Policing On-Line Communities

Fictional Case #1: Hierarchy with Board

Fact Pattern

• Jack is an Executive Director of Testy Metrics, an online nonprofit devoted to measuring the effectiveness of other nonprofits.
• Jack is caught promoting Testy Metrics under a pseud.
• The Board meets and sanctions Jack.

Analysis

• The responsibilities of a Board within the hierarchy of a nonprofit or forprofit are clearly defined, whether the nonprofit operates in bricks and mortar or mostly online.
• In this case the Board met and discharged their responsibilities under a well understood set of laws.
• End of story.

Fictional Case #2: On-Line Community

• Tamar is a member of Ultras, an online community with 10,000 members, one owner, and no board.
• Let's say the community site is established as a limited liability company.
• Tamar, under the handle, Avenging Fury, participates over the years in a number of investigations as they are called, looking into and documenting online the misdeeds of others.
• She also enjoys participating in the Ultras occasional raiding parties where they go to other site en masse and bully the owner.
• In the course of one such outreach operation, she and 25 others from the Ultras, come and go in a raid on a site, Happyland, they feel has slighted them.
• Back at home base in their community they whip each other into a fury of righteous indignation.
• The Ultras invoke their supervisory procedures: They convene a discussion of the moderators in a public thread. The Happyland owner is invited to take his concerns to the Ultras' moderator thread. In expressing his concerns he is bullied and reviled, though here and there voices of reason are heard.
• He protests on his own site. He is told in the comments by Ultras to toughen up. Get over it. Ultras have done far worse, he is told, in other situations, and their are communities far rougher than the Ultras.
• The situation grows more heated.
• At Happyland, the bullying by several Ultras spills over into harassment. Tamar under an alias (Bonsoir) sends an email to the site owner threatening to expose, say, some private aspect of that person's life in the newspaper. Or, she threatens to work on his neighbors revealing things about him which may or may not be true, but which would be humiliating. Or she threatens to bring the site owner's employer into the picture in ways that could harm the owner. Or, maybe she threatens to blacken the owner's reputation with the clients of a business he runs. In any case, the owner of Happyland feels that he is being intimidated and may be harmed.
• Back at the Ultra's clubhouse, Tamar brags of her harassing letter and calls it payback. "Let's make an example of people like him! No one messes with the Ultras!"
• Bruce, under the handle, Crusher, writes, "Are they intimidated by us yet? They should be! There's people here who can take that site down, steal the owner's identity, and mess up his life forever!"
• Owner of Happyland asks by onsite email for a phone conversation with the owner, Lydia, of the Ultras. Emails go unreturned.
• Meanwhile, at the Ulra's site the moderator's thread continues to take up the issue of their responsibility, if any. The owner of Happlyand is again asked to participate. He is listened to a little, bullied a little, denials are made, no action is taken. The gist, among some, is that the owner of Happyland is a wimp who was asking for it. Others say, "That is just how the net is; you can't change it." The thread is characterized by diversity of opinion. No one is in charge. No one speaks with delegated authority via "top management," the owner, or a Board. There is no clear supervisory mechanism, or chain of command. Job deceptions of mods are nonexistent or hazy. Policies are hazy. There is no Board. It is all talk. Opinions differ. Lydia, the owner, has no clear mechanisms for exerting control, even if she wished to do so.
• Happyland goes down in a denial of service attack.
• Owner of Happyland hires a detective who unmasks Bruce. He is revealed to have been the hacker who took down the site.
• Owner of Happyland sues Ultras.
• Lydia, the owner of Ultras, when deposed declares she has no responsibility for things said or done by her members, either on their own, in a group, or in the site's name. She has no control. Her site is a limited liability company. No way is she responsible.
• The mods when deposed declare they have no control and no responsibility. They never had been told they were supposed to keep things calm. They couldn't keep things calm, even if that had been their assigned task.
• The conveners of the thread internal to the Ultras assessing their procedures when deposed claim they have no responsibility. They were just talking.
• The suit against Ultras names the owner, Bruce, Tamar, the moderators, and 15 members who participated in the moderator's thread. Case goes to court.
• Case draws public attention
• As the case wends its way through the courts, legislation is introduced in Congress to better regulate the wild west of the internet, which is said to "provide a haven for bad behavior." 

