I. Introduction

A. Language, Facts and the Law

[p57] The Internet challenges our legal system because it makes legal outcomes uncertain. Particularly, laws made to protect computers on the Internet and computer security are applied unpredictably. Novel situations always place unique strains on the law; the law is sensitive both to equity and language. [1] Law is based on language; law that diverges from the language that forms its base risks incoherence. Incoherent law is unpredictable. At the same time, facts develop and evolve much more rapidly than language, but injustice ensues if the law does not respond to changing circumstances.

This article assumes that legal decisions about the Internet will continue to be based in partially on property rights. Application of property rights to the Internet is important. Without property rights, computer owners may not be willing to connect to the Internet if their computers can be abused without legal remedy. However, application of property rights to the Internet is also problematic. Much of the efficiency associated with the Internet derives from the Internet’s open nature. Almost all use of the Internet involves the use of computers that are not one’s own. A regime of untrammeled property rights would assign liability to nearly all uses of the Internet. Internet users would be at the mercy of computer owners’ whims. Without some provision for open access, liability for violations for property rights will chill productive use of the Internet. To some extent, this is intuitive. Connecting to the Internet implies some willingness to permit others to interact with one’s computer. The law must balance between property rights and open access on the Internet. A central assumption of this article is that a limited license must [p58] be implied by a connection to the Internet. [2] The central concern of this article is not whether interactions on the Internet are sometimes free of liability, but rather determining which interactions are a basis for liability and which are not.

To that end, this article argues that computer law could benefit from abstraction. Specifically, this article argues that computer security law would be more coherent and protect equity more predictably if it treated the Internet as if it were physical place--cyberspace. Of course, “cyberspace” is not a place, but a metaphor for a medium of telecommunication. [3] This article’s argument may be counter-intuitive: abstraction usually obscures the facts on which the law depends. [4] Telecommunication will always be distinguished from physical presence, regardless of how similar an experience the two become. Legal doctrines that confuse the two would make the law less coherent, less predictable and therefore less efficient. But using cyberspace as a metaphor does not require that we confuse cyberspace with a real place, only that we make rules that approximate the effect of how our property rules would function if cyberspace were real. If we use the metaphor instead to classify the interests that must be protected and clarify when they are to be protected, it can simplify and unify the law. This makes the law more predictable and therefore more efficient.

The remainder of this section will argue that the law could profitably adopt the use of the cyberspace metaphor. Section II develops the metaphor, describing how it accommodates the values of property, privacy and open access. Section III discusses some of the novel factual circumstances that necessitate use of the metaphor. Section IV will examine the potential impact of the metaphor in three specific areas of law: trespass to chattels [5] lawsuits in context of Internet-connected [p59] computers, computer fraud laws, and the anti-circumvention provisions of the Digital Millennium Copyright Act.

B. Historical Use of the Cyberspace Metaphor

The metaphor of the Internet as a physical place is entrenched in our popular culture. Popular wisdom credits science fiction author William Gibson with coining the term "cyberspace." [6] Cyberspace referred to futuristic computer interfaces which graphically represented computers as physical spaces that accommodated data, represented by physical objects. [7] As a literary device, cyberspace may now be a somewhat hackneyed metaphor. [8] While popular use might imply a common understanding and therefore some utility, literary history provides a cautionary tale about investing too much in a metaphor.

Professor Lessig's Code argues that the interplay between both technical and legal regulation govern cyberspace. [9] For instance, Lessig makes a comparison between the cyberplaces of Harvard and the University of Chicago Law Schools. Harvard University requires network users to register their computers, so their users can be "licensed, approved and verified." [10] The University of Chicago permits anyone with an Ethernet connection to plug into a jack on the campus. [11] The University of [p60] Chicago permits anonymous speech, while Harvard effectively forbids it. [12] The difference in technical regulation of the Internet creates different legal implications. Throughout Code, Lessig refers to cyberplaces, extensively describing how their architecture is shaped but not explicitly addressing cyberspace as a metaphor. [13] A few other legal commentators have implicitly endorsed cyberspace as a metaphor. [14] If legal commentary about the law and the Internet endorses this metaphor, perhaps it is efficient for the law to do so as well.

C. The Law's Use of Metaphors

Metaphors are incorporated into the law for the purpose of "set[ting] forth principles and dispens[ing] justice (i.e., equality) and provid[ing] predictability . . . or at least to create the impression that [courts are] principled." [15] Important examples include the "wall of separation between church and state" [16] and "sticks" that compose "the bundle of rights that are commonly characterized as property" in the context of takings cases. [17] Caution is merited in endorsing a metaphor. Some metaphors may successfully provide guidance or principles [18] but some fail to do so. [19]

Our legal system should use the metaphor of cyberspace because it is capable of providing guidance and clarifying the interests in sometimes confusing factual circumstances. Often complex factual situations can be easily conceptualized by metaphor. If this metaphor eases [p61] conceptualization and that ease in turn improves the predictability of liability, then the metaphor promotes legal efficiency. Moreover, this metaphor could provide more flexibility in allocating liability than statutory language. Statutory language suffers from its static nature; it never changes while it is applied against a myriad of factual circumstances. Section IV.B discusses this specific point is greater detail, comparing the cyberspace metaphor against computer crime laws.

II. Finding Fences

A. Fences and Property

The metaphor of cyberspace permits us to draw property lines and borders on the Internet. One of the central tenets of property jurisprudence is that property is the legal right to exclude others. [20] By defining which interactions with a computer transgress property lines in cyberspace (and therefore violate computer owners’ property rights) the law can assign liability consistently and promote equity without losing coherence.

Harold Reeves Smith argued that Internet-related law could be made more efficient when dealing with certain issues by allocating property rights to system administrators. [21] He argued that property rights would be most efficiently allocated to system administrators because they would be most likely to provide de facto enforcement of those rights. [22] Hence, system administrators would be able to make most efficient use of property rights. This article is, in part, a modification of Smith's argument. The right to exclude should adhere to parties who have the ability to [p62] implement technical measures of exclusion, regardless of whether they are system administrators or not.

The Internet is like a physical place where people constantly wander in and out of other people's property, typically with the owner's permission. In the real world, fences provide obvious boundaries, which may be otherwise lacking. Fences efficiently coincide with limits of legal liability because fences provide notice that others are meant to be excluded from the property. Liability for climbing over fences is efficient because it is predictable; fences provide notice that property rights have been asserted. Exclusionary technical measures in cyberspace and fences in the real world share the same functions. The relationship between fences and property law supplies the first corollary to the developing metaphor. Liability attaches in cyberspace only when people jump over fences. In real world terms, computer owners should be able to assert their property rights (in the form of imposing liability) only when users have circumvented technical measures that should have prevented the litigated use. This rule engenders several benefits. Judicial efficiency is promoted when prospective plaintiffs are required to at least try to fix the problem themselves before turning to the courts. Also, exclusionary technical measures reinforce legal rules about property and they provide concrete notice of assertion of property rights. Finally, this corollary checks property rights and provides the proper balance between property rights and open access. One might object that it may be difficult to define precisely where fences lie or what exactly constitutes an effective technical measure. This objection is based on a misapprehension of the function of legal metaphors. No legal metaphor functions as a formula which robotically provides legal results. Judges interpret, adapt and apply legal metaphors to the specific facts before them. Judges using metaphors decide cases, not the metaphors themselves. This metaphor is meant to provide judges and others with a vehicle with which to make decisions that account for open access and privacy, as well as for property.

