Back to School, Back to MySpace (Part I)

AGs: Gunslingers or Mudslingers?
MySpace: Yellow-bellied or Duty-bound?

State Attorneys General take their obligations seriously. AGs from eight states (Pennsylvania, Connecticut, Georgia, Idaho, Mississippi, New Hampshire, North Carolina and Ohio) all communicated their intentions to MySpace back in May when MySpace kicked thousands of known sex offenders off their site. Credit goes to MySpace for taking the initiative, but many AGs are not satisfied that the social-networking giant is doing enough.

Many AGs are doing more on their own. AGs in Connecticut and North Carolina want to require parents' permission before a child signs up.

From AGs aim to make MySpace a safe space, Daniel C. Vock cites Connecticut AG Richard Blumenthal:

“Failing to verify ages means that children are exposed to sexual predators who may be older men lying to seem younger. There is no excuse in technology or cost for refusing age verification...”

Hemanshu Nigam, MySpace chief security officer, is looking for air cover, and rightly so. MySpace privacy policy requires that MySpace exercise care in what user information they release, and to whom. Caught between a rock and a hard place, MySpace struggles (perhaps in a trap of their own making) to balance their responsiveness to law enforcement with obligations to their user-base.

A key part of the problem is that the AG's don't have the right tools for the job. So they often resort to grandstanding and eye-gouging to get their way. Mark Rasch's Your Space, My Space, Everybody's Space illuminates the apparently bizarre behavior of the AGs in their search for justice. The AGs heard about the purge of sex-offenders, and asked MySpace for the list. MySpace said, "Sure, but we need a subpoena…". And the mud started to fly:

When MySpace insisted on some legal process to provide subscriber or identity information about people they had already kicked off the service, the Attorney Generals cried foul and went to the press.

The AG's lambasted MySpace in the media, accusing them of protecting child molestors, abusing their public trust, and refusing to cooperate. But that's just not fair. MySpace was simply trying to act according to governing law, which forbids them from releasing information about subscribers. Rasch goes on to note how:

in the case of Freedman v. Am. Online, Inc., 325 F. Supp. 2d 638 (D. Va. 2004) AOL was successfully sued for giving out subscriber information without an effective warrant... In another case, United States v. Hambrick, 55 F. Supp. 2d 504 (D. Va. 1999), the Court refused to suppress the subscriber information delivered to the cops when a Justice of the Peace... signed off on an invalid warrant. In both Freedman and Hambrick, the ISP gave subscriber data to the cops without an effective warrant, and in both cases the courts found that the ISP could be held civilly liable for it.

Civil liability for cooperating with Law Enforcement. It's a tough problem, especially when the Electronic Communications Privacy Act limits the legal authority of a person or entity providing an electronic communication service to the public to disclose user information to government authorities.

There is no villain in this story. In reality, any effort to fix this problem requires thoughtful involvement from a team of key stakeholders. MySpace's Nigam is calling for laws that require sex offenders to register their e-mail addresses, so MySpace can keep them off the site in the first place. That's just a drop in the bucket. We need a wholesale examination of relevant law, and a smart, dedicated group of technologists, constitutionalists, privacy lawyers, and community advocates to even have a chance of taking on this problem.

Not an easy task, but a worthy one.

Next: What else are those AG's up to?