Fighting Terror Online

Fighting Terror Online

Martin Charles Golumbic Fighting Terror Online The Convergence of Security, Technology, and the Law

Martin Charles Golumbic Caesarea Rothschild Institute University of Haifa Mount Carmel, Haifa 31905, Israel golumbic@cs.haifa.ac.il ISBN: 978-0-387-73577-1 e-isbn: 978-0-387-73578-8 Library of Congress Control Number: 2007936872 c 2008 Springer Science+Business Media, LLC All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed is forbidden. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. Printed on acid-free paper. 987654321 springer.com

Foreword This book finds its roots in the horror that engulfed us all around the globe as we experienced and watched with disbelief the events of September 11, 2001. Naturally, policy-makers around the world rushed to examine their law enforcement capabilities and the suitability of these tools to the new war on terror. This examination resulted in a wave of legislation around the world, aimed at increasing the power of law enforcement agencies. The digital environment was a major focus of these regulatory and legislative attempts. Given the horror of the events and the haste to provide law enforcement agencies with the best tools possible to fight the new threat, policy-makers moved forward without much public discussion. Legislators around the world rushed to do the same. No real public debate took place before the USA PATRIOT Act was approved by Congress, 6 weeks after 9/11. 1 Our concern is that the public s voice is also needed in this process. Once the sky over Manhattan cleared a bit, it was time for us to take a step back and assess the fallout from that horrific day. As academics who focus on digital law, my colleagues Michael Birnhack and Niva Elkin- Koren, focused their attention on examining how the events and the war on terror that followed affected the digital environment, especially the Internet, and what would be their future effects. We decided to explore these issues in a unique academic forum, together with students of the Faculty of Law and co-sponsored by the Caesarea Edmond de Rothschild Foundation Institute for Interdisciplinary Applications of Computer Science at the University of Haifa, Israel. A group of 17 outstanding students, some of whom were jointly majoring in law and computer science, 1 Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act, 2001, Pub. L. No. 107-56, 105, 201 202, 204, 212, 814, 115 Stat. 272 (2001). v

vi Foreword participated in a research seminar during the fall semester of 2001. The goal was defined as the formulation of an appropriate policy at the interface between security and technology, human rights and economic policy. Research was conducted in teams, followed by group discussions. To complete the research stage and to learn about the views of experts and professionals working in these areas, we organized a workshop (Shefayim, December 26 27, 2001) where dozens of researchers and practitioners from various areas of computer science, law, communications and media, strategic studies and philosophy met for two intense days of discussions. Lawyers and jurists came from academia, from the private sector, and from the public sector with representatives from the Israeli Ministries of Justice, Defense, and Communication to discuss their experiences and views. We also heard the opinions of those who are directly involved in the digital environment, including researchers in the field of encryption, defense personnel, lawyers, and businesspeople. An exceptional dynamic was created over the two days of informative lectures and fruitful discussions, making absolutely clear the need for independent discussion and interdisciplinary research on issues related to law and technology. Following the research workshop and the forum, a Hebrew-language position paper was authored and distributed to policy-makers and others in Israel. Continuing in this direction, Elkin-Koren and Birnhack conducted further research, which resulted in an article on the Invisible Handshake, 2 addressing vital issues on the role of knowledge in the global world and the reemergence of the State in the digital environment. Pursuing such interdisciplinary aspects of law, technology and computer science, this book evolved and developed into a volume whose topics are of concern and interest to a worldwide audience. The book provides a snapshot of the legal regime in the 9/11 aftermath and a general framework for understanding the emerging legal and technological issues. The legal response to online security threats is gradually maturing and will evolve further in the coming decade. The fundamental principles, however, are likely to remain the same. 2 Michael D. Birnhack & Niva Elkin-Koren, The Invisible Handshake: The Reemergence of the State in the Digital Environment, 8 Virginia J. of Law and Tech. no. (6), (2003), 1 57.

Preface The unprecedented events that have taken place in recent years have led legislators and governments throughout the world to reconsider and restructure their policies regarding security issues. Today, worldwide attention is being given to a new security threat, in the form of global terrorism. Legal systems are being called upon to provide a response to these threats, in all areas of life, including the online environment. Among its many tools, global terror also uses advanced technological methods. This fact presents a difficult challenge to policymakers. Therefore, we have chosen to focus this book on the issue of formulating appropriate policy at the interface between security and technology, human rights and economic policy. The fundamental issue the tension between security needs and civil rights is not new. A great deal of experience has been amassed in various countries in this regard, and the question that now arises is whether the existing system of principles and laws, developed on the basis of experience gathered in the concrete world, is applicable to the digital environment. This book presents the position that the online environment is a significant and relevant theater of activity in the fight against terror, and will identify the threats, the security needs, and the issues that are unique to this environment. We examine whether the unique characteristics of this environment require new legal solutions, or whether existing solutions are sufficient. Three areas of online activity are identified that require reexamination: security, monitoring, and propaganda. For each of these, we will indicate the issues, examine existing legal arrangements, and offer guidelines for formulating legal policy. There is a demonstrated need to relate to the digital environment as a battlefront, map the new security threats, and thereby hope to provide focus to the pressing discussion on today s legislative and technological agenda. vii

