The Regulated End of Internet Law, and the Return to Computer and Information Law?

In the last 25 years, many lawyers have been very excited
about the global communications network connected by the Internet Protocol,
which has transformed the consumer/prosumer and small business experience of
electronic communication. Now that broadband Internet is ubiquitous, mobile and
relatively reliable in urban and suburban areas, it is being regulated as all
mass media before it. The Internet is no longer a lawless, special unregulated
zone; in fact, it never was, as seen in the wonderfully obscure case of Shetland
Times v Shetland News.[1] The major gatekeepers
are regulated for the public good and public interest to some extent, whether
that be access providers through infrastructure sharing, electronic privacy,
cybersecurity and network neutrality regulation, or the social media,
e-commerce and search giants through various duties of care including those for
notice and rapid action – in many cases requiring takedown of allegedly illegal
material in a day or even an hour,[2] and notification of
breach of security and privacy to the customer.

This short article is both a retrospective, and even
requiem, for the ‘unregulation’ argument in Internet law in that 25 years, and
a prospective on the next 25 years of computer law, in which many of the expert
treatises of the 1970s to early 1990s need to be dusted down and re-absorbed.[3] Publishing this
article in Computers & Law in 2018 is especially appropriate – the SCL
itself is 40 years old and the Society’s history far predates the commercial
Internet, with foci ‘SCL’s interests – the use of technology in the law, and
the law as it impacts on technology’.[4] Machine Learning,
smart contracts, distributed ledgers and algorithmic regulation have very long
histories and we would do well to remember those, especially given the prism of
the normalisation of the Internet as a mass medium.[5]

A Very Short Internet Legal History

Internet law was a subject of much practical and academic
interest in the 1990s in the USA, and some specialist interest in the UK and
elewhere in Europe. These foundational rules for the adaptation of liability
online focussed on absolving faultless (and low-fault, the line is shifting)
intermediaries of liability for end-user posted content. Twenty-one years after
ACLU v Reno, and 25 years since the ‘Information Superhighway’ metaphor of Al
Gore and Bill Clinton’s first administration, is as useful a time as any to
look back to the future. Settled policies were arrived at as a result of expert
testimony and exhaustive hearings, on liability, privacy, trust, encryption,
open Internet policies against filtering. Changing those policies in 2018 may
result in potentially catastrophic untying of the Gordian knots of intermediary
safe harbour/harbor, privacy, copyright enforcement, and open Internet European
regulations.

In the USA, the early legislative milestones were the
Communications Decency Act 1996, s 230 (which established no liability for
intermediaries without actual knowledge of infringement),[6]
the Digital Millenium Copyright Act 1998, s 512 (which laid out detailed rules
for copyright infringement and the action required of intermediaries when
notice of infringement was sent). These have been developed over time, and
maintain a significant degree of difference from the gradually less permissive
intermediary regime now permitted in the EU.[7] Note that the term
‘Internet Service provider’ is not used in these statutes – the terms ‘online’
or ‘interactive’ are used instead.[8] Yet we still blithely
use the legally meaningless term ‘ISP’ in all our interactions with clients!

In Europe, the milestones begin in 1996 with the
‘Convergence Green Paper’ and its responses, which explain why we refer to
Information Society services, rather than Internet services.[9] They continued with
debates over the 1997 audiovisual media law, revising Directive 89/552/EEC
(known to UK lawyers as ‘satellite TV without frontiers’) as Directive 97/36/EC
then Directive 2007/65/EC, soon to be further revised in 2018.[10]  It is worth noting that European consumer
Internet use roughly dates to 1998, with the opening of the Telecoms Single
Market and broadband to 2000, with the Local Loop Unbundling Regulation. In the
1997 Teleservices Act and 1998 Bavaria v Felix Somm (Compuserv) case, Germany
showed that it wished to see a similar limited liablity regime to that in the
USA. This led, with British support, to adoption of the E-Commerce Directive
(2000/31/EC) creating the Internal Market in e-commerce. Largely drafted in
1998/9, this was incomplete as compared to the US statute, with for instance no
‘put back’ provision, and no academic/research exception to copyright rules.
Most critically, it contained no rules for how notice was to be given, leaving
these details to national implementation from 2002, and led to the large body
of case law generated by the European courts in the 15 years since. The
Copyright Enforcement Directive 2001/29/EC somewhat clarified the earlier
Directive.

In 2000, the Europeans and US published the ‘Safe Harbor’
for Privacy. Negotiated from 1998, it was always legal nonsense if sound
policy, and was struck down in Case C-362/14 Schrems. Its replacement, the
‘Privacy Shield’, is equally a sticking plaster over trans-Atlantic
differences, and may also be struck down in 2019. While this article will not
describe any of the data protection law developments over the last 25 years, it
is noteworthy that the Data Protection Directive (95/46/EC) was continually
attacked as unsuitable for the Internet that it was not expressly designed to
regulate (for which see Directive 2002/58/EC), so the new General Data
Protection Regulation is already subject to much attack for its failure to regulate
AIe and robotics, yet again technologies for which it was not expressly
designed…but may be adapted.[11]

We also saw in 2000 the landmark French criminal case ofYahoo
v LICRA, confirming that US multinationals must conform to national criminal
law on hate speech. In 2001, the Council of Europe released the Budapest
Convention on Cybercrime (in force 2004) with the Protocol of 2003 on hate
speech (entering into force in 2006), which was not signed by signatories to
the main convention including UK, Ireland and the USA.

