Technology Law: What Every Business (And Business-Minded Person) Needs to Know

TECHNOLOGY LAW MARK GROSSMAN, ESQ.

WHAT EVERY BUSINESS (AND BUSINESS-MINDED PERSON) NEEDS TO KNOW REVISED EDITION

Technology Law What Every Business (and Business-Minded Person) Needs to Know Revised Edition Mark Grossman

THE SCARECROW PRESS, INC. Lanham, Maryland • Toronto • Plymouth, UK 2009

SCARECROW PRESS, INC. Published in the United States of America by Scarecrow Press, Inc. A wholly owned subsidiary of The Rowman & Littlefield Publishing Group, Inc. 4501 Forbes Boulevard, Suite 200, Lanham, Maryland 20706 www.scarecrowpress.com Estover Road Plymouth PL6 7PY United Kingdom Copyright © 2009 by Mark D. Grossman All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior permission of the publisher. British Library Cataloguing in Publication Information Available Library of Congress Cataloging-in-Publication Data Grossman, Mark, 1957– Technology law : what every business (and business-minded person) needs to know / Mark Grossman. — Rev. ed. p. cm. Includes index. ISBN 978-0-8108-6651-5 (pbk. : alk. paper) — ISBN 978-0-8108-6925-7 (ebook) 1. Computers—Law and legislation—United States. 2. Internet—Law and legislation—United States. 3. Electronic commerce—Law and legislation— United States. 4. Technology and law—United States. I. Title. KF390.5.C6G76 2009 343.7309'944—dc22 2009001335

⬁ ™ The paper used in this publication meets the minimum requirements of American National Standard for Information Sciences—Permanence of Paper for Printed Library Materials, ANSI/NISO Z39.48-1992. Manufactured in the United States of America.

Contents

Preface Introduction: Bad Contracts—A Lawyer’s Lament

v vii

1

The Law: Technology, Copyright, and Intellectual Property

1

2

Contracts and Contracting: Laws, Issues, and Tips

19

3

The Internet: E-Commerce, Legalities, and Getting Paid

41

4

Managing IT and Software

67

5

Websites: Development and Upkeep, Laws, Issues, and Solutions

93

6

Employees’ Rights, Obligations, and Pitfalls in Litigation

113

7

Piracy and Crime: Schemes and Scams

133

8

Privacy, Policy, and Encryption

161

9

Negotiations: Policies, Procedures, and Suggestions

179

History, Background, Thoughts, and Legal Considerations

199

10

Index

211

About the Author

217 iii

Preface

Technology has always fascinated me. Gemini, Apollo, and Star Trek all captivated me as a kid. I managed to marry both law and technology by becoming a tech lawyer. I had always wanted to write. I started in 1996. First, it was online with an e-zine (a term that came and went with the information superhighway) whose name I can’t remember. I assure you nobody else can recall the name either. Then it was PC World magazine, South Florida’s Daily Business Review, the Miami Herald, and now CIO magazine. This book is a collection of many of the columns I’ve written through the years. What it offers you is a chance to learn a lot of stuff about a lot of things having to do with tech law. For depth, you’ll have to hit the law reviews and textbooks. This is not a dry text. I intend this book, like my columns, to be approachable and readable. If you’re a businessperson who wants a good overview of tech law, this book is for you. If you’re a law student considering a specialty in tech law, this will give you an easy-reading overview of the trenches and what we really do as tech lawyers. If you’re a lawyer and your idea of contact with the Net is dabbling with LinkedIn, this book will help you learn to spot the issues and give you a glimpse at the answers. Whoever you are, this book will give you an excellent overview of the field. I want to thank my wife, Margie, for encouraging me to write and understanding when I wasn’t available because of it. I want to thank my three kids (now all adults), Lisa, Jon, and Jessy, for being quieter on Saturdays because Dad was writing. Now they tell me to be quiet. I keep telling them to be nice when they choose a “retirement” home for me.

v

vi

PREFACE

I would like to acknowledge Allison Hift, Bradley Gross, Brian Nelson, and Tate Stickles for contributing material. I want to thank my daughter, Jessica Grossman, for doing the final proofread of this book and for creating the index. I knew I paid that college tuition for a reason. If it weren’t for the proofreading abilities of my former assistant, Patricia Kemp, my newspaper editors would have had more work. I want to thank my current assistant, Gisela Cerra, for proofreading this second edition. Jill Weiss, an instructor at Florida International University and teacher of courses like Professional Ethics and Social Issues in Computer Science, was my one volunteer to read the entire manuscript of the first edition and provide comments. I could not thank Jill enough. Finally, I want to thank my former law clerks. They make me feel like a college football coach. Just when I fully train them, they graduate. I’ve had some excellent help over the years—Adam Feinsilver, Patricia Echeverri, Steve Canter, Tate Stickles, Sarah Santoro, and many others. I would love to hear your comments about this collection. As I sit here, in 2009, I have to consider what my “permanent” e-mail address will be. I mean, if you buy this book at an estate sale in 2023, I especially want to hear from you. So, I’m guessing my permanent address will be [email protected]. Please let me know your thoughts about this book.

Introduction Bad Contracts—A Lawyer’s Lament

This introduction is a lawyer’s lament. I’m getting soooo tired of bad contracts and bad contracting practices. Yet, they are what I see in the world of technology contracts, and things are not getting any better after all these years. I can’t take it anymore! THE FIRST DRAFT When a deal is ready for one side to take a crack at writing the first draft of the contract, the lawyer doing the drafting should most importantly write a contract that accurately tells the story. When I say, “Tells the story,” I mean that the contract must tell a reader what the business folks have decided to do. And it really is a story, albeit a boring one, when written in legalistic contract language. Now, whenever a lawyer attempts that first draft, it’s quickly apparent that the business folks never addressed numerous issues that should be addressed in the contract. Her job is to identify those issues and then address them in a way that has a tilt toward her client. Typically, the business folks discuss high-level concerns like price, quantity, delivery date, and basic functionality. They leave it to the lawyers to worry about things like limitations of liability, the details of the warranty, performance standards, and acceptance testing procedures. THE MARCH TO THE MIDDLE It’s naive to think that the best practice is to write the contract without a tilt toward your side. The norm is that this first draft will be the vii

viii

INTRODUCTION

basis for negotiations and will never see the light of day as a signed agreement. If the lawyer doing the drafting attempts to do the King Solomon thing, the result will be a contract tilted toward the other side. That’s because the other side is expecting a contract that has a bias toward the drafter. You can deny that you’ve drafted it that way all you want. Nobody will proceed any differently. They’ll still perceive the contract as a first draft for negotiation purposes and carry on accordingly. Inevitably, a contract is dragged toward the middle with the first draft defining one outside boundary. If a side is naive enough to set that boundary in the “middle,” then they’ll simply be pulled toward a new middle, which will be well over to the other side’s position. So, now I’ve defined the job of the attorney doing the drafting. Again, it’s telling the story and filling in the unspoken parts with a tilt toward your side. In the world of technology-related contracts, this isn’t what I typically see, though. Most first drafts that I see don’t tell the story and aren’t so much tilted or one-sided as just incompetently written. Onesided would be a big improvement. I can deal with that. At least, the contract told the story. Now I just have to go through the story, as told, and negotiate toward the middle ground. Incompetently written is a tougher one, though. It makes the negotiation time-consuming and frustrating. There are many reasons for this. For one, when the lawyer on the other side presents a poor document, it often means that he’s inexperienced with technology contracting or that some of his bulbs don’t light up, or both. Trust me when I say that law school isn’t always synonymous with bright. The best-case scenario, although not the usual one, is that the lawyer is experienced and bright, but wasn’t given sufficient time to write a good agreement.

THE LAMENT I started this section by saying that it’s a lawyer’s lament. What I’m bemoaning is how much I hate working with poor documents and incompetent lawyers. Whether they’re incompetent due to inexperience or are just incompetent, it’s the same frustration. I started my legal career 26 years ago by doing sophisticated corporate transactions. Whether it was a merger and acquisition, private placement, or documenting a large commercial transaction, the con-

BAD CONTRACTS—A LAWYER’S LAMENT

ix

tracting process was mature and the lawyers involved generally understood it. We had templates that were time tested and laid out the basic format for the deal documentation. The lawyers involved had typically been here and done this before. The same could have been said for the parties who were usually sophisticated and experienced in business. This isn’t the way it is in my world of technology deals. I’ve had deals with large and well-known companies where they produced the first draft, and I was blown away by the sheer incompetence of what I saw. It only gets worse when it’s a technology start-up on the other side. They may do good tech work and they may do sophisticated deals with venture capitalists. Still, when it comes to the bread and butter of documenting what for them should be an ordinary course of a business deal, they fall flat on their face. It just boggles my mind that a company in the business of developing sophisticated custom software can’t come up with a decent contract for custom developing software. It would be like shaking hands with your banker on a large commercial loan and then having him say, “I don’t know how we write up this deal. We don’t have lawyers who know how to document commercial loans.” It’s insane. Business people complain that litigation is too expensive. They’re right, it is. Therefore, it should follow that they should and would do whatever it takes to minimize the risk of ending up in a courtroom with a business dispute. They don’t. In the tech world, all too often, they reduce costs by not allocating enough money to have competent and experienced counsel negotiate and document their deals. It’s a shortsighted way to do business. To appreciate this point, you need to understand that most business litigation isn’t about liars, cheats, and thieves. It’s about honest people honestly disagreeing about enough money that they feel the need to go to war over it. (In our society, we call legalized and ritualized warfare “civil litigation.” Some speculate that it’s an improvement over dueling. Sometimes I wonder.) The contracting process isn’t the place to cut corners and save money. While it’s true that even the best contract—one that’s been thoroughly negotiated by extremely competent counsel on both sides—can land in a courtroom, it’s just not as likely. That’s because people don’t usually end up at war over clarity. One side may not like the answer that “clarity” provides, but if there’s a clear answer, litigation is usually avoided. Here’s the bottom line from the business decision perspective. While it may cost you $10,000, $20,000, $30,000 or more in legal fees

x

INTRODUCTION

to document a sophisticated technology transaction, it will cost you many multiples of these numbers to litigate it. Further, when you litigate you may not win or may not win completely. Even if you win you might not ever collect what you win. If this sounds ugly to you, that’s because it is.

SOME PROPOSED ANSWERS If you’re in the tech business, whether you develop e-commerce sites, custom write software, set up computer networks, or whatever, you should invest in an experienced technology attorney. He will develop some forms that you can use as the starting point for your routine transactions. While it’s tempting to “borrow” the form your competitor uses, you really don’t know that it’s any good. The odds are that it’s not. In fact, the odds are that your competitor “borrowed” it too. If you buy technology services and the other side gives you garbage where a contract should be, you should propose that your lawyer write the contract from scratch. While this may seem like an expensive fix, it may not be. If the other side doesn’t like this idea, tell them that it’s a board requirement and then have your board require it. Often it takes more time, and accordingly, more money to try to work within the bounds of a garbage contract than to just simply rewrite it from scratch. In addition, I find that no matter how hard I work to “fix” a bad document, it still has more holes than Swiss cheese. It’s like building a building. If the foundation is poor, you’ll probably never succeed in shoring up the structure. If you’re a lawyer who doesn’t have experience with tech contracting, then work with somebody who does until you have the experience to fly on your own. Seminars are good, but the formula for success is seminars plus a mentor. Anything less and you do your client a disservice.

1

The Law Technology, Copyright, and Intellectual Property

WHAT IS TECHNOLOGY LAW? I started describing myself as a lawyer with a practice that focused on “computer and tech law” more than 20 years ago. When I’d tell people this, they’d look at me somewhat quizzically. You know—the same look you would expect if you’d just told them that E.T. was in your yard. After that “look” went away, they would typically ask me two questions: What exactly is a “computer lawyer”? and Can you make money doing it? As for the second question, nobody ever asks me that anymore. In the beginning I’d say, “Sure you can. Really! Don’t look at me that way. You can!” At least I hoped so. What’s in a Name? A lot has changed in 20 years. In that time, I’ve watched this area go through many incarnations, even in its names. The list is long and includes Internet law, e-commerce law, cyberlaw, and tech law. The names reflect the evolution of what was hot at the time. To some extent, we still use all these names. The only one that hasn’t aged well is cyberlaw. A few years ago, cyberlaw sounded right. Today, it sounds oldfashioned, like the information superhighway (where did it go?) and the word groovy. (It may have been a cool word when you were a kid, but today saying it is a sure way to get that “You’re a dork” look from your kids—and your friends too.)

1

2

CHAPTER 1

Years ago, a computer lawyer did things like contracting for custom software development, intellectual property (heavy on the copyright side and light on the patent side) for software, and technology-related litigation. While any good litigator can handle the “network is dead” lawsuit, it takes a bit more finesse and knowledge to handle issues such as “network is slow,” “software crashes too often,” or “system is not performing to our expectations.” One of the problems with tech litigation is that you have to litigate these mushy issues all too often. The specialty of tech law developed (although the New York and Florida Bars don’t technically recognize it as a specialty) because people were spending a lot of money on technology, and the typical lawyer in 1990 viewed a computer as a $3,000 typewriter on his secretary’s desk. One of the results of most lawyers being technologically challenged was that they were completely unprepared to deal with the contracting and litigation that arose from tech deals. You can’t ask the right questions if you’re clueless. Tech law, or whatever you want to call it, has exploded in the last 20 years. It reflects the way technology and particularly the Internet have entered our lives. It really wasn’t that long ago that TV commercials and billboards weren’t obliged to send you to www.OurWebsite.com. What Tech Law Has Become Tech law today is still about the same things I did more than a decade ago, but now it’s much more involved. New issues seem to arise every day, and inevitably it takes a while for the answer to evolve. What’s scary about this process of legislating is that the Internet and technology have brought many fundamental changes to our society and, in many cases, the people legislating know so little about the online world. I have a problem with Internet-related legislation being influenced by someone who thinks that surfing the Web means watching his grandkids play games online. E-commerce Law The hot issues evolve, but today they include online commerce and privacy. As online commerce grows, businesses want to decrease their reliance on paper and old ways of doing business. The problem is that the law has been playing catch-up.

THE LAW

3

For example, businesses clamored for years for assurances that a contract “signed” electronically was as real and enforceable as a traditional paper contract. All too often their traditionally trained lawyers weren’t able to provide that complete assurance because the law was unclear and undeveloped. Now legislative attention has ensured that electronically signed contracts are real and enforceable. Privacy Online Real people want to know what happens to the digital data they provide to websites. They offer some of it voluntarily by answering questions like name and address. Some websites collect information, like clickstream data, without the surfer’s knowledge. Clickstream is a type of information collection that makes some people uncomfortable. Literally, it’s a record of your clicks. It may tell a website from what website you came, what you clicked on while in its own website, and what website you went to next. Is this an invasion of privacy? Should the collection of this data be disclosed? These are some of the hot and heavy issues we’ve seen legislation attempt to address. Businesses ask tech lawyers what data they can collect, what they can do with it once they have it, and what must their privacy policy say. In many cases, the answers from even a year or two ago are wrong today. That’s how fast things are changing. So, what’s tech law? It’s a legal area that’s developed because of the new and unique legal issues that arise from the use of computers and other technology. It’s a multidisciplinary area that encompasses contract, tort, copyright, employment, trademark, constitutional, banking, and criminal law. In some ways, it’s a narrow area in that it deals with only technology-related issues. In other ways, it requires a lawyer to be a jack-of-all-trades.

COMMON MISCONCEPTIONS ABOUT TECH LAW I’ll grant you that tech law is a relatively new legal area compared to, let’s say, real estate law. I can summarize the difference this way: when a tech lawyer talks about a case that’s a golden oldie, he’s probably talking about one that’s three years old. For a real estate lawyer, the golden oldie is probably 300 years old. Still, that doesn’t make it any easier to explain the fundamental misconceptions even bright and sophisticated people have about tech law. Let’s dispel some.

4

CHAPTER 1

The Internet Is the Public Domain This one’s my favorite. If you publish something on the Net, legend has it that it’s in the public domain. If this were true, it would mean that you have no copyright protection and that anybody could use the stuff you created for any purpose without your permission. That’s wrong, like really wrong, like get-you-sued wrong. I suppose that this misconception comes from the early precommercial days of the Net when it was primarily a playground for academics and government. Myth would have it that in those days the Net was more like a hippie commune from the ‘60s than the moneycentric, e-commerce, big-company-dominated creature it is today. Ironically, publishing material on the Internet in the early days didn’t mean you lost your copyright. Simply put, publishing material on the Internet does not mean and has never meant that you give up any of the protections that copyright law offers. While the Net may raise some questions that are uniquely online issues, this doesn’t mean that the basics change. Sorry, but you can’t copy another website and make it your website. This is true even if you can’t find a copyright statement or symbol (©) anywhere on the site. Defamation Another misconception is that if you say it online, it can’t be libelous. This is another one that could cost you in a courtroom if you’re not careful. If you accuse your competition of bad things that aren’t true on your website, or in a blog, chat room, or e-mail, you can get sued for libel just as quickly as if you had done it in a newspaper. Digital information counts. It’s really that simple. Be warned—you need to be sure that your employees know that they and you can be sued for libel based on what they say online. Attorney’s Fees When clients come to see me because they want to sue somebody, they inevitably end their angry rant with “and I want them [expletive deleted] to pay my attorney’s fee too.” Many people think that if they win, they automatically get their fees paid by the loser. That’s wrong. The general rule in the United States is that each side pays their own attorney—win or lose. What you need to know is that you can often change this rule if you want, but bear in mind that this can be a double-edged sword.