Acknowledgments We are proud to acknowledge the University of Haifa students who, under the guidance of Dr. Michael Birnhack and Prof. Niva Elkin-Koren, coauthored the original Hebrew position paper aimed at policy-makers, and whose work inspired and served as the basis for this research: Eran Aloni, Rachel Aridor, Eran Bar-Or, Yael Bregman, Udi Einhorn, Keren Elisha, Gal Eschet, Alon Fiul, Haviva German, Eyal Greener, Shahar Grinberg, Efy Michaeli, Tal Ron, Nir Segal, Miri Shai, Asaf Zabari, and Ben Zohar. The Workshop and Forum, which served as the incubators for this book, took place thanks to the generous support of the Caesarea Edmond Benjamin de Rothschild Foundation Institute for Interdisciplinary Applications of Computer Science at the University of Haifa. We would like to express our appreciation to the Institute and its sponsors. A distinguished list of experts contributed time and energy to the Forum and Workshop making valuable contributions. The participants gave definition to the questions under discussion, presented a range of viewpoints regarding the issues on the agenda, and offered a clearer perspective on points that were still ambiguous. We would like to thank all of them (in alphabetical order): Professor Niv Ahituv, Mr. Oded Cohen, Professor Amos Fiat, Dr. Irith Hartman, Dr. Daphne Lamish, Dr. Fania Oz- Salzberger, and Professor Gabi Weimann. Translating and editing the original position paper required a great deal of work, and we would like to thank Miriam Daya, Stephanie Nakache, and Perry Zamek. For the task of expanding, researching and rewriting the position paper into book form, we would especially like to acknowledge and thank our research assistants Sara Kaufman and Yael Bregman- Eschet, as well as Diane Romm for the final editing. The framework of the current book benefited from the evolving research on the topic by my distinguished colleagues Michael Dan Birnhack and Niva Elkin-Koren. It would have been impossible to bring ix

x Acknowledgments this book to light without their leadership in this area. As the co-directors of the Center for Law and Technology at the University of Haifa, they are inspiring a new generation of researchers with new challenges, ideas and questions to be solved. They would especially like to thank Yochai Benkler, Robert Brauneis, Julie Cohen, Amitai Etzioni, Michael Froomkin, Ellen Goodman, Irit Haviv-Segal, Orin Kerr, Neil Netanel, Dawn Nunziato, David Post, Joel Reidenberg and the participants at the Public Design Workshop at NYU School of Law, Rutgers Law School Faculty Colloquium, the Dean Dinwoodey Center for Intellectual Property Studies at George Washington University Law School, the Telecommunication Policy Research Conference (September 2002), the joint colloquia of the Faculties of Law at the University of Haifa and Tel Aviv University, and the Privacy Symposium: Securing Privacy in the Internet Age (Stanford Law School, March 2004).

Contents Introduction... 1 GlobalWarsinaGlobalInformationEnvironment... 1 TheDeclineoftheState... 4 TheComebackoftheState... 6 Balancing Wars through the Law.... 8 DigitalLaw... 10 TheLawofDigitalWars... 12 An Outline of the Book... 12 1 The Balance Between Security and Civil Rights... 15 1.1 Mapping the Threats: Preventing Physical and Virtual TerroristAttacks... 16 1.2 Designing Policies to Address New Security Threats.... 18 1.2.1 InformationWarfare... 19 1.2.2 Data Security.... 22 1.2.3 Gathering Information and Surveillance...... 24 1.2.4 Regulation of Encryption Products.... 28 1.2.5 TerrorPropaganda... 30 1.3 Preserving Civil Liberties... 37 1.3.1 TheRighttoPrivacy... 38 1.3.2 Freedom of Expression...... 44 1.3.3 Enforcement... 49 1.4 ElectronicCommerceandInnovation... 56 1.4.1 Ramifications for Research and Development.... 56 1.4.2 EncryptionRegulationandElectronicCommerce... 58 2 The Legal Situation: Prevention and Enforcement in the Information Age... 63 2.1 TheInternationalScene... 64 2.1.1 ProtectionoftheRighttoPrivacy... 64 xi