There are several other valid objections to the metaphor. It is inadequate to define property rights according to notice given by owners to others. Notice does not suffice for several reasons. Basing legal rights on the assertion of legal rights simply begs the question. While people can assert rights that they do not have, they can also fail to assert rights that they should have. This is especially true in the field of computer security, where security violations often occur precisely because an owner or operator has not anticipated a particular activity. Failure to anticipate an activity usually precludes explicitly prohibiting them to others. Finally, situations arise where a owner might be able to erect technical measures that protect some property rights but those measures nevertheless fail to provide users notice that property rights are to be excluded.

[p63] Other sound objections could be made over technical measures defining property rights. It may not be possible to build fences or establish effective technical measures. Effective technical measures may be unreasonably expensive or unavailable altogether. Another potential criticism is that legal recourse would never be needed for perfectly effective technical measures. These are valid objections; any property system based on technical measures must be tempered by the practicality of implementing those technical measures. Property owners should only be penalized for failing to implement effective technical measures only where there are measures reasonably available. There is a subtle efficiency gain here. Potential plaintiffs, concerned that their claim might fail because they did not use effective technical measures, will investigate whether technical measures are efficient. The record of this investigation can be used to prove that technical measures would have been inefficient or ineffective.

B. Property and Privacy

Another set of concerns focus on how the law decides who gets to erect fences. Fences should not be built over neighbors' land. As this article elaborates in Section IV.C, technical measures used to protect copyrights can be quite invasive and controversial. At the extreme, a recent trojan/worm not only gave the trojan's user unlimited access to the host computer, but actually prevented the host computer from accessing anti-virus sites that could "cure" the host. [23] It is counter-intuitive that this "technical measure" corresponds to a just property interest. Just allocation of property rights require additional considerations.

The first consideration is that the law should protect computer resources. In the real world, it is not controversial that computers are chattels. [24] The legal consequences of physical interference with computers (like kicking them or stealing them) are easily predictable. [25] Liability for unauthorized use of computer resources, such as processing time and hard disk space, has long been a feature of computer law. [26] (Indeed, there is [p64] even a market for processing cycles that would otherwise go unused.) [27] In the real world, it is usually clear who owns what computer. The application of the cyberspace metaphor should not change the ownership of a computer.

The second consideration is privacy. A salient definition of privacy is the ability to control the flow of information about one's self and the ability to make meaningful choices about when information is disclosed. The metaphor of cyberspace is useful here because it accommodates property rights, which in turn imply privacy interests. Privacy and the proprietary right to exclude depend on each other in other contexts. The solitary application [28] of the Third Amendment [29] found that "privacy interest[s] arise . . . out of the use and enjoyment of property" and that privacy interests gave rise to Third Amendment property rights. [30] When illegal searches are suppressed because they violate "legitimate expectations of privacy," Fourth Amendment jurisprudence has found that those expectations can be based on property. [31]

In a medium that permits extremely low cost duplication and transmission of information, the ability to control information is important. This importance is reflected in the persistence of privacy as a theme in legal and media commentary on the Internet. [32] The protection of computer [p65] resources and privacy interests in the real world should "translate" into the protection of property interests in cyberspace. An individual Internet-connected computer provides a certain amount of space for data. That computer’s resources, like its memory and processing power, provide space, or real property, in cyberspace. If an Internet-connected computer can be seen as providing space, then data, or information, that resides on that computer can be seen as movable property, or chattels. The protection of privacy interests on the Internet (the right to exclude others from an owner’s data) is implicit in the protection of property interests in Internet-connected computers.

1. Laws Which Function like the Metaphor

Two federal laws provide models that closely resemble how the fences in cyberspace metaphor might be applied. These laws reinforce measures taken to protect the privacy of information or communication with civil and criminal liability. In this sense, they recognize efforts to exclude other and expectations that others will be excluded as “fences.” These laws also treat “fenced-off” information like property, by punishing efforts to circumvent exclusive measures.

The Internet implicates individual's ability to control information flows at several places. The user may create information flows autonomously but unwillingly [33] or unwittingly, others may take information from his computer, and information sent to others can be taken in transit. American privacy laws are an ad hoc collection of very narrowly drawn laws that mainly address information autonomously disclosed. [34] One exception in this regard is the Electronic Privacy Communications Act (ECPA). [35] [p66] ECPA governs electronic communications [36] that are not readily accessible to the general public. [37] Title I of ECPA criminalizes the interception of wire or electronic communications and the use or disclosure of such communications when the interception of such communications were known to be in violation of ECPA. [38] Title I also criminalizes the use of "devices" to intercept communications [39] and the manufacture, distribution, possession or advertising of devices whose main commercial use is the intercept wire or electronic communications. [40] ECPA provides persons whose communications are intercepted in violation of ECPA a civil cause of action. [41] Title II criminalizes unauthorized access (or access in excess of authorization) of a facility where electronic communications are stored as well as unauthorized disclosure of electronic communication. [42] ECPA rules for law enforcement exceptions for interception of electronic communications and disclosure of stored information [43] are remarkably complex but ultimately irrelevant to this discussion.[44]

The Economic Espionage Act (the federal implementation of trade secret law) governs the disclosure of information. [45] Specifically, the EEA provides penalties for the theft of trade secrets: [46] "all kinds of . . . information . . . if A) the owner takes reasonable measures to keep such information secret; and B) the information derives independent economic value, actual and potential, from not being generally known, and not being generally ascertainable through proper means, by the public. . ." [47]

The metaphor of fences in cyberspace would protect privacy in a manner similar to the ECPA and the EEA. All three recognize efforts to [p67] exclude others as the basis for rights to remedy. ECPA protects electronic communications which are not available to the public. EEA protects information that is valuable because it is unknown. ECPA reinforces the property rights of electronic communication facilities owners and the expectations of privacy for users of electronic communication systems. By providing criminal and civil sanctions against unauthorized access to private communication and information, ECPA provides users of electronic communications an effective right of exclusion. ECPA has already been used to protect the privacy of communications stored on a web site in Konop v. Hawaiian Airlines, Inc. [48] Konop was involved with a dispute over his union’s concession to management and had encouraged other employees to use of his web site to discuss alternate representation. [49] Access to the web site was limited by passwords and usernames issued to employees not in management or involved in union representation who agreed to abide by certain conditions (including not disclosing the web site’s contents). [50] The court found an ECPA violation when a manager obtained a username and password from a pilot and perused the web site. [51]

C. Open Access

Again drawing on the metaphor, fences create enclosed areas. By implication, fences create areas within which people are free to wander. The gains from treating technical measures as if they were fences in the real world would be lost if liability attached to interactions between enclosed and unenclosed areas. The benefits gained from the notice function that the fences served would be lost because the application of the law would once again become unpredictable. Nor would the law benefit from the reinforcement of technical measures with which it did not coincide.