THE LAW

5

In the tech world, the most important exception to this general rule is that if you have a contract that says something like, “In the event of litigation between the parties to enforce the provisions of this agreement, the prevailing party will be entitled to reimbursement for reasonable attorney’s fees,” a court should award attorney’s fees to the victor. I happen to generally like this provision. I think that it helps keep people honest by adding some risk to litigation. Still, there’s no wrong answer on this. Many people dislike these provisions and I certainly can’t say that they’re wrong. It’s a matter of taste. There is one type of situation where I know I don’t want an attorney’s fee provision. That’s where my client is a deep pocket and the other side is Joe Consumer or their company name is something like, “We’re Small and Judgment Proof, Inc.” In this situation, an attorney’s fee provision in an agreement is a lose-lose one for my client. If the other side prevails, my deep pocket client will pay their attorney’s fees. If my client wins, he won’t be able to collect from Joe Consumer or the little company anyway. It’s Not the Wild West It’s common for people to say that the Net is like the Wild West. It’s the ultimate myth. Rather than being lawless, it’s increasingly quite regulated. Let’s say that you have a website that’s hosted in New York for a company based in France with a target audience throughout Europe. Further, let’s imagine that somebody in Hungary makes a request for information from the New York–hosted site. Then the Net routes the digital data through four states before its transatlantic voyage. It would be fair to say that you have many jurisdictions that could make a claim to power to enforce their law over that website. The answer to this daunting regulation scenario is to stay informed about the laws and get good professional advice. Otherwise, your missteps could be costly.

SOME COPYRIGHT LAW MECHANICS Here’s a quick true or false question for you and your morning coffee. If you forget to put a copyright notice, copyright symbol ©, or the word copyright on your written work, you lose all your copyright protection.

6

CHAPTER 1

The answer is “false.” This section is a primer on some copyright mechanics and related issues. Many people think that the copyright symbol © is required. I suppose that this misconception arises because before March 1, 1989, displaying a copyright notice was an important step in preventing the accidental forfeiture of a copyright. Even today, including a proper copyright notice is a good idea. While it’s not required, it offers several advantages. For one, it prevents an infringer from claiming innocence as a defense. You might also consider promptly registering your copyrighted materials with the copyright office. If you don’t register, you’ll have a copyright, but you can’t successfully sue for infringement until you register. At the least, this will delay the filing of your lawsuit while you deal with the registration process. If you register within three months from the date of first publication or before the date of infringement, you can collect statutory as opposed to actual damages. The problem with actual damages is that they may be nominal or hard to prove. Statutory damages can be up to $150,000 plus attorney’s fees and court costs in some cases. Copyright Notice Now that you know that a copyright notice is desirable but not required, the next question is, what should you put in the notice? You should use the word copyright, the abbreviation copr., or the copyright symbol ©. In the digital world, you sometimes see the letter c in parentheses, (c), because there is no ASCII symbol (basic computer character) for c in a circle. You should avoid the (c) construction because there remains some legal controversy about whether it is a proper symbol for a copyright. If your software cannot make the copyright symbol ©, you should use the word copyright or the abbreviation copr. Next comes the year of first publication and not the year the author created or completed the work. You should also include the year of first publication for an original work with an updated version. This is a good idea in case the updated version doesn’t contain enough change to qualify as a distinct work of authorship. Even better is if you include all years of first publication. For example, you might have “Copyrights 1995–2009 Mark Grossman.” The name of the owner of the copyright should follow the year. This can be a tricky area when you have employees, independent contractors, or multiple authors. You may want to consult with your attorney on this issue.

THE LAW

7

If your work includes material created by the U.S. government, you must include a statement clarifying what material is copyrighted by you. For example, your notice might say, “Copyright 2009, Mark Grossman. No copyright claimed in works of the U.S. government.” Finally, to maximize your copyright protection in some other countries, you should include the statement, “All rights reserved.” Location of the Copyright Notice Now that you know what the copyright notice should say, the next question is: where do you put it? To a large degree, the answer is somewhat self-evident when you understand that the purpose of the notice is to give reasonable notice that you have copyrighted the work. You can and probably should put it in several places. On a floppy disk or CD-ROM, you should put the copyright notice directly on the disk. When a program starts, a nice touch is a splash screen with a copyright notice. In a Windows program, when a user goes to the Help menu and chooses About [insert the name of your program], your copyright notice should again appear along with your version information. On a website, you should include your copyright notice at the bottom of every page. Two Myths Dispelled The number one most common myth in copyright law that I hear is “Since I paid them to create the software for me, I own the copyright.” This is a fatal misconception. The general rule is that when you hire an independent firm to create a copyrightable work for you, they own the copyright unless you have a written agreement to the contrary. This written agreement is not a big deal, but you should have your lawyer prepare it for you. The second most common one that I hear is “Since it’s published on the Internet, it’s in the public domain.” This one has no more reality than Santa Claus. A copyright protects items of original expression, including literary works, sound recordings, visual arts, and so on. A work is protected legally when it’s fixed in a tangible medium of expression. When something is saved to a disk, for example, it’s “fixed in a tangible medium of expression.” That it may be posted on the Net doesn’t change anything. It’s copyrighted, it’s protected, and stealing the content is a copyright infringement.

8

CHAPTER 1

COPYRIGHT LAWS ON THE INTERNET Why is it that intelligent and well-educated people believe that copyright law doesn’t apply to the Net? It might be because copying is so easy to do. Maybe it goes back to the almost utopian and noncommercial origins of the Net. Whatever the reason, it’s a myth. Copyright law applies as much to material posted on a website as it does to material printed in a book. It’s not OK to save a picture from somebody’s website and reuse it on your website. Copyright law gives a copyright owner the right to control things like selling, renting, leasing, public performance, and display. While the law protects a creator’s expression of ideas, it doesn’t protect the idea itself. Therefore, it’s not an infringement to read an idea expressed by an author and then write about it in your own words. This distinction between the expression of an idea being protected while the idea is not is an example of how you can effectively and legally work with copyrighted material without infringing on the copyright owner’s rights. Another example is the concept of “fair use.” “Fair use” is the way the law tries to balance the “needs of the one against the needs of the many.” (You Trekkers know that I borrowed this last phrase, but I think it was a fair use.) The public interest favors the wide dissemination of information while the copyright owner’s interest favors royalties in his pocket if somebody uses his material. Fair use allows copying “for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research.” The problem with relying on fair use as the basis for your use of copyrighted materials is that you can rarely be positive that if tested in a courtroom that your use would ultimately be found to be a fair use. A fair use determination requires you to look at four statutorily required factors and then judge how the answers should be determined in your case. The penalty for an incorrect judgment is that you’ll be dubbed an infringer. The first factor is “the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes.” In analyzing this first one, you need to look at a few things. You start with the issue of whether the material is being used for commercial or nonprofit educational use, with educational uses getting more leeway. Still, don’t make the mistake of thinking that schools can do whatever they want with copyrighted materials. There are limits on schools too, or they wouldn’t pay for textbooks (and nobody would have the incentive to write them).

THE LAW

9

If the use is not a nonprofit educational use, you look to see whether the use is for things like criticism, comment, news reporting, or research. These are other examples of uses that a court is more likely to find to be a fair use. Finally, in analyzing the first factor, you need to look at the degree that you’ve changed the original. The more different it is from the original, the better. The second statutory factor is “the nature of the copyrighted work.” This factor acknowledges that not all copyrighted works were created equal. For example, the law views this article differently than a movie script. It tolerates copying facts more than it does copying a creative writing work. The third factor is “the amount and substantiality of the portion used in relation to the copyrighted work as a whole.” So, if you copy a full page from a four-page website, that looks like an infringement. If you take that single page from an online encyclopedia, it’s probably fair use. (Of course, passing it off as your writing might be unethical plagiarism, but that doesn’t necessarily make it illegal.) There is no clear rational test here. It’s conceivable that using an entire original work could be fair use, while for something else, under different circumstances, using even a small part of the original might be an infringement. The fourth and final factor is “the effect of the use upon the potential market value or value of the copyrighted work.” If you copy an entire article from CNN’s website, you may be a copyright infringer since you’ve arguably reduced the market for its site. The recipient of your copy has no need to visit CNN’s site. You gave them the article. If you were to copy the headline and first paragraph, and then told them to go to CNN.com for the rest, you’re more likely to have the protection of fair use. A lot of blogs have taken advantage of this new market by giving teaser samples of whole articles. The upshot of this brief foray into fair use is that when in doubt, ask the copyright owner’s permission. Fair use is often the answer to why it’s OK to quote or copy copyrighted material, but still there is nothing safer than asking permission.

COPYRIGHTS IN CYBERSPACE: DIGITAL LAWS AND THE INTERNET On October 28, 1998, then-President Clinton signed the Digital Millennium Copyright Act (DMCA) into law. Think of it as the federal government’s first shot over the bow at dealing with the many intellectual property issues raised by our new digital world.

10

CHAPTER 1

In theory, the Internet could be the perfect way to bring information into homes and businesses. No more runs to the library to borrow a book or the store to buy a CD. The problem with translating the theory into reality is that this new digital medium raises many troubling and fundamental questions that remain largely unanswered. For example, should we allow libraries to “loan” a digital copy of a book and do we want to make music freely available on the Net? The simple reality is that the Net is still pretty new. This thing that comes into millions of our homes with websites, music, entertainment, chat, information, e-commerce, and the list goes on endlessly, may feel like it’s been around a long time, but it hasn’t. Just 10 years ago it would have been fair to describe the entire body of Internet law as a pamphlet. Now, we’re up to a few volumes, but it’s going to take many more years for it to develop to the point where the law answers even fundamental Internet law questions. In 1998, Congress took a shot at adding to a sparse body of law. The DMCA does things like make it illegal to “manufacture, import, offer to the public, provide, or otherwise traffic in (sounds like we’re dealing with illegal narcotics here) any technology, product, service, device, component . . . that is primarily designed or produced for the purpose of circumventing a technological measure that effectively controls access to a [copyrighted] work.” In plain English, the DMCA makes it illegal to circumvent copyright protections built into software to prevent piracy, and also prohibits the manufacture, sale, or distribution of code-cracking devices used to unlawfully copy software. There are some exceptions to these prohibitions. For example, you can circumvent copyright protection devices to conduct encryption research and test computer security systems. Also, nonprofit libraries, archives, and educational institutions get their own limited exceptions. If you’re getting the feeling that this is a complex and detailed statute, you’re right. But look at what Congress had to tackle. The issues are intrinsically complex, inherently new, and you have competing and divergent interests everywhere. Libraries want to loan and archive literary works. Publishers want to sell them. Record companies want to package CDs with groups of songs. Web surfers want to download (and pay for?) only the songs they want. No more flip side of that 45 that nobody listened to anyway. Then you have Internet service providers (ISPs) and issues that they raise. For example, let’s say you own a sports-oriented website where you have chat rooms, blogs where people can post materials, and you do other things that create a sense of community among your users. What happens when one of your users posts a copyrighted photo

THE LAW

11

of a baseball game? In similar situations, copyright owners have sued website owners for copyright infringement. Basically, their claim is that since it’s your website, you’re responsible for the infringement. The problem for the website owner is that she has no practical way to control all the zeros and ones flowing upstream and downstream to and from her site. DMCA took a stab at creating an equitable solution for all those concerned by limiting the liability of ISPs if they do what the DMCA requires. If you let people post to your website and you haven’t complied with the DMCA, then this is your wake-up call. This should be a major priority for you. After all, it’s not often that Congress gives you a checklist of things to do to protect yourself from liability. You’ll want to start by designating an agent to receive notices of alleged copyright infringement. You should send the name and address of this agent to the Copyright Office and post the information on your site. Next, you should have your tech lawyer develop a policy for dealing with alleged infringement. It should include a policy for terminating repeat offenders. You should post this policy on your website. Then you’ll want to set up an internal group to deal with complaints about alleged infringement. The DMCA requires you to “respond expeditiously to remove, or disable access to, the material that is claimed to be infringing.” The DMCA then gives an ISP a safe haven by providing that an ISP isn’t liable for taking down any material if it believes in good faith that it is a copyright infringement. This is true even if a court ultimately decides that it wasn’t an infringement. While the DMCA created as many questions as it answered, I’ve got to give Congress and the Clinton administration credit for taking a good first shot at some difficult and controversial issues.

DIGITAL BROADCAST FLAGS With the advent of digital data (you know, the zeros and ones), we have essentially perfected the ability to make copies. The days when each copy of a copy was worse than the copy before are now over. They’re all perfect. This drives Hollywood and the music industry crazy. Remember the original “outlaw” Napster? The problem is that perfect copies are just too easy to make. To content providers like moviemakers, this could mean that if they broadcast a movie over digital television or allow a download on iTunes, and you record it using your DVD-RW (devices that allow you to record onto a DVD), you can have it forever without paying them

12

CHAPTER 1

for that right. And, if that’s not bad enough, you can then post it on the Net for others to copy. The industries with the most money to lose here, like the movie and record industries and television broadcasters, would like to adopt copy protection schemes that prevent or at least “inhibit” people from making improper copies of the content that they invested money to provide. In their perfect world, they would have the government require that hardware devices used to play the content (like digital televisions) implement, rather than thwart, the copy protection scheme embedded in the digital content. I do emphasize the word inhibit because let’s not forget one of the axioms of any defensive tactic. For every measure there’s a countermeasure, and for every countermeasure there’s a counter-countermeasure, and so on. So, while no measure is likely to keep the devoted hacker out for long, it may keep Joe Websurfer out, too.

INTELLECTUAL PROPERTY DUE DILIGENCE Intellectual property may be among the most valuable assets your company owns. The problem with intellectual property (IP) is that by its nature it’s intangible. You can’t touch it or see it. So how do you know what you have and own? The starting point is to look to any registrations you may have with the government. For example, you may have registered a copyright or trademark and have paperwork to prove it. However, the registrations are just the starting point. It turns out that getting a handle on your company’s IP assets can be a complex process. Why Bother? Great—so far I’ve told you that it’s complex and we both know that you have a business to run and a to-do list that’s a mile long. So why would you ever take on this project? Sometimes outsiders force you to dig into your IP assets as a part of their due diligence on your company. This could come up if somebody is buying shares in your company or acquiring some of your IP assets. A bank may require due diligence on your IP before it accepts IP as collateral. I advise my clients to allow us to do an IP audit for them before anybody asks. This type of self-audit prepares companies for externally conducted due diligence and can enhance their own IP planning and management.

THE LAW

13

The first time a lawyer audits your IP, it can be time-consuming. Usually, I’ve found that the record keeping is less than pristine and that basic questions lead to lots of head scratching. The time to deal with these issues and get your IP portfolio in order isn’t when you need a loan secured by your IP or you have an investor with a pocket full of money who wants a full accounting of your IP assets. The time to do it is now without a deadline hanging over anyone’s head. Bear in mind that the nature of an IP audit is that it’s often a stopand-go process that can continue for weeks. This is unavoidable when you need documents from the government or, as is sometimes the case, signatures on agreements to clean up problems that your lawyer finds. The process can seem glacially and unacceptably slow if you need that money, but it all hinges on completing the IP audit. What You Will Learn from an Audit A properly conducted IP audit will analyze a textbook set of questions. The most basic is whether your company owns the rights. If your reaction is, “Of course we own it,” guess what, maybe not. There are more ways to screw up ownership to IP than you can imagine. For example, have you ever hired an independent contractor to create IP for you? It might have been a company to develop your website, an advertising agency to develop your ad campaign, or whatever. In a great example of one of many ways to screw up in the world of IP is that if you don’t have a written agreement that clearly and properly says that you own the IP, then your independent contractor owns it although you paid for it. Ouch! I’d hate to be you when you’re explaining to your board how you spent $100,000 on a website and don’t own the copyright. Maybe somebody can get Paul Simon to write a song called, “A Hundred Ways to Lose Your IP.” If you own your intellectual property, then the next issue is, have you adequately protected it? A part of the audit will also look at whether your right to use the IP is dependent on rights from a third party. For example, you may have custom-created software modules that you own, but you may not be able to use them without a license to some underlying software. Another issue that your audit will explore is whether the scope of your rights is sufficient for you to exploit your IP. Moreover, if you have exploited your rights, have you done so properly? This will look at issues like whether you’ve kept control of your IP through proper license and confidentiality agreements. A case in point would be letting

14

CHAPTER 1

third parties use your trademark without any controls in place. This could cause you to lose a trademark even if you registered it. The final question I like to answer in my IP audits is whether the IP rights you’re asserting present a risk of litigation. Here, I’ll deal with such issues as, does anyone else claim overlapping rights? My suggestion is that you not wait for some third party to force you to get your arms around your IP assets. You should want to do it for your benefit. You need to know what you have, and if there are problems with what you think you have, it’s better to deal with it sooner instead of later.