xii Contents 2.1.2 International Regulation for Protection of Personal Data 65 2.1.3 International Regulation of Encryption Products...... 68 2.1.4 International Regulation of Decryption Products...... 68 2.2 TheUnitedStates... 69 2.2.1 ProtectionoftheRighttoPrivacy... 69 2.2.2 Protection of the Freedom of Speech... 74 2.2.3 American Regulation of Encryption Products... 80 2.2.4 American Regulation of Decryption Products.... 85 2.3 TheEuropeanUnion... 88 2.3.1 ProtectionoftheRighttoPrivacy... 89 2.3.2 EURegulationofEncryption... 95 2.3.3 EURegulationofCopyright... 99 2.4 Other Countries.... 102 2.4.1 Britain... 102 2.4.2 Canada... 104 2.4.3 Australia... 105 3 The Legal Framework in Israel... 107 3.1 TheRighttoPrivacy... 107 3.1.1 SearchandSeizure... 108 3.1.2 SecretMonitoringinIsraeliLaw... 110 3.2 Freedom of Speech.... 119 3.2.1 Liability of Service Providers... 119 3.2.2 EnforcementofHackingProhibitions... 122 3.3 IsraeliRegulationofEncryption... 124 3.3.1 The Framework of the Legal Arrangements up to 1998. 125 3.3.2 The Framework of the Legal Arrangements After 1998. 128 3.4 FreedomofOccupation... 132 3.5 PropertyRights... 135 4 Technological Issues... 137 4.1 What is Encryption? The Technological Basis... 137 4.2 The Basic Principle of Encryption: Letter Replacement...... 139 4.3 SymmetricalEncryption... 139 4.4 AsymmetricalEncryption:PublicKeyandPrivateKey... 141 4.4.1 TheRSAEncryptionMethod... 141 4.4.2 AnalysisoftheRSAMethod... 142 4.5 HowisInformationGatheredontheInternet?... 146 4.5.1 General Background.... 146 4.5.2 Means of Collecting Information and Monitoring theinternet... 148

Contents xiii 4.5.3 CollectionofinformationontheserverorthePC... 152 5 Recommendations: Is There a Need for New Regulations?.. 155 5.1 The Existing System s Suitability for the Internet..... 155 5.2 ImplementingExistingLegalRegulationsfortheInternet... 156 5.3 ProtectingtheRighttoPrivacy... 157 5.4 The Liability of Internet Service Providers... 159 5.5 Regulating Encryption Products to Protect Freedom ofoccupation... 160 Concluding Remarks... 165 Name Index... 169 Subject Index... 173

Introduction In recent years, it has become tragically apparent that terrorism is a global phenomenon. The response the war on terror has thus, unsurprisingly and necessarily, become global too. 1 When terrorism takes place in public spaces, shopping malls, subways, buses, restaurants and cafes, the war on terror takes the form of camera monitors, airport checks, data surveillance, and the increased presence of security forces in all these spaces. Terrorists make use of the public media by relying on the certainty that their brutal acts will be reported in headline news, so they can capture the front page to achieve their political gains. The war on terror then responds with hot debates in newspaper columns, television talk shows, radio call-in shows, documentary movies, and public squares. Whether it is London s Hyde Park or a regular park bench of the elderly in Smallville, all of these attributes reflect the characteristics of modern wars, or perhaps post-modern warfare. They are no longer limited to a geographic front; the enemy is not always a visible army, and in some cases, it is not always possible to identify the enemy at all. Global Wars in a Global Information Environment The global war on terror is a war orchestrated by national states that are increasingly losing their role as the centers of power in modern times. Redefining national borders is no longer the goal of the new global war. 1 The term war on terror is controversial in itself, and terrorism, too, is difficult to define. The term war on terror has been applied in many contexts over the past century. This book uses the term as it was first applied by President George W. Bush in his address to a joint session of Congress on September 20, 2001. See http://www.whitehouse.gov/news/releases/2001/09/20010920-8.html. M. C. Golumbic, Fighting Terror Online. 1 C Springer 2008

2 Introduction Terrorists often set a far more ambitious objective for themselves, that of shaking the fundamental principles of the free world and setting new cultural hegemonies. Terrorism threatens civilians, everywhere and nowhere in particular. Individuals still seek security across national borders. States, however, can no longer provide a remedy against terror and, unfortunately, too often fail to secure the personal safety of their citizens. The enemy becomes an undefined them, while we remain we. Old dichotomies and long-established, bloody principles of war collapse, while new ones emerge to replace them. The new war on terror takes place in yet another arena, the digital information environment, namely the Internet. The use of means of communications in the context of war is not new. Wherever communications have been used in the battlefield, they have also been a target. This is true of the pigeon carrying a message between the king and his soldiers, of human messengers running between camps, of the telegraph, the telephone, the radio, and recently the Internet. A message can kill; a message can save lives. It is a target and a crucial tool, always an enigma to be deciphered, interpreted and applied. War and technology have always walked hand in hand. The machinery of war is considered one of the most powerful, motivating forces of technological progress. Most technologies have been developed as tools for warfare, been adopted as such soon after being developed in the nonmilitary market, or been created as a spin-off of warfare research. 2 The Internet is no different. This seemingly civilian and egalitarian information environment was conceived and born as a defensive infrastructure, to be resilient to attacks by the enemy. 3 It is now also being used by the new enemy, and law enforcement has no choice but to follow the terrorists, treating the Internet as a war zone. Yet, the extension of the current war on terror into the Internet is not just another development in the linear history of technological progress and war. Fighting terrorism today is unlike any other war in history. Much of the difference lies in the unique characteristics of the digital environment, which has tremendous potential and power to change the way in which we live. Within the very first few minutes of their first Internet use, most users realize its special nature and its potential for humankind. It 2 For the history of war and technology and their complex relationship, see Martin L. van Crevald, Technology and War: From 2000 B.C. to the Present (New York, 1991). 3 See Richard T. Griffiths, History of the Internet, Internet for Historians, Chapter Two: From ARPANET to World Wide Web (2002), available at http://www.let.leidenuniv.nl/history/ivh/chap2. htm.