Harold Reed Smith also presented an open-system model of the Internet that did not reference boundaries but referenced "the actions taken in [c]yberspace--considering their consequences and apparent motivations." [52] Smith recognized that the Internet functioned best by sharing access to computing resources and facilitating communication between users. [53] Smith found that open-system would permit sharing of computing resources when boundaries between networks were [p68] "permeable." [54] Smith's open-system model further informs the cyberspace metaphor. There is precedent for adopting Smith’s open-system model; courts have previously presumed implied licenses based on social custom. The Supreme Court presumed an implied license to use unenclosed land from common customs prevailing at the time of the settlement of the American West:

We are of opinion that there is an implied license, growing out of the custom of nearly a hundred years, that the public lands of the United States . . . shall be free to the people who seek to use them where they are left open and unenclosed . . . Of course the instances became numerous in which persons purchasing land from the United States put only a small part of it in cultivation, and permitted the balance to remain unenclosed and in no way separated from the lands owned by the United States. All the neighbors who had settled near one of these prairies or on it, and all the people who had cattle that they wished to graze upon the public lands, permitted them to run at large over the whole region, fattening upon the public lands of the United States, and upon the unenclosed lands of the private individual, without let or hindrance. . . . Everybody used the open unenclosed country, which produced nutritious grasses, as a public common on which their horses, cattle, hogs and sheep could run and graze. It has never been understood that in those regions and in this country, in the progress of its settlement, the principle prevailed that a man was bound to keep his cattle confined within his own grounds, or else would be liable for their trespasses upon the unenclosed grounds of his neighbors. Such a principle was ill-adapted to the nature and condition of the country at that time. [55]

[p69] As implied licenses to used unenclosed lands promoted the settlement of the West, a implied licenses to use computer resources and data stored on computers presumed from an absence of preventative technical measures promotes use of Internet. The article will return to comparing the Internet to the unsettled American West when it considers the application of the metaphor to specific laws.

D. Metaphors Found

In review, this article has explored four aspects of the cyberspace fences metaphor. First, conceptualizing computers as embodying physical space in cyberspace permits the law to adapt current rules about privacy and computer security in a way that would mirror the function of property rules in cyberspace. Secondly, the metaphor permits the law to posit fences in cyberspace that then permits the law to define property rights in cyberspace much more precisely. The third aspect is that property in cyberspace must be based on property-like interests in the real world, such as privacy or actual ownership of the computers and information stored therein. Fences should only be built on one's own land. The final aspect of the metaphor is a presumption of open access where no property rights have been effectively asserted. The Internet can effectively be compared the early days of the West. Without a presumption of free access to resources that are not cordoned off by technical measures, many uses of the Internet are thrown into legal indeterminacy. The law would be much more invasive and unpredictable, and much less efficient.

With this expanded metaphor of cyberspace, the article can examine information flows on the Internet and technical measures that protect them. The next section will describe how cyberspace actually “looks.” In Section IV, the article will examine how laws would apply to these information flows and will use the cyberspace metaphor to point out shortcomings in our laws and advocate different language and different applications.

III. Information Flow on the Internet

A. Autonomous Information Flows

The Internet is a single network using a common communication protocol communication: the transmission control protocol/Internet protocol (TCP/IP). Communicating across the Internet typically implies a TCP/IP connection, although there are exceptions. There are four [p70] different layers of communication within TCP/IP; the network interface layer, the internet layer, the transport layer, and the application layer. [56]

The network interface layer, or link layer, is where electronic signals are sent and received over the wire. The electronic signals may be packaged in order to achieve compatibility with the hardware.

The internet layer, or network layer, is where the Internet protocol functions by routing packages of data, called packets. Packets consist of data that are being sent to or from the computers and "packaging." The packaging includes source and destination IP addresses. [57] IP addresses are the numeric designation of individual computers on the Internet. Packets sent through the Internet are routed according to their IP address; they perform substantially the same function as mail addresses. The other important communication protocol used at this level is the Internet control message protocol (ICMP.) ICMP is used for two important diagnostic programs; ping and traceroute. Packets sent by ping are returned by computers that are connected to the Internet. Ping is used to establish whether particular IP addresses have computers associated with them and whether those computers respond. Traceroute functions in a slightly more complicated fashion, but its function is to return a list of every IP address that is used to route data in between the source and destination IP address. Traceroute is used to identify and diagnose networks.

The Transmission Control Protocol operates at the transportation layer, negotiating the transfer of data between applications and the operating system that controls the connection to the Internet. The TCP controls socket generation. Sockets consist of ports and IP addresses. Port are numeric designations that permit TCP to distinguish between data on the basis of their application. Port numbers permit the operation of several applications simultaneously. The transmission control protocol reconstructs data passed from the internet layer into segments, while breaking data passed from the application layer into segments. Segments have a socket number and a sequence number. The sequence designation permits TCP to ensure that all segments are received both at the local and remote computers and that the segments are ordered correctly. A process called a the three-way hand shake initiates data transfers in TCP. First, a client computer sends out a packet with a "SYN" flag. The server responds with a SYN packet that has a initial sequence number (ISN) and an ACK packet that acknowledges the clients request. The client computer completes the process with an ACK packet that carries sequence [p71] information. [58] The other major protocol at the transportation layer is the universal datagram protocol (UDP). The UDP does not attempt to guarantee the reception of segments; it is used to broadcast messages to computers on a local network in situations where reception is not critical.

The application layer is where the user actually interfaces with the computer and the network. Data passes from the user's input into the application, which passes it to the transportation layer.

Interaction on the Internet requires certain levels of disclosure. The lowest common denominator of information flow on the internet is an IP address. Traffic to and from a user's computer will probably be logged (if not reproduced) by their local Internet access provider and the remote computer. [59] Public WHOIS databases can correlate IP addresses with the internet service provider responsible for those IP addresses. [60] The Internet access provider can then correlate a particular IP address (and possibly the time at which that particular IP address was assigned) with the login name of a user. The login name can they be correlated with billing or other such records that personally identify the user of a particular IP address. [61] While Internet access providers do not generally disclose the identities of particular IP addresses without legal prompting (that is, subpoenas), users' privacy is dependent on the policies of their Internet access provider. [62]

Naturally, there are exceptions. Proxy servers will accept packets from the local computer and substitute their own IP address as the source address in the packet headings that are sent to the destination computer. The result is that the remote computer will not log the user's actual IP address, but the proxy's IP address. Nevertheless, the user's IP will possibly be logged by the proxy. [63] There are different kinds of proxies, [p72] including those that occur accidentally and those designed for anonymity, security or speed. Depending on the logging policy of the proxy, they can offer complete privacy to users or merely create an additional step in identifying a user.

Automation and graphical user interfaces (GUIs) increase user accessibility to computers and increase productivity. Unfortunately, automation and GUIs also mask the underlying mechanics of information flow on the Internet. Because web browsing and other activities are made transparent, users are unaware of information that is inadvertently exposed through their use of applications. A prime example is browsing the world wide web. Web browsers expose users to the risks of cookies, Java and JavaScript and environmental checkers. Often, even the use of proxy servers does not eliminate these risks. While a user autonomously chooses to load a web page, the user may be unaware of how the browser is leaking information about them.

Cookies are small text messages that are saved either as discrete files or as lines in a single text file. They are used to identify recurring visitors and can be used to track users as they move across the Internet identifying a user every time he or she requests a web page that requires data from whomever set the cookie. This feature of cookies gives web advertisers the best vantage point to observe web users, because large advertisers provide images in many web pages across the Internet. The most prominent Internet-banner advertiser is most likely DoubleClick, Inc., a New York-based corporation. DoubleClick claims that its patented DART technology provides real-time profiling of users demographically identified by cookies.