Analysis

• The fact pattern could be spun in thousands of ways, to include dead dogs on the Happyland owners lawn, anonymous phone calls, Ultras in a car outside his home, letters to his boss, and his eventual stroke, loss of a job, or suicide. The case could be expanded to detail the Happland's owner's flaws. Maybe he is an ex-con, or in the witness protection program. I made the facts up;  you could make up others. But even the mild case above raises the critical issues.
• Under current law does the owner of Happyland have a cause of action against Tamar?
• Against Bruce?
• Against Lydia, the owner of Ultras?
• Again the mods at the Ultras?
• Against the conveners of the thread internally who failed to condemn or restrain the emotions that spilled over into the actions as they unfolded?
• Against the voices of unreason in that thread?

Overall Discussion

• Cased law and legislation is evolving in this area. Wherever the edge is, we had better not explore it. Better we learn to police ourselves. That begins with accepting moral responsibility, and joint responsibility as a community, before it spills over into legal responsibility.
• A nice tight Board structure over a hierarchy is a much easier case to parse. The law is settled and everyone knows the rules, and the legally defined roles, though they may argue the facts.
• Whatever current law may be, we may soon see net communities forced into a legal mold such that, when suits or criminal cases arise, blame can be laid in an orderly process upon those who have supervisory and management responsibility, or the equivalent of Board level oversight.
• Operating in the gray is safe, it feels like, until things go black and white, and then we wonder how we ever let it happen.
• Best to tighten up while matters are still in our own control, and we can evolve mores, manners, rules, policies, and procedures that keep us all safe. 

This Case Study is fiction. Any resemblance to any specific case, controversy, or persons is unintentional. In my own blogging life I have no complaints. I have never been intimidated, threatened, harassed, or harmed in any way online. I like the status quo, where we hash things out among ourselves, but I do think the day is coming when law will intervene, and the consequences to free speech and freedom of assembly may be ugly. So, this Case Study is put out on the net to seek a net solution to an evolving set of issues that affect all of us who care about this open, public space in our democracy. Let's self police before the legislature and the courts find a pretext to crack down on a culture they would dearly love to control from the top down.

Comments

[Gerry]

Thank you for the work you do, Phil.

[Trust Fundy]

sorry, but that's just absurd, phil. you're starting to come off as obsessed. let it go!

[Marcel]

Of course, there's another version of Fictional Case # 2, where...

--Reasonable members of the Ultras repeatedly tell of the moderator of Happyland that he is misunderstanding things, that there is no policy and no history of "investigations" and "raids," that the community HAVE NOT "done far worse." That bad behavior towards third parties is unambiguously frowned upon, and, given all of the above, don't feel such things are issues of prime concern.

--The moderator of Happyland responds politely in every instance, yet demonstrates a steadfast unwillingness to take them at their word, or to acknowledge any viewpoint other than his own. He devises increasingly elaborate hypothetical scenarios that are simply restatements of what he has been claiming all along, and despite professions of "no hard feelings," refuses to let the issue go.

--The few remaining Ultras following along give up, go away and leave the moderator of Happyland to his claque of well-wishers.

The End.

[Gerry]

Marcel, you may choose to write it off in terms of your interpretation of what may or may not have happened, but what about actually responding to the case as posted or with less substantive variation. The point is that the facts we were rehasing, and the dead horse you insist on beating could easily have been different. Things could easily have gone as badly as Phil suggests, and I for one don't appreciate being close to it.

Keep it on the case study, please.

[Josh Millard]

What shapes do you see the hypothetical legislation taking? What specifically might be legislated?

It occurs to me (as a legal nincompoop, mind you) that as you've partitioned out the potential defendants in the Happyland owner's* potential legal actions (Tamar as inciter, Bruce as attacker, Mods as supervisors, etcc) so might those actions be expected to be taken on in a similarly partitioned fashion, in a way that doesn't sound unfamiliar to me from my happenstance observations of similar legal cases.

Is there something unique, for example, about Bruce's situation, something about his being an Ultras member that makes the legal context notably different than if he were, say, the member of a social club, or a non-principal employee of some organization? I'd like to see what the perceived distinctions there could be.

