BERKELEY TECHNOLOGY LAW JOURNAL Research Articles

The Tort of Negligent Enablement of Cybercrime

Michael L. Rustad and Thomas H. Koenig propose a new tort of negligent enablement which will hold software vendors accountable for defective products and services that pave the way for third party cybercriminals who exploit known vulnerabilities. At present, the software industry has externalized the costs of making code safe for its intended environment of use onto its end users through one-sided mass market agreements. The proposed negligent enablement tort fills the void left by the failure of contract law to give meaningful remedies for the unacceptably high levels of risk of computer intrusions due to defective software. The public policy rationale for imposing secondary tort liability on software publishers who aid and abet cybercriminals is to reduce the rate of cybercrime. The proposed negligent enablement tort draws upon wellestablished principles of the Uniform Commercial Code (UCC) Article 2 warranties, premises liability, and negligence-based product liability to construct a modified duty of care to produce safe software suitable for its environment of use. This Article examines the elements of duty, breach, causation, and damages for the proposed negligent enablement tort as well as defenses, procedure, and possible policy-based objections. © 2005 Michael L. Rustad & Thomas H. Koenig f Michael L. Rustad Ph.D., J.D., LL.M. is the Thomas F. Lambert Jr. Professor of Law and Co-Director of the Intellectual Property Law Concentration at Suffolk University Law School in Boston, Massachusetts. t Professor Thomas H. Koenig chairs Northeastern University's Sociology and Anthropology Department and is on the Executive Committee of its Law, Policy & Society Doctoral Program. We appreciate the editorial work and substantive suggestions of Chryss J. Knowles on this piece. Our research assistants, Shannon Downey, Kara Frato, John Hebb, and Conway Kennedy, worked diligently and creatively. Diane D'Angelo, a research librarian at Suffolk University Law School, provided us with extraordinary substantive assistance. Thank you also to the members of the Berkeley Technology Law Journal who contributed to the editing of this piece. BERKELEY TECHNOLOGY LAW JOURNAL

Will Merging Access Controls and Rights Controls Undermine the Structure of Anticircumvention Law

Copyright owners are increasingly using technological measures, often referred to as rights management systems, to protect their works in digital formats. In 1998, Congress granted copyright owners legal remedies against the circumvention of such measures and against the suppliers of circumvention technologies. This Article considers how the complex structure of these legal protections might affect copyright owners' choices of which technological measures to deploy. Because Congress provided stronger protection to measures controlling access to copyrighted works than it provided to measures controlling copyright owners' rights in those works, copyright owners might prefer access controls to rights controls. In practice, however, copyright owners may be able to employ technological protection systems that incorporate both an access control and a rights control. So far, courts have treated such control measures as entitled to the legal protections afforded both access-control and rights-control measures. The Article next considers the impact on consumers of copyright owners' use of merged control measures. Congress expressly provided less protection for rights controls in order to allow consumers to make noninfringing uses of copyrighted works in protected digital format. By protecting merged control measures as both access controls and rights controls, courts may undermine this congressional scheme for balancing protections for copyright owners and the public's interest in noninfringing use. Finally, the Article explores possible responses to the potential threat posed by the deployment of merged control measures, including amending the legal protections for technological control measures to allow the circumven© 2003 R. Anthony Reese t Assistant Professor, School of Law, The University of Texas at Austin. B.A., Yale University; J.D., Stanford Law School. I thank Graeme Dinwoodie, Paul Goldstein, and Christopher Leslie for comments on earlier drafts. I thank Beth Youngdale of the Tarlton Law Library for research assistance. BERKELEY TECHNOLOGY LAW JOURNAL tion of a merged control measure where the post-circumvention use of the protected work is noninfringing.