Global Wars in a Global Information Environment 3 is already apparent that the digital environment is reshaping our personal lives, our political institutions and organizational structures, our habits and economy. Now it is also a war zone. Cyberspace is filled with a myriad of targets for terrorists and creates a new type of vulnerability in modern societies. As Thomas Ridge, former Director of Homeland Security, who emphasized America s critical need for a coordinated, comprehensive national strategy to protect against terrorist threats and attacks, noted: Information technology pervades all aspects of our daily lives, of our national lives. Its presence is felt almost every moment of every day, by every American. It pervades everything from a shipment of goods, to communications, to emergency services, and the delivery of water and electricity to our homes. All of these aspects of our life depend on a complex network of critical infrastructure information systems. Protecting this infrastructure is critically important. Disrupt it, destroy it or shut down these information networks, and you shut down America as we know it and as we live it and as we experience it every day. We need to prevent disruptions; and when they occur, we need to make sure they are infrequent, short and manageable. This is an enormously difficult challenge. It is a technical challenge, because we must always remain one step ahead of the hackers. It s a legal challenge, because this effort raises cutting-edge questions of both privacy and civil liberties. It s a political challenge, because the government must act in partnership with the private sector, since most of the assets that are involved in this effort are owned by the private sector, which owns and operates the vast majority of America s critical infrastructure. 4 This book explores the intersection where the war on terror meets the digital environment. Once we replace our enthusiasm for the tremendous educational, political, cultural, and social opportunities in the digital environment with the new mindset of the law enforcement agents who are responsible for the safety of the citizenry, the Internet no longer seems a garden of roses. The digital environment, like other civil spheres, hosts a mixture of obedient citizens and covert terrorists, mingled therein, who utilize the Net for their vicious purposes. It has a dual nature, as it simultaneously hosts users with benevolent intentions and those who use it to wreak destruction. Therefore, the innocent public arena necessarily becomes the object of law enforcement efforts. Once it was the pigeon, the messenger delivering secrets among the battle stations, that was targeted by enemy intelligence. If it were caught, the harm was the disclosure of the information carried by the bird. However, Internet communication is 4 See White House, Office of the Press Secretary, News Release, Oct. 9, 2001, available at http://www.whitehouse.gov/news/releases/2001/10/20011009-4.html.

4 Introduction not a pigeon. It is the engine of civilization in post-modern times. If it is shot down or intercepted, it is not just the carrier that loses; we all lose. Of course, we cannot afford to shut down the Internet, so the question becomes how the bird can be captured without killing it. Herein lies the dilemma to be explored in the chapters that follow. TheDeclineoftheState The war on terror sheds light on and challenges the role of the State any state in the digital environment. By State we mean the democratic system of government, which is elected by the people to govern themselves, a government that, in liberal democracies, acts as the representative of the people itself. The development of the digital environment during the last decade of the twentieth century is associated with a general decline in the role of the State. By the end of the twentieth century, it seemed that we had entered a post-national era. The advances of technology mean that citizens rely less on the State to provide various needs. Once communications, commerce, education and consumption of information, culture and entertainment are conducted over international networks, physical borders matter less and less. 5 Some governments around the world realized this immediately and sought to limit their citizens access to the Internet. A Chinese surfer has a very different Internet experience than that of a French surfer, not to mention an Iranian or a North Korean versus an Italian. 6 Some states have attempted to reinstate or transpose the physical borders into cyberspace. The well-known decision of French courts to require U.S.-based Yahoo! to prevent French surfers from accessing Nazi memorabilia on Yahoo! s auction site is a clear illustration, 7 as is Google s reported agreement to 5 See David R. Johnson & David G. Post, Law and Borders: The Rise of Law in Cyberspace, 48 Stan. L.Rev. 1367 (1996); BORDERS IN CYBERSPACE: INFORMATION POLICY AND THE GLOBAL INFORMATION INFRASTRUCTURE (Brian Kahin & Charles Nesson, eds., MIT Press, 1997). 6 See the country studies performed by the OpenNet Initative, available at http://www. opennetinitiative.net. 7 See the decision in France: League Against Racism and Anti-Semitism (LICRA) v. Yahoo! Inc., Yahoo! France (County Court, Paris, 20.11.00), available at http://www.lapres.net/yahen11.html, and a related decision on the enforceability of the French decision in the United States: Yahoo! Inc. v. La Ligue Contre Le Racisme Et L Antisemitisme, 433 F.3d 1199 (9th Cir. 2006), cert. denied, La Ligue Contre le Racisme et l Antisemitisme v. Yahoo! Inc., 126 S.Ct. 2332 (2006). For a discussion, see Joel R. Reidenberg, Yahoo and Democracy on the Internet, 42JURIMETRICS 261 (2002).

