Simple rules for protecting your domain name

We work with a lot of internet service providers, and one of the biggest headaches is determining who actually owns a particular domain name or account, particularly when the website is created by a third-party webmaster or other service provider. Here are a few tips which will help you protect your valuable online presence:

• Register the account yourself, in the company name, with a company credit card
• Don’t give out the password except as needed
• If your web designer or staff opened the account, make sure someone in management has the password as well (or, better yet, require that it be re-registered in the name of the company)
• Make sure you change the password before firing anyone who has access to the account
• Most registrars offer the ability to lock a domain name, use it!
• Make sure you are listed as both the registrant and administrative contact for the domain name
• Use an e-mail address for the account which you know you’ll keep, and which isn’t in a domain which is in the account
• Keep an offline backup of the website
• Address domain/password ownership in any contract for design or hosting (or, in the case of business partners, in the shareholder’s agreement

CNet offers up another excellent idea – maintain (or create) a copy of the company website on a second server if you think (or know) that your webmaster may not be around for long. This allows you to switch to the backup website quickly in the event of a problem.

California dreaming? Not for online businesses

Most online business have terms and conditions which require that litigation brought relating to those businesses be brought in the business’ preferred jurisdiction. That, of course, make sense for the business, particularly smaller businesses which don’t have the resources for lawsuits brought over the entire country. Of course, the flip side is that unhappy consumers end up with a lousy draw, and may be forced to bring any litigation in an unfriendly jurisdiction quite far away from home.

Apparently California is willing to take a second look at those clauses, at least where California public policy is concerned. In a case involving the massive disclosure of data by AOL, a California court has decided to permit the litigation to proceed in California, notwithstanding the jurisdiction clause in AOL’s contract with its customers. That clause requires that any litigation be brought in Virginia.

Given the outrage over this particular incident, the decision may not be surprising, but it may well pave the way for more discretionary application of online jurisdiction clauses

What good is a privacy policy?

Privacy is a tricky subject in the US, in large part because we don’t do much to protect it. On the consumer side, American consumers tend to opt for convenience over security, as anyone who has ever done online banking in Europe can attest. On the legal side, there is no overarching privacy law governing the protection of personal data. Instead we make do with a hodge-podge of state laws and federal laws intended to cover certain industries or limited ranges of data, such as e-mail communications or health information. Many of the state laws focus on notice after a breach, rather than protecting the data itself, leaving most consumer with two options: keep your data to yourself or enter into a contract to protect your information.

A recent case out of Louisiana illustrates the limits to the latter approach. In Pinero v. Jackson Hewitt Tax Service Inc., a Louisiana court decided that simply dropping old tax records in a dumpster doesn’t violate that state’s notification law, and that the plaintiff could not recover based on a signed “privacy policy,” at least absent actual damages. While the former is surprising enough, the latter decision would seem to allow businesses a fair amount of leeway in the handling of personal data even in the face of a clearly stated (and agreed to) policy.

It’s a somewhat chilling reminder that privacy protection is a do-it-yourself activity in this country.

Online visitors only, please

As of yesterday, individuals who are permitted to travel to the US without a visa (on the visa waiver program) must register with the Department of Homeland Security using the Electronic System for Travel Authorization (ESTA). Previously, ESTA had been largely voluntary.

The ESTA questionnaire collects the same information as the previous paper application (I-94W), and there is no fee involved. Normally, travel is approved immediately, although some ineligible travelers will be notified to apply for a visa at the local US consulate. Pre-registration is good for 2 years and can be renewed online.

The ESTA system is online only, so unplugged travelers will require assistance from wired friends, family, or, most likely, travel agents. Some observers expect other countries to make life more difficult for US travelers in the future, as retribution for increasingly onerous entry requirements.

Mixed verdict in Megan Meier/My Space case

Last Wednesday, the Jury in the case of Megan Meier – the 13-year-old who committed suicide in 2007 after the defendant Lori Drew, her daughter,and another teenage girl first befriended Megan and then bullied her under a fake MySpace profile – came to a verdict.
The jury convicted Lori Drew of three misdemeanor computer crimes for her part in setting up the MySpace hoax, but were unable to agree on the fourth count of conspiracy.
This was the first time that a federal statute, that was designed to fight computer crimes was used to prosecute violations of a user agreement on a social networking site.
According to the Associated Press, a majority of the jurors wanted a felony conviction for Drew, but four jurors rejected that Lori Drew had conspired to harm Megan Meier, believing that she had created the false account only to obtain information about rumors on her own daughter.
Drew could face up to a year in prison and a $100,000 fine for her convictions on three misdemeanor counts of accessing computers without authorization.

Bring me your tired, your poor, your internet connected

Speaking of the visa waiver program, effective January 12, 2009, all travelers planning on entering the US under the visa waiver program (i.e., without a visa) will need to register online prior to leaving their home country. The program is free for the moment, although in this economy all bets are off (and DHS expressly reserved the right to impose a fee at some later date).

See this DHS Fact Sheet (pdf) for more information.