TRADEMARK LAW OVERVIEW As a tech lawyer, my clients frequently have questions about trademark law. Whether it’s because they’re launching a new venture online or because they realize that exposing their trademark to the world on the Net means that their trademark may get more scrutiny from competitors and others, they ask a lot of questions. My goal here is to provide you with a businessperson’s overview of trademark law. Let’s start with a working definition. A trademark is any work, name, symbol, or device, or combination of these, that you might use to identify and distinguish your goods from those manufactured or sold by others. Trademarks refer to goods. Technically, if you’re referring to services, it’s not a trademark, but rather a service mark. Many people use trademark to loosely include service mark, although that is not technically correct. At the risk of causing a professor of intellectual property to lose a night’s sleep (can they revoke my law degree?), I’m going to use trademark to include service mark. Choose carefully. While even simple dictionary words like Apple, as in the computer company, can be trademarks, it’s important to understand that not all trademarks are created equal. There is a continuum of strength for trademarks. You want to be thoughtful about the trademark you choose so that yours is a stronger one. The strongest trademarks are arbitrary or fanciful ones. An arbitrary trademark is one that doesn’t even suggest the goods or services you’re labeling. A fanciful trademark consists of a word you make up to apply to goods or services. Classic examples of arbitrary trademarks are Apple for computers and BlackBerry for those handheld e-mail devices. Other good examples of fanciful trademarks include Xerox, Ketchup, and Lucent. These are powerful and easy-to-enforce trademarks. They were not in the dictionary when created and if you try to

THE LAW

15

use a word that’s even close, you may find yourself at the wrong end of a federal judge’s ire. Next down in strength are suggestive trademarks. These indirectly describe or “suggest” whatever it is they identify. LinkSys is a good example of a suggestive trademark. It’s a brand for networking equipment that “links your system” together. Cute—and it’s a relatively strong trademark. Next down in the continuum of strength are descriptive marks. These marks describe the goods or services. An example would be the Weather Channel. Descriptive marks are not registrable as trademarks until they develop what’s called a secondary meaning. What that means is that you’re going to have to prove that people really think of your product or service in connection with the mark. That’s not easy. The weakest kind of mark and one not entitled to registration as a mark are generic marks. Sorry, but you can’t register personal computer or television to describe a personal computer or television. Think about registering your trademark. However, what’s interesting about trademarks is that they arise from use, not government registration. If you make up a word and apply it to goods, you have a trademark. It’s that easy. While it is true that you aren’t required to register a trademark with the government, it’s still an excellent idea for many reasons. For one, registration is strong evidence that you do own the mark. It’s also a truism that a registered mark is far more valuable than an unregistered mark. So, if you ever dream of selling your company or bringing in outside investors, they’ll be favorably impressed if your registrations are in order. Another good reason to register is that in the online world, if you have to battle a cybersquatter for taking a domain name that is based on your trademark, you’ll be in a much stronger position if your mark is registered. And a final example of an advantage of registration is that you are then entitled to use the registration symbol ® in association with your mark. That little symbol sends a powerful message to would-be trademark infringers that you have a registered trademark and can invoke all of the remedies provided by federal trademark law. If you choose not to register your trademarks (hold out your hand so I can slap your wrist), you still should tell the world that you claim a trademark, albeit an unregistered one. You do this by putting TM next to your trademark or SM next to your service mark. At the least, it takes away the “Gee whiz, I didn’t know it was a trademark” defense. Moreover, in case you were wondering, gee whiz is a technical legal term, but that’s for another chapter.

16

CHAPTER 1

Bottom-line business advice for the average businessperson concerning trademark law comes down to this: register your marks, and use a competent tech or intellectual property lawyer to handle it for you. Have no fear; your registration won’t send a lawyer’s kids through college because, in the grand scheme of things, a trademark registration is not expensive. Just budget for it and get it done—today. It’s an essential investment in your business.

INVISIBLE TRADEMARKS? Let’s say you want to buy a Chevrolet. Looking for information, you go to your favorite search engine and type in “Chevrolet.” If websites for other car brands popped to the top of your search results, you might wonder how that happened. The answer would probably be metatags. Metatags are words in a website that are hidden to the casual web surfer. You don’t see the metatags because they’re embedded in the hypertext markup language (HTML) code. (HTML is techno speak for the programming language used to create a website.) You can see the metatags if you choose View and then Source from your browser’s menu when you’re at a website. Metatags often include generic categories like books, computers, legal services, or doctors, but they can also include trademarked terms like Adidas, Quicken, Xerox, or Dell. Although you may not see the metatags, many search engines do and they use them to help the search engine rank results. This means that if a website for another car brand includes the word Chevrolet in its metatags, when you search the word Chevrolet,the website for this other brand will be included in the results generated by your search. Now if you’re Chevrolet, you might be less than pleased to find out that when people search for your brand, they get information about your competitors. Clearly, you can’t open a Ford dealership, put up a sign that says Chevrolet, and then when a potential customer walks in trying to buy a Chevy, sell her a Ford. You don’t need to go to law school to know that a Chevrolet sign in front of a Ford dealership is a trademark infringement. Likewise, this hypothetical Ford dealer can’t use the domain name chevroletinformation.com to lure you to its site about Ford cars. Again, common sense tells you that this would be over-theline conduct and that this Ford dealer is going to end up on the wrong end of a federal court lawsuit. What both of these scenarios have in common is that the most casual observer can see the word Chevrolet being used to sell Ford cars.

THE LAW

17

What makes the metatag issue cute is that with metatags, the casual observer can’t see that the Ford dealer’s website is using the word Chevrolet to lure you to a Ford dealer’s website. So, can you infringe a trademark if the infringement is invisible? The question seems simple enough, but as with many questions in Internet law, the answer isn’t completely clear. The issue is just too new for our legal system to have formulated unambiguous answers. What is clear is that this can be a treacherous area. The one thing that legal uncertainty generates is litigation as businesses look to courts to provide answers to confusing scenarios. Legal scholars and courts are grappling with this issue. While traditional tests used to determine whether the particular use of trademarked terms is an infringement don’t seem to perfectly fit the hidden metatag issue, I suspect that we’ll see a trend where courts will be imaginative in stretching traditional doctrine to demonize metatags that use trademarks owned by others to draw traffic to a website. After all, law should be about good public policy. From the consumer’s perspective, it’s a form of bait and switch to ask for information about Chevy and get Ford information instead. Viewed another way—if the law is unclear, do you want to be the test case, which helps clarify the law for the benefit of others? Think about the potential number of zeros on the number when you consider a damage award against you if you lose, and the attorney’s fees involved as you test the limits of the law. Until the law is clearer, I recommend against using your competitors’ trademarks in your metatags. It’s just begging for a problem. If you hire an independent contract website developer, I also recommend that you take control of the metatags. Most developers take the initiative with metatag creation and that’s fine. In a way, part of what you’re buying from them is their creativity in creating metatags for you. Still, there may be legal consequences arising from the choice of metatags and you really should run the choice by your tech lawyer before your site goes live. Now, there is a flip side to this too. Run your trademarks through all the search engines. You may just find that your competitors have used your trademarks to draw traffic to their site. If you discover that they have done this, I think that a cease and desist letter from your lawyer may be in order. If they won’t back down, you have to evaluate whether you want to use your only sledgehammer—a lawsuit. While expensive and a test case, I’d rather take this side of a test case because I think that most courts will see that good public policy requires the protection of trademarks even if the infringement is invisible to the casual eye.

2

Contracts and Contracting Laws, Issues, and Tips

WORKING WITH REQUESTS FOR PROPOSALS One of the time-tested ways of buying computer-related goods and services is to use a request for proposal (RFP). If your organization has never used an RFP before and you’re considering a major investment in your computers or software, you should give some thought to an RFP. An RFP is essentially a request for potential vendors to make offers to provide a service or product that matches your basic specifications and budget. While I’ve helped create and have worked with RFPs that required loose-leaf binders, I’ve also helped to create some that are rather short. While governments may have requirements that lead to extremely formal and legalistic RFP processes, in the private world you can create your own rules for the RFP process. You don’t have to create a monster document, unless you choose to create a monster to suit your needs. In the world of private industry, you can and should disengage yourself from the image you might have about government RFPs and their formalistic process. Hey, we get to make the rules. If you don’t want to be “required” to award the contract to the lowest bidder, then don’t. We will just write the RFP in such a way that you have no such requirement. If you want vendors to submit all their questions in writing with the question and answer going out to all bidders to keep the playing field level, then make that the rule. If you prefer to take informal phone calls or have a scheduled bidder’s conference, then do that. The overriding point is that in private industry there is no right or wrong way to do an RFP. It’s your game. You make the rules—subject to one important proviso.

19

20

CHAPTER 2

As with everything else you do in business, you only have one reputation to go around. While I tell you that you can set the rules any way you want, I warn you that whatever rules you set, you should abide by them and not change them whimsically as the process progresses. Conceivably, you could set yourself up for some kind of lawsuit if you play fast and loose with your own rules, but that’s really not the big issue. You would almost have to work at it to end up on the wrong end of a lawsuit over an RFP. The real issue is your reputation. The Basic Format Experience has taught me that the time, money, and effort invested in writing an effective RFP on the front end will save you time, money, and effort at the back end of the contracting process. An RFP is an effective way for you to tell your vendor what it is you want and what you intend to invest to make it happen. The most important component of an RFP is your detailed explanation of required functionality. You’ll want to describe things like your operational requirements, performance standards, acceptance testing criteria, the operating environment including hardware, operating system and other software, your size and scalability requirements, delivery needs, and other related details. Your tech lawyer should be sure that your RFP includes some basic protections for you. For example, you’ll want it to be clear that the issuance of the RFP commits you to do nothing. You pay no costs associated with creating the response to the RFP, you don’t have to enter into any contract with any of the potential vendors, and you won’t provide any materials or labor. From the Vendor’s Perspective While you don’t want to ignore the rules your potential customer has created, you should construe every ambiguity in your favor to gain some advantage over your competitors. You need to use everything you know about your potential customer and read the RFP in context. If you have contacts within your customer’s organization, use them. An informal phone call handled properly might just give you the edge. Be careful here, though. You don’t want to cross any lines and do anything improper, but if you can, use your back channels to your advantage. You might call your biggest fan in your customer’s organization and ask if it’s OK to discuss the RFP. Invite them to say no. Often,

CONTRACTS AND CONTRACTING

21

when you’re outside the realm of legalistic government contracting, you’ll find that informal conversations may be welcome. Once you get permission to start the conversation, ask away. Never lose sight of that cliché, “Information is power.” The more you know about their wants, needs, expectations, predispositions, and whatever else it is that you can learn, the bigger the advantage you have over the competition. Your response should get some level of legal review. As much as anything, the purpose of this legal review is to ensure that you haven’t somehow created unintended legal obligations with your response. I can assure you that your customer has left themselves wiggle room for the final negotiation. You just want to be sure to do the same.

FORMING CONTRACTS ONLINE When you’ve surfed the Web, you’ve probably noticed that some webpages have a link at the bottom of the page labeled something like Terms and Conditions. If you’ve ever really been bored, you might have even clicked on the link to investigate. If you did, you probably found a contract that purported to govern your use of the site. Could a contract you didn’t sign and that you didn’t even have to read possibly be a real contract? It turns out that this is actually an important and somewhat open question. It’s important because if you own a website, the classic advice is that you must—absolutely must—have terms and conditions for website use. After all, it’s your opportunity to have a completely one-sided agreement protecting your interests. However, how do you ensure that the contract you put on your site will hold up in court if you need it? One-Sided Agreements Let’s start with the one-sided issue. Simply put, you can get away with a one-sided agreement because—well, let’s face it—nobody reads these agreements. When I write these agreements for clients, I like to include provisions like no warranties on uptime or the accuracy of the information presented. Another is that if you sue us, you have to do it in our local court, not yours. I’ll also include a limitation of liability, which when reduced to its essence says, “No matter what we do and no matter how bad it is, we owe you nothing or very little.”

22

CHAPTER 2

A Real Contract? There are two common ways websites attempt to form contracts with users. They are clickwrap and browsewrap. Clickwrap is when you’re forced to affirmatively click on a button that says something like “I Accept” after you’ve been given the chance to read the Terms and Conditions of Website Use Agreement. If you don’t click “I Accept,” the website won’t let you in. You also see clickwrap when you install software. As you begin to install the software, a license pops up and you have to click the I Accept button before you can continue with the installation. Of course, you don’t read it, print it, contemplate, or think about it before you click “I Accept.” (When they come to pick up your firstborn the next day, you might give some thought to that agreement you didn’t read.) Although this point is not 100 percent clear, I think that it’s fair to say that a clickwrap agreement is almost certainly a binding contract. Pretty much everything on the legal landscape is pointing toward validity and public policy would seem to favor their validity. If you’re properly guided by your tech lawyer, you should be able to post a valid and enforceable agreement on your website. The more problematic issue is browsewrap. Courts seem less comfortable with the idea that an agreement “hidden” behind a little teeny tiny link at the bottom of a webpage can be a binding contract. In a case involving Netscape, the court took a negative view on browsewrap by saying that “The case law on software licensing has not eroded the importance of assent in contract formation. Mutual assent is the bedrock of any agreement to which the law will give force.” Translated into English, the court said that you couldn’t say that someone has agreed to something simply because there’s a link at the bottom of a page inviting someone to read an agreement. So, if clickwrap probably works and browsewrap is more problematical, why not just use clickwrap? I think that the answer lies in marketing and good business practices. If you have a website that exposes your company to low legal risk, it would be a case of the “legal” tail wagging the “business” dog to inconvenience your website users with a clickwrap agreement. Legal considerations should not always override good business. It’s the nature of some websites that if you force users to go through a registration process and click “I Accept” before they can enter the site you will lose an unacceptable number of visitors. This is when you must consider using browsewrap rather than clickwrap.

CONTRACTS AND CONTRACTING

23

Making Browsewrap Work Although there is no certain way to ensure that a browsewrap will be enforceable if you ever need it in a courtroom, here are some ways to enhance the likelihood that you will be able to convince a court to enforce your browsewrap agreement. First, make that terms and conditions link conspicuous and make it say “These terms and conditions govern your use of this site. You must click here before proceeding.” Second, you might consider putting this link in a persistent window that won’t come and go as a surfer surfs. In your agreement, be sure that you clearly state that by merely viewing your site, the web surfer agrees to be bound by this agreement. If you take these steps, you’re on the right path to enforceability.

LETTERS OF INTENT: PROCEED WITH CAUTION After almost two decades of practicing law, I’m still amazed at the number of legal fallacies that even sophisticated business people have about doing deals and properly documenting them. A prominent fallacy is that letters of intent (LOI) are always nonbinding. I suppose that the misconception arises because—well—it does say “Letter of Intent” and not “Contract” at the top of the page. Do yourself a favor. Press the Believe button on this one when I tell you that LOIs can be binding agreements—you need to take them seriously, and they need to be written by your attorney. As a person who’s always doing other people’s tech deals, I understand and still get the adrenaline rush of closing the big deal. I get excited when it becomes clear that a venture capitalist wants to fund my client. I’m not so jaded that I don’t understand what it means when a potential customer is about to sign on the dotted line to hire my client to do a huge custom software development deal. Still, these are the moments where you need to take a deep breath and make sure that you get the documentation right. LOIs go by many names, such as Memorandum of Understanding, Agreement in Principle, and Term Sheet, among other things. Whatever you call them, they can bite you if you’re not properly circumspect about the things you sign. Yes, it’s exciting when a venture capitalist wants to fund your tech company. (Yes, venture capitalists still fund tech companies.) I know that when they mention the LOI, it’s a Right Guard moment. Just understand that once you sign that LOI, you may be blurring the line between engagement and marriage.

24

CHAPTER 2

If you never close your deal because you never could work out all the details, you may find that LOI under intense scrutiny. LOIs can and do end up in courtrooms. The essence of the lawsuit is often plain ol’ “breach of contract.” It really comes down to this. Nonlawyers are often under the misconception that the title of the document absolutely governs the situation. If the language in your LOI reads like a binding contract, it’s probably a binding contract. Don’t make the mistake of thinking that just because not every detail of your deal is in the LOI that this necessarily means you would win if sued. The starting point in drafting an LOI is to remember its purpose. Usually, parties are looking to summarize their deal as a prelude to negotiating the details. It’s usually intended to be superseded by a more formal and lengthy document. Using a venture capital deal as the example, the LOI will deal with issues like the size of the investment, the type and quantity of stock that the venture capitalist will get, and other high-level issues. Usually, the parties don’t intend for these terms to be binding if they never sign a more formal contract that includes all the details. However, the parties usually have terms they do expect to be binding even if they never close the deal. Some examples would include a confidentiality provision and a provision that says each party is responsible for their own attorney’s fees and other expenses in connection with the negotiation of the deal. If your LOI isn’t specific about whether it’s really a contract or a nonbinding summary of the state of your negotiations, you could be creating an unpredictable mess for yourself. If there’s ever a dispute about the LOI, you’re forcing a court to look at the document as a whole, accept testimony with those who participated in the LOI creation process, and then make an educated guess as to the intent of the parties. In this situation, the fact that it says “Letter of Intent” at the top is just a single piece of evidence that a court will use to find the parties’ intent. If everything below the title reads like a binding agreement, the court may find that you have a contract and not just the simple outline of terms to be negotiated that you thought you had. In some ways, if your lawyer does it right, the solution can be simple. A well-drawn LOI has a provision that specifically states to what extent the parties intend it to be a binding agreement. A typical provision will say that the LOI does have provisions that the parties intend to be binding even if they never sign another document. It will then go on to specify those provisions.

CONTRACTS AND CONTRACTING

25

Whatever you do, just remember that an LOI is a legal document, which you should have your lawyer write. If you think that you are up to the task, let me give you some perspective: as somebody who mentors young lawyers, I’ve yet to find one who fell out of law school with an innate ability to draft legal documents. It takes years of mentoring and training for a young lawyer to master the art of legal writing. I just ask, “Who mentored you?”

