Technology and constitutional rights intersect in ways that challenge traditional expectations of the security of government and corporate secrets. Networks allow "smart mobs" of individuals to share information in ways that are fast, cheap and out of control. Those with an agenda can today extract and publish institutional secrets in ways that may be hard to detect, let alone remedy with money damages or sanctions.
Q: Where should government and business look for protection? Tighter information security? Tough criminal laws and prosecutions? Prayer?
Q: What is the future of institutional secrets? (More ... )
The Pentagon Papers
In 1971, someone leaked to the New York Times the "Pentagon Papers," a top-secret DOD study critical of the United States involvement in Vietnam. The Times began publishing articles based on the contents, but the United States sued to block any further publication of the Top Secret material. The case quickly reached the Supreme Court, which decided that the damage to national security from publication did not outweigh the damage to the freedom of the press from prior restraint. The Court's ruling is a landmark decision on the balance between secrecy and free press. New York Times Co. v. United States, 403 U.S. 713 (1971)
The nine separate opinions (6 to 3 in favor of the defendants) left open the possibility of criminal prosecution of the Times and the Post after publication, but found insufficient basis for prior restraint. Of the majority, two maintained that the First Amendment provided no room for any prior restraint of the press. The other four conceded that prior restraint could be justified in proper cases, some noting as exceptions publication of troop movements in time of war, prohibitions of obscenity, and restraints on publication of material in violation of copyright, which protects the form of expression rather than the ideas expressed. Ibid. Members of the Court have since written about the importance of the Pentagon Papers to a matter of significant public debate as an essential element in the outcome. Bartnicki v. Vopper, 532 U.S. 514 (2001).
The Cigarette Papers
In 1994, thousands of pages of internal documents previously kept secret by Brown & Williamson Tobacco Corporation were anonymously delivered to the University of California, San Francisco (UCSF) with portions also sent to Congressman Henry Waxman and the New York Times. In a related case, District Court Judge Harold Greene characterized the documents as possible evidence "supporting a 'whistle-blower's' claim that the tobacco company concealed from its customers and the American public the truth regarding the health hazards of tobacco products." Maddox v Williams 855 F.Supp. 406, at 414, 415 (D.D.C. 1994).
The university library added the papers to its tobacco industry archives, made them available to the public and prepared to publish scanned copies electronically. They quickly became a popular source for anti-tobacco litigators and activists, through whom B&W learned of UCSF's collection in January 1995. B&W demanded that UCSF return the documents, deny public access and disclose the names of all who had seen them, and sued when UCSF refused.
The California Superior Court allowed UCSF to keep the documents and publish them. In its opinion, it emphasized the lack of evidence that UCSF was involved in any wrongful taking of the documents, the fact that they were not being introduced into evidence against B&W, the strong public interest in the documents' relevance to public health issues, and the futility of action against UCSF when the documents were widely available elsewhere. The California Supreme Court let the decision stand and on June 30, 1995, the University began publishing the documents on the Web. A year later, both a hard-bound and an online analysis of the collection was published by University of California Press.
The DeCSS Algorithm
In 1999, "DVD Jon" Johanson, a Norwegian, reverse-engineered the proprietary technology inside the Content Scrambling System (CSS) used by the DVD Content Control Association (DVDCCA) to protect commercial DVDs from unauthorized copying. He wrote an algorithm that enabled unscrambling of the disks, and called it "DeCSS." He posted it on the Web and copies spread rapidly. When it learned about DeCSS, the DVDCCA demanded that operators of websites where it appeared take it down and sued those that refused, including Andrew Bunner.
In California, the Superior Court hearing the case against Bunner found that DVDCCA had a likely case for Bunner's violation of California's trade secret act (a version of the Uniform Trade Secrets Act or "UTSA"). The Court entered a preliminary injunction against Bunner using or disclosing DeCSS or linking to sites that disclosed it. The Court of Appeals found that DeCSS was "pure speech" and overturned the injunction as a First Amendment violation. In August of 2003, the California Supreme Court reversed the appellate decision and sent the case back for further proceedings.