But the interesting core of the questions you're asking may have more to do with law as it regards and could come to regard the more indirect things -- how moderators might be liable, how the bystanders and conversants might be.

So what analogues to that exist in off-line law?

For a hastily contrived example: take fifty Shriners, out for a dinner banquet, strolling all a-fez; they come across a man posting a bill, and a conversation about the contents of the bill crops up. A few of the Shriners object to the message, the man posting it objects back.

Tempers heat up; one of the Shriners declares, finally: "Buddy, I'm inclined to punch you in the nose. Don't think I won't do it."

The rest of the Shriners react: with mutters; laughter, both nervous and raucous; rebukes against the threat of violence or against the uncharitable interpretation of the bill-poster's intent; casual encouragement that a punch in the nose wouldn't be unjust. One or two of them declare more firmly that in fact it'd be just the thing. Among them, an elder agrees with the rebukers, but does not physically wrestle the pugilist to the ground.

The nose is punched.

How does existing law approach that? Who is culpable, and how, and what legal actions could the bill poster reasonably expect to pursue? And how does that situation differ from one where the punch is an electronic attack, the discussion in comments rather than words, the supervisor an administrator rather than a lodge elder?

That's only bits and pieces of the case study, but I'm interested in how people see the comparisons breaking down.

* And why doesn't this good fellow get an apellation? "The owner of Happyland" is so stiff and wordy compared with evokative "Tamar" and "Bruce".

[Marcel]

Not my dead horse, Gerry--I'm only an onlooker.

Have fun, everybody.

[Worst Case Scenario Guy]

Things could easily have gone as badly as Phil suggests

Giant man-eating Mexican fire ants could have invaded. The sun could have exploded, too.

Just out of curiosity, do you have a job, Gerry? Other than being Phil's reacharound guy, of course.

[Marcel]

Or, to put it another way:

You jostle a stranger in a crowded train.

He confronts you and says: "You tried to attack me. We must talk about this!"

You say: ""Uh, no, sorry--the train is crowded and it was an accident." Bystanders speak up, supporting your version of events.

The stranger then says: "Well, you COULD HAVE attacked me. Who have you attacked in the past? We must talk about this!"

You explain that you've never attacked anyone in your life.

The stranger says: "Well, SOMEONE could have attacked me. We must talk about this!"

I'm the guy sitting in a corner of the train, shaking my head and chuckling.

[Josh Millard]

(And I hope we get the discussion you're looking for, Phil, but here again is the weird question of choosing when to bait an audience you know is watching -- and appending a disclaimer to the end of what is likely to be read as the rhetorical antonymn of a hagiography doesn't realistically do a whole lot to mitigate that effect.

Your house, I'm game for the Case Study, and I'll try to say nothing more specific on it here, but it's something worth thinking about, as far as producing the discussion you want.)

[Dan]

Gerry, you may believe that the post above is "rehasing" facts - and if this coining is intended to mean that it is seeking, and not for the first time, to make facts more hazy then you are certainly free to argue that, although it seems rather rude of you to suggest that Phil is doing such a thing on his own blog. It is clearly not, however - see the disclaimer. Any resemblance to real events is purely coincidental.

So, what would happen in such a case? Well, the thing about case law is that it tends to rely on the existence of cases. The above is a short piece of fiction, and as such one might speak with as much concern over the danger of an attack on Happyland by ferocious web unicorns.

There are laws that do exist to deal with online harassment, hacking, DDoS attacks and so forth. They vary across national boundaries, but can reasonably be said to exist. These may be a good place to start in the discussion, although it will require a little work.

[Gerry]

You have a point Dan, but what I'm reacting to is that Marcel's post puts a spin on the case as presented, it doesn't just change the facts, it could be views as challenging them. What if the facts are disputed, the community maintains that nothing is wrong in spite of actual wrongdoing behind the scenes and they won't take the evidence seriously?