TheDeclineoftheState 5 censor the search results of Chinese users. 8 The New York Times limited the access of British users to a story about a pending terror investigation in the UK, citing adherence to local UK sub-judice law. 9 These cases illustrate the tension between global technology and the local sovereignty of states. States lose their power when faced with borderless alternatives, and almost instinctively, attempt to hold on to their territorial power and re-establish it in the online environment. The State s loss of power also raises some doubts as to the very legitimacy of the State. If it no longer plays a fundamental role in our lives, perhaps the State is obsolete. While this is obviously an extreme claim, one to which we do not subscribe, it might imply that in particular areas, the State, which functions through the rule of law within national borders, may no longer be useful in Cyberland. Consider the contours of free speech, for instance. A state may attempt to regulate obscenity and declare all obscene content not to be speech for the purpose of its free speech jurisprudence. This is the legal situation in the United States. Such a declaration results in a legal debate as to the definition of obscenity, but that is an American debate. 10 The point here is that once access to obscene material is easily available through the Internet, the local definitions whatever they are no longer matter. Or, consider another example virtual casinos. Once citizens realize that they can gamble online, while physically located in their no-gambling allowed state, it suddenly seems that the old rule is no longer valid. Of course, we might re-validate it, for example by imposing duties on financial intermediaries, 11 but the doubts raised by the new technologies are arrows shot at the core of the legitimacy of the State. States have also lost power to corporations. As local corporations grow into giant global, multinational entities, operating in many countries, they can juggle funds and activities between them. Some of the biggest global corporations have become so powerful that they are richer than most states, and they have learned that they can manipulate local governments 8 See Michael Liedtke, Google Agrees to Censor Results in China, AP, Jan. 24, 2006, available at http://msl1.mit.edu/furdlog/docs/2006-01-25_apwire_google_cn.pdf 9 See Tom Zeller, Times Withholds Web Article in Britain, New York Times, August 29, 2006. 10 The current judicial test to determine the contours of obscenity were outlined in Miller v. California, 413 U.S. 15 (1973). The Supreme Court struggled with its application to cyberspace. In the context discussed here, an interesting controversy revolved around one element of the Miller test, that which addresses contemporary community standards. How should a community be identified on the Internet? See Ashcroft v. American Civil Liberties Union, 535 U.S. 564 (2002). 11 See Unlawful Internet Gambling Enforcement Act of 2006, codified as 31 U.S.C. 5361 5367.

6 Introduction to meet their needs. When some developed countries pushed for a new global order in intellectual property laws, for example, they were impelled to do so by the multinational corporations acting from within these countries. 12 The rise of multinational corporations is the result of many factors, with the information-based economy and global technologies comprising just two aspects thereof. Whatever the reasons may be, however, the result is that the State has lost power. Yet another reason for the demise of the power of the State is that new technologies offer code as a substitute for the main tool of governance that the State traditionally held the law. Joel Reidenberg pointed to Lex Informatica, 13 and Lawrence Lessig coined the phrase code is law. 14 Technology, goes the argument, affects the way in which we behave no less than state-issued laws. In many cases, code actually replaces the law. Where the law fails to protect our privacy, Privacy Enhancing Technologies (PETs) attempt to provide an answer. When copyright owners are disappointed with the legal protection provided by the State, they turn to Digital Rights Managements (DRMs) to fill in the void. The result is the commodification of information, at the expense of a free, open commons. 15 Contracts embedded in code are self-executed, meaning that the parties no longer rely on the State to provide enforcement. Instead, it is code that serves as the solution. The overall consequence is that the Internet, a distributed network that belongs to no one and is run by no government, is packed with the commercial interests of multinational corporations who have only one goal: promoting their own self-interests. This is where the decline of the State is most visible. The Comeback of the State Faced with the decline of their power, states have found themselves weaker than ever before and unequipped to face the new global terrorism. The decline of the State in the digital environment reached its lowest point 12 See Pamela Samuelson, The Copyright Grab, Wired 4.01 (1996); Peter Drahos, Negotiating Intellectual Property Rights: Between Coercion and Dialogue, in Global Intellectual Property Rights: Knowledge, Access and Development 161 (Peter Drahos & Ruth Mayne, eds., 2002). 13 Joel R. Reidenberg, Lex Informatica: The Formulation of Information Policy Rules through Technology, 76 Texas L. Rev. 553 (1998). 14 Lawrence Lessig, CODE AND OTHER LAWS OF CYBERSPACE (New York, Basic Books, 1999). 15 For a critical analysis of the process of commodification, see The Commodification of Information (Niva Elkin-Koren & Neil Netanel, eds., Kluwer Information Law Series, 2002). For a discussion of the counter-forces pushing towards a commons-based environment, see Yochai Benkler, THE WEALTH OF NETWORKS (2006).