CONFIDENTIALITY AGREEMENTS Confidentiality agreements are the most common type of agreement I write as a lawyer. No matter what type of deal, the parties inevitably want one in place. After doing this stuff for 20-plus years, here are some tips from the deal negotiation trenches. Let’s start with the common misconception that there is a “standard” confidentiality agreement sitting on my hard drive waiting to be printed. When I started practicing law, people thought that the “standard” form was in my drawer and I filled in the blanks with a typewriter. Times and technology have certainly changed, but the myth of the standard form has not. To the contrary, the confidentiality agreement may be the first “little deal” you negotiate on your way to the Promised Land of whatever it is you’re negotiating in the big picture. Watch out for a form with a line for your company name. If you’re tempted to sign it, I have some simple advice: Don’t. Not ever. Every confidentiality agreement is customized. Since tech lawyers see them constantly, writing a good one should never be an exercise in reinventing the wheel. Still, they do require some thought. Before we discuss the how-to on these agreements, let me say that I think confidentiality agreements are widely overused. Clients ask me to prepare one before they have even a preliminary discussion with the other side. In the world of tech deals—more than other types of deals—my clients want to sign confidentiality agreements quickly. I’m sure that many people will disagree with me on this one, but I like to avoid them in the early stages of a deal. My feeling is that you shouldn’t be exchanging secrets with strangers, and that doesn’t change no matter what they’ve signed. Experience tells me that most deals at the “initial feeler” stage never reach fruition. It’s a long way from that first lunch to a closing and a bottle of champagne. I say skip the paperwork and legal entanglements until you’ve at least gone as far as thinking: “This is getting interesting and serious.” In the meantime, keep your secrets to yourself. Usually,

26

CHAPTER 2

you can get through the early stages of a negotiation with a demonstration of what “it” can do without revealing how it does it. Of course, if what it does is as much a secret as how it does it, then my generalization may not be true for you. My recommendation is usually that preliminary discussions proceed without any agreement in place. After all, why would you want to share secrets with people until you have reason to believe that there’s a real possibility that both sides are serious about the deal. Until then, the verbal understanding should be that the parties won’t share confidential information. If and when the deal is getting serious, that’s the time to impose a confidentiality obligation on the parties. Remember that most confidentiality agreements have reciprocal obligations. Therefore, in trying to tie their hands with your information, you may unintentionally find yourself restrained from pursuing a direction you want to go because you may be accused of breaching a confidentiality agreement. Degree of Care If you’re going to be the one mostly receiving confidential information, you want to have the lowest standard of care possible with the other side’s information. Here you want language like, “You will use commercially reasonable efforts to protect the information.” A good fallback position is that you will use “the same degree of care” to protect the other side’s information as you use to protect your own information of similar sensitivity. Of course, the beauty of this language is that it is so mushy that it’s hard to ascertain what it means. It’s not exactly an objective standard. If you’re the one concerned about your own information in the other side’s hands, you want to use stronger language. You’ll want things like a requirement that the other side not disclose the information except to people with a “need to know.” You might even limit disclosure to certain named people within the company and certainly do not permit information to be shared with consultants or other third parties. Have Ready-to-Go Documents I advise my clients to let me prepare two documents for them. One is for when they have sensitive information and they want as much protection as I can get them. The other is for when confidentiality is more of an issue for the other side.

CONTRACTS AND CONTRACTING

27

The reason to have the agreements ready to go is that when a deal is at the stage that it’s now appropriate to sign a confidentiality agreement, you want to quickly volunteer your agreement before they volunteer theirs. There is usually an advantage to being the one who provides the document. I’ve often said, “He who drafts sets the agenda,” which is to say that no matter how much you and I negotiate their form, you’ll never do as well as when they’re negotiating my form. It’s just the way it is in the world of sophisticated business negotiations. Limit the Subject Matter If you’re not as concerned with your information as the other side is with theirs, you’ll want to be as specific as possible about what exactly the confidential information is. You’ll want to avoid catchall language and their ability to designate previously disclosed information as confidential after the fact. Of course, you should flip the advice if you’re providing them with important company secrets. You’ll still want the specifics, but be sure to get yourself some broader language. People being people, they sometimes say the darnedest things. How Long? There are two issues under the heading of “how long.” One is that you may want to limit the period of disclosure so that you can have an intense period with lots of information exchange, but that’s it. Anything disclosed outside this defined period, let’s say the next 30 days, isn’t covered by the agreement. Of course, if you’re mostly providing the secrets, you’ll want as long a period as you can get. The second issue is how long the confidentiality obligation should last. If the information will be public anyway in six months, you don’t need a three-year agreement. But make sure the agreement does a good job of distinguishing between confidential information and trade secrets. This is important because most nondisclosure agreements (NDAs) have an expiration date after which a party is free to reveal the confidential information—and you never want that with a trade secret. A trade secret is an idea that derives independent economic value from not being generally known or readily ascertainable by proper means by other persons who could obtain economic value from its disclosure. It must also be the subject of efforts to maintain its secrecy. One most famous example is Coca Cola’s secret ingredient.

28

CHAPTER 2

While you could argue that the obligation to maintain confidentiality of your secrets should last forever, most people hate to have longterm agreements hanging out there. It’s usually reasonable to compromise and come up with an expiration date when we’re talking about confidential information that doesn’t rise to the level of a trade secret. Having said this, if you’re revealing a trade secret, the obligation to maintain the secret absolutely must, without exception, last forever. Once the obligation to maintain the secret is gone, so is your trade secret. No court will protect your right to that trade secret after you’ve consented to it being publicly revealed. Whatever confidentiality deal you strike, just be aware there is no standard agreement or terms. You’re free to strike the deal that best balances your risks with the benefits of the confidentiality agreement. Just don’t sign whatever it is they put in front of you because it’s their “standard form.”

THE NORMS OF IT CONTRACTING The world of computers and information technology (IT) has developed some unusual norms in warranties and allocating risk. In other industries, these norms might seem absurd, but not in IT. As long as you understand the significance of the way IT contracts are done, you can come to a fair deal. As a preliminary matter, let’s clarify that I’m using the term IT in a broad sense. The same principles will apply whether we’re discussing outsourcing your entire IT department, hiring somebody to design an e-commerce site for your company, buying hardware, or just having some software customized for you. Whatever it is, many of the same contracting norms apply. Warranties If your new car doesn’t work, you take it to the dealer for repair. Knowing what it’s supposed to do is easy. After all, it’s a car. Everybody knows what a car’s supposed to do. It’s rarely that easy with IT-related contracts. Certainly, it could be that the computer doesn’t turn on or that all network communication is down. These would be easy cases. As long as you have anything that looks or smells like a warranty in your agreement, you should be covered. The problem arises because it’s just never that simple. Typical IT problems are more like “computer is too slow,” “network is too slow,”

CONTRACTS AND CONTRACTING

29

“system crashes too often,” or “website doesn’t have some of the functionality we expected.” These are the types of problems that can lead to ugly disputes. There’s no magic after the problem arises. The solution is careful contracting at the front end. It’s good for both sides of the deal. I say that as a tech lawyer who represents those who sell tech services as well as large businesses that buy these services. Careful contracting is good for everyone in the deal because it ensures that the parties have a true understanding of the other side’s expectations. There is no doubt that taking the time to carefully contract for IT services slows the date of the contract’s signature. Contracting, like any other process, simply takes time. Still, it can save you if things go less than perfectly. Using the development of a complex e-commerce website as an example, the norm in the IT industry is a vaguely worded warranty that says that the website will function according to its specifications, or some other vague document or attachment to your contract. The point is that the standard the website must meet is this “other document.” It’s the norm because it’s easy and provides at least some guidance. It can also be a poor way to go because it often doesn’t have the objective standards against which you’ll later want to judge your website. Having said all this, have I ever had contracts where I’ve used some vague specifications as the benchmark for the warranty? Yes, I have. The reason is actually quite simple—it’s time and money. Quite frequently, the parties don’t want to take the time or spend the money necessary to prepare a more meaningful warranty. We all know what a car should do. There’s no similar commonsense benchmark by which to judge IT work. If you don’t specify things in your contract, you may find yourself staring into the face of a bad situation. IT contracting is often a time-consuming and resource-draining project. It takes effort to negotiate a deal and develop things like performance standards and acceptance testing procedures. You can choose to march ahead with a contract that has as much definitive and clear material as a politician’s stump speech. If all goes well, you’ll feel like you made the correct judgment. In fact, you were just lucky. This method is OK for the desperate and those who like to play in the dark. Who Takes the Loss? When things go wrong in the world of IT, they can have far-reaching consequences. If your office network goes down, you have all the losses that go with the lack of productivity of your employees. If

30

CHAPTER 2

you’re an airline and your reservation system crashes and burns, it’s obvious how disastrous that can be. Who pays for these losses? In IT, the answer is that the customer usually bears these risks. We can argue about how fair it is. The airline could say something like, “Let me get this straight. I pay you $5 million to update our reservation’s software. It stops functioning, I lose millions of dollars, and you think that you shouldn’t be responsible for that loss?” The standard IT answer to the question is “That’s right!” The developer’s perspective may not be obvious to many customers, but it does ring of legitimacy in many cases. As the customer, you must build mission critical systems with enough redundancy and overcapacity to prevent catastrophic mishaps. The argument would be that it was the airline in our scenario that decided that running a parallel reservations’ network or providing for more capacity was too expensive. Similar arguments are made when other IT disasters happen. If you lose data, the vendor says that you should have had better backups. I could create other examples, but the point remains the same. It’s up to the purchaser of IT services to create enough redundancy to protect against unacceptable losses. The vendor’s answer to legitimately broken or poorly performing IT products is “response time,” not money. You must largely accept this fundamental norm. Yes, there are exceptions. I have seen and negotiated contracts with real teeth against vendors, but they are the exceptions. So, as a buyer of IT goods and services, focus on what you can get. You should always negotiate for better response time guarantees than are first being offered. Follow this up by requesting specific escalation provisions, which helps to insure that if level one support can’t get the job done in a reasonable amount of time, it will move up through the vendor’s chain of command quickly. Good response time and escalation provisions can be worth their weight in gold when you’re in crisis.

DON’T ACCEPT LIMITS ON ANOTHER PARTY’S LIABILITY When clients come to me to consider suing because of a tech deal that has gone bad, the single worst lawsuit killer is often the standard limitation of liability clause. It never ceases to amaze me how people don’t even pay attention to these clauses as they blithely sign off on a one-sided agreement. It’s just one little clause and yet it can cause so much damage.

CONTRACTS AND CONTRACTING

31

Here’s an example of the type of provision that you’ll see in tech agreements: “The liability of developer to customer for any reason and upon any cause of action related to the performance of the work under this agreement whether in tort or in contract or otherwise shall be limited to the amount paid by the customer to the developer pursuant to this agreement.” Judges Can Read Now, if you sign off on a clause like that because you figure that your lawyer will find some technicality to overcome it, I’d say don’t depend on it. As a generalization, it means what it says; judges can read and will probably enforce it as written. If you had to sue for damages that exceed what you’ve paid under the agreement, all isn’t necessarily lost, but it’s like fighting with both hands tied. While it’s clearly one-sided, courts aren’t in the business of rewriting deals to make them fairer. That’s your job when you’re negotiating your deal. It’s the Norm When you negotiate your agreement and tell the other side that the limit of liability has to go, you’re likely to get a blank look. You know, it’s the same look you get from your kids when you remind them that they haven’t given you your change. I know what I say when I represent the seller of tech services. I say things like “Limits of liability are the norm.” “Everybody uses them.” “We’ve never done a deal without one.” “We’d have to increase the price dramatically because of the additional risk we’d be assuming.” Ironically, all of this is true. So we’re done, right? Wrong. A skilled and experienced negotiator can make all the difference here. While it is to some extent the norm to see limits of liability in tech deals, it’s not necessarily true that they’re all as onerous as my example. While getting the other side to remove it completely may be like climbing Mount Everest, making it fairer isn’t necessarily so hard if you ask for the right things. The Negotiation If they won’t eliminate the limit of liability provision, you have to start pecking at it. In my example, the developer’s liability is “limited

32

CHAPTER 2

to the amount paid by the customer to the developer pursuant to this agreement.” Let’s say we have a $500,000 deal cooking, which calls for five equal payments over five months as work progresses. Let’s say that after the first month it becomes clear that the work they’re doing is causing more harm than good, so you rightly refuse to make your second $100,000 payment. Finally, let’s say that they’ve somehow caused damages worth $200,000. You might think that you can sue for your $200,000, but you can’t because you’re limited to the amount you’ve paid—that is, a refund. So, as written, no matter what they do and no matter how bad it is, the most you get is the $100,000 you’ve paid to date. They risked nothing! My first attempt to chink their armor would be to ask them to limit liability to the total value of the contract to them ($500,000), not the amount paid to date. Failing that, I might ask for some multiple of the amount paid to date. Another approach is reciprocity. I’d say that no single word is more important in moving a one-sided agreement toward the middle than reciprocity. What’s good for them is good for you. Don’t be embarrassed to ask. They certainly weren’t embarrassed to make it one-sided to their advantage. The idea is that the most that they can ever recover from you is equal to the most you can recover from them. Why should they have a protective limit, but not you? They won’t like that, but it’s hard to argue against the proposal’s inherent fairness. Yet another approach is to carve out an exception for infringing intellectual property. In the example as written, if they “create” software for you and you get sued for millions for infringing some third-party’s copyright, you pay millions, but can only recover $500,000 from the ones who really caused the infringement. Again, it’s not fair. The last thing you might try is to exclude any third-party’s property damage or bodily injury claim from the limit of liability. As with the copyright situation, it seems inherently unfair that you should pay unlimited amounts of money to a third party because of something your developer did, but then your recovery is limited by your contract. It’s almost a waste of time to put effort into negotiating a contract to have it emasculated by a one-sided limitation of liability clause. Don’t let that happen to you. While it may be true that these types of clauses are “normal,” don’t assume that the one in their proposed agreement has dropped from the heavens as the only way it can be.

CONTRACTS AND CONTRACTING

33

CONTRACT MANAGEMENT SOFTWARE Most businesses collect contracts at a prodigious rate. It’s almost insidious as the sheer numbers grow. If you stop and consider, you probably have contracts like software licenses, office space leases, maintenance agreements, warranties, website hosting agreements, employee leasing, and agreements with independent contractors. Managing these agreements is essential. Consider this. No matter how good your agreement is, it’s useless to you if you don’t know what your rights and remedies are under the agreement. You can’t use what you negotiated to your benefit if you don’t know what’s buried in your agreement. It only gets worse as the number of agreements you have grows; the people who negotiated them move to different positions in your organization or, worse, move on to other companies. With them goes the institutional knowledge of what your deal is. Of course, a new person in the position will find that previous employees left neatly organized files with all the agreements within their purview. We also know that during the new person’s spare time, she will review all the contracts so that she knows everything she needs to know. Finally, we know that neither you nor I believe the first two sentences of this paragraph. Real Life In real life, if the new person is lucky, she finds files organized using the previous person’s idiosyncratic filing system. As for that spare time review of the contracts, we all know that’s fantasyland. All too often, people manage the relationships memorialized by what may be 25, 100, 1,000, or even thousands of agreements, depending on the size of your organization, “fireman style.” When it’s a burning issue, they deal with it. You know how that goes. Let’s say you’re unhappy with the company that hosts your website. You try to find that agreement. Is there an agreement? Where is it? You ask around. Nobody is quite sure. If you’re lucky, you find it. If you’re not, you ask the other side for a copy of it. Of course, now they’re wondering why you’re asking. So maybe, rather than ask them, you ask your lawyer. Oops, you never bothered to send your lawyer a copy of the final signed agreement although he asked for it several times. If I’m describing your life, raise your hand. (Don’t worry, your co-workers will think you are stretching.)

34

CHAPTER 2

Now, let’s say you find it. Immediately, you read it. Hey, I bet you can’t wait to explain to your boss that had you sent notice last week, which would have been 30 days before the agreement’s automatic oneyear renewal, you could have just terminated and moved on. Since you didn’t know that an automatic renewal date had come and gone, you did nothing. Now you have to call your tech lawyer and find out if the service you’re getting is bad enough to be considered a breach. Of course, even if your lawyer’s opinion is good news to you, if the other side believes they didn’t breach, it’s “Hello, courtroom.” Avoid the Mess You got to this point because you made the fundamental mistake of not knowing your agreements. It doesn’t matter how good an agreement you negotiate is if you don’t know what’s on the paper and don’t take advantage of it. If you haven’t already done so, your company needs to implement a contract management system. Just a small amount of research on the Internet will yield a wealth of information about the contract management software solutions available to you. If you’re not familiar with contract management software, it’s simply software that automates managing contracts in a user-friendly database. At the highest level, you have two paths. You could license contract management software like you license Microsoft Word or you could use the services of an application service provider (ASP) who will provide you access to the software over the Internet. Features You Want A good contract management system is feature rich. While no system has every feature you might like, you need to evaluate which ones are important to you and then look for the system that best fits your needs. A basic feature is access to the actual document. My preference is that the software provide an image of the signed document so that you see the actual signature and any handwritten changes. Next, you want to be sure that you receive notifications of all time-sensitive deadlines. It’s a core function for this type of software. Other features you should look for include secure storage of all related purchase orders, warranties, and other documentation relating to a contract. The software should also be a repository of information for

CONTRACTS AND CONTRACTING

35

vendor profiles, contact information, and expense records. Finally, you also want to look at the software’s reporting capabilities. While the information the software gives you is only as good as the quality of what you input, this type of software can be an invaluable tool in managing your business relationships. If you haven’t yet outgrown “ad hoc” as your method of managing your legal relationships, make today the day that your business procedures begin to grow up.