Josh, the moderator or person judged to have authority can be liable for not taking action to avert a predictable tragedy. In a crowd situation, eggers on can be charged with incitement. I'm no lawyer either, but there is no substitute for staking out a strong moral position whether or not you have any actual power to enforce. Setting a good example in words is always a good strategy. The court is unlikely to find you liable if you took good faith steps to stop things from spiraling out of control.

I'm very good at my job and have an enormous backlog of slack. I'm also pretty good at doing two things at once.

I live a pretty open internet life, and I'm not really very concerned about getting caught up in a landmark case or being attacked by some cyber-miscreant. Don't make the mistake of thinking that makes me a soft target.

[Dan]

What if the facts are disputed, the community maintains that nothing is wrong in spite of actual wrongdoing behind the scenes and they won't take the evidence seriously?

Well, I believe that this is where we have law. It doesn't matter whether they - the community - maintain that nothing is wrong or not. If, to go back to the train, nobody is attacked, then it does not make much difference whether the people on the train argue for the person staying on the train, interacting with the other people on the train in other contexts than talking about whether or not they had been attacked, or tell the person on the train to sit down and shut up. If a person on a train is attacked - that is, if there is actual wrongdoing - then the other people on the train become witnesses to that wrongdoing, and if they then maintain, having been subpoenaed to testify, that there was no wrongdoing, then they are committing a felony.

You claim - there is no substitute for staking out a strong moral position whether or not you have any actual power to enforce is perfectly fine, and good advice, no doubt, but has no force in law.

Let's look at it another way. A casual reader takes Don't make the mistake of thinking that makes me a soft target as an implied threat. In the absence of any actual wrongdoing, or any consensus on whether it was a threat, what, in terms of the force of law, do you think should happen?

[Gerry]

Dan, that was in context of an actual ad hominem directed at me. I imply no threat or intended action. Just that if I ever do find myself attacked, I have the will to defend myself.

[Marcel]

I imply no threat or intended action.

I don't know, that sure sounded like a threat to me.

Even if it wasn't, it could easily have been, and I for one don't appreciate being close to it.

[Chris]

Without several actual lawyers being involved, this entire discussion is a bit futile. Laypeople can put forth their opinions, but no actual answer would emerge.

Gerry: Marcel's post puts a spin on the case as presented, it doesn't just change the facts, it could be views as challenging them.

That's what a defense attorney would do, should such a fictional case be brought to court. Present a different angle, question the merits of the case to begin with (whether it's frivolous or not, for example).

Anyway, back to the fictional case, and with the note that I'm not a lawyer and merely giving my opinion:

does the owner of Happyland have a cause of action against Tamar?

Probably, for harassment.

Against Bruce?

Probably, for the DDoS.

Against Lydia, the owner of Ultras?
No.
Again the mods at the Ultras?
See Above.
Against the conveners of the thread internally who failed to condemn or restrain the emotions that spilled over into the actions as they unfolded?
See Above.
Against the voices of unreason in that thread?
See (guess where?) Above.

The only exception I see to that is if one of those conveners or voices of unreason posted private information about HappyLand guy. Information that isn't readily available on HappyLand itself: say, the owner's cellphone number, summer cottage address, children's contact info, hamster's vet's address and known socializing venues, etc. That might be construed as an invasion of privacy, maybe.

The owner, mods, thread participants are not responsible for Tamar's or Bruce's actions. Even the ones who egged them on.

The owner and mods are no more responsible for it than a coffee shop owner would be if a couple of people plotted a murder while sipping his lattés. The other users are no more responsible than fellow customers who were in line with the plotters.

As to egging on and inciting... There's that maternal cliché about friends and jumping off bridges. No matter how much egging on is going on, the final decision is made by the perpetrator. Even if I were to be surrounded by friends inciting me to rape a random person on the street, it's still up to me to heed that 'advice' or not. Eggers on may be general assholes, or otherwise good people behaving in an asshole manner at the moment, but I don't see them as responsible or contributary to a perpetrator's actions.

That's my take on it. Would be the same if the places had been swapped, and the perpetrators were from HappyLand.

