 58 Defining Freedom of Speech The Bill of Rights First Amendment to the Constitution of the U.S. of America reads: “Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the government for a redress of grievances.”

59. Prentice Hall, 2002 59 The United Nations Universal Declaration of Human Rights in 1948 addresses the right of freedom of expression: “Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive, and impart information and ideas through any media and regardless of frontiers.” Defining Freedom of Speech (cont.)

60. Prentice Hall, 2002 60 The Debate About Free Speech on the Internet Free speech debate “Most citizens are implacably opposed to censorship in any form — except censorship of whatever they personally happen to find offensive.” The debate: what restrictions, if any, should there be on Internet content, and how should it be monitored?

61. Prentice Hall, 2002 61 The Debate About Free Speech on the Internet (cont.) What are the boundaries, and how should they be enforced? Governments protective of their role in society Parents concerned about exposing their children to inappropriate Web pages and chat rooms Federal agencies attempting to deal with illegal actions

62. Prentice Hall, 2002 62 The Debate About Free Speech on the Internet (cont.) What are the boundaries, and how should they be enforced? (cont.) Citizen action groups desiring to protect every ounce of their freedom to speak Individuals concerned about their right to information on the Internet Organizations seeking to empower the citizens of the earth

63. Prentice Hall, 2002 63 The Debate About Free Speech on the Internet (cont.) Provisions in law for 2 cases that limit free speech Obscene material Compelling government interest “Indecency” “Any comment, request, suggestion, proposal, image, or other communication that, in context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs”

64. Prentice Hall, 2002 64 Protecting Children 3 approaches (regarding the protection of children from inappropriate material on the Internet) No information should be held back and parents should be responsible for monitoring their own children The government is the only one who can truly protect children from this material To hold the Internet providers responsible for all the material and information they provide, or enable access to it

65. Prentice Hall, 2002 65 Protecting Children (cont.) Parents governing their own children Government protecting the children Responsibility of the Internet providers Forcing Internet providers to be accountable, or enable access to information

66. Prentice Hall, 2002 66 Legal Perspectives in the USA Child Online Protection Act Internet Tax Freedom Act Family Friendly Internet Access Act Internet Protection Act Internet School Filtering Act

67. Prentice Hall, 2002 67 Controlling Spamming What is spamming, why is it bad? Spamming “The practice of indiscriminate distribution of messages (for example junk mail) without permission of the receiver and without consideration for the messages’ appropriateness”

68. Prentice Hall, 2002 68 Controlling Spamming (cont.) Spamming’s negative impacts Spam comprised 30% of all mail sent on America Online (in the past, now less than 10%) Slows the internet in general Shuts ISPs down completely

69. Prentice Hall, 2002 69 Legislation, Legal The Electronic Mailbox Protection Act The Unsolicited Commercial Electronic Mail Act The Netizens Protection Act The Telephone Consumer Protection Act Controlling Spamming (cont.)

70. Prentice Hall, 2002 70 Controlling Spamming (cont.) How to cut spamming Tell users not to validate their addresses by answering spam requests for replies if they want to be taken off mailing lists Disable the relay feature on SMTP (mail) servers so mail cannot be bounced off the server Delete spam and forget it— it’s a fact of life and not worth wasting time over Use software packages, e.g. getlost.com and junkbusters.com

71. Prentice Hall, 2002 71 Taxation Policies The Taxation Exemption Debate Internet Tax Freedom Act (October 8, 1998) Promotes electronic commerce through tax incentives by barring any new state or local sales taxes on Internet transactions during the next three years (extended by 5 years) Being challenged in court as discriminatory against regular business

72. Prentice Hall, 2002 72 Taxation Policies (cont.) Proposed Taxation Solutions in the USA The Internal Revenue Service might “come to the rescue” with a single and simplified national sales tax. This will reduce 30,000 different tax codes to “no more than 50”. Net sales would be taxed at the same rate as mail order or Main Street transactions. While states could set their one rate, each sale could be taxed only once.

73. Prentice Hall, 2002 73 Other Legal Issues What are the rules of electronic contracting, and whose jurisdiction prevails when buyers, brokers, and sellers are in different states and/or countries? How can gambling be controlled on the Internet? Gambling is legal in Nevada and other states. How can the winner’s tax be collected? By whom? When are electronic documents admissible evidence in the courts of law? What do you do if they are not?

74. Prentice Hall, 2002 74 Other Legal Issues (cont.) Time and place can carry different dates for the buyers and sellers when they are across the ocean. Which time should be considered? Is a digital signature legal? The use of multiple networks and trading partners makes the documentation of responsibility difficult. How is such a problem overcome?