ANALYZE CONTRACTS BEFORE CALLING YOUR LAWYER If your tech deal goes sour, you may find yourself evaluating whether to sue to recover your damages. You might find it helpful to do a preliminary analysis before calling a lawyer. When clients call and tell me they want to sue somebody, the first thing I do is ask for a quick synopsis of the facts. Then I want to see the contract and all relevant documents. On one level, to evaluate the strength of a case, you need to see if the facts are such that the other side has breached the contract in a material way. On a second level, you need to see what guidance and limitations the contract has in case of a dispute. Obviously, the facts in every case will vary. What you’re analyzing is whether what happened did breach the written agreement. It’s great when the contract is a well-written legal document that describes the business deal with a reasonable level of detail. I rarely get to analyze well-written contracts. Two major factors cause this to be true. The first one is that well-written tech contracts are less likely to be involved in a dispute. This is because most tech litigation isn’t about liars, cheats, and thieves. It’s about honest people honestly disagreeing over what the deal is. A good contract means the parties took the time to clearly communicate about the terms of their deal and then write it up in an understandable contract. The second reason that I rarely read quality contracts is that there are so few of them out there. The quality of the lawyering I see in my tech world continues to shock me, but that’s a whole other section. In my review, I would like to find language that I can use to support my client’s position. Depending on what type of case I have and whom I represent, I’ll look at things like, What was the warranty? Is it tied to any objective standard? When should the seller have delivered the services? Did they deliver what they should have delivered? Did the deliverables work as

36

CHAPTER 2

promised? Who owns what intellectual property rights? Who has to indemnify whom and under what circumstances? Aside from the facts, I look to the contract to see if it has any limitations of liability that may be applicable. Usually, these provisions are one-sided in favor of the seller of technology products or services. It’s common to see limitations of liability that severely limit a buyer’s ability to recover more than nominal damages against the seller. Of course, if my client is the seller, these clauses can be great. The best position to be in is to have a limitation of liability clause that says that my client’s maximum liability is some small amount, while the other side (typically the buyer of the services) has unlimited liability. It’s especially nice to be in this position when negotiating a settlement. The imbalance of power can be quite persuasive. Other provisions that I’ll search for are clauses that deal with issues like jurisdiction and venue (what court has the power to hear the suit), choice of law (what state or countries’ laws will govern the suit), and attorney’s fees (does the winner get a reimbursement of attorney’s fees). In a perfect world, I’d hope to find that we can sue in a place convenient for my client and that the law that will govern the case isn’t the other side’s local law. What’s important to note here is that this was all decided when the parties signed the contract. The lesson is that those miscellaneous clauses, which are usually tucked away in the back of contracts, are important. Consider the difference it makes to you if you’re able to sue in your backyard using your local law versus having to seek a remedy in a court thousands of miles away. Experience tells me that these types of “standard” clauses are amazingly negotiable and that you should always try. Another item that’s often tucked away somewhere in the back is an alternative dispute resolution clause. Does the contract require mediation or arbitration before or instead of a lawsuit? If it does, these clauses are generally enforceable. Never lose sight of the fact that lawsuits are nothing less than a form of legalized warfare. Like war, they are costly in terms of resources, stress, and money—and that’s if you win. It’s usually preferable to reach a compromised settlement rather than spend years involved with courts and litigation. If suing is your best choice, make sure that you know what to expect in the way of time, expense, and risk before you begin. If the cost-benefit analysis adds up, then fight it like a war: aggressively and with the will and determination to win.

CONTRACTS AND CONTRACTING

37

PLAN FOR THE END OF YOUR CONTRACTS There’s an old saying among trial lawyers: Write your closing argument first, and then use it as a guide to present your case to the jury. In short, if you know where you’re going before you start, you’ll eventually end up where you want to be. I think that lawyers who draft high-tech contracts should tattoo that saying across their foreheads. Too often in their zeal to get the “big deal” signed, many lawyers draft high-tech agreements by thinking only about the beginning of the deal. They forget about what their clients will need at the end of the deal and, predictably, completely drop the ball when it comes to drafting provisions that will tell the parties what they can (or can’t) do when the contract is over. The problem with this is that the end of a hightech deal is as important to tech companies—if not more important— than the beginning. Here’s a common example. Go get the last technology-based contract that your attorney drafted for your company. (If you don’t have one, or you’ve never needed one before, just follow along with me anyway. I’m sure you’ll enjoy the ride.) Remember when that contract was signed? Everyone was so happy about closing the deal. Money was about to change hands, business was looking up—maybe you even had a celebration to mark the beginning of the deal. But if your tech contract is like the dozens of tech contracts that I see every month, then it suffers from what I call no end in sight. This terrible condition is caused by careless attorneys who only think about the beginning of the deal, and completely forget where they want their clients to be at the end of the deal. Note the Obvious Symptoms Some of the symptoms of no end in sight are obvious. If, for example, your agreement doesn’t describe how or when it’s supposed to end, that’s an obvious symptom of no end in sight. It was probably caused by an attorney who paid too much attention to the beginning of the agreement, and gave little or no thought to the end. Watch for the Nonobvious Symptoms These symptoms are the most problematic, and usually don’t appear until you desperately need to rely on the agreement. Unfortunately, at

38

CHAPTER 2

that point, you’re probably up the proverbial creek and there’s no paddle in sight. If you want to know whether your agreement suffers from some of the less-obvious symptoms, apply this simple test: Assume that the other party to your contract will go out of business tomorrow morning. Remember, for the sake of this test, pretend that after tomorrow morning, it’s as if the other side dropped off the face of the Earth. Kaput. (For those nonbelievers who think this can never happen, take a stroll to your favorite Web search engine and look for articles about the infamous ASP, Red Gorilla. Once you believe, come on back and keep reading.) Now ask yourself: Can your company keep functioning without the other party? How much time will it take for your business to find a replacement? How much will it cost? Who owns the intellectual property rights? Who will provide support for the software or hardware? Can you modify or reverse engineer the software as necessary to keep it running, or does the license section of your agreement stop you from doing that? If your response to one or more of these questions is “I’m not sure,” then your agreement is probably terminally infected. (I say terminally because the odds are low that the other party will let you go back and modify an already-signed agreement for the purpose of adding exit strategies.) Unfortunately, the harsh truth is that once your agreement is infected, all you can do is sit back and hope that the other party stays in business. My point is that tech agreements are suffering because the attorneys who draft them have too much focus on the here and now, and not the end. While it may be too late to save your current tech contracts, your future contracts don’t have to share the same fate. My advice is to think of the end, first. Before you put pen to paper, take a moment to recite the trial lawyers’ mantra, and figure out where you want your company to be at the end of the deal—then work backward from there.

EXIT STRATEGIES If you’re with a technology company, you may be feeling the pain of the current economic downturn more than most. While there are lots of lessons to glean from current events, one of the best is the importance of locating the exit door.

CONTRACTS AND CONTRACTING

39

No, I’m not talking about the door that leads to the parking lot. Instead, I’m talking about the exit strategy that you should have included, but probably didn’t, in all of your technology-based contracts. You probably didn’t even realize you needed an exit strategy until your customers’ wallets grew tight, your expenses began to pile up, and your contract obligations with your technology affiliates started to drain your company’s operating account. Let’s go back to just before the end of the current economic downturn. That was probably around the time you entered into that mega money website development agreement. You had aspirations of building the perfect website. The website was going to knock the socks off your competition, and it was guaranteed to attract customers in droves. Well, maybe it did, maybe it didn’t. If it didn’t, you found yourself in the same boat as dozens of other companies: bills were piling up but the customers weren’t. When you went to cancel that costly website development contract, you might have come to some ugly realizations. One might have been that you couldn’t get out of the contract without shelling out big money to the developer. Another really ugly scenario might be that your developer—not you—owned the copyright to your website, and you weren’t going to own it anytime soon without a costly legal battle. Last, but painfully not least, might be that you weren’t quite sure whether the website would ever work again after the developer stopped supporting it. The problem is, of course, that we don’t like to think about the end of a contract. The end is depressing. Instead, we like to think about the money that we’re going to make throughout the contract. Unfortunately, it’s this type of thinking that will come back to bite you where you’re most vulnerable. Before we continue, keep this in mind: you shouldn’t try to build or evaluate your exit strategy without help from your tech lawyer. This section isn’t a legal textbook. There are too many contingencies that could arise in your contract, and I couldn’t cover all of them even if I devoted 50 articles to the subject. Five Points You should keep certain broad areas in mind when reviewing your exit strategy. Follow the oft-cited mantra of good reporting: who, what, when, where, and why. First, consider who can terminate your contract. While no contract can legally bind you in such a way that you can never get out, you

40

CHAPTER 2

should never assume that you have the same rights to end the contract as the other party. Second, think about what you have to do to end the contract. If you end the agreement after only a short time, will you have to pay out the remainder of the contract fees, or will you be liable only for those services that you have received up to the point of termination? Third, consider how long it may take to cancel your obligations under the contract. Fourth, think about where you would want to settle any dispute that might arise from your termination of the contract (read, l-a-w-su-i-t). Finally, think about all the situations in which you might reasonably want to cancel your contract, and make sure that your exit strategy covers you for all of those scenarios.

3

The Internet E-Commerce, Legalities, and Getting Paid

EVERYTHING YOU NEED TO KNOW WHEN DOING BUSINESS ONLINE This section will tell you everything you need to know to do business online and use computers in your business. Your first reaction is probably that it’s impossible to fit all that in one chapter. Well, you’re right, but humor me while I cram in as much as I can. To keep it interesting, I’ll start this in the form of a quiz so you can test your own knowledge. Copyrights True or false? The Internet is the public domain and when you publish something on the Net, you lose your copyright. The answer is false. This is just one of those misconceptions that seem to have a life of their own. Intellectual property laws, including copyright and trademark laws, apply as much online as offline. The Net is just not the lawless Wild West, so please get the idea out of your head. Libel True or false? If you post a libelous statement on a website, you can’t be sued for libel. The answer is false. This second item is yet another example of a popular misconception. Call someone a thief on the Internet or in a magazine and you have the same result—you’ll be sued—unless, of course, the person is a thief. After all, online and offline, truth is an absolute defense to libel.

41

42

CHAPTER 3

Contracting Online True or false? If you put a link on your site that says “Terms and Conditions of Website Use” and it links to a contract that governs use of your site, the contract is enforceable although the web surfer never read it. The answer is true. Well, it is a true or false test, so I have to say that it’s more true than not. However, this is still the subject of some controversy. Though I think most courts would agree that it’s true, some courts may not agree. Be cautious with this. Although I think that you’re more likely to have a winner than a loser on this point, don’t lose sight of the fact that this is a statistical game. To illustrate my point, I state that I may have been perfectly correct when I told you that there was a 10 percent chance of rain; if it rained on your picnic, I was completely wrong. My point is that you should get some good legal advice on your method of online contracting. After all, it is a complex area. Faxed Signatures True or false? You can’t enter into a contract with a faxed signature because a fax is not “a writing,” but rather is nothing more than a series of beeps and chirps. The answer is false. On this “beeps and chirps” issue I have to comment that I don’t have enough imagination to come up with the idea that a fax isn’t a writing because it’s—well—created by beeps and chirps. For this deeply analytical thinking, we need a judge from Georgia. Without further comment by me, a mere mortal, I will let the judge speak for himself: “It may also be added that a facsimile transmission does not satisfy the statutory requirement that notice be ‘given in writing.’ Such a transmission is an audio signal via a telephone line containing information from which a writing may be accurately duplicated, but the transmission of beeps and chirps along a telephone line is not a writing, as that term is customarily used. Indeed, the facsimile transmission may be created, transmitted, received, stored and read without a writing, in the conventional sense, or hard copy in the technical vernacular, having ever been created.” You just have to wonder about someone who thinks “hard copy” is “technical vernacular.” I should just stop here because I’m not sure that I have (in the “technical vernacular”) the “bandwidth” to analyze the tremendous depth of thought given to us by this learned court, but I won’t stop.

THE INTERNET

43

On a serious note, I think that this court completely missed the mark with its decision. People commonly use faxes to form contracts and I think that this procedure is generally fine. Still, in an abundance of caution, there is still something nice about receiving the original signature the next day from your favorite overnight delivery company. Long-Distance Courtroom True or false? Your website could give a court in a far away state or country the power to hear a case against your company. The answer is true. Being hauled into a far away court can be extremely expensive to your company and stressful for you. You’re more likely to run into a problem here if your website takes orders from distant places than if your website is really nothing more than an online brochure. Still, you should consult with your tech lawyer about how to deal with the laws of distant places. Some of the recommendations might include having different websites for different countries to help ensure compliance with their local laws, and creating a user agreement that requires web surfers to litigate any disputes in your local courthouse, not theirs. That’s it. Now you know everything you need to know. Maybe not, but this was a good start and I bet you learned something. CLICKWRAP AND BROWSEWRAP AGREEMENTS When you register with a new website you want to use, the registration process often asks you to click “I Accept” to some agreement governing your use of that website. If you’ve ever wondered if that was now an enforceable contract, the simple answer is almost certainly yes. Tech lawyers call them clickwrap agreements. Another variation on this theme is that some websites have a link at the bottom of the page that says something like “Terms and Conditions of Website Use.” They are called browsewrap agreements. If you’re ever really bored and you’ve completed your entire to-do list (the last time this happened for me was in 1964), you might want to click on one of these browsewrap agreement links. Typically, what you’ll find is an extremely one-sided agreement in favor of the website owner. I know because I write those one-sided agreements for my clients. Conceptually, courts have a bit more of a problem finding browsewrap agreements enforceable. After all, there was no symbolic moment where there was a manifestation of assent equivalent to

44

CHAPTER 3

when you sign a paper agreement or click “I Accept” to a clickwrap agreement. Nonetheless, most courts, most of the time, will find that even browsewrap agreements are real agreements. Still, both clickwrap and browsewrap agreements don’t have thousands of years of history behind them like a traditional quill and parchment contract. So, while my general answers clearly favor the idea that these types of agreements are perfectly OK, I think that some caution is in order if your business relies on these types of agreements. What you can do is take some steps to enhance the likelihood that if you ever had to rely on one of these agreements in a court of law some judge who is as old as quill pens doesn’t give you a blank look when you tell him that you don’t have a piece of paper with a signature to show him. It starts with reasonable notice. You want these online agreements to be as obvious as possible. If you decide to use browsewrap, the terms and conditions link should appear on every page and your web surfer shouldn’t have to scroll down to see the link. In a perfect world, you would use clickwrap rather than browsewrap and you would make the viewing of the terms mandatory. You could accomplish that by graying out the I Accept button (i.e., the I Accept button won’t work) until your web surfer has scrolled to the bottom on the agreement. Another good practice is putting a notice near the I Accept button that says something like, “By clicking ‘I Accept,’ you are entering into a legally binding agreement. You must read the agreement before you click ‘I Accept.’” Now, while we all know that almost nobody will read the agreement anyway, that’s OK. Like the old cliché, “you can lead a horse to water but you can’t make him drink,” it probably won’t hurt you if Joe Websurfer clicks “I Accept” without reading the agreement if you’ve taken these steps. One final best practice is keeping a record of the moment that your web surfer clicked “I Accept.” This may help some court feel comfortable in believing that your online contract is like a “real” contract.

MAKE SURE YOUR SLA IS OK I hope that you like alphabet soup. Ready? If you outsource technology functions to an IT (information technology) provider like an ISP (Internet service provider) or ASP (application service provider), you need an SLA (service level agreement). Was that sentence fun or what?

THE INTERNET

45

An SLA details the service levels you can expect from an outsourcer and the consequences for failing to achieve them. Consequences could include things like credits against future fees and the right to end the contract. Some SLAs add a carrot to the stick by including bonuses if the provider exceeds service levels. SLAs are not really a separate agreement, but should be an addendum to the main agreement with your outsourcer. While the main agreement will deal with things like warranties, price, payment, limitations of liability, indemnification, intellectual property, confidentiality, and other basic terms, it’s your SLA that details things like downtime, response time, lost packets, ping times, and other technical minutia, which used to interest only vampires turned techies. As our reliance on technology has increased, these things interest or should interest CEOs, too. While smaller organizations doing smaller deals may rely on vendor-provided boilerplate SLAs, it’s best to avoid these forms if you can. As somebody who sometimes sits on the vendor side of the table and sometimes on the customer side, here’s the scoop from the trenches. If you’re a vendor, you should be sure to create a form SLA. It should be tilted in your direction, but not too much because you don’t want to encourage the buyer of your services to negotiate the SLA from scratch. It’s a fine line. Sophisticated customers will always negotiate SLAs, but a form still smacks of legitimacy. If nothing else, it sets the agenda. Once you create your form, a little subtle tinkering can make it even more effective as a negotiating tool. One thing you should do is arrange it in a two-column format in eight-point type. Then when you provide it to the other side to review, you should send it as a PDF. I suggest the PDF because it’s a file format that’s less inviting to edits compared to a Word document, which begs your customer to edit it. You do all this to create the illusion of a “standard’’ form, which reeks of “nonnegotiable.’’ If you’re the customer, your response to this PDF should be, “Please send it to me in Word format so that I can work with the document.’’ Just that request sends a powerful message to your vendor. They now know that you’re not going to be a pushover and that they’re going to have to enter into a meaningful negotiation designed to find the middle ground if they want your business. Even form agreements are negotiable. Yes—they’re always negotiable. A clear SLA benefits the deal, not either party. From the vendor’s perspective, it prevents the customer from having unrealistic expectations.

46

CHAPTER 3

For the customer, it helps to define what they expect as a way of ensuring that they get it. Negotiating an SLA will require both sides to bring their team to the table. At a minimum, each team should include the business folks affected by the deal, as well as their respective technical people, and a tech lawyer. A good SLA does more than list service indicators and measurements and lay out the ongoing monitoring and response process. It should also clearly define each party’s responsibilities, deal with corrective action and escalation, and include consequences for failure to meet the required service level. For example, an SLA may measure the user experience. It could require that the screen be refreshed in three seconds after the user hits the Enter key. If you’re dealing with financial trading, though, you might need to require subsecond response. The point is that your SLA negotiation is the time to discuss and agree upon performance. As the customer, the SLA negotiation is your chance to define what it is you expect and create penalties for failing to achieve these expectations. If you don’t get whatever you need in the SLA, you’ll be in a weak position to demand it from your vendor later.