In December 1998, [DoubleClick] received over 5.3 billion requests for the delivery of ads (impressions) generated by an aggregate of approximately 6,400 web sites of 570 Web publishers . . . According to Media Metrix, 45.8% of Internet users in the United States visited Web sites within the DoubleClick Network during the same month. [64]

DoubleClick's activities generated a consolidated lawsuit alleging that "DoubleClick Inc. improperly used or monitored confidential information of computer users in delivering advertisements on the Internet." [65] The federal claims of the lawsuit were dismissed on summary judgement in [p73] March, 2001. [66]

Java is a computer language written by Sun Computing. Mini-applications (applets) written in Java are stored on the remote web page and are run when browsers encounter the appropriate "tag" in the source code of a web page. Browsers download complied Java applications and execute them. [67] JavaScript is a series of extensions to the HTML language designed by the Netscape Corporation and implemented by most modern browsers. It is an interpreted language designed to control the browser (as known as a scripting language, meaning that remote web server hosts the source code and the source code is compiled by the client). [68] Both Java and JavaScript have a series of security issues [69] including permitting the discovery of a user's IP despite a proxy, [70] stealing files from a client computer and monitoring a user until sensitive information is revealed, [71] and the execution of arbitrary code. [72]

Browsers also reveal environmental variables in the header fields of the HTML language. Information revealed in environmental variables includes the user's original IP address, his browser version and operating system. [73]

Users can also inadvertently expose their IP address by opening documents with images supplied by embedded URLs. If a user is connected to the Internet, Microsoft Word [74] and email programs capable of displaying HTML will load the images from remote sites as if they were web browsers. [75] Indeed, documents with unique URLs could be prepared to track the viewing of a document across the Internet. Indeed, images [p74] consisting of a single pixel can be embedded in documents so that the document users would not know that they were loading images at all. Microsoft Word is also capable of writing and sending cookies that Microsoft Explorer keeps on a user's computer. [76] This could expand the potential threat to privacy.

B. Exogenous Information Flows

A connection to the Internet can reveal substantial information about a computer at the direction of a remote user. Pinging an IP addresses will reveal if that IP address is connected to the Internet and responsive. Although ascertaining the presence of computers at an IP addresses is necessary for the function of the Internet and may seem uncontroversial, many system administrators react negatively to systematic pinging by remote networks. [77] Other activity is even more invasive. Each platform and operating system has a unique "fingerprint" on the Internet, which can be found be sending a series of specially crafted IP packets to a computer and comparing the responses (or lack thereof) to profiles of known operating system/platform. [78] Probably the best implementation of operating system/platform TCP/IP-based identification is nmap. [79] Nmap is also a port scanner. [80] Packets can also be sent to different ports to check if they are open (if applications are receiving data on those ports.) This technique is called a port scan; it also can be used to predict whether particular applications are running on a computer (although applications can usually be made to use arbitrary port numbers.) [81] Responsive applications have further implications. Some applications display a brief text message, or a banner, that announces the name and version of the application. [82] Collecting this information systematically called banner grabbing. This is significant because certain applications can only be run on particular operating systems. Finally, some applications will disclose the operating system at the prompting of unauthenticated users. [83]

[p75] Another class of disclosure occurs when applications initiate obscured information flows without the user's initiation. The most invasive are trojan horses and remote administration tools. After a user unwittingly executes these programs, they permit a remote trojan user to control the user's computer. The remote trojan user's access to information on the computer is coextensive with the user's. The most prominent examples of this kind of application are Back Orifice and Back Orifice 2000. [84]

The legitimacy of these programs exists on a continuum. Back Orifice's publisher's claims that it functions as a free, open source replacement to commercial remote administration programs with better encryption. Although those claims are probably best viewed as sophistry, they are perfectly true. [85] The publishers of NetBus have successfully legitimized their product to the point that anti-virus programs will no longer prevent the installation of NetBus. [86] And the publishers of Back Orifice validly point out that accepted commercial remote administration tools will perform silent and remote installations. [87]

Applications besides remote administration tools collect information for their publishers. These applications have been collectively referred to as "spyware." The most legally prominent of these applications is RealNetwork's RealAudio. In a class action lawsuit against RealNetworks, the plaintiffs alleged "trespass to privacy and property, claiming RealNetworks software products secretly allowed RealNetworks to access and intercept users' electronic communications without their knowledge or consent." [88] The essence of the allegations was that RealAudio made record of the files that users downloaded and relayed this information to RealNetworks without giving any indication to the users of what was happening. The class action suit has been stayed by enforcement of the mandatory arbitration clause in the End User License Agreement included in every copy of relevant software. [89] A later RealNetworks application, [p76] Download Demon, had a similar function but disclosed it in the EULA. [90] Another class action lawsuit against Amazon.com its subsidiary, Alexa, alleged violations of ECPA has survived attempts to prevent the lawsuit from going forward as class action. [91] The lawsuit's core allegations were that Alexa's plug-in software, which provided additional information about website providers, leaked browser' habits back to Alexa without notice and in violation of the privacy policies of Amazon.com and Alexa. The Federal Trade Commission has reportedly initiated an investigation. [92]

Similar allegations have been made about the software that accompanies CueCat, a bar code scanner. CueCat's software attached unique identifying numbers to barcode queries that were sent to the databases of CueCat's manufacturer and cross-referenced with extensive profiles filled out by users in order to activate the software. [93] This was done without informing users. [94] Other notorious examples include Arthur's Reading Race, a children's educational game by Mattel, [95] Netscape's AOL Smart Download and Qualcomm's free version of Eudora. [96] In fact, hundreds of applications use technology that surreptiously discloses user information. [97]

C. Flows From Communication Between Computers

Data sent to another computer on the Internet must typically pass through networks and computer systems that are not under the control of the originator or the recipient. While the data is out of the control of originator and recipient, owners of intermediate computers could copy all their traffic rather than simply forwarding it.

Increasingly, users operate behind firewalls that monitor and control their on-line behavior. [98] A survey conducted by the American [p77] Management Association revealed that 27% of employers store and review users email and 21.4% store and review files users have transmitted in 1999 (up from 20.2% and 19.6% respectively in 1998.) [99] There are a multiple of widely used commercial software products that permit corporate firewall managers to control and monitor employee's Internet activities. [100]

Governments also monitors network traffic in transit. Many government surveillance systems are installed by the government at the access provider's facilities or installed by the access provider under government order. The American, British and Russian surveillance systems are the most publicized. The U.S. Federal government implemented "Carnivore," a system designed to selectively monitor the activities of an individual user (and therefore compliant with ECPA). [101] The United Kingdom has passed the Regulation of Investigatory Powers Act of 2000 (RIP), which permits the Secretary of State to impose "such obligations as it appears to him [or her] reasonable to impose for the purpose of securing that it is and remains practicable for requirements to provide assistance in relation to interception warrants to be imposed and compiled with." [102] The end result of RIP is a legal regime authorizing the UK government to install "black boxes" to Internet access providers "that can be switched on under warrant to pipe data to a unit in the building of MI5, Britain's internal intelligence service." [103] The Russian Federation's Federal Security Service (FSB) promulgated an order on the System of Operational Research Actions (SORM-2) which required Internet access providers to install systems that could monitor their users. [104] The Russian [p78] Supreme Court recently ruled that the operation of SORM required warrants, evidently overturning some of the FSB's order. [105]

D. Referencing the Facts

In the next Section's discussion of how the metaphor of cyberspace could permit the law to provide predictable and just outcomes, this article will reference some of the information flows previously mentioned in this Section. This Section provides a basis for discussing the current state of the Internet. Rooted in language developed for previously discussed technology, the law is able to adapt to the current state of the Internet only roughly. The final Section will consider the remaining information flows to ensure the robustness of the metaphor.

