Causation, Spam, and Worms

September 13, 2006 10:30 AM by Stephan Kinsella (Archive)

Hackers Jailed for Zotob Worm Attack provides an illustration of how the crime of trespass can be committed remotely by computer means, such as, in this case, by “creating and distributing the Zotob worm that squirmed through Windows 2000 networks in August 2005.” Likewise, as argued here, spam can also be considered to be a form of trespass against property rights.

But to view these as such requires a broader, less rigid, and more subtle theory of causation and responsibility, such as that discussed in my Causation and Aggression.

***

See also Eric Sinrod’s Trespass – An Ancient Legal Doctrine Gains Traction In Cyberspace.

Spam as a Nuisance

August 28, 2006 1:46 PM by Stephan Kinsella (Archive)

As argued in my forthcoming Whittier Law Review article with Walter Block, The Duty to Defend Advertising Injuries Caused by Junk Faxes: An Analysis of Privacy, Spam, Detection and Blackmail, spam can, in principle, properly be considered a type of trespass–since it is a means by which the spammer uninvitedly uses another’s property. (See also Spam, Spyware, Spiders and Trespass.) I just came across this 2004 article, Spam—Oy, What a Nuisance!, by law professor Adam Mossoff, which argues that spam “is indeed a nuisance, and that ISPs and other affected businesses should sue the persons responsible for swamping the Internet with billions of spam for creating a nuisance. Nuisance doctrine is superior to the currently favored “trespass to chattels” because it does not require courts to engage in unnecessary legal fictions or doctrinal somersaults in finding that spam has “dispossessed” a plaintiff from its computer network.”

Spam, Spyware, Spiders and Trespass

February 2, 2006 2:50 PM by Stephan Kinsella (Archive)

As mentioned previously in Spyware and Trespass, spam can, in principle, properly be considered a type of trespass–since it is a means by which the spammer uninvitedly uses another’s property. As noted, a classic case is CompuServe v. Cyber Promotions, which held that transmitting a substantial volume of unsolicited e-mail to someone’s computer, after demands to cease and desist, gives rise to a claim for trespass to personal property. And a court in Chicago recently a while back that the doctrine of trespass to chattels also “applies to the interference caused to home computers by spyware.”

Just recently, as noted by Cyberlawyer Eric Sinrod, a Los Angeles court has ruled “that trespass was a viable legal theory to address the alleged distribution of spyware and adware programs.”

The old common law doctrine of trespass to chattels relates to the interference with or taking of another’s personal property. The idea is that this doctrine is flexible enough to cover various types of ways that others access or interfere with others’ computers, networks and servers, without consent.

In the case of spam–unsolicited email–sending a large amount of unsolicited email to someone’s computer can bog it down, fill up the hard drive, etc., thereby causing a sufficient amount of interference or harm to make a trespass claim. In the case of spyware or adware, the argument is that a user downloads something like a free game or screensaver, which causes the installation of spyware and adware on the PC without the user’s knowledge or consent, which then “substantially impair” the ability of the computer to function (i.e. reduced its efficiency), and destroy other software on the PC, etc.

As Sinrod noted, there are eBay in 2000 also was able to convice a judge that the unconsented-to use of “spiders” by Bidder’s Edge (an Internet auction aggregation site) to “crawl eBay’s servers to obtain auction information … placed some minimal burden on eBay’s servers,” so that eBay “prevailed on its trespass to chattels theory.”

Spyware and Trespass

October 12, 2005 11:40 AM by Stephan Kinsella (Archive)

As Walter Block, Roy Whitehead and I argue in a forthcoming law review article, “The Duty To Defend Advertising Injuries Caused By Junk Faxes: An Analysis Of Privacy, Spam, Detection And Blackmail” (and as I have argued elsewhere), spam and related activities can in principle be a crime–a type of trespass–since it is a means by which the spammer uninvitedly uses another’s property. A classic case is CompuServe v. Cyber Promotions, which held: “where defendants engaged in a course of conduct of transmitting a substantial volume of electronic data in the form of unsolicited e-mail to plaintiff’s proprietary computer equipment, where defendants continued such practice after repeated demands to cease and desist, and where defendants deliberately evaded plaintiff’s affirmative efforts to protect its computer equipment from such use, plaintiff has a viable claim for trespass to personal property.”

Now, as reported by my former partner, noted cyberlawyer Eric Sinrod, a court in Chicago has ruled that the doctrine of trespass to chattels also “applies to the interference caused to home computers by spyware.”

Good.

Spam and Knocking

August 30, 2004 2:46 PM by Stephan Kinsella (Archive)

My neighborhood, West University Place, is a small, self-contained little island of a city within Houston. It’s only about 2 square miles; but it’s fairly densely packed, about 10,000 families. Unlike Houston proper, West U has zoning. And most of its residents like it this way including, I confess, yours truly.

A recently passed ordinance (sec. 15.011) prohibits door-to-door soliciting in several cases: too early or too late; for any unregistered solicitors; or where the homeowner has a “no soliciting” sign posted. Now it’s been amended to provide for a “do-not-disturb list,” which lists addresses of residents who have indicated that commercial soliciting is not welcome.

Now personally, I like these rules. But are they consistent with liberty and property rights? It seems to me they are.

Property owners have the right to exclude, or to permit (“license”), others to enter or use their property. There is normally a presumption that neighbors and others with peaceful purposes in mind can walk up to your door and knock on it, e.g. to borrow a cup of sugar. They have implicit license. There is a presumption in an area based on conventional usage and tradition, etc. But I can change this, e.g. by telling someone they are unwelcome or posting a sign. And there is no implicit permission for girl scouts to knock on my door at, say, 4:00 a.m. to sell me cookies; in such conditions the presumption is the other way around.