FINE PRINT NEEDS CAREFUL REVIEW Advertising can be so technically squeaky clean that it crosses the line into a bad joke. As I was reading an issue of PC Magazine, I was struck by a Dell ad. It had five neat columns with computer systems for sale. The sixth column was the fine print. Imagine that one-sixth of the ad is fine, and I mean fine-little-itty-bitty print. Let’s look at the fine print and translate it into English. Let’s start with a simple statement in the ad. It says “1-Yr Next Business Day On-Site Service.” Now I don’t know about you, but to me that means that if my computer breaks within one year, Dell sends a technician to my home or office the next business day to fix it. Right? Wrong. Well, thankfully Dell gives us a footnote to clarify this clear language. It says that “Service will be dispatched, if necessary, following phone-based troubleshooting.” Translated, that means that you had better be prepared to get verbal instructions on dismantling your system, running diagnostic software, and spending what could be two hours plus on the phone with a tech support rep before they will fi-

THE INTERNET

47

nally conclude that you need the On-Site Service for which you paid extra. Later it even adds that “Availability varies.” I wonder what that means. I suspect it means that if nobody is available to visit you the next day, they can say, “We warned you when we said ‘Availability varies.’” So, the final translation of “1-Yr Next Business Day On-Site Service” is, “If your system breaks within one year and after you spend hours with us on the phone acting as our remote hands, if you still can’t fix it and we think you really tried, if we have a tech available in your area, we’ll send him to your site.” Now, what’s interesting is that this footnote for this warranty offers no clarification of on-site. I would think that includes my home. Well, maybe it doesn’t. You see, in another column I see a warranty that includes “1-Yr At-Home Service.” If you’re wondering how that’s different from onsite service, we have to look at another footnote. This footnote talks about “At-Home or On-Site service.” I suppose that by negative implication, they come to your home only if your particular system comes with an at-home warranty, not merely an on-site one, because on-site doesn’t include at-home. That’s clear, right? I suppose so. I guess . . . Now, I know that so far Dell has been wonderful in using the fine print to muddle the clear words in the large print. So, just in case you think you now understand what you’re getting, I hate to tell you that even the fine print leaves you wondering because it says, “Other conditions apply.” I’m glad they clarified that. In case you want clarification on anything in the ad, you’ll be pleased to know that Dell does give you an 800 number and an information-filled website. The ad does everything it can to encourage you to use the website except when it comes to warranty information. For warranty information, the fine print tells you that you should try to write to Dell—using the good ol’ fashioned post office. That’s interesting since I found detailed warranty information on the website. Somehow, it doesn’t look like Dell wants to make it too easy for you to read too much fine print. I suppose that if you want the best warranty, you should buy the CompleteCare Service. After all, we all know what complete means. Complete can’t have a footnote because then it wouldn’t be “complete,” right? Well, guess again because CompleteCare doesn’t include theft, or loss, or damage due to fire. I’m going to call that Mr. Webster fellow and suggest he change that dictionary of his because it’s wrong.

48

CHAPTER 3

If you want to see the details of the CompleteCare Service, you’ll be pleased to know that if you type in a 67-character address into your browser, you’ll find all the details except, of course, the related warranties. For warranty information, the website doesn’t link you to the answer. Rather, it says, “For a complete copy of Guaranties and Limited Warranties, please write Dell USA, L.P., Attn: Warranties, One Dell Way, Round Rock, TX 78682.” Some systems give you six months of DellNet by MSN® Internet Access. Hey, it’s free. Free has got to be as “free” as complete is “complete”—right? If you’ve read this far, you know that free isn’t quite what it used to be. First, you have to register “within 30 days of invoice” and accept their terms of service. That’s reasonable enough, but did you know that free means that “you agree to be billed monthly fees after the initial service period”? Translation—they want your credit card number before you can register for your free six months. Have no fear, though. You can cancel at any time. Do you think that they may be betting that you won’t remember to call and cancel after six months? Moreover, if you do call, I wonder how long you have to sit on hold waiting for the MSN customer disservice representative so that you can cancel. I suppose that it’s good to know that our American tradition of “the fine print” is alive and well.

ONE-SIZE-FITS-ALL APPROACH TO TECH CONTRACTS WILL FAIL Horribly written contracts for tech deals cross my desk every day. They are lawsuits waiting to happen. When a lawyer writes a contract, he should be writing a document that tells a story about the deal, albeit with a tilt toward his client. Often, what I see isn’t a tilt, it is illiteracy. When I started practicing law over 25 years ago, I was exposed to what you might call “sophisticated” corporate deals. The documents I saw were well written. Then there’s tech contracting. Usually, the first draft of the contract comes from the seller of the tech services. These deals show the wisdom of the 20-minute-old tech company driving the deal. All that’s missing are pimples on the documents. Throw in some rhetoric like, “We have to move this deal at Net speed,” and “On the West Coast, they do these deals in a day,” and what you have is a nuke looking to explode in a courtroom near you.

THE INTERNET

49

It’s really a simple formula. Poorly written contracts lead to war. When people are negotiating a deal, they have a natural tendency to assume that the team putting it together will be the team implementing it. I start from the opposite perspective. I always assume that none of the players at the negotiating table will be involved after the parties sign the contract. Businesses are sold all the time and people get promoted. When these things happen, it means that whoever knew what the contract “really” meant is gone. The written document has to stand on its own. When the person across the table doesn’t want to take the time to clarify a clause, he’ll often say something like, “Come on, you and I know what it means. Just trust me.” At that point I like to say, “I assume that you’re so good at what you do that you’ll be outta here doing bigger and better things in about four minutes. It’s not you I don’t trust. It’s the guy who I don’t know who will replace you that I don’t trust.” You know you have a well-written contract if somebody who knows nothing about the specifics of your deal could read it and understand the deal. If your contract doesn’t meet this standard, you need to get one that does. Let’s do a reality check. Why are tech contracts often so bad? For starters, tech contracting is a relatively new legal specialty. Outside of a few places like Silicon Valley, Seattle, Austin, and New York, you just can’t find many lawyers with legitimate experience doing these deals. The potential client asking about experience might have the audacity to think legitimate experience means having done several of these deals. Before you think lawyers are completely at fault for bad tech-contracting practices, let me assure you that’s not true. Many times, the first draft has never crossed a lawyer’s desk. After all, why involve your tech lawyer when you have the contract form that somebody else in your industry used or have the contract your lawyer gave you for a different deal? As for the answers, we could start with one size doesn’t fit all and you’re playing with fire. While it’s tempting to use the form your competitor used, you really don’t know that it’s any good. The odds are that it isn’t. If you’re on the buying side of a tech deal, you should have your tech lawyer prepare the contract from scratch. If your tech deal is worth doing, it’s worth doing right. If you’re buying tech services, you should demand that the other side agree to high-quality legal documents. If excellent documentation

50

CHAPTER 3

of your deal doesn’t seem important to them, you should question at what point high quality will become important to them.

LEGAL IMPLICATIONS FOR DOMAIN NAMES: DISPUTES AND RESOLUTIONS Before you register that domain name, you need to consider the legal implications of what you’re about to do. If you don’t, you could find yourself landing in a courtroom. The days when the law surrounding domain names was as simple as first come, first served are gone forever. The days when the law was still developing and nobody really knew if you could get away with registering mcdonalds.com if McDonald’s hadn’t already done so are no more. It used to be the Wild West. In 1994, Joshua Quittner, of Wired magazine, was writing a story like this one about domain names and discovered that Ronald had not yet understood the importance of registering mcdonalds.com. Reportedly, he even called Ronald’s managers to warn them that anyone could register the name if they didn’t. Ronald didn’t respond, so Joshua did. He registered mcdonalds.com. Josh even adopted the e-mail address [email protected] for himself. Arising from its stupor, McDonald’s was not happy when officials realized the significance of what Josh had done. Maybe with holiday spirit in mind, Josh gave the domain to McDonald’s in return for a $3,500 donation to an elementary school. My all-time favorite domain name story involves Princeton Review and Kaplan, bitter competitors in the test preparation business. They prepare you for tests like the SATs for college admission and the LSATs for law school admission. I bet you know where this is going. Princeton Review not only registered princetonreview.com and review.com, but also kaplan.com. In 1994, it simply wasn’t clear that registering the trademarked name of your competitor was a no-no. You have to admire Princeton Review’s ingenuity. This is about the same time McDonald’s hadn’t yet figured out that it might want to own mcdonalds.com. Of course, Kaplan soon discovered that people who typed www.kaplan.com were going to Princeton Review’s website. Kaplan was perturbed. When challenged, Princeton Review offered the domain to Kaplan for a case of beer (reportedly domestic or imported). Kaplan refused and went to court instead. The court awarded Kaplan the disputed domain. When it was all over, Princeton Review’s president,

THE INTERNET

51

John Katzman, is reported to have said that Kaplan has “no sense of humor, no vision and no beer.” That Was Then and This Is Now You’re looking for nothing but trouble if you don’t do your homework before you register a domain. The starting point is the Patent and Trademark Office at www.uspto.gov/main/trademarks.htm. If you get an “all clear” from this search, you still need to have your tech lawyer run and then interpret a full trademark search done by one of many private companies that provide this service. Trademarks can be a treacherous area and I caution you that you do need a lawyer’s assistance with this. The penalty for choosing a problematic domain name is that you may find yourself accused of being a cybersquatter. Loosely defined before the Anti-cybersquatting Consumer Protection Act, a cybersquatter is somebody who registers a domain name for improper purposes, like extorting money from its rightful owner. Of course, the interesting part is giving some meaning to terms like improper and rightful. The act takes a stab at these terms by saying that several things are improper. For example, it’s improper for you to use another’s trademark or personal name with “bad faith intent” to make a profit. It’s also improper for you to register, traffic, or use a domain name that’s the same or confusingly similar to a mark that was distinctive or famous at the time you registered the name. A court will use many factors to determine bad faith intent. One part of the analysis is for the court to see if you have any trademark or other intellectual property rights in the domain name. Other factors include the extent to which your legal name is represented by the domain name, your previous use of the domain name in “bona fide” commerce, your “bona fide noncommercial use or fair use” of the mark, your intent to divert consumers from the proper online site, and using false or misleading information when registering or holding the mark. If a court finds that you’re a cybersquatter, it could award the rightful owner substantial damages. Having said that, even with the act in place, many times it’s still unclear who has what rights to what domain name. As is often the case, the law can be a bit gray. From practical experience, I’ve learned if the law’s application to your situation is in any way muddy, it still often comes down to a straight price negotiation. If you already have a questionable domain

52

CHAPTER 3

name, you need to know what your rights are, what your risks are, and then proceed from there.

DOMAIN-NAME POACHING If you currently own a domain name you cherish, you need to be careful because it’s all too easy to lose it. It could be a mistake or fraud, but either way, you could have a major problem when you discover that you’ve lost a valuable domain name. First, we had cybersquatting, which started in the Net’s early days. Then, you had people who grabbed company names as domain names before the company with that name registered it. McDonald’s and MTV are examples of famous companies that had cybersquatter problems early in the Internet age over their company names. Today, most cybersquatter issues tend to be over variations on a company name like apple.com. Now enter the poachers. They grab domain names when a domain name that a company had previously registered becomes available for any of a multitude of reasons. It could be something like a company letting its registration expire by mistake, domain-name registrar error, and sometimes, hard-to-identify shenanigans. In yet another example of law developing after the new technologies it regulates, there’s little clear law on the issues that arise from domain-name poaching. For instance, let’s say the reason a domain name became available was registrar error. Should the name go back to the original owner? Would it matter if the name were trademarked? What should the answer be if it’s a generic word like lawyer.com? King for a Day Before you answer the questions, take a moment to consider how valuable a domain name can be and then, since the law is unsettled, let’s play king and decide what you think the law should be. What if Amazon.com’s registration somehow became available— even for an instant—and some association for the preservation of the Amazon forests took it. In creating this fictitious scenario, let’s even assume that the problem arose because somebody in Amazon.com’s organization mistakenly forgot to pay the fee to renew the registration. So now, I’ve set it up so that it’s Amazon.com’s fault. Should this be a case of you snooze, you lose? Darwinists would probably say yes.

THE INTERNET

53

Now, let’s change the facts. Let’s talk about your home and assume that you “forgot” to pay your property taxes. In that case, the legal system has elaborate procedures in place to ensure that you don’t accidentally lose your home to the highest bidder on the courthouse steps. Does your domain name deserve similar protection? Is your ownership of a domain name a property right similar to home ownership or is it more like a contract right? This distinction is important because if it’s a mere contract right, the law generally provides fewer protections than if it’s a property right. In one infamous case involving the domain name sex.com, the owner of sex.com sued the registrar when it allegedly mistakenly cancelled his registration. The basis of the lawsuit included claims of breach of contract, breach of a fiduciary duty, negligent misrepresentation, and conspiracy to convert property. The lower court ruled in favor of the registrar. In its ruling, the court said the registrar did not have a contractual commitment to prevent the assignment of the domain name to someone else and that a domain name isn’t property. This was one lower court’s take on the issue and not necessarily the last word. The issue remains, what should the law be? Redemption Grace Period It looks like we’re heading toward a new policy that will provide for a 30-day redemption grace period. During the grace period, the domain name cannot be transferred to any third party. The hope is that this solution will resolve the issue since domain-name owners will presumably notice that their websites aren’t functioning. With that as the ultimate notice, it will give the domain-name owner time to resolve the issue before somebody poaches the name. I think it’s hard to come up with a reasoned argument against this 30day hold. It seems to achieve a proper balancing of everyone’s interests. Still, there are many poaching disputes already out there. Courts are being forced to grapple with the murky legal issues that arise. If there were a trend, it would be that the registrars generally come out smelling like a rose. Maybe it’s because they have good courtroom lawyers and well-written one-sided nonnegotiable agreements. Whatever the reason, the registrars have this nasty and, I think, well-earned reputation for arrogance and poor customer service. As a group, they typically personify customer-service organizations with phone numbers like 1-800-WeDon’tCare. Maybe a few court judgments

54

CHAPTER 3

with hefty money damage awards for when they give away somebody’s domain, due to registrar error, might make them more responsive. A little accountability can go a long way.

ONLINE DISPUTE RESOLUTION Whenever you have buyers and sellers, you will inevitably have disputes, and the online world is no different. What the online world lacks but needs is an inexpensive, quick, efficient, and impartial method of dispute resolution. What we have now is a patchwork system for dealing with these issues, and I’m not optimistic that major improvements are coming anytime soon. Today, when you make a purchase online and then have a dispute with your seller, there is no quick and easy answer to resolving the problem. This isn’t necessarily a uniquely online problem either. For example, just the fact that most consumer purchases are for relatively small amounts creates a problem. You can’t exactly hire a team of lawyers, bring in three arbitrators, and serve subpoenas because your Cabbage Patch doll arrived without its birth certificate. Distance and Language While my Cabbage Patch doll example might be a bit flip (OK—very flip), it does help make the point that even small arguments need a method of dispute resolution that’s perceived as fair to all concerned. Moreover, the online world is different from going to your local store for a multitude of reasons. We must come up with better ways to deal with disputes that arise online or face the consequences of consumer fear of online buying because of concerns about things like bad service, broken promises, and fraud. The starting point of why online is different is distance. There was a time that the best check on “reasonable behavior” by both buyers and sellers was geography. If you lived in a small town where everybody knew everybody, the desire to maintain one’s reputation helped ensure buyers and sellers were fair with one another. One interesting attempt to take the reputation check on behavior from the offline to the online world is what a website like eBay does. There, you can see how other buyers have rated your potential seller. The idea is that lots of negative comments will cause people to shy away. The flip side is the fear of negative comments will cause sellers to act responsibly.

THE INTERNET

55

Still, the Internet and e-commerce do throw away geography. With e-commerce, it’s almost (the almost is mostly about shipping issues) as easy to buy from China as your city’s Chinatown. Often, a buyer doesn’t even know where the seller is. Most people don’t know where even a famous online seller like Amazon.com is located. Then, consider the language issues created by the Net and the reduced relevance of distance and geography. Sure, the court systems in large metropolises like Miami, New York, and Los Angeles have their share of language issues, but that’s nothing compared to the language issues if the world is the marketplace. Credit Card Companies as Judge Often things develop almost by accident and today’s best online dispute resolution process from a consumer’s perspective is an accident brought to you by your credit card company. I call it “an accident” because nobody really wanted to make MasterCard and Visa the world’s judge and jury, but in the realm of small purchases, they often fill that role. It’s a role they evolved into taking because of their practical need to resolve disputes between buyers and sellers when the buyer refuses to pay because of a dispute with a seller. I always tell people to use their credit card, and not a check, when buying online because their best remedy in case of a problem is to complain to the credit card company. In many ways, it is a good remedy for consumers because the credit card companies tend to give the benefit of any doubt to consumers. Still, it’s not quite a system and it doesn’t help where a credit card wasn’t the payment method. What we need is some sort of universal arbitration system, similar to the credit card dispute resolution system. We Need a Better System For such a system to work, it will need to be perceived by all as independent and impartial. Systems set up by industry trade groups and other apparently biased organizations just won’t pass the consumer’s smell test. It’s also important that disputes be decided consistently according to a clear body of law. One system that fails this test is the arbitration system in place for domain-name disputes. While they do publish the decisions of these arbitrators, and that could theoretically be useful for

56

CHAPTER 3

researching precedent relevant to your case, publication isn’t useful because the decisions are inconsistent and unpredictable. In many ways, a good system comes down to a right to be heard, a right to respond, a fair hearing, and a decision based on clear legal principles. It sounds easy until you consider that e-commerce is international by nature. Trying to create an international and enforceable system of dispute resolution isn’t going to be easy. I go back to my starting point. I’m not optimistic that it will happen anytime soon. Until it does, a consumer’s best protection online remains buying with a credit card.