IV. Application of the Metaphor

This section makes three applications of the cyberspace metaphor. The metaphor provides the most practical utility in the context of trespass to chattels actions against unauthorized use of network resources. Endorsing the metaphor would permit the law to convert actions for trespass to chattels to actions for trespass on real property. Converting trespass to chattels actions to trespass on real property solves nagging damages issues that complicate straightforward application of the law to stop spammers and others from abusing network resources.

Second, the cyberspace metaphor provides a critical perspective on state and federal computer fraud laws. The word "access" has been adopted by most legislatures, but courts have sometimes struggled to fix boundary of liability at "access." Furthermore, the cyberspace metaphor can assign privacy and property right on the modern Internet much better than current computer fraud laws. "Access" terminology confounds the consistent, practical and efficient application of current laws to modern information flows.

Finally, the cyberspace metaphor adds to the debate over the Digital Millennium Copyright Act, which reinforces "trusted systems." Although it is beyond the scope of this article to discuss on which side of the debate the public good lies, the metaphor permits a new examination of the issues involved.

[p79]

A. Trespass to Chattels and Strong Fences

1. Background

State v. McGraw [106] first recognized that misappropriation of computer resources could constitute trespass against chattels. [107] In overturning a conviction for theft, McGraw found that the storage of data for an employee's outside business was more like trespass against chattels. [108]

The first actual application of the trespass to chattels tort to computers did not occur on the Internet but over a phone line. In Thrifty-Tel, Inc. v. Bezenek, [109] the defendant's underaged sons made long distance phone calls through the unauthorized use of Thrifty-Tel's long-distance telephone service. [110] Long-distance phone calls could be made without charge through the use of Thrifty-Tel's telephone service with an access code and an authorization code. [111] With an access code provided by a friend, Bezenek's sons used a computer and a modem to automate a random search for authorization codes. [112] Thrifty-Tel filed suit and the court acknowledged the defendant's liability for trespass to chattels. [113] Trespass to chattels requires tangible interference with the property. The court was willing to find that the defendant's repeated phone calls constituted tangible interference, but it required an extension of the law.

The modern rule recognizes an indirect touching or entry: e.g., dust particles from a cement plant that migrate onto another's real and personal property may give rise to trespass. . . . But the requirement of a tangible has been relaxed almost to the point of being discarded. Thus some courts have held that microscopic particles . . . or smoke . . . may give rise to trespass. And the California Supreme Court has intimated migrating particles (e.g., sound waves) may result in a trespass, provided they do not simply impede an owner's use or enjoyment of property, but cause damage. . . . In our view, [p80] the electronic signals generated by the Bezenek boys' activities were sufficiently tangible to support a trespass cause of action. [114]

As Professor Dan Burk notes, however, the actions cited by Thrifty-Tel were actions for trespass to lands. [115] Burk objects that trespass to chattels does not entail "the interest of inviolability that attends trespass to lands," and that even within "the context of real property, impinging ephemeral substances . . . or intangibles . . . typically have been addressed by doctrines of nuisances [116] rather than doctrines of trespass." [117] Burk also argues that trespass to chattels is a deficient legal theory in this context because it requires that some actual harm or impairment must be shown; either the owner is dispossessed of his property, the quality or condition of the property is impaired, the owner is deprived of the use of the property for a substantial time or some bodily harm is caused. [118]

2. Adoption and Development

Despite these flaws, courts have widely adopted the trespass to chattels theory in lawsuits by email providers against spammers. [119] Courts found [p81] two common, relevant elements in these cases; first, by consuming system resources, spam impaired the condition of the email servers (namely, by consuming computer resources and generating complaints from subscribers) and, second, defendants received some sort of notice that their use was unauthorized (either explicit written notice or notice in a Acceptable Use Policy.) [120] In CompuServe Inc. v. Cyber Promotions, Inc., the defendants raised the issue of implied consent. [121] The court acknowledged that "there [was] at least a tacit invitation for anyone on the Internet to utilize [CompuServe's] computer equipment to send e-mail to its subscribers" because of the utility CompuServe derived from having its subscribers receive email. [122] The court found the defendants' claims that this invitation could not be revoked (and therefore neither could the implicit consent) "erroneous under Ohio law." [123] This line of cases never found that the spam caused the computer to actually reach maximum capacity, possibly because impairment could always be found in subscriber complaints. It was therefore not necessary to turn to computer resource consumption to find impairment.

The trespass to chattels theory has spread to other contexts on the Internet. In eBay, Inc. v. Bidder's Edge, Inc., [124] the court found that the automated retrieval of eBay's web pages and consequent indexing of eBay auctions by a Bidder's Edge program constituted trespass to chattels. [125] eBay, Inc. explicitly addressed the impact of unauthorized consumption of computer resources where the consumption did not cause the computer to reach maximum capacity. [126] The court's findings seem to impute the inviolability of chattels by conflating the absence of a right for Bidder's Edge to use eBay's property with eBay's legal right to exclude Bidder's Edge. [127] Register.com, Inc. v. Verio, Inc. used the same standard of harm to impose liability for trespass to chattels on Verio, where Verio accessed Register.com’s public WHOIS database for marketing purposes. [128]

3. A Trespass Too Far?

Burk makes two reductio ad absurdum arguments against the application of trespass against chattels. First, he raises the possibility of extending the trespass to chattels theory to other contexts.

One wonders where the limits of such 'trespass by electrons' might lie. If one is willing to base the physical contact requirement of trespass upon the receipt of electrons, then whole new vistas of electronic trespass are opened to our view. Unwanted telephone callers would seem to be engaging in trespass to chattels; the telephone call sends signals to the instrument of the recipient. So, too, with fax machines that receive unwelcome transmissions. [129]

This result is not so absurd, however. Federal law already gives telephone and fax owners certain private rights of action against certain unsolicited commercial callers. [130] Some of those prohibitions protect the same interests at stake in these cases; interlopers should not be able to impair the value or impose extra costs on the owner of communications equipment. Secondly, Burk argues that the computers cannot legally be considered to be harmed if they function as they were designed to do (that [p83] is, email servers are not harmed by sending email.) [131] This argument does not recognize the rights of owners that underlie the legal theory of trespass to chattels. A similar argument could be made about joyriding in a car. The joyrider’s use of the car causes no harm to the car, but is unauthorized. Nevertheless, it is not controversial that depriving the car’s owner the use of the car is a valid basis for liability, no matter that no harm was caused to the car.

