Congress is still trying to figure out how to handle the Internet. All too often, PK is in the position of defending online innovators from higher legal standards of secondary liability—holding a service provider or product manufacturer liable for the misdeeds of the users. Now, we’re starting to see more of this kind of secondary liability applied to online sales of physical goods. Recently, bills in both the House and Senate are trying to deputize online retail markets (like eBay) and turn them into police. Although the idea of shifting the burden of policing transactions onto these marketplaces in counterfeit cases was recently rejected by a federal court, these bills are trying to revive it.
The bills are trying to make it illegal to participate in a fencing) scheme. For those of you uninitiated into the criminal underworld, a fence is a person who buys stolen goods and resells them. For example, if I stole your TV and then gave it to my buddy who ran a local electronics shop to sell again, he would be my fence. Similarly, if my buddy didn't own an electronics store and decided to sell it on eBay, he would also be a fence (although, unlike in the real world example, if my buddy sold the TV on eBay he would create a number of digital records that he could come to regret later).
Wow, you might think, fencing should be illegal. Good news – fencing is illegal. These bills want to make it, well, more illegal. Also, they would make services that have developed expertise in creating a marketplace liable for not developing an expertise in investigating theft and criminal enterprises as well.
These bills differ in small ways, but all three have some similar themes:
Shifting the duty to investigate onto online merchants.
Here is how a stolen goods investigation usually works: something gets stolen. The owner tells the police. The police investigate. If the police decide they need information from a third party, they get a subpoena. The police use that information to continue their investigation. This is good because police are organized to investigation crimes, and presumably have an expertise in those investigations.
Here is how the bills envision the investigation to work: something gets stolen. The owner can do one of three things: file a report with the police and hand a copy of that report over to the online marketplace, OR write a letter swearing that something was stolen from them, OR produce “credible evidence” that something was stolen. This requirement varies from bill to bill, but none of the bills require that a neutral third party evaluate the request. At that point, the online marketplace has a duty to investigate anyone that the owner tells them to and make a determination about the legality of the user's wares.
Unlike the police, online marketplaces are not necessarily good at investigating users and collecting evidence of a possible crime. Also, unlike the court system, online marketplaces are not necessarily good at evaluating evidence and determining if a user is criminal. Just as YouTube is good at serving up videos but bad at determining if a specific video infringes copyright, eBay is good at providing a huge marketplace but is bad at evaluating the likelihood of an individual seller being involved in illegal activity. Furthermore, if eBay were required to support a staff of fraud investigators and judges, it would have to raise fees on all of its users. Even if these online services were “good” at investigating and tracking down criminals, would we prefer online marketplaces doing that job to the police and a court?
Failure to investigate fully creates civil liability
These bills also create massive liability for online marketplaces. If I am a retailer who has been the victim of theft and I can convince a judge that an online marketplace's investigations were inadequate, I can hold the marketplace liable. Instead of tracking down the shadowy characters who actually stole from me, or the also-shadowy characters who paid for the stolen goods, I can just sue the online marketplace – likely a company with a fixed address and easily located assets. And by the way, that online marketplace is probably a competitor of the victim retailer.
Services are forced to turn information over to third parties without a warrant
In general, it takes some sort of court order to force an online service to hand over information about one of its users. There is a good reason for that. Before a user's privacy is violated, the party that wants to get at the information has to prove to a neutral party – usually a judge – that they have a good reason for the violation. This serves as a check against unwarranted invasions of privacy. These bills throw that protection out the window for “high volume sellers.”
The definition of a high volume seller varies from bill to bill, but generally anyone selling more than $12,000 worth of goods in a year would qualify. Online marketplaces would be required to collect contact information – names, telephone numbers, email addresses, physical addresses, and the like – and hand them over to anyone who has had something stolen in the past year. It is unclear what happens if this information is incorrect or out of date. While one bill requires that the requester has reported the theft to the police, another merely requires undefined “credible evidence.” Ultimately, this low threshold provides a way for a retailer to harass online marketplaces and its users with little more than a hunch that they are up to no good.
It all comes back to liability
Like a number of internet-related conflicts going on here in Washington, this boils down to a website's responsibility for its users. Should a website that facilitates millions of interactions have an obligation to screen every one of these interactions for potential wrongdoing? Should it be forced to choose between protecting itself by blocking any user it receives a complaint about and exposing itself to liability by standing up for the user (as is the case with the current DMCA notice-and-takedown regime)?
Or should we treat these websites be like any other service? Protected by a court from unjustified privacy intrusions? Obligated to cooperate with legitimate police investigation? How about allowed to focus on doing what it does well instead of being forced to recreate the criminal justice system on its own? We wouldn't even need a new law for that.