MySpace hoax trial begins today

The trial of Lori Drew of Missouri, will begin today in Los Angeles. The opening statements are expected this afternoon. 13 Year old Megan Meier committed suicide on October 17, 2006 after a fight with the hoax “Josh”, whom Megan thought was a 16-year old boy. Her former friend, the friend’s mother Lori Drew, and the mother’s 18 year old assistant Ashley Grills had set up the MySpace account with the fake identity of a “good-looking” boy who had just moved to the area. Megan Meier and Lori Drew’s daughter and their family were friends who lived in the same street, but the two girls drifted apart in 2006 . 

Lori Drew allegedly encouraged her daughter and her employee Ashley Grills to “flirt” with Megan. But on October 16, another girl form the neighborhood received the password for the “Josh” account and sent Megan a message, telling her that he didn’t want to be her friend anymore because she was mean to her friends. After Megan received more mean messages from other people, Ashley Grill sent Megan Meier a final Message on October 17, saying that “the world would be a better place without [her]”. Grills told Good Morning America that she had wrote that message to end Megan’s relationship with the online hoax because she thought things had gotten too far. Later Megan’s parents found that she had hanged herself with a belt in her bedroom. She died in the hospital the next day. 

After learning from Lori Drew’s involvement in the case, Missouri officials did not charge her, because they did not find any law that she had violated. Looking for anything to hold Drew responsible, the federal court in Los Angeles, where MySpace has it’s headquarter, has charged Drew with conspiracy and three counts of unauthorized access to protected computers (Computer Fraud and Abuse Act [CFAA], 18 U.S.C. § 1030). The trial will not focus on whether Drew caused Megan to commit suicide, but on whether she violated MySpace’s terms of service in order to inflict emotional distress on Megan.

Each of these charges involve a maximum prison term of five years. According to the prosecutor, this will be the first time that the statute that was originally intended to fight cyber hacking will be used in a case of cyber bullying.  Drew’s attorneys and other outside legal experts argued that a criminal convcition for a terms of service violation would be a dangerous expansion of the law. They argue that most people never read the terms of service before joining a social network. And that if Lori Drew never read the terms of service, could not have “(…)intentionally accessed and caused to be accessed a computer (…), namely, the MySpace servers (…), without authorization and in excess of authorized access, and, by means of interstate commerce obtained and caused to be obtained information from that computer to further tortious acts, namely intentional infliction of emotional distress on [Meier]”, as the indictment reads. As there is doubt as to whether the CFAA statute even applies to the conduct here, the outcome of this trial will be interesting and defining for the internet law. 

Visa-free Vítáme Vás

I’ll never forget my first trip to the Czech Republic (then still Czechoslovakia). It was snowing, and the normally 8-hour bus ride from Munich to Prague took over 14 hours, almost ten of which were just to get to the Czech border. When we did finally arrive at the border, the guards came in very brusquely and demanded all of our passports. The communist world was in the process of breathing its last death rattle at the time, but the border patrol was no less grim and unsmiling. Hence my surprise when the guard took my passport, looked at me, smiled, and told me to stay on the bus because I didn’t need a visa. The rest of the bus, neighbors and fellow Europeans, were none too happy about this show of favoritism, and left the bus into the cold, wet snow grumbling and moaning about our good fortune.

Well, it’s been a long time coming, but effective yesterday, November 17, 2008 visitors to the US from the Czech Republic can enter the US without a visa, as can citizens of Estonia, Hungary, Latvia, Lithuania, the Republic of Korea, and the Slovak Republic. The US visa waiver program has been extended to include those countries, meaning that citizens entering for less than 90 days on business or pleasure can travel without obtaining a visa beforehand.

So, to any visitors from the Czech Republic, a warm Vítáme Vás! For more, see this DHS Fact Sheet.

Germany reforms GmbH Law

On November 1, 2008, the new law to reform the existing GmbH Law (MoMiG) came into effect. The reform represents the biggest change of the act since it was original enacted in 1892. According to the German Department of Justice the reforms goals are flexibility and deregulation on the one hand, and better protection against violations on the other hand. Although the GmbH is Germany’s most common form of a limited liability company, the biggest handicap of the GmbH Law was always the difficult and expensive founding process. That lead to a wave of German entrepreneurs who founded a British “Limited” (“private company limited by shares”) instead. To strengthen the GmbH against other European corporate forms, German lawmakers reduced the costs and administrative work that is required to establish a GmbH. The required minimum founding capital has been reduced from €25,000 to €10,000. Additionally, investors are now able to form a new category of GmbH that is called “Mini-GmbH” (officially: “limited liability entrepreneurial company” – “haftungsbeschränkte Unternehmensgesellschaft, UG”). This new GmbH form can be started with a start capital of €1. However, the “Mini-GmbH” must put aside one quarter of it’s annual profits to allow the share capital to grow. When the capital is at Gmbh level, the “Mini-GmbH” can change it’s form and name into a GmbH.

Deutsche Bank Facing Investigations

Deutsche Bank AG has found itself under investigation for a second time related to its role in tax shelters which the IRS has subsequently deemed illegal. The bank was identified in a previously sealed indictment as bank “B” which arranged bogus trades to generate false losses for wealthy clients.

For more on the charges, including the US connection, read this post on taxgirl.