GRIPE SITES Who would you imagine owns the domain ford-sucks.com? Would it surprise you if I told you that it was Ford Motor Company? Clearly, Ford owns it to control it and prevent somebody else from posting a “gripe” site there. Sucks at the end of a trademarked name is just one common way to post a gripe site. What do you do if your company finds itself at the wrong end of a gripe site? Gripe sites come in many flavors and sizes. Sites using the word sucks is probably the most popular, but you also have stinks as a variation. Starbucks is at the wrong end of what may be the most famous gripe site of all, starbucked.com. These gripe sites raise some interesting legal issues. One interesting recent case involved a Mr. Mishkoff, who registered the domain shopsatwillowbend.com upon learning of a Mr. Taubman intending to build a mall by that name. Mr. Mishkoff’s website included information about the mall and a map and links to the mall’s tenants’ individual websites. In addition, this site contained a link to his girlfriend’s company’s site (shirtbiz.com) and to his Web design company’s site. Posted on the site was a prominent disclaimer that told surfers that Mr. Mishkoff’s site was unofficial, and there was even a link to Mr. Taubman’s official site for the mall, found at the addresses, theshopsatwillowbend.com, and shopwillowbend.com. Well, you know where this is going. Mr. Taubman wasn’t pleased with somebody other than him having the domain shopsatwillowbend .com, so he sued Mr. Mishkoff. Now the ball was in Mr. Mishkoff’s hands and he responded by registering taubmansucks.com, shopsatwillow bendsucks.com, theshopsatwillowbendsucks.com, willowbendmallsucks .com, and willowbendsucks.com. Clearly, Mr. Mishkoff is not a man who’s shy about taking on a battle. You can just feel the blood pressure

THE INTERNET

57

of the parties going up as the situation unfolds and, of course, the “sucks” sites become part of the courtroom fray. These five domain names all linked to the same website. According to the court, the content of the site includes a “running editorial on Mishkoff’s battle with Taubman and its lawyers, and exhaustively documents his proceedings in both the district court and this court, both through visual scans of filed motions, as well as a first person narrative from Mishkoff.” The court ruled in favor of Mr. Mishkoff on the “sucks” sites, finding that they were an expression of free speech. The court said that “[Al]though economic damage might be an intended effect of Mishkoff’s expression, the First Amendment protects critical commentary when there is no confusion as to source, even when it involves the criticism of a business.” The court then goes on to say that “[i]n fact, Taubman concedes that Mishkoff is `free to shout “Taubman sucks!” from the rooftops. . . .’ Essentially, this is what he has done in his domain name. The rooftops of our past have evolved into the Internet domain names of our present. We find that the domain name is a type of public expression, no different in scope than a billboard or a pulpit, and Mishkoff has a First Amendment right to express his opinion about Taubman, and as long as his speech is not commercially misleading, the [Trademark] Act cannot be summoned to prevent it.” So, what are the lessons to be drawn from this case? First and foremost, I would say it’s don’t get on the wrong side of Mr. Mishkoff. After that, I take away that you should register the “sucks” variation of your domain names just as Ford did. While there are other cases that do not look so favorably upon the sucks site as this one, I say don’t rely on winning in a courtroom when a simple and inexpensive domain name registration will do it. Generally, I advise my clients not to ignore gripe sites. In fact, you should have a Net savvy person assigned to monitoring their possible existence. As you find them, you need to develop a plan for dealing with them. You don’t want to be the one to take away Starbucks’s title as the victim of the most famous gripe site. One thing to do is verify and address any legitimate complaint listed in the gripe site. Once you’ve addressed the complaint, you might just affirmatively discuss the issue on your site. If you can’t make it right from the other side’s perspective, then you might tell your side of the story on your site. Be cautious about cease and desist letters, and other correspondence that has a threatening tone. You’re likely to see these letters

58

CHAPTER 3

scanned and posted on the gripe site with commentary that won’t make you smile. As for a lawsuit, that’s a big maybe. I can’t generalize. These cases turn out to be very fact specific. So talk to your tech lawyer and then decide if a courtroom is likely to provide a remedy.

STAYING OUT OF TROUBLE ONLINE The end of the last century brought us Internet access in the workplace. While it’s clearly a great tool in the office, it can cause problems too. Here are some tips for keeping out of trouble online. Let’s start with the most basic concept. The Internet isn’t some lawless subculture that exists outside of the “real” world. What you and your employees do online counts. Your business should have a written Internet use policy in place to help minimize the legal risks that could embroil you in unneeded litigation. For some reason, even reasonably bright people seem to think that “anything goes” online. They couldn’t be more wrong. One troubling area is copyright. A common misconception is that once somebody posts material on the Internet, it’s in the public domain. Wrong! Copyright law applies on the Internet too. Just because it may be as easy as clicking File, Save to copy material doesn’t mean that it has been donated to you. While the Internet may raise some questions that are uniquely online issues, this doesn’t mean that the basics change. Sorry, but you can’t copy your competitor’s website, change the name at the top, and make it your website. It’s a copyright infringement just as it would be if you did that with a paper brochure. This is true even if they didn’t register the copyright with the Copyright Office and you can’t find a copyright symbol © anywhere on the site. Another problem area is e-mail. People say the darnedest things in e-mail. Things they’d never say in a paper letter or formal memo. Folks who should know better, like Oliver North and Bill Gates, have been betrayed by their own e-mails. It just may be that e-mail is too easy to send. In many ways, it’s as easy as or easier than making a telephone call, so people treat it like the telephone. Generally, telephone calls are ephemeral and not recorded. E-mail is always recorded. We call the recording device a hard drive. This should be obvious. Even worse is that Forward button. With a few keystrokes, your e-mail could be everywhere you don’t want it to be—and you may have no way of knowing that it’s there.

THE INTERNET

59

The point is that while private verbal communication can often be safely informal, e-mail can never be. Litigants can subpoena e-mails in litigation just as they can subpoena other written documents. You should always assume that once you hit the Send button, it’s gone and out of your control forever. You can never really be sure that you’ve deleted all traces of it and you should act accordingly. As a businessperson, you must train your employees to be cautious about what they say in e-mail. It should be treated like formal written correspondence in the sense that what you say can come back to haunt you later in a courtroom or the boss’s office. (I felt that it was important to clarify the way I meant “formal” because I wouldn’t want to be the one responsible for people using fewer smiley faces in their e-mails.) Using copyright and e-mail as examples, the higher-level point is that you must train your employees about the proper use of the Net. Common sense is something mom, dad, and life experience hopefully taught us. When it comes to the Net, you shouldn’t assume that your employees have common sense. It’s all too new for common sense to have been learned and developed. It’s easy to forget that just a few years ago, ubiquitous Internet and e-mail access in the office wasn’t the norm. As an employer, you generally have no reasonable expectation that the people who work for you are experienced web surfers. What might seem like common sense to those of us who’ve been online for a while may not be obvious to the occasional home AOL user. It’s all about training. You have to train people to accept the idea that if they libel somebody in an e-mail, chat room, or on the Web, they can get you sued. Eventually, this will be common sense, but today it is training. Another troubling area is online contracting. While it’s true that the law can sometimes be unclear about whether a contract you enter into online is a “real” contract, you should train your people to assume that it is. It goes back to the basic concept that “online counts.” If you have a policy that limits who can sign contracts for your company, you need to make it clear that this applies to online contracts too. Having said that, this doesn’t mean that your offline contracting policy will perfectly fit the online environment without at least some thoughtful modifications. You should consult with your tech lawyer on this for the details. A final thought has to do with adult websites. It’s really quite simple. Your Internet use policy should prohibit viewing adult sites at the office. (Sorry if I’m killing your fun.) It’s nothing but trouble. Inevitably, somebody is offended. If it gets ugly enough, you may

60

CHAPTER 3

find somebody accusing you of having a sexually hostile work environment. It’s all about training and having a good Internet use policy in place. With this, you minimize the risk that providing Internet access to your employees will haunt you.

ONLINE SHOPPING As you do your shopping online, you “know” that the Internet is a dangerous place for your credit card. Your common sense tells you that it’s always better to call the 800 number rather than send your credit card number over the Net. It turns out that what you “know” and your common sense are absolutely and positively wrong. Understand that I’m not saying that the Internet is a perfectly safe place for your credit card. It’s not. But neither is your waiter’s or store clerk’s hand. As your waiter walks away with your card, have you ever considered the possibility that he may be running it through his machine more than once. Your credit card is never perfectly safe. This is a relative safety, not absolute safety, issue though. Life is all about relative safety issues. If we were seeking absolute safety, we’d never let our kids out of the house. The Internet has unfairly developed an unsavory reputation when it comes to credit cards. Yes, there is credit card fraud on the Net, but it’s a big “so what?” There’s credit card fraud everywhere. I’ve never understood why the same people who will call 1-800-Send-Me-SomeJunk, read their credit card number to a minimum-wage order taker working for a company they’ve never heard of, located they don’t know where, won’t send their credit card number to a reputable store online. Sometimes the things that we do aren’t rational. It’ll be our little secret, but have you ever had a store clerk hand you the carbon copy of your credit card charge, where upon you tore it into four perfectly neat little pieces and handed it back to her to discard? There you stand—the human shredding machine. It’s absurd when you think about it. People who won’t send their credit card number over the Net wear that fact like a badge of honor. It’s as if they’re the all-knowing ones, and those of us who transmit that magic number are the fools. It’s a misplaced concern, and it does matter in the big picture. It matters because this phobia about credit cards and the Net hurts the growth of ecommerce because credit cards are the fuel that feeds e-commerce. For

THE INTERNET

61

all the talk about e-cash, online wallets, and smart cards, today’s payment over the Net remains a story that’s all about plain old credit cards. Here’s the real bottom line for those of you who would rather wear a big diamond on your finger in a bad neighborhood than let your credit card number traverse the Net. No matter how much money a thief spends on your credit card—whether the thief is a store clerk who “forgot” to give you your card back or that hacker from your nightmares who snatched your credit card number out of cyberspace—you lose $50 at worst. In 1975, Congress passed the Fair Credit Billing Act (FCBA). Although it predates when I invented the Internet (I wanted to stake my claim here, too), it provides all the protection you need. It’s a law that works. If you follow the FCBA’s procedures, your maximum liability for unauthorized use of your credit card is limited to $50. Moreover, if you’re a good customer, most banks routinely waive that $50. You do have to follow the law’s procedures to get its benefits. First, and most important, send your creditor a written billing error notice within 60 days of receiving the first bill that contained the error. If you look on the back of any credit card bill, you should see a full summary of the FCBA and its procedures. Now that I’ve told you to feel free to use your credit card online, please don’t interpret that like a 16-year-old who’s been flipped the car keys by dad and then barrels down the road at 90 miles per hour. There are prudent steps you can take to help minimize the risk of online credit card fraud. You can start by knowing your merchant. Have you heard of them? Are they reputable? There is no magic answer here, but I would suggest that you should have less concern buying from Sears.com than INeverHeardofYou.com. One thing you should look for before you send your card number over the Net is a secure server. A secure server will encrypt your number so that if a hacker were to intercept it, it would be gibberish. Usually, a website will loudly proclaim that you’re in a secure server so that you’ll feel comfortable using your credit card. If you have any doubt, you can look at the address bar on your browser. If it says “https” before the address instead of “http,” you can feel pretty good about being in a more secure environment. So, go forth and use your credit card online this holiday season. I’m not promising a perfectly safe journey. There are dangers online, but look at the bright side of online shopping. Nobody will snatch your purse or pick your pocket.

62

CHAPTER 3

COMMERCIAL BUILDINGS AND TELECOMMUNICATIONS SERVICES Real estate developers, beware. AT&T, BellSouth, DirecTV, and other telecommunications providers (telcos) want access to your offices and homes. Telcos want to put their equipment on your property to offer cable television, telephone, and high-speed Internet services. Many downtown commercial buildings and condominiums recently received proposals from telcos for this, but beware. The “legalese” in these proposals doesn’t protect your rights. Don’t just sign on the dotted line. A real estate developer should provide for consumer choice while protecting consumer safety and community aesthetics. It will make your properties more valuable. It may even provide you with an extra revenue stream. Otherwise, you’ll find yourself caught in a complicated mess where several telcos are fighting over limited space in your rights-of-way, conduits and molding, and on rooftops. To plan for a multiprovider property, you’ll need to consider lots of issues including safety, aesthetics, consumer choice, carrier reliability, and general engineering. You should also look at your current communications revenue streams. Do you charge your telephone or cable television provider a fee for access to your building? Do your occupants receive discounts on services? Who installed the wiring in your development? Who owns the wiring in your development? Do you even know? Having the answers to these questions is important if you want to get the most bang for your buck. Traditionally, local telecommunications services have been provided almost exclusively by a single carrier. There was one telephone company and one cable television company. Now the Federal Communications Commission (FCC) is trying to promote competition in the industry. Recently, the FCC prohibited telcos from entering into exclusive access contracts for commercial property. An exclusive access contract would prevent a building from having more than one telco offering service to tenants. In other words, if you don’t like the service from Telco A, you could go to Telco B. But if Telco A has an exclusive deal with a building, and if you don’t like the service, you’re outta luck. Now the FCC has sought comments as to whether prohibitions on exclusive access contracts in commercial settings should be extended to residential settings, and whether this prohibition should be in addition to or in lieu of a nondiscriminatory access requirement.

THE INTERNET

63

The FCC has also sought comments on whether it should prohibit carriers from enforcing exclusive access provisions in existing contracts. In other words, the FCC is considering the possibility of reopening contracts that have previously been negotiated and entered into in order to allow a developer to reconsider its previous decision to grant a provider an exclusive deal. Take a look at what companies are providing which services in your developments. Take a telco inventory and assess whether your tenants have choices for high speed Internet access and state of the art communications services. Once you determine what companies are providing telco services to your property, find their contracts. Often, when you look back in your paperwork, you’ll see that at one time or another, you probably signed a two- or three-page agreement with them. Next, assess the condition of the facilities they installed. On some properties, you’ll see that the wiring is rotted and abandoned. Other providers carefully maintain their wiring. Has a provider installed a dish on your rooftop? Have tenants installed dishes in their units? On their terraces? If you see that the demand is there, issue a request for proposals to see what providers are willing to offer your property. If you own a building in downtown, chances are that your tenants need high-speed Internet access and are willing to pay for reliability and 24/7 access. If you’ve developed a residential community to be inhabited by snowbirds, chances are a bulk bill cable television arrangement may be right for your community. Talk to your anchor tenants. What are the issues that they’d like your help in avoiding? Have they experienced service outages? Have their networks been hacked? For example, if you have a bank as an anchor tenant, you may need to address issues of network security in your telco agreements. If you have a law firm as a tenant, you may need to ensure that service outages are addressed in minutes or hours, rather than days. Have you been approached by a company that wants to put a satellite dish on your rooftop? Did you know just how valuable your rooftop space can be to a telco? Telcos are paying thousands upon thousands of dollars to ensure that they can place their reception and transmission antennas at just the right location to give them optimal service, and if that location is your rooftop, make sure that you enter into a properly drafted rooftop lease for the space. (I bet you never thought of your roof as an additional revenue stream!)

64

CHAPTER 3

Don’t let yourself get locked into a dead-end telco deal. None of us have a crystal ball that will reveal the state-of-the-art service of the future, so make sure you leave your options open.

REGULATING E-BUSINESS AND INCREASING CONFIDENCE Long before there was an Internet, the Federal Trade Commission (FTC) has had broad authority to protect consumers by regulating “unfair or deceptive acts or practices.” The FTC now takes the commonsense position that consumer protection laws apply online as well. Internet law being as new as it is, it wasn’t too long ago that this position wasn’t clear. I characterize the FTC’s position as “common sense,” but let’s not forget the old cliché that law is common sense as modified by the courts and legislature. It’s good to see that the FTC has adopted a commonsense approach to regulating e-commerce. It’s the right position for e-businesses and consumers. Adding a dose of consumer protection to the online world breeds consumer confidence. Consumer confidence means more people will buy online. The last thing reputable e-businesses need is for the Internet to develop an unsavory reputation as a place that’s less consumer friendly than other marketplaces. Let’s put to bed the idea that the Internet is the Wild West. It may have been several years ago when the answer to the most basic questions about Internet law was often, “Nobody knows. The law is unclear in this area.” Today, Internet law represents the most rapidly developing area of the law. As recently as 15 years ago, I would have said that the body of law that represents Internet law couldn’t fill a pamphlet. Today, it fills multiple volumes. It’s now clear that the prohibition against “unfair or deceptive acts or practices” encompasses Internet advertising, marketing, and sales. If you’re responsible for an e-business, you need to be familiar with the FTC’s rules and comply. If you’re a consumer, you need to know what your rights are. The devil is in the details. That summarizes the basic problem with taking old laws regulating Net advertising, marketing, and sales, and applying them online. How exactly do advertisers handle limitations and disclaimers in a banner ad that loudly proclaims a special offer if the offer is complex and cannot fit into a small banner ad? Space constraints in a banner ad make it difficult to effectively make proper disclosure. The FTC recognizes this and therefore takes the position that disclosures may be more effective if they’re made on the website to which the banner links.

THE INTERNET

65

The rule is that advertisers should place disclosures near, and when possible, on the same screen as the triggering claim. The law strongly discourages advertisers from being tricky. Advertisers are required to use text or visual cues to encourage consumers to scroll down a Web page when it’s necessary to see a disclosure. When using a hyperlink to lead to disclosures, the link needs to be obvious. The link should be labeled appropriately to convey the importance of the information that it’s giving the consumer. Consumers who find a website that makes it difficult to understand the fine print have a couple of remedies available. They can complain to the FTC. Just as important, they can show disapproval by taking their business to an honest and reputable e-business. One of the benefits of the Net’s rising popularity is that even midlevel and senior government people use it and are increasingly familiar with the way it really works on a practical level. This has often led to reasonable regulatory schemes. The FTC’s foray into clarifying online advertising rules is pleasantly marked by the increasing sophistication of those involved in the regulatory process. They’ve done an admirable job of making it easier for tech lawyers like me to give clients solid advice based on reasonable and clearer government regulations. Both e-businesses and consumers benefit. E-businesses must learn the now clearer rules of the game and comply. It’s not the Wild West out there and they will have nobody to blame if the FTC makes them a project.

SPAM The good news is that Congress finally passed a law on spam. The bad news is that they legalized it. In case you’ve been living in a cave for the last few years, spam is unsolicited commercial e-mail. It’s those lovely e-mails we all get hawking things like herbal remedies, bargain travel, Viagra, and body part enhancers. I say Congress “legalized” spam because a few states had laws that were stricter than this new federal law and the federal law overrules or preempts these state laws. Some have called the new law no more than an instructional guide on how to bombard Internet users with spam. Having said all this, the law is better than nothing, and Florida is an example of a state that had nothing in the way of spam regulation before this new federal law took effect. Under the new law, spammers may no longer do things like disguise their e-mail header information.

