Although the laws are supposed to say that ISPs are not responsible for policing users, many ISPs still find themselves caught between customers and law enforcement.

by Alex Goldman ISP-Planet Managing Editor [November 29, 2005]

It was an early morning session at ISPCON, but the room was packed. There's plenty of legal changes and proposed legislation to learn about, so The 10 Biggest Policy Issues Facing Your Business and What to Do About Them was a real draw.

Panelists Jason Talley, CEO of Overland Park, Kan.-based Nuvio, the VoIP provider lobbying actively to influence the FCC; Kris Twomey, CLEC lawyer and principal of the Law Offices of Kris Twomey (LOKT), based in Washington, D.C. and San Francisco; and Washington, D.C.-based e-commerce and copyright lawyer David Snead each spoke to their area of expertise.

Porn
"I thought that when Ashcroft left, the crackdown on pornography would end, but Gonzales has actually strengthened it," said Snead.

The Attorney General wants a law requiring everyone touching a pornographic image to know the model's age. Snead's suggestion to ISPs is quite simple: "get to know your FBI agent before your FBI agent visits you."

As to due process, Snead said that ISPs are caught in the middle, in an area where ISPs should be protected. "We're seeing an increase in the number of subpoenas and warrants, and we're also seeing an increase in the number of lawsuits by individuals, such as those erroneously fingered by ISPs." (See, for example, the Reuters story Comcast Sued for Disclosing Customer Information.)

Snead said that one Comcast customer's door was broken down and was interrogated for five hours—due to a typing error. "The plaintiffs are likely to win a substantial amount," Snead said.

Again, his advice was good and simple: "ensure that your employees who review subpoenas know what they're doing."

One attendee had a fascinating question. "I've got a school district on NAT behind 1 IP address. If I got a subpoena, I could not tell which of the 300 users behind that firewall were implicated."

Snead advised, "my advice to my clients is always that you should think about this before the FBI knocks on your door. Go talk to them. Then you may be able to stop some of the egregious requests we're seeing, like a request for an entire server when they're really only interested in information about one of the websites on that server."

Privacy
Privacy is an important and thorny problem for ISPs. It's why Verizon fought back against the RIAA (see, for example, Verizon, RIAA Trade Jabs at Senate Hearing).

"The issue right now is that your privacy policy is a contract with your customer," said Snead. "Don't let the marketing department write your privacy policy to say, 'we never give out your personal information' if your billing system is designed to do that automatically."

There are also issues with regard to employee confidentiality. Snead said, "you need to say what you do, and to do what you say you do. And don't forget to protect yourself against bad actors within your company."

Snead said his advice differs depending on what state you operate in. "Last year, I would have told you not to have a privacy policy. This year, I think you should have one, especially if you're in California, Oregon, or Utah."

Snead reiterated his advice about having the privacy policy written by lawyers, not marketers. "Both privacy policies involved in FTC actions were written by the marketing department."

— End

 

1. ISPCON Policy Panel: The Government and the Wires

2. ISPCON Policy Panel: The FCC and WISPs

3. ISPCON Policy Panel: VoIP and that Duck

4. ISPCON Policy Panel: Porn, Privacy, and Due Process