The Comeback of the State 7 just before the realization that a new kind of threat was at work that of global terrorism. Moreover, a new type of war a war on terror would be required in response to the threat, despite the lack of agreement on how such a war should be handled. Faced with new threats of global terrorism and the need to undertake enforcement measures in the online environment, governments around the world found themselves struggling to reinstate their power in the digital environment. Some would argue that this process was, and still is, inevitable, and that the war on terror merely serves as a cover for the continued attempts by states to assert their control over a network that remains out of reach for local governments and threatens their sovereignty. However, traditional governmental tools do not fit the new digital arena. During the temporary absence of the State from the information arena, the latter has changed. Perhaps it has not yet fully matured, but the information arena has surely developed some habits. There are powerful private entities in this arena, and many of these have acquired their power by pushing governments to change their internal laws in favor of these influential groups. Intellectual property laws, especially copyright laws, and rules regulating the liability of Online Service Providers (OSPs) are chief examples 16, as well as new rules governing online commercial competition, such as the new life of the ancient tort of trespass to chattels. 17 Governments wishing to regain control must adapt to the new situation. The State has done so by holding hands with the private nodes of power. The invisible handshake 18 between the market and the State represents the cooperation between governments and large market players that emerged in the information environment during the late 1990s. While this partnership is significant, it is invisible to most users. As Richard Clarke, former special advisor to President Bush for Cyber Security, appointed shortly after 9/11, warned: America has built cyberspace, and America must now defend its cyberspace. But it can only do that in partnership with industry. [...] Private sector companies own and operate most of our critical infrastructure 16 Niva Elkin-Koren, Copyright Law and Social Dialogue on the Information Superhighway: The Case Against Copyright Liability of Bulletin Board Operators, 13CARDOZO ARTS &ENT. L.J. 345 (1995). 17 Niva Elkin-Koren, Let the Crawlers Crawl: On Virtual Gatekeepers and the Right to Exclude Indexing, 26 U. Dayton L. Rev. 179 (2001). 18 Michael D. Birnhack & Niva Elkin-Koren, The Invisible Handshake: The Reemergence of the State in the Digital Environment, 8VIRGINIA J. OF LAW AND TECH. no. 6 (2003), 1 57.

8 Introduction cyberspace systems. So we have been working closely with industry. [...] We ll be working even more with them in the future, to secure our cyberspace from a range of possible threats, from hackers to criminals to terrorist groups, to foreign nations, which might use cyber war against us in the future. 19 The invisible handshake is a simple phenomenon, yet a disturbing one, because it makes the State reliant on the cooperation of corporations for executing some of its basic roles, such as regulation and enforcement. Such is the case when online service providers are asked to report suspicious behavior to the authorities or are asked to implement various filtering systems. Privatizing the State s enforcement functions liberates law enforcement agencies from some of the restraints that limit the exercise of power by governments. It therefore renders useless some traditional checks and balances that safeguard individual liberty and provide guarantees against governmental abuse of power. When dot.com holds hands with dot.gov, law enforcement tasks are de-facto privatized to non-elected, commercially motivated entities, accountable to no one. The State is back in the picture, but in a completely new way. One of the main tools that the State has traditionally used to perform its designated tasks is the law. The American founding fathers taught us that the government is one of laws, not of men. The powers of the State were determined by the law, examined under the law, and limited by the law. The law served as a space where old war-related dilemmas were addressed. The law is also the language of the invisible handshake and occupies the space where the current comeback of the State is taking place. When the state acts indirectly through private corporations, it bypasses the fundamental checks and balances set in constitutional law. Balancing Wars through the Law Wartime dilemmas are not a new phenomenon. How should a sovereign country treat civilian populations in an occupied territory during wartime? How should prisoners of war be treated, particularly if they are believed to have information that can save many lives (the ticking bomb case)? As 19 See White House, Office of the Press Secretary, News Release, Oct. 9, 2001, available at http://www.whitehouse.gov/news/releases/2001/10/20011009-4.html.