[phil]

I don't have the legal background to know what causes of action a person might have against a community where talk gets heated and group members cause real world harm. If I pwn a bar and a patron gets very drunk and dies on the road home, I believe I as owner have liability. If I have clear policies in place that the bartender is not to allow a person to get drunk and not to let them drive drunk, then perhaps I can defend myself, or minimize damages. But if I have no policies, and let people get as drunk as they please, I believe (and I am not a legal expert) that I would not only have legal liability, but would also perhaps be open to punitive judgements, based on having failed to put proper systems and controls in place.

If I incite a riot, and a store gets trashed by others in the mob I have whipped into fury, I would imagine (again not being an expert) that I would have criminal or civil liability.

If I own an ice rink, and bullies show up every Saturday, and they become more and more rowdy, and I do nothing, and then one Saturday a child is roughed up on my rink, I would think I might have liability.

Likewise, if I owned and supervised a big discussion site where people became heated and did things that caused harm, or got so worked up that harm might be caused, I believe I would consult legal counsel. I do not know how legal counsel would parse the liability, or what they might recommend to manage whatever liability might be there.

There is a saying, "Anybody can sue anyone at any time for any reason." Some suits are tossed out as frivilous. Others wend their way along with extended legal battles. When a suit happens, the litigator may seek the deeper pockets of anyone he or she can drag into the case. You don't have to be guilty to pay legal fees to prove you are innocent. Sometimes people settle cases out of court simply because they can't risk an expensive legal process with an uncertain outcome.

Even if today there is fuzzy law around the liability of online discussion sites, we may be one high profile incident away from legislation that makes running a discussion site like running a bar where people can get themselves into a state where they may harm themselves or others, with penalties for owners if they let things go too far, resulting in harm.

"Bad cases make bad law." But bad cases seem in the news: Kathy Sierra and Meankids, and that Facebook case where online bullying led to a teenager commiting suicide come to mind. There is a feeling among some voters that people can get hurt on the internet and there should be a law against it. To ward off potentially onerous legal frameworks, self-policing seems a good response. Playing proactive defense is always a good policy, as is designing and staffing and managing with the worst case in mind.

When people feel they have no risk, they tend to be a little cavalier. The risk, I am afraid, will hove over the horizon some dark day, and it would be good to prepared. That is the moral I am drawing for my own site and my own day to day work as moderator.

[Gerry]

Chris, I think you are wrong about the liability of those down the list. It will of course pivot on the specifics which are not available for a hypothetical. The standard if "what a reasonable person would do" can be applied, and particularly those responsible for the site can be liable. At least I wouldn't count on it not being so. I wouldn't want to be sued even if I am right.

Also, most of you are losing sight of the idea that if it comes to calling police and lawyers we have a failure already. Just because your community has and is likely to always remain on the good side of this doesn't mean it is a good idea to downplay the liabilities in this conversation. Could they be sued? Definitely. Could they lose? Who knows. Many of the participants here seem all to eager to test these boundaries.

[phil]

Gerry, I don't think anyone in this discussion really wants to test the boundaries. The thing is that few have considered that there really might be boundaries, or trip wires. We tend to think this is all just talk. "Sticks and stones can break my bones and words can never hurt me." But little by little on the net we are beginning to see that people can get hurt. When hurts happen people want laws to prevent it. "Look what happened! Someone has to pay for this!" That is an all too familiar response to getting hurt. If the law does not provide protection against harms, and clear lines of liability, then new laws will be enacted. Just as with Holden we knew exactly who had the responsibility to supervise, so in the future the lines of accountability between participants in an online community and those who moderate, own, manage and govern that community will be clarified.

I am sure that when the teenager on Facebook committed suicide that the CEO at Facebook was on the line that morning with office of legal counsel and probably with Rupert Murdoch, the owner. I am sure they had their firewalls in place and their fine print, and their legal team warming up, but in the end we none of us know how the litigation and the legislation is going to go in the next couple of years in this evolving area, as we spend more and more of our lives together online, with young and old, strong and weak, stable and unstable. I would guess that the wide open culture of the net will change, and that as legal liabilities become more clear, that we will be a lot more cautious. I prefer it the way it is. Legislation and law suits could chill online speech. Better we chill out ourselves, and use peer influence to keep things down to a dull roar.

[Josh Millard]

But little by little on the net we are beginning to see that people can get hurt. When hurts happen people want laws to prevent it.