75. Prentice Hall, 2002 75 Electronic Contracts Uniform Electronic Transactions Act Uniform Commercial Code (UCC) Shrink-wrap agreements (or box-top licenses) The user is bound to the license by opening the package

76. Prentice Hall, 2002 76 Electronic Contracts (cont.) Click-wrap contracts The software vendor offers to sell or license the use of the software according to the terms accompanying the software The buyer agrees to be bound by the terms based on certain conduct

77. Prentice Hall, 2002 77 Computer Crimes Computer crimes refers to computer fraud and/or computer abuse Computer fraud committed by: Alteration of input Alteration of computer data Alteration/misuse of programs Destruction/suppression/misappropriation of output

78. Prentice Hall, 2002 78 Computer Crimes (cont.) Computer abuse committed by: Misuse of company computer service/resources by performing unauthorized private work or playing games by employees Compromise of system integrity by: Altering company data Introducing viruses Hacking into the system

79. Prentice Hall, 2002 79 Computer Crimes (cont.) Characteristics of computer crime Chronic underreporting of abuse Security not introduced until abuse has occurred Organizational size unrelated to severity of punishment Abuses by high-level employees less likely to be prosecuted Programmers most difficult to identify Publicity discourages abuse Security efforts reduce abuse

80. Prentice Hall, 2002 80 Computer Crimes (cont.) Effective measures in deterring computer crime Make computer security visible Define and communicate company’s policy regularly Make staff aware of penalties Report cases to police Publicize successful prosecution Deploy security technologies extensively

81. Prentice Hall, 2002 81 Computer Crimes (cont.) Legal aspects Any person who, by using telecommunications, knowingly causes a computer to perform any function to obtain unauthorized access to a computer commits a hacking offense To do the following without consent Cause a computer not to function normally Alter or erase any program or data Add any program or data to a computer

82. Prentice Hall, 2002 82 Fraud on the Internet Internet Stocks Fraud SEC brought charges against 44 companies and individuals who illegally promoted stocks on computer bulletin boards, online newsletters and investment Web sites Other Financial Fraud Selling bogus investments, phantom business opportunities, and other fraud schemes

83. Prentice Hall, 2002 83 Fraud on the Internet (cont.) Other Fraud in EC Customers may: Receive poor quality products and services Not get products in time Be asked to pay for things they assume will be paid for by sellers

84. Prentice Hall, 2002 84 Consumer Protection Tips for safe electronic shopping Look for reliable brand names at sites Search any unfamiliar site for address and phone and fax number. Call up and quiz a person about the sellers Check the seller with the local Chamber of Commerce, Better Business Bureau, or TRUSTe as described later

85. Prentice Hall, 2002 85 Investigate how secure the seller’s site is and how well it is organized Examine the money-back guarantees, warranties, and service agreements Compare prices to those in regular stores; too- low prices may be too good to be true Buyer Protection (cont.)

86. Prentice Hall, 2002 86 Buyer Protection (cont.) Ask friends what they know. Find testimonials and endorsements Find out what you can do in case of a dispute Consult the National Fraud Information Center Check consumerworld.org Do not forget the you have shopper’s rights

87. Prentice Hall, 2002 87 Third Party Services Public organizations and private companies attempt to protect consumers TRUSTe’s “Trustmark” (truste.com) non-profit group to build user’s trust and confidence in the Internet by promoting the polices of disclosure and informed consent

88. Prentice Hall, 2002 88 Third Party Services (cont.) Public organizations and private companies attempt to protect consumers (cont.) BBB (Better Business Bureau) Private non-profit organizations supported largely by membership To provide reports on business firms that are helpful to consumers before making a purchase

89. Prentice Hall, 2002 89 Third Party Services (cont.) Product information Advertising Ordering methods prices Delivery of goods Consumer privacy Receipting Dispute resolution Security WHICHonline (whichonline.com) Gives consumers protection by ensuring online traders abide by a code of proactive guidelines that protect

90. Prentice Hall, 2002 90 Third Party Services (cont.) Web trust seal Online Privacy Alliance Diverse group of corporations and associations lead and support self-regulatory initiatives Create environment of trust Foster protection of individuals’ privacy Evaluation by consumers

91. Prentice Hall, 2002 91 Authentication If authentication online can be verified Students will be able to take exams online from home Fraud of recipients of government entitlements and other payments will be reduced to a bare minimum Buyers will be assured who the sellers are and sellers will know who the buyers are with a very high degree of confidence

92. Prentice Hall, 2002 92 Authentication (cont.) Arrangements will be made so that only authorized people in companies can place purchasing orders Interviews for employment, possible marriage, and other matching applications will be accurate Trust in your partners and in EC in general will increase significantly

93. Prentice Hall, 2002 93 Biometric Controls Matching against a template: Photo of face Fingerprints Hand geometry Blood vessel pattern in the retina of a person’s eye Voice Signature Keystroke dynamics Iris Cathy.

94. Prentice Hall, 2002 94 Figure 17-3 Capabilities of Biometric Controls Source: InfoWorld (June 29, 1998) pg, 88 and courtesy of International Biometric Group.

95. Prentice Hall, 2002 95 Seller Protection Sellers must be protected against: Dealing with customers who deny placing an order Customers downloading copyrighted software and/or knowledge and selling it to others Not being properly paid for products and services provided Use of their names by others Use of their unique words and phrases, names, and slogans and their Web addresses by others

96. Prentice Hall, 2002 96 What Can Vendors Do? Use intelligent software that signals questionable customers Develop a list of warning signals for possibly fraudulent transactions Ask customers to have shipping address added to their bank account if different from billing address

97. Prentice Hall, 2002 97 Managerial Issues Multinational corporations face different cultures in the different countries in which they are doing business Issues of privacy, ethics, and so on may seem to be tangential to running a business, but ignoring them may hinder the operation of many organizations

98. Prentice Hall, 2002 98 Managerial Issues (cont.) The impact of EC and the Internet can be so strong that the entire manner in which companies do business will be changed, with significant impacts on: Procedures People Organizational structure Management Business processes