This ordinance seems to me to largely reflect libertarian principles. It prohibits soliciting too early or too late. It prohibits soliciting those who have made it clear they don’t welcome it–they don’t give permission for this use of their property (by means of a sign or signing up to a public, easily accessible list). It even makes an exception for those under 14 years of age, because most of us would not want to keep our neighbors’ kids from coming by to ask for donations to the Little League or selling girl scout cookies.

Of course similar comments could be made about spam (as I have done before). If you have a publicly accessible or known email address, the presumption is people can email you to send you a message. But you could rebut it for a specific person, like someone stalking or harassing you. Because sending an email to me is a way of using my computer, since it causes certain physical things to happen to my computer. Therefore you have to have my permission, at least tacit, to send me email. In my view, there should be no need to sign up to a “do-not-spam” list, since the presumption should be that nobody wants all that spam, unless they explicitly welcome it.

Interesting response to my previous post about spam:

“I would extend your “knock on the door” analogy for spam to likening it to knocking repeatedly, loudly and in the middle of the night. This activity is certainly not of the type implicitly permitted by having a walkway and doorbell on your home even absent an explicit proscription against it.“From a technology perspective – even independent of property rights and legal theory – there are ways to deal with spam and other security issues. The best involve securely identifying and classifying those contacting you. People currently use caller-id to screen phone calls, and providing a richer version of caller-id for internet traffic would allow individuals to screen (normally automated and policy-based filters) incoming traffic along with many other applications. To do this requires a trusted PKI (public key infrastructure) that could be federated. For example, there need not be a single and centralized certificate authority such as the Social Security Administration, USPS, state DPSs or other government authority, but could include a federation of normally trusted companies such as Visa, Verisign, Bank America, and others who have part of their business in managing and verifying identities. Microsoft Passport and other systems use federated identity management, but I suspect that it has not gone further because of the expectation that governments would ultimately subsume or otherwise interfere in this.

“Once there are federated and trusted PKIs, the use of signing, authenticated identification, encryption, etc. will become automatic and transparent. It will no longer be the sole province of paranoid technophiles. It will obviate the billion ids and passwords we set up for each web site, and will make eCommerce easy and secure. The anti-spam benefit is only one of many.

“It is not imminent, and I believe the specter of government involvement has a lot to do with it. For this to occur, there would need to be a (useful) critical mass of certified users and support in common email programs such as Microsoft Outlook and AOL. The latter is easy while the critical mass is more problematic.

“How does this stop spam? You set up email policies that automatically (programmatically):

“–Deletes mail without a trusted digital signature or puts them in a “bulk mail” folder.

“–For signed mail, checks to see if it is from someone in your contact list/sphere or is singed with “personal” or solicited commercial response. If not, it deletes it. If a sender abuses this (lies about the intent/use), recipients could complain to the certificate authority (e.g., Visa, Verisign), which could result in revocation of the certificate (think Better Business Bureau complaint/investigations).

“–If it is commercial unsolicited email, it could see if it has a certificate from the BBB (and other private agencies such as could even be a certificate authority for its members in good standing who properly designate the intent of the email) and examines the subject of the email for an area of interest.

“Certificate authorities not diligent in maintaining their information correctly would lose trust, in both general and computer security meaning, and might even be subject to tort action in extreme cases. They thus would have a large incentive in being careful.

“Anyway, you get the idea. While email creates a problem by making it virtually cost-free to send bothersome message, computer technology ultimately also provides an automated solution to this in ways impossible with physical junk mail.”

Barnwell mentions the draconian sentence imposed on spammers by federal anti-spam legislation. The law is clearly unconstitutional since the Constitution nowhere authorizes the feds to regulate such activity. But in principle, in my view, spam is a crime. As found (correctly, in my view) in the now-classic case CompuServe v. Cyber Promotions, “where defendants engaged in a course of conduct of transmitting a substantial volume of electronic data in the form of unsolicited e-mail to plaintiff’s proprietary computer equipment, where defendants continued such practice after repeated demands to cease and desist, and where defendants deliberately evaded plaintiff’s affirmative efforts to protect its computer equipment from such use, plaintiff has a viable claim for trespass to personal property.”

Why is this consistent with libertarianism? Because the owner of property (such as a PC) has the right to control it, which means the right to excluse others from using it. Sending an email to someone is a means of using the PC–it causes things to happen with the PC. It is analogous to knocking on someone’s door. Normally, this is permitted by the owner; and in many contexts, this permission or license is implied by the context. E.g., my neighbor does not trespass if she walks on my sidewalk and knocks on my front door to borrow a cup of sugar. My consent for such innocuous uses of my property is implied. Yet it can be revoked: e.g., I can erect a fence or “no trespassing” sign, or I can tell my neighber she is no longer welcome on my property. If she then knocks on my door she has commited trespass, since she is now using my property without permission.

Similarly in the case of spamming: especially where warned not to spam, someone is using the victim’s computer without their permission; and I would argue there is an implied denial of consent to send unsolicited commercial email, just as there is implied lack of consent for a dozen of my neighbors to hold an Amway meeting on my front lawn.Coda: Gil Guillory’s Mises blogpost, dissent on spam, raises some good points. Gil may like getting spam, but I get probably 300 a day lately, and it is becoming a serious problem. It is not so easy to simply delete them. Second, in a free market, I would envision ways of publicizing your preferences as to whether you do, or do not, consent to receive unsolicited faxes, emails, even mail. After all, when someone shoves a letter in my mailbox I have to dispose of it, which costs. I regard all the tons of snail mail I get as littering on my property.