Yes, and I see this as the heart of your scenario, one of the really interesting big questions.

Where I look at it, I'm wondering about the likelihood of new laws regarding websites, though, vs. the (perhaps precedent-setting) application of existing laws to cases that happen to involve websites. Hence my original question: what would this hypothetical net-legislation look like? Where is the line drawn between applying existing laws (regarding harrassment, tampering, incitement, etc) and creating new ones specifically for the internet or the web?

I do wish we had a proper law wonk or three in on this.

Phil, you mentioned the idea of a bar and its owner, of liability for a driving drunk who leaves Bar A for Point B. So there's an example where we have, say, state liquor commissions that define and enforce service regulations: to whom and when and how much alcohol you can serve.

In Oregon, at least, our commission (the OLCC) is seen by pretty much anyone who runs (or performs in) a bar as a miserable pain in the ass; and I suppose that's part of the tone of warning in the speculation here: nobody who runs a web community wants to have to deal with some pain in the ass commission, compared with how things behave now.

But then, there's a question of expectation of harm. There's a liquor commission because there's liqour—setting aside arguments about legislating sin, etc, there's the real issue that alcohol is very strongly implicated in unusual rates of bad or dangerous behavior. Drunk driving, assault, alcohol poisoning, etc.

So there's a challenge, I think, in showing the sort of parallel between serving alcohol and hosting conversation: where would the motivation for legislation be comparable, and where would it be incongruent? Are there existing-law examples that better fit the idea of community hosting (and community participation) than a model like bar ownership?

I am sure that when the teenager on Facebook committed suicide that the CEO at Facebook was on the line that morning with office of legal counsel and probably with Rupert Murdoch, the owner.

Mere quibble, but Murdoch owns MySpace, not (unless I missed a recent acquisition) Facebook.

[phil]

Thanks, Josh, I think you are right about Murdoch. I agree too that we need a law wonk to opine. I hope that Jeff Trexler shows up. He is a JD with a Yale Law degree, I believe. Smart guy who as you know also is a member of MeFi.

[Jeff Trexler]

On the flip side, charities need to be sensitive to the dangers of formalism. For the charitable community, the very fact that a board has made a decision is often seen as sufficient proof that proper action has been taken--the law vests governance in the board, the board has acted, QED.

Not everyone sees things this way, however. For many people, what a charity actually does is far more significant than the execution of a process.

The danger of downplaying this is real. If you look at the history of charity law--particularly federal exempt organizations law--time and again legislators have imposed cumbersome new rules because of decisions made by charities that were, at the time, wholly consistent with existing law.

[Jeff Trexler]

Phil, your comment must have summoned me--didn't see it until after I finished writing. As they say, speak of the devil and he shall appear!

[phil]

Glad to see you here, Counselor Trexler. Pro bono, I hope.

[Gerry]

From the apologies thread: Whether online communities have vicarious liability for what is done by members in their name I don't know.

As other have argued here, the off-line cases are likely at least a starting guide. I didn't have the term, vicarious, yes thanks. That's the argument that trumps Chris' assertion that those lower down the list could not be held responsible. How much are you willing to risk on that assurance?

[phil]

"Negligence," "attractive nuisance," "vicarious liability" - who knows how the mesh of existing law or new law will tighten around on-line communities. So far no high profile cases have worked through the courts. Don't you imagine that some soon will? That some incident will provoke it? And isn't the best time to build the levees before the rain starts?

[phil]

It would nice to find a cache of articles or posts by authorities on this topic of the liabilities of those who own or run online communities. Does anyone know of such a resource?

[Dan]

Gerry: So, in terms of the answer to my question, what should happen is... nothing? is it incumbent on you to make it clear that you intend no threat by the statement at the point of making it? If so, how? If you do not do that satisfactorily, are you then responsible for somebody else deciding to take up the cudgels on your behalf and deliver a beatdown to the person he believes to be the target of the threat?

This is tricky stuff, but, as I say, it is tricky stuff for which at least some law already exists. Staying within that law makes very good sense, legally and I would say in most cases ethically. Behaviour can be legal but reprehensible, and the mechanisms for dealing with that, while primarily social, are nonetheless mechanisms. The problem comes when somebody desires that others behave in a particular manner, because otherwise they might in the future be at risk of breaking the law by doing the thing that they are currently not breaking the law by doing. This is a desire wrapped in the weeds of a kind of preemptive legality.