So what is this ‘cyberlaw’ that law students are taught?
Lessig famously debated the ‘law of the horse’ with Easterbrook in 1996,
concluding that Internet law helps us understand the complexities and
multifaceted techniques of control that our environment places on us – it’s an
advanced survey course in undertsanding the Theory of Everything as applied to
the law.[12] Some of the more
interesting Internet law academic literature from the 1990s (and early
noughties) has also stood the test of time,[13]
for instance on network effects,[14] cyberlaw and control
by code or Lex Informatica,[15] free and open source
software and control of the online environment,[16]
network neutrality and the regulation of intermediaries by their networked
environment[17] and the creation of
monopoly gatekeepers resisting yet also predicting the dominance of Google,
Amazon, Facebook and Apple (GAFA).[18]

Too much specialism may be a boost for career prospects –
client ignorance is bliss or at least creates more billable hours – but
Guadamuz argued as far back as 2004 that the ‘Attack of the Killer Acronym’ was
preventing accessibility to Internet law for the wider legal profession,
clients (and faculty).[19] That
over-specialised  argument was extended
by Larouche in 2008, who predicted the end of Internet law as a subject and the
abstraction of information law to move away from a specific technology (except
telecoms, media law).[20] That has happened to
some extent, with e-commerce part of standard contract law, platform dominance
in competition law, digital copyright (and patent) law, cybercrime in criminal
law, and so on, as Murray described.[21]
The law syllabus is being digitized, quite literally (e-books, e-syllabi, e-libraries).

It is not only the European institutions who are becoming
excited about more Internet regulation, driven in part by self-preservation and
the rise of disinformation (fake news – sic). These seem to be exciting times
to be an information lawyer. Law students 
are no longer demanding Internet law classes, but AI or (heaven help us)
Blockchains and the Law…electronic signatures plus Merkle Trees have developed
in 25 years.[22] In 2018/19 the
cyberlaw past has arrived in the Law School: empirical textual analysis, tools
of information retrieval, and a ‘scientific legal approach’ are beginning to
once again dominate information law analysis as they did in the 1980s. It is
worth asking when students (or trainee solicitors) last visited a Law Library!
Reed and others question how we regulate Artificial Intelligence[23] (not with ethics!)
and dominance of the ‘surveillance-industrial’ state in these
post-Snowden/Schrems/GDPR times, pushing digital law into even constitutional
studies.[24] Most law students
(and most young lawyers) understand most legal issues better if it comes with
an app as an example…

The Future: OffData, a regulator for the ubiquitous computer
era

Just as Internet lawyers are widening their horizons and
returning to the broader notion of being information lawyers whose interests
extend beyond a public IP network, the end of the special place for Internet
law, and its absorption into media law, was prematurely announced. Government
in a rumoured White Paper,[25] Opposition,[26] and Ofcom in
September 2018 all called for more regulation, and potentially a new regulator,
of the Internet.[27]  To put a damp squib on too much recurrent
techno-optimism or cynicism, I argue that most arguments for regulating the
Internet and cyber technologies in 2018 remain old wine in new bottles.[28]

We have lots of legal regulators of information, even if
none of those is entirely shiny, new and ‘cyber’. There is the Information
Commissioner in ‘faraway from Whitehall’ Wilmslow, the Electoral Commission,
Ofcom itself, the Advertising Standards Authority, and others. There are
technical support institutions such as the National Cyber Security Centre,[29] the Turing Institute,
and a variety of non-governmental organisations such as the new Nuffield
Foundation-supported Ada Lovelace Foundation and the venerable Foundation for
Information Policy Research (20 years young in 2018).[30]

We need to recall what is known about sectoral regulation.
Ofcom was set up almost 20 years ago as a result of technological convergence
between broadcasting and telephony,[31]
but deliberately constructed not to regulate Internet content. It is now
required to so do. This is not a moment for unique solution peddling or an
ahistorical view of the need to extend competences beyond a privacy, a
security, a sectoral competition and a communications regulator. In
constructing what I call ‘OffData’, a regulator of electornic communications
and content,[32] we need to learn the
lessons of previous regulatory mergers both inside (OfCom) and outside (OfGem)
communications.

While information law is maturing, and the old ‘Internet
law’/‘cyberlaw’ nomenclature may be fading, what we do as lawyers dealing with
computers and their impact on society is growing more important. Some of the
new ideas about regulating the Internet and AI betray a worryingly ingenue view
of technology and law. It is now our job as somewhat grizzled, experienced
information lawyers to help policy makers understand that we have a great deal
of experience in making laws for cyberspace.

Chris Marsden is Professor of Internet Law at the University
of Sussex, author of a number of works on Internet law (most recently Network
Neutrality: From Policy to Law to Regulation (2017)) and a member of the SCL
Advisory Board.