Virtual Legality: An Overview of Your Rights and Responsibilities in Cyberspace
Steven J. McDonald, former Associate Legal Counsel
The Ohio State University
The Internet is a powerful and revolutionary tool for communication - powerful in its ability to reach a global audience and revolutionary in its accessibility to those who formerly were only at the receiving end of mass communications. With access to the Internet, anyone - even a preschool child - can now effectively be an international publisher and broadcaster. By posting to Usenet or establishing a web page, for example, an Internet user can speak to a larger and wider audience than does the New York Times, NBC, or National Public Radio. Many Internet users, however, do not realize that that is what they are doing.
Not surprisingly, given these facts, the Internet also has a powerful and revolutionary potential for misuse. Such misuse is particularly prevalent on college and university campuses, where free access to computing resources is often mistakenly thought to be the equivalent of free speech, and where free speech rights are in turn often mistakenly thought to include the right to do whatever is technically possible.
The rights of academic freedom and freedom of expression do apply to the use of university computing resources. So, too, however, do the responsibilities and limitations associated with those rights. Thus, legitimate use of university computing resources does not extend to whatever is technically possible. In addition, while some restrictions are built into the university's computer operating systems and networks, those restrictions are not the only restrictions on what is permissible. Users of university computing resources must abide by all applicable restrictions, whether or not they are built into the operating system or network and whether or not they can be circumvented by technical means. Moreover, it is not the responsibility of the university to prevent computer users from exceeding those restrictions; rather, it is the computer user's responsibility to know and comply with them. When you're pulled over to the side of the Information Superhighway, "I'm sorry officer - I didn't realize I was over the speed limit" is not a valid defense.
So just what are the applicable restrictions? The same laws and policies that apply in every other context. "Cyberspace" is not a separate legal jurisdiction, and it is not exempt from the normal requirements of legal and ethical behavior within the university community. A good rule of thumb to keep in mind is that conduct that would be illegal or a violation of university policy in the "offline" world will still be illegal or a violation of university policy when it occurs online. Remember, too, that the online world is not limited to The Ohio State University, to the State of Ohio, or even to the United States.
Computer users who engage in electronic communications with persons in other states or countries or on other systems or networks may also be subject to the laws of those other states and countries and the rules and policies of those other systems and networks.
It is impossible to list and describe every law and policy that applies to the use of university computing resources and the Internet - since, by and large, they all do - but the following are some of the ones that most frequently cause problems:
Copyright law generally gives authors, artists, composers, and other such creators the exclusive right to copy, distribute, modify, and display their works or to authorize other people to do so. Moreover, their works are protected by copyright law from the very moment that they are created - regardless of whether they are registered with the Copyright Office and regardless of whether they are marked with a copyright notice or symbol (©). That means that virtually every e-mail message, Usenet posting, web page, or other computer work you have ever created - or seen - is copyrighted. That also means that, if you are not the copyright owner of a particular e-mail message, Usenet posting, web page, or other computer work, you may not copy, distribute, modify, or display it unless:
- Its copyright owner has given you permission to do so; or
- It is in the "public domain"; or
- Doing so would constitute "fair use"; or
- You have an "implied license" to do so.
If none of these exceptions applies, your use of the work constitutes copyright infringement, and you could be liable for as much as $100,000 in damages for each use. In addition, if you reproduce or distribute copies of a copyrighted work having a total retail value of at least $1,000 (which could include, for example, posting a $50 software program on a web page or newsgroup from which it is downloaded 20 times), your actions may also be criminal - even if you do it for free.
It's usually easy to tell whether you have permission to make a particular use of a work - the copyright owner will have told you so expressly, either in writing or orally - but it's not always so easy to tell whether the work is in the public domain or whether what you want to do constitutes fair use or is covered by an implied license.
Placing a work on the Internet is not the same thing as granting that work to the public domain. Generally speaking, a work found on the Internet, like a work found anywhere else, is in the public domain only if (a) its creator has expressly disclaimed any copyright interest in the work, or (b) it was created by the federal government, or (c) it is very old. Unfortunately, just how old a particular work must be to be in the public domain depends in part upon when the work was created, in part upon whether and when it was formally published, in part upon whether and when its creator died, and in part on still other factors, so there is no one specific cutoff date that you can use for all works to determine whether or not they are in the public domain. As a rule of thumb, however, works that were created and published before 1923 are now in the public domain. Works that were created in or after 1923, works that were created before 1923 but published in or after 1923, and works that have never been published might be in the public domain, but, if you don't know for sure, it's best to assume that they are not.