The Empirical Case against Asymmetrical regulation of Broadband Internet Access

The United States regulates the provision of broadband Internet access service asymmetrically. A cable television system operator is not regulated in its sale of cable modem service. In contrast, an incumbent local exchange carrier (ILEC) that offers digital subscriber line (DSL) service faces price regulation as well as the obligation to offer competitors the use of its broadband network on a wholesale (or, unbundled) basis. The social costs of asymmetric regulation are by now familiar. The Federal Communications Commission (FCC) could remove its own asymmetric regulation. It could reclassify broadband Internet access as an information service, which is largely unregulated. Or, it could forbear from regulating ILEC provision of broadband Internet access. A third, and more incremental, approach would be for the FCC to declare ILECs in the provision of advanced services, including broadband Internet access. In this Article, we evaluate the empirical case against asymmetric regulation of broadband Internet access through the lens of the FCC's approach to deciding petitions for nondominance. We use a nested-logit discrete-choice model to produce econometric estimates of the own-price elasticity of demand for DSL service and the cross-price elasticity of demand for cable modem service with respect to DSL service. Our findings suggest that demand for DSL service is price-elastic, that DSL and cable modems are in the same product market, and that DSL providers lack market power. The FCC © 2002 Robert W. Crandall, Hal J. Singer, and J. Gregory Sidak t This Article is an outgrowth of a declaration that we submitted to the Federal Communications Commission on behalf of SBC Communications' petition to be deemed nondominant in the provision of advanced services. The views expressed here are solely those of the authors and not those of the Brookings Institution or the American Enterprise Institute, neither of which takes institutional positions on specific legislative, regulatory, adjudicatory, or executive matters. tt Senior Fellow, The Brookings Institution. ttt F.K. Weyerhaeuser Fellow in Law and Economics Emeritus, American Enterprise Institute for Public Policy Research; Emeritus, American Enterprise Institute for Public Policy Research. tttt Senior Vice President, Criterion Economics, L.L.C., Washington, D.C. BERKELEY TECHNOLOGY LAW JOURNAL would advance the public interest by ruling that the ILECs are nondominant in the mass-market broadband services market.

Safety in Numbers: Revisiting the Risks to Client Confidences and Attorney-Client Privilege Posed by Internet Electronic Mail

Courts have not yet considered the application of the attorney-client privilege to electronic mail transmitted over the Internet. Despite the absence of a definitive ruling on the issue, legal commentators and ethics committees have presented opinions that tend to conclude that the privilege applies to electronic mail. This Comment addresses the possibility that these legal opinions are based on misconceptions about the underlying technology and security of Internet transmitted electronic mail. This Comment critically evaluates legal opinions regarding the relationship of the privilege to electronic mail by explaining the pertinent technology and security issues that attorneys should be aware of when discussing sensitive information with their clients over Internet transmitted electronic mail. Given the relative ease with which unencrypted electronic mail can be intercepted by third parties, encryption presents one cautionary measure that can be taken by attorneys seeking to ensure that communications with their clients remain privileged. © 1999 Joshua M. Masur. t J.D. 1999, Columbia Law School; A.B. 1990, Columbia College of Columbia University. Prior to attending law school, Mr. Masur worked in the computer and networking industries for eight years, including stints as director of management information services for a nonprofit law firm, director of consulting services for a computer consulting company, and computer technology manager for an international advertising agency. This article represents the views of the author only, and is not to be attributed to any client or employer of the author. The author wishes to thank the editorial staff of the Berkeley Technology Law Journal for their assistance and dedication; Richard Ziegler, for having suggested and guided his research into this topic; Michael Geist, for early editorial advice and input; Lance Liebman, for requesting that he teach relevant portions of this material in his course on telecommunications law; those unfortunate members of Columbia Law School's class of 2000 whom he forced to argue these issues as first-year students in Moot Court; and Shelly K. Masur and Julia Astrid Masur, for their love, understanding, and support. This Comment was the first-place winner of the 1999 Berkeley Technology Law Journal Comment Competition. BERKELEY TECHNOLOGY LAW JOURNAL