The thing is, this is a trickier business than one might immediately think. Rosa Parks, for example was perfectly within her rights to keep her seat on the Montgomery bus - the rules stated that nobody should have to give up a seat that they had been entitled to sit in, if the bus was crowded and there were no other seats available. However, by refusing to move she was just inviting the bus company to change those rules. From her point of view, though, and the point of view of everyone else who followed that logic, there might as well be a rule against keeping one's seat if one had to vacate it to avoid the creation of a rule mandating that one surrender one's seat.

At this point, if people are genuinely interested in the legal status of the Internet, I would recommend looking at the laws of your country. I can absolutely believe that the same sort of confident innocence that describes a man who was identified and busted for failing to understand how to falsify his identity on the Internet as a "digital native", or that speaks with authority about Facebook despite believing that it is owned by Rupert Murdoch, might also think of the Internet as a wild and chaotic place, but it really isn't. Simply put, things are regulated, and not only by law, but by terms and conditions, agreements with ISPs, social structures and, ultimately, by the awareness of most reasonably savvy users that it is not hard for a faceless individual with a pervasive presence to be identified.

Ultimately, though, it is not people being mean to people that is the greater harm of the Internet. I imagine that credit card scams, 419 fraud, fake medicine, malicious hacking of military and civil computer networks, child pornography and money laundering will probably remain more important in the eyes of the law than who called whom gay on 4chan for some time to come.

Somebody calling somebody else an idiot on the web, as Gerry did on this very site a little earlier, is as simple abuse not a legal issue, although it may well be a social betise. Somebody deciding that they should seek to disrupt said idiot's virtual property, and the property of others, with a DDoS attack is a legal issue. However, between the writer of the software, the provider of the Internet connection and the perpetrator of the assault, there is probably enough legal culpability to go around before looking at people who simply agreed with the verdict of idiocy.

[phil]

Thanks, Dan, yes, I could use a primer or a link to existing law on the topic of liabilities of online community owners and managers. I don't present myself as an authority, just asking questions around hypotheticals to see if others have answers.

[phil]

On the tact filter thing, let's all try not to get each other riled up. Maybe apply tact filters on both outgoing and incoming communications? Try to keep the signal to noise ratio high?

[Jeff Trexler]

In a nutshell, the key rule here is Section 230 of the Communications Decency Act of 1996, which effectively immunizes an online content provider from liability in a defamation claim.

[Gerry]

Interesting, Jeff. Does that imply that without the specific law immunizing content providers the kind of liability discussed above could apply?

[phil]

Jeff, thanks. I was familiar with that general concept of online defamation and its treatment. Without offering legal advice or counsel, do you think that there is any possible vicarious liability for a community whose members engage in real world harms? Who discuss those potential harms in the community and are not rebuked? If there were a pattern of such? Make up your own examples of real world harm going beyond just talk. Are there things you would flag for an online community leader or owner or moderator as high risk things to be monitored and squelched?

[Jeff Trexler]

Yes (referring specifically to the liability of, say, a message board administrator or blogger who allows third-party comments). This immunity was enacted after a court held Prodigy liable for material posted on it. Section 230 expressly preempts state law that would otherwise contradict it.

NB, though, that the original author of the comment may still be held liable.

For more, check out this overview from the Berkman Center and this FAQ from EFF.

[Jeff Trexler]

Phil, there's recently been a book published by a law professor on this issue: Daniel Solove's "The Future of Reputation: Gossip, Rumor and Privacy on the Internet." You can get the flava of it here. He shares many of the concerns raised in this thread & suggests ways to deal with the problems without severely burdening free speech.

[Dan]

Well, as far as my very limited legal understanding goes, over here in the UK we do not have anything too closely resembling that codicil to the CDA, and an ISP can theoretically be held responsible for the content on its servers - the Defamation Act 1996 was used by a plaintiff to prosecute an ISP for libel for failing to remove a defamatory post.