In very general terms, a particular use of a work is "fair" if it involves only a relatively small portion of the work, is for educational or other noncommercial purposes, and is unlikely to interfere with the copyright owner's ability to market the original work. A classic example is quoting a few sentences or paragraphs of a book in a class paper. Other uses may also be fair, but it is almost never fair to use an entire work, and it is not enough that you aren't charging anyone for your particular use. It also is not enough simply to cite your source (though it may be plagiarism if you don't).
An implied license may exist if the copyright owner has acted in such a way that it is reasonable for you to assume that you may make a particular use. For example, if you are the moderator of a mailing list and someone sends you a message for that list, it's reasonable to assume that you may post the message to the list, even if its author didn't expressly say that you may do so. The copyright owner can always "revoke" an implied license, however, simply by saying that further use is prohibited.
In addition, facts and ideas cannot be copyrighted. Copyright law protects only the expression of the creator's idea - the specific words or notes or brushstrokes or computer code that the creator used "” and not the underlying idea itself. Thus, for example, it is not copyright infringement to state in a history paper that the Declaration of Independence was actually signed on August 2, 1776, or to argue in an English paper that Francis Bacon is the real author of Shakespeare's plays, even though someone else has already done so, as long as you use your own words. (Again, however, if you don't cite your sources, it may still be plagiarism even if you paraphrase.)
Exactly how copyright law applies to the Internet is still not entirely clear, but there are some rules of thumb:
- You may look at another person's web page, even though your computer makes a temporary copy when you do so, but you may not redistribute it or incorporate it into your own web page without permission, except as fair use may allow.
- You probably may quote all or part of another person's Usenet or listserv message in your response to that message, unless the original message says that copying is prohibited.
- You probably may not copy and redistribute a private e-mail message you have received without the author's permission, except as fair use may allow.
- You probably may print out a single copy of a web page or of a Usenet, listserv, or private e-mail message for your own, personal, noncommercial use.
- You may not post another person's book, article, graphic, image, music, or other such material on your web page or use them in your Usenet, listserv, or private e-mail messages without permission, except as fair use may allow.
- You may not download materials from Lexis-Nexis, the Clarinet news service, or other such services and copy or redistribute them without permission, unless the applicable license agreement expressly permits you to do so or unless your particular use would constitute fair use.
- You may not copy or redistribute software without permission, unless the applicable license agreement expressly permits you to do so.
Libel is the "publication" of a false statement of fact that harms another person's reputation "” for example, saying that "John beat up his roommate" or "Mary is a thief" if it isn't true. If a statement doesn't harm the other person's reputation - for example, "Joe got an 'A'on the test" - it's not libel even if it's false. In addition, a statement of pure opinion cannot be libelous - for example, "I don't like John" - but you can't turn a statement of fact into an opinion simply by adding "I think" or "in my opinion" to it. "IMHO, John beat up his roommate" is still libelous if John didn't beat up his roommate. If you honestly believed that what you said was true, however, you might not be liable if it later turns out that you were wrong.
A libel is "published" whenever it is communicated to a third person. In other words, if you say "Mary is a thief" to anyone other than Mary, you have "published" that libel. That means that almost anything you post or send on the Internet, except an e-mail that you send only to the person about whom you are talking, is "published" for purposes of libel law.
A person who has been libeled can sue for whatever damages are caused by the publication of the libel. Since a libel on the Internet could potentially reach millions of people, the damages could be quite large.
A good rule of thumb to follow: If you would be upset if someone else made the same statement about you, think carefully before you send or post that statement to the Internet, because it might be libelous.
There are a number of different laws that protect the "right to privacy" in a number of different ways. For example, under the Electronic Communications Privacy Act, a federal statute, it generally is a crime to intercept someone else's private e-mail message or to look into someone else's private computer account without appropriate authorization. The fact that you may have the technical ability to do so, or that the other person may not have properly safeguarded his or her account, does not mean that you have authorization. If you don't know for sure whether you have authorization, you probably don't.