Balancing Wars through the Law 9 the war extends beyond the battlefield itself, what are the ethical, political, or legal limits? 20 Propaganda and other means of psychological warfare raise yet another set of problems. Can a government deliberately circulate disinformation in order to mislead the enemy, even though it may confuse or mislead its own people? Can the press report everything that it knows? Is information about military activity fit to print? Is there a limit to the freedom of speech of citizens who object to the war and openly support the enemy or who may even urge soldiers to disobey their commanders? These and many other issues cannot be ignored. Many of the answers are difficult to find. Usually, the places to which we look in our search for answers are in ethics, politics, and perhaps justice. The law is often the focal point where all these considerations converge. A constitution often reflects the morality of the people, and courts strive to interpret it to maintain its integrity to this morality. 21 Where politicians often limit their view to the here and now with their horizons often not extending beyond the next elections the law has the ability to consider both the immediate problem and the long-term implications thereof. This is by no means an easy task. Courts often lack the ability and expertise to evaluate military needs. They are often hesitant, as they should be, and are frequently afraid to make bold decisions when it comes to military issues. This is only natural and understandable. Few are willing to take the risk when human lives are at stake. It is thus not surprising that courts seek escape routes, usually in doctrines of non-justiciability. However, sometimes courts do not have the luxury of avoiding the hard cases. They might turn to international law, but often it is constitutional law that serves as the legal framework for addressing war-related dilemmas. During World War II, the U.S. Supreme Court approved the detention of American citizens of Japanese origin, in the notorious Korematsu case. 22 While the case is considered one of the darkest decisions of the U.S. Supreme Court, it is also regarded as a paradigm of an elaborate methodology of constitutional balancing. Today, this method is utilized in many legal systems in liberal democracies. For example, the European Convention on Human Rights (ECHR) reflects the understanding that human rights are not absolutes and that on some occasions rights need to 20 See Gabriel Weimann, TERROR ON THE INTERNET:THE NEW ARENA, THE NEW CHALLENGES (USIP Press Books, 2006). 21 For constitutional interpretation based on morality, see Ronald Dworkin, FREEDOM S LAW: THE MORAL READING OF THE AMERICAN CONSTITUTION (Harvard University Press, 1996). 22 See Korematsu v. United States, 323 U.S. 214 (1944).

10 Introduction be balanced against each other. Sometimes it is a social need that requires compromising on human rights. Freedom of the press can be halted in order to avoid disclosing a secret military operation as it is taking place. The privacy of suspects may be violated if there is a reasonable basis for believing that they are hiding crucial enemy secrets. Sometimes liberty itself may be compromised in order to extract vital information from a suspect, such as knowledge of a bomb about to explode on a city bus (the ticking bomb problem ). These constitutional tools provide a framework for the law in regulating some-war-related dilemmas. Surely, not all problems can be solved in solemn judicial chambers. In many cases, the balancing of military interests with human rights is so difficult that it is almost unbearable. However, we may be comforted by the fact that legal systems have gained knowledge and experience in dealing with these complex matters. As legal systems have learned from each other s experience, especially since the end of World War II, our legal understanding of human rights continues to develop and the law is better equipped to address these questions. Digital Law Today, liberal democracies are faced with a new kind of war the war on terror and a new battlefield the Internet. Are the old laws of war still relevant? In answering this question, we need to bear in mind the complex and dialectic relationship between law and technology. It is wrong as a matter of description and useless as a matter of normative judgment to declare that one of the two rivals law or technology trumps the other. 23 Indeed, it is often the case that the law is challenged by new technologies. In this sense, the law often lags behind new technologies. Most legal rules were drafted before the advent of the Internet. For instance, how does copyright law apply in the digital environment? Simple acts that do not trigger copyright issues at all in the physical world, such as lending a book to a friend, might suddenly be treated as copying, publishing, distributing, or displaying to the public when performed in the digital context. In response to the new environment, some rules have been drafted to address problems such as those related to defamatory speech posted on a website. Should the law treat the website operator as it treats the publisher 23 Niva Elkin-Koren, Making Technology Visible: Liability of Intent Service Providers for Peerto-Peer Traffic, 9 NYU J. OF LEGIS. AND PUBLIC POLICY 15 (2006).

Digital Law 11 of a book or a newspaper? Should ISPs be exempted from liability for any injurious materials exchanged by their patrons? 24 The law, by its very nature, is often called upon to address disputes over uses of new platforms and therefore must respond to the challenges of new technologies. Sometimes new rules are drafted by the legislature, and other times courts interpret old rules so that they fit the new technology. Some of these new or renewed rules might fail, but then they will be replaced by even newer ones. The American experience with regulating children s access to online pornography is an example. 25 In yet other cases, technology responds to the legal rule. The rise of non-centralized peer-to-peer filesharing systems, like Kazaa after the legal defeat of Napster, is a wellknown example. 26 Finally, in some cases, technology may substitute for law. Code may replace law in protecting privacy, as in the cases of Privacy Enhancing Technologies (PETs) such as P3P and anonymizer.com. 27 Rather than imposing access restrictions to online materials, one may simply use a filter. Instead of prohibiting unauthorized copying, Digital Rights Management systems, used in formats such as ebooks and pdf files, may limit the technical ability to redistribute or make copies. In this sense, code becomes law. However, even this type of regulation by code would be subject to the law and its underlying principles. 24 See 47 U.S.C. 230, and its interpretation in Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997). See also Batzel v. Smith, 333 F.3d 1081 (9th Cir. 2003), and compare it to the European solution to the problem of ISP liability, in Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on Certain Legal Aspects of Information Society Services, in particular Electronic Commerce, in the Internal Market (Directive on Electronic Commerce), articles 12 15. 25 Congress and the Courts are still engaged in a 10-year old struggle in which Congress enacts laws that are then invalidated by the courts. This process is repeated over and over, generally with Congress losing the battle. For example, Congress enacted the Communications Decency Act of 1996 (CDA), which was declared unconstitutional in Reno v. ACLU, 929 F. Supp. 824 (E.D. Pa., 1996), aff d, Reno v. ACLU, 521 U.S. 844 (1997). Following these decisions, Congress enacted the Child Online Protection Act (COPA), which, after several tests in the lower courts and the Supreme Court, is still under preliminary injunction. See American Civil Liberties Union v. Reno, 31 F.Supp.2d 473 (E.D.Pa. 1999), aff d, American Civil Liberties Union v. Reno, 217 F.3d 162 (3rd Cir., 2000), reve d, Ashcroft v. American Civil Liberties Union, 535 U.S. 564 (2002); remanded, American Civil Liberties Union v. Ashcroft, 322 F.3d 240 (3rd Cir. 2003), aff d and remanded, Ashcroft v. American Civil Liberties Union, 542 U.S. 656 (2004). At the time of this writing, the trial on the merits of the case is taking place in the District Court (Oct. 2006). 26 See A&M Records, Inc. v. Napster, Inc., 239 F.3d 1004 (9th Cir. 2001). Later cases discussed various other p2p systems, finding they violate copyright. In re Aimster Copyright Litigation, 334 F.3d 643 (7th Cir. 2003); Metro-Goldwyn-Mayer Studios, Inc. v. Grokster Ltd 125 S.Ct. 2764 (2005). 27 See http://www.anonymizer.com/ and http://www.w3.org/p3p/ respectively.