This, however, is the ISP rather than a peer of the offender. The culpability of anybody simply in the same virtual room as the defamatory statement - even those who might have reacted as if the defamatory statement were true - would be, I think rightly, impossible to demonstrate. Arguably one might be able to use this provision against the moderator or owner of a bulletin board, but I think a judge might ask you if you did why you had not instead made representation to the ISP managing the service.

The Computer Misuse Act 1990 would be the relevant provision for a DDoD attack, which would come under seeking to impair the function of a computer:

a) to impair the operation of any computer;
b) to prevent or hinder access to any program or data held in any computer; or
c) to impair the operation of any such program or the reliability of any such data.

I suspect that attempting to prosecute the members of a message board for the actions of one member would probably not be practicable, because, unless actually doing harm, they would have little harm to do. At best you might hope for them to be found accessories - but accessories to what? They have not provided an Internet connection, or a program. A person who agrees in the pub that chap A is deserving of a good kicking by chap B is rarely hauled in as an accessory when chap B gives chap A such a kicking a week later in a different location. So, I think that it would be difficult to prove an accessory status. To my knowledge, such a thing has never been proven, but my knowledge is little and dated.

[Jeff Trexler]

Interesting re the UK. IIRC, there was a recent US law journal essay calling on the UK & other common-law countries to model on a more nuanced approach.

Re the Megan Meier/Myspace case, if you haven't heard already, the US attorney in Los Angeles is said to be seeking an indictment predicated on a fraud claim. No guarantee it'll work, but there we are.

Another tactic for dealing with overzealous "norm police"--cyberstalking statutes.

[phil]

Wow, Jeff, that is very helpful. Posted your links on the main page. Thank you very much. The links shed a flood of light on much that we have discussed.

[Hastily Construed Nincompoop]

For a hastily contrived example: take fifty KKKers (the Ku Klux Klan is a fraternal organization dedicated to the preservation of certain civil traditions and economic arrangements), out for a dinner banquet, strolling all a-hooded; they come across a man posting a bill advocating the right to vote without paying a poll tax, and a conversation about the contents of the bill crops up. A few of the KKKers object to the message, the man posting it objects back.

Tempers heat up; one of the KKKers declares, finally: "Nobodaddy, I'm inclined to punch you in the nose. Don't think I won't do it."

The rest of the KKKers react: with mutters; laughter, both nervous and raucous; rebukes against the threat of violence or against the uncharitable interpretation of the bill-poster's intent; casual encouragement that a punch in the nose wouldn't be unjust. One or two of them declare more firmly that in fact it'd be just the thing. Among them, an elder agrees with the rebukers, but does not physically wrestle the pugilist to the ground.

The nose is punched.

How does existing law approach that? Who is culpable, and how, and what legal actions could the bill poster reasonably expect to pursue? And how does that situation differ from one where the punch is an electronic attack, the discussion in comments rather than words, the supervisor an administrator rather than a Grand Dragon?

[Josh Millard]

This is some of that keen satire, I guess. Hats off to you, random unidentified person, for elevatin' the level of discourse.

[Gerry]

Gerry: So, in terms of the answer to my question, what should happen is... nothing? is it incumbent on you to make it clear that you intend no threat by the statement at the point of making it? If so, how? If you do not do that satisfactorily, are you then responsible for somebody else deciding to take up the cudgels on your behalf and deliver a beatdown to the person he believes to be the target of the threat?

Sorry, I misunderstood the question as a suggestion that I had made a threat. I don't think we are responsible for every way a person might misconstrue what we say or write. As a pragmatic strategy, I would do what I did here and clarify the difference between a threat and indicating ones willingness to defend oneself if attacked. I'm willing to take the chance that this will make me a lightning rod for someone primed to go off, but I'd rather have them go off on me than someone not prepared for the rough and tumble of it.

In the context of this discussion, I realize this strategy could get me entangled in a controversy. I hope not, my unspoken motto on-line has always been, "Try not to say anything too stupid." I've always thought that applying common sense will keep you out of trouble except for the case that trouble comes looking for you. If that happens, I want friends around me to put a charitable spin on my words and legacy. (And to consult on cyber-defensive tactics and strategies.)