Invasion of privacy, like libel, is also a "tort", which means that you can also be sued for monetary damages. In addition to the sorts of things prohibited by the Electronic Communications Privacy Act, it can be an invasion of privacy to disclose intensely personal information about another person that that person has chosen not to make public and that the public has no legitimate need or reason to know - for example, the fact that someone has AIDS, if he or she has not revealed that information publicly. Unlike with libel, a statement can be an invasion of privacy even if it is true.
Under both state and federal law, it is a crime to publish, sell, distribute, display, or, in some cases, merely to possess obscene materials or child pornography. These laws also apply equally to the Internet, and a number of people have been prosecuted and convicted for violating them in that context.
The line between what is obscene and what is not is hard to draw with any precision - as one Supreme Court Justice said, "I could never succeed in intelligibly" defining obscenity, "[b]ut I know it when I see it" - but the term basically means hard-core pornography that has no literary, artistic, political, or other socially redeeming value. One reason that it is so hard to define obscenity is that it depends in part on local community standards; what is considered obscene in one community may not be considered obscene in another. That makes it particularly difficult to determine whether materials on the Internet are obscene, since such materials are, in a sense, everywhere, and it is therefore not enough that the materials are legal wherever you are. In one case, the operators of a bulletin board service in California posted materials that were not considered obscene there, but were convicted of violating the obscenity statutes in Tennessee when the materials were downloaded there.
Child pornography is the visual depiction of minors engaged in sexually explicit activity. Unlike obscenity, child pornography is illegal regardless of whether it has any literary, artistic, political, or other socially redeeming value.
Sexually oriented materials that do not constitute either obscenity or child pornography generally are legal. Still, it is illegal in most cases to provide such materials to minors, and displaying or sending such materials to people who do not wish to see them may be a violation of the university's Sexual Harassment Policy.
Under the federal Computer Fraud and Abuse Act, and under a variety of similar other state and federal statutes, it can also be a crime to access or use a computer without authorization, to alter data in a computer without authorization, to transmit computer viruses and "worms" over computer networks, to conduct "e-mail bombing", and to engage in other such activities. Engaging in such activities can also make you liable for monetary damages to any person who is harmed by your activities. Again, the fact that you may have the technical ability to do any of these things, or that another computer owner may not have properly safeguarded his or her computer, does not mean that you have authorization. If you don't know for sure whether you have authorization, you probably don't.
Use of university computing resources is also subject to the university's Code of Student Conduct, the university's Policy on Academic Misconduct, the university's Sexual Harassment Policy, and all other generally applicable university policies. In addition, the following prohibitions apply specifically to the use of university computing resources:
- University computer accounts and passwords may not, under any circumstances, be shared with, or used by, persons other than those to whom they have been assigned by the university - even family and friends. Users are responsible for all use of their accounts.
- Users must limit their use of university computing resources so as not to consume an unreasonable amount of those resources or to interfere with the activity of other users.
- University computing resources are intended for university-related use and therefore may not be used for personal commercial or business purposes or for other personal gain. Personal use of university computing resources for other purposes will generally be permitted when it does not consume a significant amount of those resources, does not interfere with the performance of the user's job or other university responsibilities, and is otherwise in compliance with university policies.
- Users of university computing resources may not state or imply that they are speaking on behalf of the university and may not use university trademarks and logos in connection with their use of those resources without specific authorization to do so.
For Further Information
If you have questions about the legality of your use of university computing resources, it's best to ask before proceeding. You can get general advice (but not specific legal advice) from your UVC advisor, from any of the computer lab site managers, or from the IT Service Desk (614-688-4357) or firstname.lastname@example.org.
In addition, you can find more information on these and related topics at the following web sites:
Cyberspace Law for Non-Lawyers, which is located at: www.teachingcopyright.org
10 Big Myths About Copyright Explained, which is located at: www.templetons.com/brad/copymyths.html
Soundbyting: Music on the Internet, which is located at: www.musicunited.org
- Policy on Responsible Use of University Computing Resources
- Frequently Asked Questions about the Policy on Responsible Use of University Computing Resources