12 Introduction When new laws are made, be it by the legislature, courts, or the executive branch, and when we evaluate new laws, we need to bear this complex relationship in mind. Laws reflect ideology, ethics, social norms, and cultural values. They have a goal and a purpose, namely, to improve our lives in the community. The law is a fundamental social instrument in modern democracies, a fact that is sometimes forgotten. Hence, we should not seek to get rid of our laws too quickly. We should decipher them and study their underlying purpose. We should then study the new technologies, the opportunities that are embedded within them and the values that they reflect, as well as their negative consequences. When devising legal solutions, one should bear in mind that whatever stance is chosen, it is likely to have an effect. Technology might respond to a law in a way that would render the law obsolete within 10 minutes after it takes effect. We should seek solutions by going back and forth between the law, with its social goals, and technology, including its opportunities and negative consequences, in order to find the equilibrium between them. The Law of Digital Wars This book attempts to tie together three elements that converge here: security, technology, and the law. Should the law regulate the conflicts between national security needs and human rights when it comes to the digital environment? How can it best do so? What is the golden path that will allow us to achieve our optimal security goals while causing minimal harm to our civil activities, which all take place in the same arena? These issues are put in the context of the new threats posed by global terrorism and the war on terror, as well as the decline of the State and its reemergence in the digital environment. It is the context of a dynamic technology that interacts dialectically with the law. An Outline of the Book We begin by outlining the framework of this book, that is, the comeback of the State in the digital environment. Chapter 1 will present the main theme of the book the balance between the need for security and the safeguarding of civil liberties. We will first map the threats, both physical and virtual, particularly in the areas of data protection and monitoring of

An Outline of the Book 13 information, and then address the issues of psychological and informational warfare, with a focus on propaganda. Security threats within the online environment can also be classified based on the type of damage caused, whether physical or non-physical. In the category of non-physical damage, we can include the term soft war, referring to the dissemination of false information for propaganda purposes and demoralization. The legal problems that arise in connection with the issues of incitement, sedition, disinformation, hostile propaganda, and hate speech have been dealt with in depth in the pre-digital environment. Within that framework, many legal systems have devised a series of constitutional balances to guide both the executive and the judiciary branches. The issues covered include the tension between security needs and the freedom of the press, the public interest in the maintenance of order versus the freedom to demonstrate, and the limits on forms of political expression that offend the majority. The chapter continues with a discussion of the preservation of civil liberties in the information age. Individual subsections will deal with topics about the right to privacy, freedom of speech, freedom of occupation, market intervention and research and development considerations, and the influence of encryption regulation on electronic commerce. Building on this theoretical basis, Chapter 2 demonstrates how legal systems worldwide have dealt with these challenges. Here we examine international regulations, as well as laws in the United States, the European Union, and several other countries including Britain, Canada, and Australia in an effort to determine how the world is balancing the threat of online terrorism with the need to safeguard civil rights. A similar examination of how the Israeli legal system is dealing with this challenge is the focus of Chapter 3. Chapter 4 offers a technical examination of encryption and explains how information is gathered on the Internet. Encryption software is one of the most common and effective means of protection. In the legal sphere, the threat of information warfare demands a reconsideration of the regulation of encryption products. Such products serve the State in securing the information in its possession, but may also serve hostile groups in achieving their aims. The regulation of encryption products is an issue that emphasizes the questions underlying the whole discussion: the balance between security needs and individual rights, the cost of intervention in the marketplace, and, fundamentally, the applicability of traditional legal concepts to the online environment. Finally, Chapter 5 assesses the law s ability to regulate technology in its efforts to assist law enforcement agencies in the war on terror and offers recommendations for new regulations.