But Burk's last policy argument presents a much more potent objection to the theory of trespass to chattels. Burk cites Intel Corp. v. Hamidi, [132] where Intel sued a former employee who sent email critical of Intel to Intel employees through Intel's own email servers. The court found that a connection to the Internet did not transform the email servers from private property to a "public forum," where Hamidi would be immune from legal intervention by the property owner. Hence, the court rejected Hamidi's First Amendment defenses. Burk argues that the application of the theory trespass to chattels to the Internet could have severe effects on the function of the Internet as a whole. [133] Hamidi stands as an example of how trespass to chattels can be used as an arbitrary barrier on the Internet. Burk argues that exercise of property rights in an environment like the Internet represents a threat to the functionality of the system as a whole.

[P]roperization in a networked environment encourages the holder of the exclusive right to attempt to free-ride upon the external benefits of the network, while at-will avoiding contribution of such benefits to others. For example, in the Hamidi case, Intel apparently wished to enjoy the advantages of e-mail access to the Internet from its system, which was the reason it connected its machinery physically to the network. At the same time, it hoped to make its system unavailable to Hamidi, at least for the transmission of content that the company found objectionable. . . . Intel or eBay may hope to avoid the local burden of networking by legal exclusion, but this eventually will result in suppression of the positive externalities of networking. . . . If propertization via trespass imposes costs in excess of the costs imposed by [p84] spam, it is difficult to justify recognition of trespass claims: they may do more harm to the digital commons than do the unauthorized uses they are designed to prevent. [134]

Users would need to seek the permission of each individual computer owner their traffic passed over if trespass to chattels was taken to its extreme. Burk's argument is potent because it addresses how the exercise of property rights could effectively destroy the public nature of the Internet. Nevertheless, two answers to it can be raised.

First, computer owners are capable of employing technical measures to prevent many unauthorized activities that might otherwise contribute to the commons of the Internet. Eliminating the tort of trespass to chattels from the law applicable to the Internet would not save the Internet commons from privatization. Moreover, legal rules prohibiting such technical measures seem like a dramatic curtailment of property rights.

Second, Burk's economic analysis is specific to spam. Other activities with different economic effects need to be regulated. Application of the trespass to chattels theory might be inefficient with respect to spam but efficient with respect to hacking, spyware or cookie placement. Moreover, property rights are based in personal autonomy, not economic efficiency; we cannot include spam under trespass to chattels and then exclude Hamidi's messages, without implicating the coherence of the law. As previously argued, the incoherence and unpredictability of the law have their own economic costs. Ultimately, inconsistent legal rules are more inefficient than permitting propertization of the Internet when technical measures can impose the same loss of open access in any event.

4. Application of the Metaphor: The Importance of Fences

As a strict matter of law, Burk's contention that trespass to chattels does not technically cover spam or unauthorized indexing may be correct. [135] (I equivocate because the courts have established all the elements of trespass to chattels to their own satisfaction and the courts' definition is self-reinforcing in a way Burk's analysis is not.) Indeed, Susan Ballantine contends that courts should analogize and use trespass on lands precisely because trespass to chattels is inadequate for the situation. [136] Using the cyberspace metaphor provides an easy exit to this dilemma. If we envision email servers as a physical space, then spam is [p85] easily perceived as a nuisance. The cyberspace metaphor transforms trespass to chattels to trespass on real property.

The application of the metaphor of fences in cyberspace requires us to examine he plaintiff's technical measures to prevent the defendants from consuming their computer resources. The rule of fences holds that the law will not fix liability unless the defendant circumvents reasonable technical measures implemented by the plaintiff. In fact, most of the spam cases mention defendants' measures to conceal the origin of their messages. CompuServe discussed the legal right of chattel owners to take such measures. [137] Bidder's Edge, Inc. discussed the extensive measures eBay took to prevent Bidder's Edge indexing eBay. [138] The only case previously cited which does not discuss technical measures to prevent defendants' actions is Hotmail Corp. v. Van$ Money Pie, where the defendants used accounts at the plaintiff's free email service to send spam. [139] Given that Hotmail offered free email accounts to the general public, the costs of screening may have been unreasonable. It may be that there were no possible technical measures to be taken in Van$ Money Pie. In these cases, the "fences in cyberspace" analysis looks to see whether reasonable technical measures were available and whether the technical measures taken were reasonable.

The benefits of the analysis associated with the application of the metaphor are threefold. First, the metaphor eliminates the technical problem in the law described by Burk and Ballantine. Second, the metaphor promotes technical solutions. Consider that if the technical measures taken in the above cases were found to be inadequate, more effective technical measures would have to be used. Technical measures are preferable to judicial action: the CompuServe court noted that "the implementation of technological means of self-help, to the extent that reasonable measures are effective, is particularly appropriate in this type of situation and should be exhausted before legal action is proper." [140] Users would benefit more from technical measures against spam that worked universally than from a legal remedy that applied to a limited set of defendants and whose enforceability was not reliable. Finally, fences promote free space and open access on the Internet. Burk's root concern [p86] is the erosion of common land in cyberspace. Under the cyberspace fences metaphor, computer owners who do not choose to erect fences have no basis to assign liability to users who consume their property. While the law should not prevent the erection of fences on private land, it can assume that whatever is not fenced off is free to use. The assumption behind open access resembles the legal rule articulated in Buford v. Hurotz, [141] which promoted free use of unenclosed portions of the Western range because such use benefited agriculture, the economy and ultimately, society. [142]

B. Computer Fraud, Access and Nmap

1. Access as the Threshold of Liability

Most American jurisdictions have computer crime laws which include prohibitions on unauthorized access. Seven states are exceptions. Georgia, Montana and Viriginia criminalize unauthorized use of a computer. [143] Minnesota criminalizes the "penetration" of a computer or computer system. [144] Wisconsin criminalizes the access of data, computer programs and documentation, but requires that computer equipment itself by modified, damaged or destroyed. [145] (Section IV.B.2 discusses the remaining states, New York and Massachusetts, separately.) Of the remaining forty-three states, only Alaska, Louisiana, Michigan, Mississippi, South Carolina, and West Virginia require some other element beyond unauthorized access and mens rea (typically including modification or destruction of data or fraud.) [146] Thirty-seven other states require only access and mens rea. [147] As a threshold for criminal liability, [p87] "access" proves to be a tremendously porous border. Statutory definitions of access are remarkably homogeneous and quite broad. The table below shows how twenty one states use essentially three definitions for access.

[p88] Another thirteen states use very similar definitions to those presented in the table. [148] California, Maine, Hawaii and Oklahoma) define access as "entry" into a computer system. [149] The federal computer fraud statute [p89] (Computer Fraud and Abuse Act) protects only limited class of computers; the most broadly-defined category of computers are those involved in interstate or international communication. [150] The CFAA criminalizes intentionally accessing and obtaining unauthorized information from a computer across state or national boundaries. [151] The federal computer fraud law does not define access. [152]

2. Developments Limiting Application of Computer Fraud Laws

The homogeneity may be evidence of legislative inexperience rather than a well-tested regime for criminal liability. [153] Viewing warning banners and password prompts by unauthorized users constitutes communicating with a computer and receiving data from computers. As such, those activities would fall under a stringent interpretation of most definitions of access and would trigger liability. Such an interpretation would not provide users with notice that a use is unauthorized. Interaction with any computer connected to the Internet satisfies most statutory definitions of "access." The boundary of liability falls back to the authorization or consent of the computer owner. Register.com, Inc. v. Verio, Inc. provides one unsettling example of how easily liability can be incurred. [154] Addressing Register.com’s CFAA claims based on Verio’s access to Register.com’s public WHOIS database, the court notes simply “because Register.com objects to Verio's use of search robots they represent an unauthorized access to the WHOIS database.” [155] Although the court did base Verio’s liability for trespass to Register.com’s chattels on the Verio’s notice that its access of the WHOIS database was unauthorized, it is unclear whether the court also based the CFAA claim on notice. [156] In any event, because liability expands and contracts at will, [p90] the threat of liability could hinder interactions on the Internet. Moreover, computer owners have no incentive to implement technical measures to exclude others. Technical measures would function more efficiently than judicially imposed sanctions, if only because they do not involve the same chill on interactions with the Internet.