The California high court agreed that DeCSS qualified as speech protected by the First Amendment, but ruled that an injunction could be justified by an actual trade secrets act violation. They balanced the governmental interests served by the trade secrets act against the magnitude of the speech restriction that would result from an injunction. They found that publishing the DeCSS code was not necessary to debate on a matter of substantial public interest such as that which characterized the 2001 decision in Bartnicki v. Vopper, 532 U.S. 514 (2001).
Justice Moreno, in his concurring opinion, agreed that an injunction could be justified in a proper protected speech case, but maintained that this was not one of them. He argued that the record was clear that DVDCCA had no case against Bunner because DeCSS was so widely disseminated that it was no longer actually "secret." As a result, he wrote, it was not protected by the trade secrets act, making an injunction an unlawful prior restraint on speech.
The case was sent back to the Superior Court for further consideration of the merits of the claim that the CSS technology is a protected secret and that Bunner's publication of DeCSS violated the trade secrets act. DVD Copy Control Association, Inc. v. Bunner, 31 Cal. 4th 864 (2003). The DeCSS code continues to be widely available on the Internet at international locations easily discoverable through use of a common search engine.
In December, a Norwegian appeals court affirmed the acquital of "DVD Jon" Johanson on criminal charges of breaking the CSS copy protection on DVDs he bought. The charges were brought by the Norwegian Economic Crime Unit (ØKOKRIM) under Norwegian Criminal Code 145(2), upon the complaint of DVDCCA and the Motion Picture Association of America (MPAA). The Norwegian court ruled that his action was legal under Norwegian law. An earlier acquittal had been appealed by the government. See "Legal victory for 'DVD hacker," BBC News 12/22/03, and " and "DVD-Jon" Defeats Hollywood: Consumer Rights Upheld in Norway," IP Justice.
The E-Voting E-Mails
In August of 2003, electronic copies of thousands of internal e-mail messages between employees and contractors of Diebold, Inc. were posted on a publicly accessible website. The e-mails indicated Diebold had knowledge of security flaws and regulatory violations involving its electronic voting software widely used by state and local governments. News of the material spread, and other websites hyperlinked to the compilation, including student websites hosted on university computers.
When Diebold learned of the material, its lawyers issued "takedown" notices to ISPs that were hosting the material or sites linking to it, triggering the "safe harbor" provisions of 17 U.S.C. §512, the Digital Millenium Copyright Act (DMCA). Universities responded by directing students to take down the material and links, and cut off Internet access of students who failed to comply. Rather than filing the counter-notifications provided for in the DMCA, students moved the files to other sites and urged others to copy the files and "mirror" the archive on multiple hosts elsewhere, which many did. At Swarthmore, an activist group's website tracked the efforts of Diebold, the reactions of universities and students, and the spread of mirror sites throughout the Internet.
The national media picked up the story in October, widely publicizing the existence of the documents and Diebold's attempts to discourage their publication. In November, the website of Congressman Denis Kucinich posted excerpts from the material, adding a public scolding of Diebold and a call for a Congressional investigation into its actions.
Online Policy Group (OPG), an ISP to which Diebold sent a takedown notice, filed a federal lawsuit to enjoin Diebold from further efforts to discourage publication. OPG got legal represetation from the Electronic Frontier Foundation (EFF) and the Center for Internet and Society Cyberlaw Clinic at Stanford Law School. In a November 17 procedural hearing on a motion for a preliminary injunction, the District Court judge's questions focused on the public interest in information about voting systems and First Amendment issues raised by the controversy.
Diebold seemed to realize that the harder it pushed, the more adverse publicity it got and the further the information spread. On November 24, it advised the District Court that it would not sue those hosting copies of the materials for copyright infringement and was withdrawing its DMCA notices, as an indication of its commitment to an open discussion of "helping America vote better."
http://www.eff.org/Legal/ISP_liability/OPG_v_Diebold/DieboldResponse.pdf.
_____________
Some sources:
The Pentagon Papers
The Cigarette Papers
The DeCSS Algorithm
The E-Voting E-Mails