Madonna's borderline MP3 tactics

Deceptive trade practice

The material girl's foul-mouthed revenge on music traders could be interpreted as a deceptive trade practice, or even outright fraud, says Mark Rasch, SecurityFocus columnist.

Virginia's new anti-spam law makes it a criminal offense to send e-mail with inaccurate and deceptive source or header information. The new PROTECT Act signed by President Bush similarly makes it a federal offense for online pornographers to obtain or use misleading domain names to induce individuals to surf unwittingly to porn sites. At the same time, the U.S. Federal Trade Commission filed a series of civil complaints against "porn-spammers" alleging that spoofed source information and misleading subject lines constitutes a deceptive trade practice.

Can this mean that Madonna goes to jail?

The recording industry won and lost in a series of cases in late April. In separate decisions, they won the ability to subpoena the names of p2p users from Verizon's online services, but they lost the ability (at least for now) to pursue direct or contributory infringement lawsuits against the distributors of p2p software.

One method of "self-help" employed by the record and motion picture companies is to attempt to flood the p2p networks with bogus material -- files that are labeled as, and appear to be, genuine copyrighted work (they are the correct format and file size), but contain either no data, or, in the case of Louise Veronica Ciccone (a/k/a "Madonna"), contain a voice file asking, "What the f*ck do you think you are doing?"

One response of the p2p users has been to hack back -- defacing the RIAA website, or hacking Madonna's webpage and inserting copies of her own music for download. Another is to use IP filtering to block p2p downloads from known RIAA or MPAA sites.

Here's how it would work: The FTC's theory of liability in the "porn-spammer" cases is that the header information or subject line of a mass e-mail is deceptive or fraudulent, and is intended to induce the recipient to open the file, and thereby see the advertisement that they would not otherwise have seen. The FTC does not -- at least not in these complaints -- allege that the underlying advertisement itself is false or deceptive; just the descriptions.

Similarly, the PROTECT act makes it a federal crime to use a misleading domain name to trick people into viewing obscene materials or to trick children into viewing materials that are "harmful to minors."

The message from these laws (and various anti-spam laws across the country) appears to be that using fictitious headers, names, or descriptions in interstate or foreign commerce in order to induce someone to act is an offense -- either a crime or, at a minimum, a "deceptive trade practice."

This may be bad news for those who post fake files on Kazaa.

Unclean Hands
The FTC has general authority over false or misleading advertisements, derived from Title 15 USC Section 45(a)(1), which says that "... [u]nfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." This grant of jurisdiction is remarkably broad, and is limited only to a showing that the act or practice is "deceptive" and is either "in commerce" or "affects commerce" -- not that the act itself be commercial.

While Congress has limited the FTC's jurisdiction in areas that come under the regulation of other agencies (e.g., FCC, DOJ) its powers to act are unquestionably broad. The FTC has used this grant of authority to punish companies that do not adhere to their own stated privacy policies, that engage in mislabeling of goods or services, and to go after people who engage in "pretext calling" -- pretending to be someone other than who they are to get people's financial or medical information.

In other words, the FTC has general jurisdiction over fraud, false statements, fraudulent pretexts, hucksters, con-artists, and most things deceptive. If it smells bad (and isn't delegated to another agency) and affects commerce, it probably violates the FTC Act.

The actions of RIAA and MPAA in placing files on p2p networks to deceive users of those networks into thinking they're actual music or video files, to waste their time, resources, energy and bandwidth (not to mention hard drive space and CPU cycles) quite likely is "deceptive" and undoubtedly "affects commerce."

Foul!, you shout. Why should downloaders, freeloaders, pirates and copyright felons be entitled to the protection of the law? Druggies who buy talcum powder from undercover cops can't sue the police because they were "deceived," can they? What about the legal doctrine of "unclean hands" -- you can't complain about somebody else's wrongdoing if you are engaged in wrongdoing yourself?

In fact, law, policy and tradition have all held that law enforcement agencies are entitled to use trickery in connection with criminal investigations. But there is no such body of case law with respect to copyright holders.

Moreover, there is nothing in the FTC Act that says "deceptive trade practices" are permitted if done for a good reason, or against people we don't like.

Imagine if a person was in midtown Manhattan selling what you assumed were pirated DVD's -- say X-Men 2. You plunk down your $5 (such a deal) and voila! -- a blank CD-ROM.

The seller would be liable for fraud or deception -- even though you thought you were purchasing a pirated disc.

What about the idea that the record and film companies aren't "selling" the fakes, but just putting them up for free? For FTC jurisdictional purposes, it makes no difference -- it's still deceptive, and it still affects commerce. The FTC Act doesn't even require proof of damages, though if it did, computer crime laws have already established that waste of computer time, hard drive space, memory, processor time, network resources or user time are all cognizable "losses."

Sadly, the FTC Act does not provide for individual remedies: a victim of the material girl's foul-mouthed trickery could only file a complaint with the FTC and try to get them to go after her. This is not a very likely prospect. But many states do have their own consumer protection statutes that allow victims to sue individually for deceptive or fraudulent trade practices, so it's not inconceivable that someday the recording industry might find itself on the wrong end of a p2p lawsuit -- maybe even from one of the Verizon customers the RIAA is attempting to identify.

©

Mark D. Rasch, J.D., is a former head of the Justice Department's computer crime unit, and now serves as Senior Vice President and Chief Security Counsel at Solutionary Inc.