The overexpansiveness of these laws has contributed to the unpredictability of their application; courts are resistant to interpreting statutes' full potential scope. For example, in State v. Rowell, the New Mexico Supreme Court found that the New Mexico computer fraud statute could not be applied a defendant who defrauded his victims over the telephone. [157] The court found that the fraudulent calls were made through "computerized switches" and that the defendant's action's "resulted in the access of computerized switches, and in fact access to a computer or a computer network." [158] Nevertheless, the court concluded that the "access of such components is not the type of conduct the legislature sought to punish by the Act." [159] Furthermore, in State v. Allen, the Kansas Supreme Court substituted a dictionary's definition of "access" in place of the "tortured translation of the definition . . . provided" by the Kansas computer fraud statute, rather than hold the statute unconstitutionally vague. [160] This interpretation favored the defendant, where the defendant had called a Southwestern Bell computer but where there was no evidence that the defendant had attempted to respond to the password prompt. [161] At the same time, the court resisted the state’s argument that Southwestern Bell's investigative costs were the measure of the defendant's damage to Southwestern Bell’s computer system. The court commented that "a fitting analogy [is] that the State is essentially saying that a person looking at a no trespassing sign on a gate causes damage to the owner of the gate if the owner decides as a result to add a new lock." [162] In Moulton v. VC3, a federal court found that the costs incurred investigating a port scan did not constitute damages under the federal Computer Fraud and Abuse Act. [163] Moreover, the court found that a party's port scan did not access the other party's network. [164] Port scans elicit information from computers and computer [p891 networks; under many of the state statutory definitions above, port scans do access computers and probably would constitute computer crime. Certainly, the court could have found port scans to constitute access under the CFAA and found the party liable for the port scan. Moulton may signify that there is a threshold of network activity below which courts will not interfere. [165]

However, not all state statutes provide for such expansive liability. A small minority of states, Connecticut, Ohio, New Hampshire and West Virginia, provide affirmative defenses to offset the expansiveness inherent in "access" when defendants reasonably believed that they were authorized or could not have known they were unauthorized. [166] Massachusetts criminalizes knowing, unauthorized access and failure to terminate access after becoming aware that access is unauthorized. [167] Moreover, the Massachusetts statute states that the requirement of a password constitutes notice that access is limited to authorized users. [168] Massachusetts has made some provision to limit liability and, more importantly, given a concrete guide to the limits of access. New York, on the other hand, criminalizes only unauthorized use where "the computer utilized is equipped or programmed with any device or coding system, a function of which is to prevent the unauthorized use of said computer or computer system." [169] This qualification was held to limit liability in People v. Angeles, where a defendant obtained and sold a copy of the Empire Car Service's customer list and the prosecution failed to allege that Empire Car Service's computer system had any sort of computer security system. [170] Instead the court noted that

The legislative history of the statute makes clear that this requirement was included on the ground that "[s]uch protective devices provide the first line of defense against unauthorized intrusion into a computer system." . . . The Legislature thus put computer owners on notice that in order to receive the protection of the criminal statute, they must equip their computers with some kind of protection mechanism, such as a password requirement or a lock. [171]

[p92] While password prompts and warning banners may lie just beyond a common-sense threshold of access, there are many times where computer crime occurs without encountering a password prompt. Moreover, there may be situations where consideration limited to password prompts will not adequately analysis the entire bundle of rights inherent in computer property connected to the Internet.

3. Translating "Access" into Real Life on the Internet

The application of access-based computer crime laws could damage the digital commons as much as the current formulation of trespass on chattels. The efficiency of communication on the Internet stems from the implied consent to use the computer resources and information of others'. Legal rules that extend liability to any access whatsoever damage that efficiency. Consider how trespass to chattels and access-based computer crime laws would function on the Internet. These laws implicate the most rudimentary network functions, like pinging an IP address to see if a network host is connected to the Internet, let alone initiating a TCP connection that would provide the basis for communicating that access is unauthorized.

The benefit of the fences in cyberspace metaphor is an enhanced capacity for precision. Application of the metaphor of fences in cyberspace could create a legal regime capable of much finer distinctions between liability and non-liability. Consider a situation where the law assigns a privacy right to the computer owner over the kind of operating system running on the computer. (This privacy right is, and should remain, a hypothetical situation. The overall utility of such a privacy right is questionable. While discovering the identity of a target's operating system is an integral step to breaking into the target, it is poor security to rely on the obscurity of the operating system’s identity.) [172] In cyberspace, information about the kind of operating system is an object. This hypothetical posits that the owner has the legal right to put a fence around this object. Individuals on the network can use techniques like banner grabbing, port scanning or nmap's OS fingerprinting to identify the [p93] owner's operating system. [173] Most "fences" would protect against banner-grabbing; banners must be either changed or eliminated. [174] Port scanning can be prevented by shutting down unnecessary applications and through using firewalls that filtered packets on the basis of port numbers. [175] These measures would create a fences that encompasses more of the information. Finally, preventing nmap-type OS fingerprinting requires using a firewall that filtered on a packet-by-packet basis or altering the TCP/IP stack of the computer. [176] These measures would enclose most of the remotely available information about a computer's operating system. A court deciding whether to assign liability would first inquire into what technical measures were used; the court must find the fences in cyberspace. Next, the court must decide whether the technical measures were reasonable. The computer owner who failed to protect against banner-grabbing should not have legal recourse when banner grabbing identifies his operating system. A computer owner who used a firewall that prevented port scans but not nmap-type OS fingerprinting might establish a strong case for liability against a nmap scanner. Then again, perhaps the cost of preventing nmap-type OS fingerprinting might be found minimal; the court might assign liability only where the defendant used other means to get the information. The point of the exercise above is that the metaphor allows courts to distinguish between relative degrees of care that the owner has taken to restrict information flows.

Courts striving for equitable and predictable distinctions between liability and non-liability receive little help from the language of the law; most current laws could be used to penalize any interactions on the Internet between networked computers. To be efficient, the law must also be capable of precision and coherency, even more so because information flows on the Internet can be very complex. The cyberspace fences metaphor can help provide that precision.

