Electronic Data Records Law | How to Win E-Discovery

Augmented Reality Property Protection

Augmented reality apps enable the user of a mobile device to see data and symbols laid over the image displayed in real time from the device’s camera.  

Data Over Famous Images

For example, while standing outside a famous commercial building like Caesars Palace in Las Vegas, the user could point the camera on her Android smartphone at the building. The phone could display a live video image of the building.

As that image is displayed, an augmented reality app could use
geolocation and image recognition technology to discern that the video shows an image of the famous building.

With the knowledge that CP is being displayed, the app might cause to be displayed on top of the image additional information, such as an advertisement that says, “Thinking of staying at Caesars Palace? We’ll give you a better deal down the street.” Or (hypothetically speaking) the app might display remarks from other users about Caesars Palace, like “CP is a dump!”

What legal steps might the owner of Caesars Palace take to prevent apps from displaying undesirable statements over the building’s image or to the side of the building’s image?

Trademark and Copyright

The owners of famous commercial properties sometimes claim trademark or copyright protection for the appearances of their properties. Caesars Palace might assert that the maker of the app infringes its trademark or copyright.

The mixed reality app maker, however, might counter that its app makes no more than fair and nominative use of the trademark or copyright.  


Publication of Travel Guide

The owner of a business might have a claim against the publisher of an app for defamation or commercial disparagement. The law protects a business like CP from the publication of a false statement that injures the business.

The app maker, however, might argue it is subject to the same rules and privileges as the publisher of an online travel guide that includes ads and user comments. Today a user at an online travel guide can search the words “caesars palace” and pull up reviews of Caesars Palace, as well as ads from CP’s competitors.

Yes, the publisher of an online travel guide can be liable for knowing publication of a false statement that damages a business. But free speech and other protections afford the publisher considerable leeway to publish opinions about a business.


End User License Agreement for Real Property?

Allow me to speculate. The owner of a property like Caesars Palace might try to form a contract with anyone who captures a smartphone image of the building. The contract might be like an end user license agreement (EULA).  It might say, for instance, that the image is copyrighted/trademarked and the user agrees not to use the image with a non-approved app.

Further, to add incentive and consideration to the contract, the EULA might say that the user who complies with the EULA will be afforded all of the privileges (such as CP perks and discounts) available through the use of augmented reality apps that CP has approved.

To enforce this EULA against each individual user would be difficult for CP. However, CP might try to take action against non-approved app makers. CP might assert that app makers who induce users to use non-approved apps are wrongfully:

* interfering with the contractual relationship between CP and the users; and

* committing the tort of inducing someone to violate the intellectual property of another.

CP’s owner might publish notices of the EULA as terms posted on the premises around the building. The terms might be posted as full sentences, or as references to a web address (Example: “Capturing images of the CP facilities is subject to terms published at www.caesarspalace.com/IPterms.”), or as a QR code. 


Municipal Ordinance?

A local government like the City of Las Vegas might adopt an ordinance to regulate the presentation of data over live images of territory and buildings within the city. The justification for the ordinance might be to preserve the beauty and decorum of the city scape, just as zoning laws do. That justification may not be compelling enough under the US Constitution to support restraining the rights of users and app makers to freedom of speech.

–Benjamin Wright

Mr. Wright teaches the law of data security and investigations at the SANS Institute.

Google+

Barcodes as EULAs, Notices, Contracts, Disclaimers, Legal Terms

Augmented Reality as No Trespassing Sign

An app on a smartphone (iPhone, Android) can use the phone's camera to read a bar code (QR Code) and then display information associated with the code.

For instance, Stickybits offers custom barcode stickers, where each sticker bears a unique code and refers to unique information.  A user can stick the code on any physical object or space, such as a coffee pot or the door to a hotel.  Then the user can direct that when a smartphone scans the code, the phone will display text, an image, a video, a web page and so on.

With the right app, the phone might display a form of “augmented reality,” which presents a live video image of the physical object or space to which the sticker is attached, together with additional information such as a video.

I ponder this Buck Rogers technology.  How might it be used to present legal information in association with an object or space?  Example:  I could place a bar code on a bottle of medicine.  Under the code might be the words “Scan for Warnings, Disclaimers and Terms of Use” . . . not unlike the “Terms of Use” hyperlink commonly at the bottom of web pages today.  If a patient scans the code, his phone could present a lengthy contract, saying that the patient agrees to the contract by opening the bottle.

Thus a new frontier will open in the eternal war over contracts of adhesion.  The war has included battles over shrinkwrap agreements (on boxes of software), clickwrap agreements, and end user license agreements.

A student in one of my SANS courses came to call the terms of use on web pages “drive-by contracts” because a user might be deemed to have agreed to a contract simply by visiting a web page.

How enforceable are such agreements?  The answer is it depends.  I suspect courts are more ready to enforce “drive-by contracts,” web no-trespassing notices*, augmented reality agreements and the like against unsympathetic, parties such as hackers or malicious intruders, and against sophisticated parties such as professional investigators.

Update:  California attorney Dan Balsam publishes a contract he says is binding on spammers. http://hack-igations.blogspot.com/2010/12/web-contract-eula-published-to-world.html More: Can hackers consent and agree to be surveilled and thwarted?

–-Benjamin Wright

Mr. Wright teaches cyber investigation law at the SANS Institute.

* A web no-trespassing sign might deter so-called OSINT (open source intelligence) gathering by the adversaries of the web site owner.  Adversaries might include plaintiff lawyers or labor union organizers.

Public Relations of a Data Security Breach?

Professional Education - Technology

[Update:  I've an evaluating Google Buzz as a vehicle for crisis communications, such as public announcements and interaction following an information security incident.]

Public communications are an under-appreciated facet of cybersecurity.  Over the years, I have increasingly emphasized public communications in my SANS LEG523 course on the law of information security (which includes e-discovery, record retention and internal investigations). 

Public communications is much more than just press releases and press conferences.  It embraces a wide array of
public statements related to IT security -- policies, disclaimers, web notices, contracts, network terms & conditions, blogs, filings submitted to regulators, interactions with law enforcement, breach notices to consumers, declarations made in courts of law, and much, much more. 

For instance, observe how central publicity is to the pivotal IT security lawsuit PlainsCapital Bank v. Hillary Machinery.

If anything could summarize my 5-day LEG523 course, it would be this:  Words count, and words need to selected carefully.  The words your enterprise utters to the world can have an astonishing impact on legal liability, public reputation, regulatory compliance, the cooperation (or not) of law enforcement and so on.  Silence also counts, and silence is often a bad idea. 

No other training course in the world will shake up your thinking about information and computer security as much as LEG523. 

I'd be happy to answer questions about the course.

Learn more and register.

--Benjamin Wright, Senior Legal Issues Instructor, SANS Institute

Employee Privacy on Social Network

Trespassing in Cyberspace

Computer Investigation Law

Investigators engaged in electronic discovery should be mindful of posted terms, conditions, EULAs, labels, notices, warnings, banners, contracts, agreements and no-trespassing signs.  They can have legal effect in the electronic world, and may be binding on an investigator who encounters them. 

Consider Pietrylo v. Hillstone Restaurant Group.  

While off-duty, restaurant employees maintained a password-protected MySpace forum, labeled as “talk about all the crap/drama/and gossip occurring in our workplace, without having to worry about outside eyes prying in.”  Pietrylo created and maintained the forum, explicitly designated it as “invitation only,” and distributed passwords to a limited number of employees.  One of these employees gave her password (whether voluntarily or otherwise is unclear) to restaurant management.  Management accessed the forum, and discovered . . .