"Liquid" information in the wild west of e-Commerce. (Cover Story).

Is it fair to compare e-commerce to the Wild West, where anything goes?

Al Segars, a professor of information technology at the University of North Carolina-Chapel Hill, thinks so. "If you're the sheriff coming into town, it's very difficult to get your arms around some of the issues," he says.

Internet regulations seem as palpable as clouds floating overhead, and when they do gather to cause rain, it is a brief shower of legalities that don't always do the job.

The truth is that the same laws that govern the operations of brick-and-mortar businesses apply to Internet commerce. But the Internet, just past its infancy, continues to offer a novel approach to reaching consumers, and there are operators who are willing to push the legal envelope.

Actions to stop Internet fraud absorbed "considerable resources" at the Federal Trade Commission during its fiscal year 2001, according to the agency's Fiscal Year 2002 Congressional Budget Justification report. The laws the commission used to back its actions were already on the books.

What remains the top issue for Internet consumers, and what has spawned, so far, limited federal legislation, is privacy. The other major concern, engendered by the Internet's ease in transferring data, is copyright protection. The controversial Digital Millennium Copyright Act was enacted -- hastily, some claim -- to address a broad range of concerns.

Privacy is "the Internet regulatory issue that is most real for most businesses," says Jeremy Sharrard, an associate policy analyst at Forrester Research. The only privacy laws that exist on the national level, unique to the Internet, are those targeted to financial services, the healthcare industry, and to Web sites which collect information from children under 13, Sharrard explains.

In January, the FTC's Division of Financial Practices announced that it had sent to about 200 firms notices that their practices of obtaining financial information were not in compliance with the Gramm-Leach-Bliley Act (GLB). Enacted in 1999, the GLB prohibits "individuals from obtaining a customer's information from a financial institution or directly from the customer using false representations, fictitious documents, or forgery." The notices were sent after the FTC surveyed more than 1,000 Web sites and reviewed more than 500 print advertisements for firms offering to conduct financial services.

Congress also enacted the Children's Online Privacy Protection Act (COPPA) of 1998, which is intended to protect the privacy of children using the Internet. Under COPPA, companies are not allowed to solicit personally identifiable information from children under 13 without parental consent.

Privacy has become such a major issue for companies that many have created positions devoted entirely to ensuring compliance. "It's pretty common at this point," says Jennifer Blum, director of corporate communications at DoubleClick, a business-to-business online marketing company. DoubleClick hired its chief policy officer (CPO) in March 2000, and since then CPOs have been "popping up everywhere ... You're seeing not only Internet companies embrace that title, but really all the large Fortune 500 companies." The "smart companies," she maintains, "are taking this seriously and hiring an expert to help them drive that part of the business."

In August 2001, the Walt Disney Co., the entertainment conglomerate, was searching for a candidate to fill its CPO slot. Larry Shapiro, executive vice president of business development and operations at Walt Disney Internet Group, a Disney division, says his unit was very proactive in working with the FTC and Congress to shape COPPA. And the company is currently involved in working with Congress to craft pending Internet privacy bills. Disney is also a member of TRUSTe, a seal program that guarantees that Web site members are honestly disclosing what they're doing with the information they collect from consumers.

"We even treat children's privacy beyond the boundaries of the rules," says Shapiro. "We don't market to children 12 and under at all, even though that's permitted to a certain extent under COPPA. We don't advertise our site on sites that don't have privacy policies. We also don't accept advertising on our site from sites where the advertising would link to a site that doesn't have a privacy policy. And to our knowledge, I don't think anyone in the industry has done that."

Shapiro says Disney does not see any sweeping privacy legislation -- he believes, like other experts, that Congress will pass something -- as being contradictory to the way the company is conducting Web business now.

"If there's one rotten egg, it sort of spoils it for all of us," he says referring to Web sites that are breaking the law. Because of those "rogue Web sites," and the deleterious impact they have on consumers' expectations of privacy, "we may need legislation to be able to protect the greater whole." No one at Disney believes that pending legislation "is problematic to the way we do business," he says.

Segars says any legislation will certainly have its "gray areas." Any federally enacted bill will have to apply to both e-commerce and the information that employers have about employees, such as benefit packages. "It's a real double-edged sword because organizations want to make this information available to employees so that they can be the stewards of this information." If employees have children or get married, it is less costly for them to update that information themselves. But to give employees that access "runs the risk of other unauthorized entry" to that personal data. Segars sees that as the biggest issue right now.

"I do think you'll see a privacy legislation come through that will be more targeted to the consumer," he adds. The federal government views the Internet as a way to facilitate economic expansion and innovation and "if people lose confidence in the Internet, or become suspicious of it, it's not in the best interest of government."

Thanks to the Russian?

Internet regulation garnered much attention recently thanks to Dmitri Sklyarov, who came to the United States to give a speech and got arrested.

Sklyarov, a Russian computer programmer, wrote software that circumvented copyright protections Adobe Systems had installed to prevent purchasers of its e-books from making copies. That includes, of course, making a back-up copy for personal use, which was the purpose of Advanced eBook Processor, the program Sklyarov created for his Russian employer, ElcomSoft. Adobe contended the program violated the Digital Millennium Copyright Act (DMCA), and once company officials heard Sklyarov was entering the country to speak at the Def Con convention (a "hacker-centric," gathering, says Newsweek), they called the authorities and the Russian was arrested. He spent three weeks in jail, first in Las Vegas, then in an Oklahoma federal prison, and finally in San Jose, California. His bail was set at $50,000 and he was released a month later. At his hearing, Sklyarov and his employer, Elcomsoft, pled not guilty.

The Sklyarov case has attracted international attention and demonstrations and Free Sklyarov Web sites because his supporters believe that the programmer's arrest is a consequence of bad law. But the ultimate repercussions may prompt a re-examination of the DMCA.

The DMCA, signed into law in November 1998, is the first U.S. legislation to address online copyright protection and prohibits the unlawful use of any kind of copyrighted file online. Bill Maher, a professor at the University of Illinois at Urbana-Champagne and the school's archivist, says the law is "a solution that they've come up with to try to close the barn door on electronic piracy," which is "so broad and so sweeping that it affects all sorts of other kinds of information."

The Sklyarov case, Maher says, is the first to test the efficacy of the DMCA, which made it not only criminal to copy somebody else's work and use it without their approval and without compensation, but also made it a crime "to try to figure out a way to circumvent any copyright protection scheme ... No matter what your purpose is."

Maher says the same thing could have happened to anyone who manages records. For example, say someone needs information from a database that was created five years ago using software designed by a company that is no longer in business. In order to access that information, they have to crack the software code. "If you enforce the law strictly, you're guilty of criminal action and (subject) to criminal penalty," explains Maher.

Apparently the protesting howls from the high-tech community and a meeting with the Electronic Frontier Foundation, an organization that advocates civil liberties issues related to technology, prompted Adobe to retreat from supporting Sklyarov's prosecution. But the die has been cast.

Forrester's Sharrard contends that Adobe did "a disservice to their own case. I think it's cases like this that put into view some of the weaknesses of the DMCA (and) could cause it to be overturned."

Copyright protection will continue to be an issue, he concludes. The fallout from the music industry's troubles will affect other sectors involved in e-commerce. "Each industry has its own dynamics, and that has to do with the fact that information is a lot more liquid online," says Sharrard.

AT THE CORE

THIS ARTICLE EXAMIES:

* the challenge of legislating e-commerce and the Internet

* key laws regulating the internet

ABOUT THE AUTHOR: Mark Richard Ross is a freelance writer and can be reached at [e-mail].