C. "Trusted Systems" and Conflicted Property Rules

1. From "Trusted Systems" to the Law

Software creates "trusted system" by disabling some of the usual capabilities of the computers on which it is run. [177] "Trusted systems" are granted some privileges in return for accepting the limitations placed on [p94] them. Increasingly, software publishers are turning to "trusted system" technology to enforce agreements with software users. [178] Mostly, software publishers use "trusted system" technology because of their concern that their copyrights would otherwise by violated by users copying and distributing an infinite number of perfect digital copies. [179] "Trusted system" technology is used to prevent users from copying and distributing copyright owners' works. [180] In this context, "trusted system" technology is also called rights management systems. [181] "Trusted system" technology is also used to ensure that the players of Internet-based games to not use illicit technology to cheat. [182] The client/user side of "trusted system" technology is very vulnerable, because users are free to study methods of attacking the technology at their leisure. Commentary on the seemingly innocuous example of Internet games shows how difficult it is to implement effective "trusted system" technology. [183] The most salient example of client side attacks on rights management system is the failure of the Secure Digital Music Initiative standard. [184] The vulnerability of the client side of "trusted systems" technology has led one computer security authority, Bruce Schneier, to declare: "there is no way to trust a client-side [p95] program in real usage" and that, in fact, it is not possible to implement effective "trusted system" technology. [185]

Recognition of the inherent vulnerability of "trusted system" technology led to the Digital Millenium Copyright Act. [186] The DMCA prohibits the circumvention of technological measures that effectively control access to copyright owner's work, as well as the manufacture and distribution of technologies of devices whose principle purpose is such circumvention. [187] The DMCA also prohibits the manufacture or distribution of devices or technologies that circumvent technological measures that effectively protect the rights of copyright owners. [188] The DMCA provides exceptions for nonprofit libraries, educational institutions and archives, [189] law enforcement activities, [190] reverse engineering, [191] encryption [192] and security research [193] and the protection of personally identifying information. [194] Violations of the DMCA are punishable civilly [195] and criminally. [196]

Many criticisms of the DMCA focus on the DMCA's failure to accommodate fair use. Fair use is a defense against a claim of a copyright holder for copyright infringement. [197] Fair use is encompasses traditional prerogatives of copyright users, [198] including First Amendment rights to free speech. [199] "Trusted systems" are not required to incorporate fair use [p96] exemptions into their functionality, but circumventing "trusted system" technology for fair uses still results in civil and criminal penalties under the DMCA. [200] This concern with the DMCA was borne out by the Copyright Office's exemptions for encrypted lists of websites blocked by filtering software applications and literary works (including computer programs) protected by access control mechanisms that fail to permit access because of malfunction, damage or obsoleteness. [201] The Copyright Office made explicit statements about the fair use values that necessitated the filtering software exemption:

[R]eproduction or display of the lists for the purpose of criticizing them could constitute fair use. . . . [A] persuasive case was made that the existence of access control measures has had an adverse effect on criticism and comment, and most likely news reporting, and that the prohibition on circumvention of access control measures will have an adverse effect. Thus, it appears that the prohibition on circumvention of technological measures that control access to these lists of blocked sites will cause an adverse effect on noninfringing users since persons who wish to criticize and comment on them cannot ascertain which sites are contained in the lists unless they circumvent. [202]

The Copyright Office also made reference to the First Amendment issues implicit in the public dissemination and discussion of the sites blocked by filtering software, especially where adults using public libraries might not by able to receive speech because of the filtering software. [203]

2. Application of the Metaphor

The DMCA fits well into the language of the metaphor. Copyrighted works are a property in real life and in cyberspace; access to that property is controlled by technological fences. After satisfying the license [p97] requirements for access, a user is permitted access, but the ability to copy and distribute data in his own computer is fenced off. Although the work is on the computer owner's cyberspace, he or she is not able to control it. The DMCA's threshold of liability coincides precisely with the metaphors. Circumvention of technical measures are jumping over fences in cyberspace are equivalent and prohibited.

In this way, the DMCA creates consistent and coherent rules and provides copyright owners' strong incentives to use technical measures before turning to courts. Universal City Studios, Inc. v. Reimerdes, the first application of the DMCA, found the application of the law "clear," and that there was "no serious question" that the defendant's behavior violated the statutory provisions in the DMCA. [204]

3. Whose Property Rights Trumps?

Although the DMCA coincides precisely with the metaphor, the significance of the metaphor to critical analysis of the DMCA merits more than a perfunctory discussion. The DMCA controversy raises the issue what residual property rights of computer owners remain after using copyrighted software with DMCA-protected technical measures. This question is more complicated than identifying computer owner's a priori property rights. How should the law permit software to curtail computer owners' property rights who knowingly and willingly run the software? This question encompasses issues with obvious answers, like virii and trojan horses. It also encompasses more ambiguous matters. Lawsuits have been filed against against software publishers whose software gathered information about users without explicitly saying so [205] and against America Online, whose software made it difficult to revert to competing Internet access providers and web browsers after installation. [206] The merit of these lawsuits may well hinge on the availability of technical measures that would have prevented or reversed the harm at issue. Analyzing those lawsuits from the perspective of the fences in cyberspace metaphor, the liability of the defendants depends on whether they circumvented technical measures implemented by the computer owner. The transfer of cookies can be prevented by proper configuration of the browser, while the configuration of Internet connectivity software may be substantially more complicated and controlling the effects of installed software is extremely [p98] difficult. Preventing or reversing the harm caused by America Online is much more difficult for most consumers than preventing the harm caused by Internet advertisers using cookies.

For computer owners to enjoy their property rights, implementation of technical measures that control software will be increasingly needed. The problem is that technical measures employed by computer owners will conflict with technical measures implemented by software publishers. Technical measures implemented by the computer owner protect and control his property, while technical measures implemented by copyright owners provide control over their work at the expense of the computer owner. One easily analogized example of a brewing technological conflict between consumers and website operators over banner ads and cookies. Many website operators employ banner ads to subsidize their operations. At the same time, users resentful of the privacy implications employ software that manipulates cookies and prevents banner ads from loading. [207] Reacting to this software, some web site operators use technical countermeasures to prevent browsers that won’t load ads from loading at all. [208] Others have responded with threats to boycott or to sue the publishers of this software, under the theory that use of the software violated the web site operators’ copyright. [209] This technological struggle does not beg the question of whether the consumer or the web site operator have property rights in their respective computers and the information on them. They should both retain rights in their property. Instead, this struggle begs the question of who has yielded those rights. Has the consumer yielded his property rights over his computer by loading a web page and is he now required to display the page however web site operator wishes? Or has the web site operator yielded his right to control his data by making the web page publicly accessible over the Internet? Returning to DMCA considerations, to the extent that property rights can and should coincide with effective technical measures protecting property, whose rights should dominate, computer owners or copyright owners?

Arguments against the DMCA have not yet considered the effect of the DMCA on the property of computer owners. Although it may be effectively countered by theories of implied or explicit consent, this [p99] argument at least addresses the loss of functionality and property rights computer owners must accommodate to avoid liability under the DMCA.

V. Conclusion

The fences in cyberspace analysis addresses shortcomings in modern law. Certainly, the metaphor trims back overexpansive doctrines of trespass on chattels and statutory computer crimes. The metaphor also describes the controversy over the DMCA in terms of property rights, instead of fair use and copyright. But the fences in cyberspace metaphor provides for a more precise and coherent line between property rights, the DMCA discussion shows that it does not address the underlying allocation of property rights. The analysis provided by the metaphor comes full circle, hopefully with a clearer conception of the practical values involved.