66

CHAPTER 3

Spammers have traditionally done this so that you can’t trace their email back to them. Also prohibited are misleading “from” lines, deceptive subject lines, and the harvesting of e-mail addresses from online sources if there is a notice prohibiting this practice on a website. What spammers must do is have a valid physical post office address in the e-mail, have a “clear and conspicuous” notice that lets you “opt-out” and a working return address or an automated way to opt out. This sounds great, but actually I’m still not sure what advice to give on the opt-out option. For years, I’ve been telling people that they should never opt out of spam. The reason has been that spammers have used the opt-out as a way of confirming that an e-mail address was a good one. Remember, that spammers do their work based on pure volume. They don’t take the time to confirm whether an address is still valid. They just blindly send bazillions of e-mails knowing that many go to bad addresses. Once you opt out, your address becomes gold to them because it now becomes a confirmed e-mail address. Now the question is, do you start opting out in the hopes that breaking the new federal law will cause spammers to change a core business practice? For now, my advice remains, don’t opt out. I’m betting that it will still be a trap to confirm your address. I reach this conclusion because as I look at my in-box, I don’t see many spam messages that are complying with the new law. Inaccurate headers, misleading subject lines, and other violations still look like the norm. One thing to look for soon will be a report from the Federal Trade Commission on the feasibility of a Do Not Spam list. While I am enamored by the idea, I’m not sure how you overcome the list becoming a list of confirmed addresses for spammers outside our borders. If I were a spammer, I would set up offshore in some funky lawless jurisdiction, buy myself some computers and spam the Do Not Spam list. Unless we’re willing to send in the marines to enforce our spam laws, I’m not sure what we could do to overcome this loophole. Here’s your depressing bottom line. Spam is not going away anytime soon. Sorry, but don’t shoot the messenger.

4

Managing IT and Software

JOINT APPLICATION DEVELOPMENT As a tech lawyer, I’ve been doing contracts for the custom development of software for years. As the Net took off, I started to do agreements for the development of websites. In many ways, these types of deals are similar. At the highest level, they both involve programming and can be mucked up quite easily. When you begin to examine the literature on computer-related development projects, you can’t help but detect a pattern. Projects routinely come in late and cost more than expected. You’ll see studies that say things like two-thirds of all projects come in substantially late and the average large project misses its planned delivery date by 25 to 50 percent. All too often, companies jump into outsourced development projects in a haphazard way. When they need speedy development, they choose high-risk practices, like signing a contract that hasn’t been thoroughly reviewed, which actually reduces the likelihood of on-time completion. When the overriding goal is saving money, these companies often look to speed as a key to reducing cost. That’s a fallacy. Speed usually drives costs up. If you want your project to be the one that breaks the late and over budget pattern, you must have the guts to begin to do things differently. There is a better way. It starts with the five Ps: prior planning prevents poor performance. Consider this, if you’re late for an appointment, is it better to take a few minutes to chart your course, or should you leave the house and figure out your route along the way? Common sense says that you

67

68

CHAPTER 4

should take the time to chart your path, but many development projects seem to follow the latter method. Speed is often an overriding goal. You have an illusion of speed if you jump right in and have a flurry of development activity happening. You feel good having skipped niceties like achieving a consensus within your own organization as to what the software or website will do, how it will do it, and other related issues. You’re downright heady about having cut lawyers out of the process so they didn’t have the time to nitpick at silly issues like warranties, performance standards, and a clear statement of work. The project is moving! Details like performance and maintainability can wait until the next project. As for testing procedures—you’ll know if it works. But wait! There are better approaches. One methodology to consider is what’s called joint application development (JAD). This methodology takes end users, executives, tech lawyers, and developers off-site, and away from distractions, for meetings where they work out the details of what the developers will create. The focus is on business objectives rather than programming details. While these meetings do take time, they will generally shorten the entire process because a clear definition of requirements reduces change requests and haggling later. An important aspect of JAD is that it requires top executives to be intimately involved in the planning process. This helps ensure organizational buy-in and reduces the approval process for the contract that comes from this process. JAD also shortens the requirements-gathering stage, which, with some projects, can seem to go on endlessly. “What we want the software or website to do” can lead to endless rounds of e-mails, meetings, and political infighting. JAD gets the key players together so they can get it all on the table and quickly resolved. Yet another way JAD can shorten the development cycle is by eliminating features of questionable value. A typical ad hoc requirements-gathering process often allows extra junk to creep into the project to satisfy the needs of various constituencies. JAD can provide an effective forum for a full and frank discussion. The more you remove items from the project, the faster it can move and the less it will cost. To make this process work, you need certain key players involved throughout. I emphasize “throughout” because JAD should be an intensive process, not a “come and go as you please” meeting. It starts with the executive sponsor who ultimately will bear the go/no-go decision at the end of this process. Others include the

MANAGING IT AND SOFTWARE

69

end-user representative, developer, others with required specialized knowledge, and the lawyers. Lawyers who are skilled and experienced with these types of deals can help facilitate accurate and clear communication, and minimize the likelihood of misunderstandings, which can only serve to slow down the process. JAD may seem like it makes work, but it doesn’t. It’s a time-saver that you should try with your next significant project.

PROJECT SCOPE CREEP Have you ever had the feeling that your outsourced tech project will never stop growing? Have you ever felt like it’ll never be finished? Your project may be suffering from scope creep. Scope creep is an insidious growth or change in your project that happens while you’re working on your project. It typically involves adding or modifying features as a project evolves. It can increase costs, require time-consuming rework, delay your launch date, and fray tempers. Scope creep is bad enough when it happens on a purely in-house project. The worst-case scenario is that you’ll have co-workers at each other’s throats. (Of course, depending upon who is at whose throat, you may find it to be a good spectator sport.) When it happens on an outsourced project—particularly one with a fixed price—you could be looking at an ugly legal dispute. Define Your Project Scope creep can occur with fixed-price deals as well as contracts calling for payment on an hourly fee basis. With an hourly fee deal, ugliness can rear its head if the project goes significantly over budget. The customer will often feel like the vendor lowballed them on the budget. The seller of the services will typically contend that as the project developed, the customer wanted more than she originally requested— scope creep. With a fixed-price contract, scope creep can be an even uglier situation. Here, you may have a customer arguing that the fixed price includes something the other side thinks is outside of the scope of the fixed price. In both cases, the beginnings of the solution are the same. You have to define the scope of your project carefully. I’ve done enough of these deals over the years to know what your reaction is. You’re thinking that this sounds great, but it’s unrealistic.

70

CHAPTER 4

You’re thinking that I’m living in a world where there are 60 seconds in a minute and 12 months in a year. Actually, I’m not. As a tech lawyer, I live in your world with compressed time. I know that your product cycles are short and the competition always seems to be moving faster than you. I also see more deals than you do. It’s the nature of what I do that causes me to have a bigger database of experience than the typical businessperson. While your business life is mostly about routine ordinary courseof-business tasks with an occasional big project issue, I tend to live a life where I only see larger and more complex deals. Nobody hires a tech lawyer to help with the contracting for a PC purchase at a local computer store. Among the many things that my experience has taught me is that the old cliché “Haste makes waste” still applies even in a Net-speed world. If Internet time drives you to the exclusion of other factors, you will make more mistakes along the way. The likely result is that you’ll be farther behind the time curve than if you had moved at a more deliberate pace. You simply must take the time to define the scope of your project. This definition must find its way into your contract and you must reach a consensus—both internally and with your vendor—that this defines the scope. While Net speed makes it tempting to march into a project with a loosely defined scope, you must resist the temptation. If you don’t, you’ll pay dearly later in aggravation, lost time, and money. Change Orders A good agreement for most tech projects will usually include a change order procedure. Theoretically the change order procedure is the only method by which the project scope is supposed to change. In reality, people make changes all the time without formal change orders—although they shouldn’t. Theoretically, as used in this context, has the same meaning as when you say “Theoretically, only Congress can declare war.” Of course, as we know, Congress hasn’t done that since 1941 and we’ve fired a few bullets in anger since then. Likewise, although it should never happen, let’s just say I’ve seen a few contracts evolve without change orders. The Right Way A good change order procedure typically involves a written request for a change, a period for the other side to consider the request, and a re-

MANAGING IT AND SOFTWARE

71

quirement that if the change is approved it will be documented and become part of the contract. If your agreement handles change orders right, it will require that the change order, as approved, take into account not only the price change, but the change in the timeline and impact on other aspects of the project scope. A good change order procedure can help control scope creep by requiring formality. Often, scope gets out of hand because it’s too easy to change. It’s too informal. This happens because people often want to appear friendly, informal, and cooperative. While these are certainly all great attributes, scope creep can be a consequence of these wonderful traits. You have to stay disciplined because every change has consequences in money and time. One of the most common mistakes I see my clients make starts with the role they give their tech lawyer. They see him as a part of the team during the negotiation and contracting phase, but then end his involvement during the implementation stage. The feeling seems to be that implementation is a completely nonlegal stage that can be run by business folks without legal consultation. That’s wrong because what these business folks are implementing is a project governed by a legal document. It’s ironic that they’ll put tremendous effort to craft a legal document that satisfies the parties, but then put the document along with its chief architect in the drawer as soon as they start building whatever it is they’re building. It would be like going to an architect to construct an office building, paying lots of money for her to draw up plans, then putting the plans aside and never consulting with her during the actual construction. A good tech lawyer will impose discipline during implementation. That means adhering to the agreed upon specifications and requiring that the letter of the change order procedure be followed for all changes. After hearing this, you may be thinking that this level of formality will muck up your project while keeping your lawyer happy. That’s simply wrong. What it will do is discipline everybody into full and frank communication. There will be no informal trade-offs, additions, subtractions, price increases, or whatever. Scope creep is a difficult thing to fight. It’s an almost inevitable result of complex projects. The buyer of the services feels like he’s just tweaking the project. The service provider feels like the project has become a never-ending nightmare. Honest people can and do honestly disagree. In fact, most business litigation is about honest people honestly disagreeing. You minimize the likelihood of ending up in this type of honest disagreement if you insist on formally documenting any changes in the deal.

72

CHAPTER 4

Nice people do have lawyers and contracts, and do insist on formal change orders. More important, so do smart business folks.

SOURCE CODE ESCROW It’s a nightmarish scenario. Let’s say that you’re the head of information technology (IT) for a hotel chain. You pay a software development company $500,000 to create new software for your worldwide reservations service. Then they go bankrupt or for whatever reason refuse to support the software. How would you maintain the software without them? Could you add features as needed? Could you continue to upgrade your investment to keep up with the latest and greatest? If you didn’t consider access to the source code in your agreement with the developer, you may find that you’re unemployed. The starting point in answering these questions is for you to understand what it is you licensed. Generally, when you license software, you receive the object code. In plain English, object code is code that only your computer can read. Mere humans don’t program using object code. Humans write programs using what’s called source code. Source code is simply human-readable code. Generally, you can’t do anything about rewriting software code unless you have the source code. Therefore, if your developer goes bankrupt and you don’t have the source code, it would be fair to say that you have a disaster in the making. Software developers consider the source code to be their most valuable trade secret. With the source code, a competitor could create a competing work without incurring all of the development costs of the original developer. Source code is the lifeblood of the software development business. From your perspective as the head of IT for that hotel chain, you need the source code to continue the evolutionary development of your software or to fix bugs if your original developer disappears on you. If they can’t or won’t help, you’ll need to hire another company to do the work. This other company’s efforts will be severely hampered if it doesn’t have the original source code. Back to the Beginning If we go back to the beginning of this transaction between you and the developer, we see that you had competing interests. You needed software developed to run reservations. You felt that for $500,000, you should own all rights to the final product. The developer wanted to be able to license use of the software to competing hotels and said that

MANAGING IT AND SOFTWARE

73

ownership would cost you far more than $500,000. So, you agreed on a perpetual, nonexclusive license. You could use it forever, but they could license the final product to others (presumably for more than $500,000 since you were the guinea pig). Typically, when you get a license, you only get the object code. Remember that the source code is the last thing the developer wants to give you. Your lawyer blew it if he didn’t work out a deal concerning access to source code before you paid your $500,000. Typical Arrangement Clearly, you needed a compromise. You had your very real need to access the source code in case the developer went out of business or filed for bankruptcy, or the developer simply breached its support contract with you. Just as legitimately, the developer needed to keep the source code secret—locked up in a vault. The solution was a source code escrow. Source code escrow is when you deposit the source code and other information with a neutral third party (an escrow agent such as Iron Mountain, www.iron mountain.com/index.asp). The “other information” is miscellaneous material that a trained computer programmer would need to work with the source code. This might include things like technical manuals, maintenance tools, proprietary utilities, and contact information for key technical employees. The escrow agent’s job is to keep a copy of the source code secure and safe. You only get the source code if the developer defaults on support, goes out of business, is involved in a merger or acquisition, or any other predetermined “release condition.” The idea is that if a release condition occurs, the escrow agent gives you the proprietary information. This strikes a balance between the parties. The developer can maintain strict control of its company’s greatest assets by not giving away its intellectual property, while continuing to satisfy your needs. At the same time, you can protect your investment in the technology and ensure proper support from the developer or access to the source code in case the developer fails. It’s a fair deal that no developer should refuse. If you fail to get a software escrow, you and your lawyer should be shot. Set Up the Escrow There are many variations in the way you can establish an escrow. My scenario involved software priced at $500,000. This calls for a major league escrow arrangement.

74

CHAPTER 4

Still, your development project may be only $25,000, not $500,000. This might call for a minor league arrangement. Somewhere in between is a continuum of increased diligence and cost. You’ll need some expert legal counsel to guide you through all the options in between. Each escrow will have its own unique twists. First, let’s talk about the simpler “minor league” escrow. The minor league escrow arrangement is appropriate when the size of your investment is smaller. The problem with what I describe as the “major league” arrangement is that it can cost many thousands of dollars. You may not be able to justify this investment for software that costs you only $25,000. A typical simple arrangement has the developer depositing the source code and related materials with a bank or attorney who puts the material in a vault. While this arrangement may be better than nothing, the key words are may be. There are many problems with this simple arrangement. What’s on the CD-ROM in that vault? Is it what it purports to be? Is it really everything that a trained computer programmer would need to work with the source code? You may find that your banker escrow agent is lost when you need the source code released from escrow. Bankers are in the banking business, not the escrow business. As your investment in software increases in size, you might want to consider an escrow with a professional software escrow company. You never want your lawyer or bank holding your escrow. They are just not equipped to do this right. A professional escrow company also can offer you technical verification services. This is an essential service. Unfortunately, it’s not always affordable for smaller investments in software. It’s absolutely required if your investment is large. When your escrow company receives what it thinks is the source code, it has no way of knowing what’s on the media (like a CD) without going through some kind of verification process. Typically, verification is an additional service escrow companies would like to sell you—and that you should buy. My take on verification is that it’s not worth doing an escrow without at least some minimal form of verification. Typically, an escrow company will offer three levels of verification with varying costs. “Typical” is something like this: With Level I verification, they ensure that the media deposit in your escrow account is readable and complete. They test the deposit to verify that the source code files are identical to the files that the developer warrants are included in the deposit.

MANAGING IT AND SOFTWARE

75

With Level II verification, they confirm that the source code will convert into object code, and that the complete, deposited source code files are the same as their counterparts residing on your hardware. With Level III, they confirm that the deposited source code will convert into object code, when compiled, and that it will process data exactly as the licensed program does. How far you go with your escrow will mostly depend on how much you invest in the software. The more you invest in the software, the more you should invest in the escrow. There is no single right answer to the question, what level of verification do you need? It’s a complex cost-benefit analysis that you must undertake with your IT folks, key end users within your organization, and your tech lawyer. The point is that you have no way of knowing what’s on that disk without verification. According to John Boruvka, vice president of Iron Mountain, “About 80% of verifications fail.” Think about that statistic for a moment. It means that you only have a one in five chance of your escrowed source code working right when and if you need it. That is precisely why you need to verify! Software escrow is an essential insurance policy. Still, you must remember that unless you take Level III to the max, you’ll never be sure of what you have in escrow. When your developer goes bankrupt is not the time to find out that the CD-ROM in escrow is blank.

DOCUMENT RETENTION POLICIES Seemingly innocuous documents can haunt your company in a courtroom. The best defense is destroying documents. If you do it right, you’re legal and safe. If you get it wrong, you may find a judge accusing you of destroying relevant evidence. The solution is having a wellformulated document retention policy (DRP). While I admit that nobody will ever win a business leadership and vision award from the Chamber of Commerce for giving time and attention to the development of a DRP, you need to do it. It’s like sleep. You may not feel like it’s a productive use of time, but you shouldn’t try to live without it. With information going digital and the price of digital storage on its way down, it’s too easy to keep everything. The problem with that approach is that when you’re involved in litigation, you’re almost inviting the other side to go fishing through your ancient records. Who knows what evil lurks there? It only gets worse when you’re faced with a subpoena for a document and you have so much data that you can’t even find what you

76

CHAPTER 4

need to find. Now you look recalcitrant. (Throughout this chapter, I’m going to use the word document broadly to mean any type of record, whether written, digital, audio, visual, or whatever.) Let’s start with what you wish your DRP could say, but can’t. “When litigation is threatened or filed, immediately review all relevant documents. Upon completion of the review, destroy all documents that are detrimental to our position.” Somehow this policy conjures up something having to do with 18 minutes of tape. Let’s just say that it didn’t work for Nixon and it won’t work for you. No matter what your policy is, it must call for a complete halt to document destruction once litigation is threatened or filed. If you ignore this rule, you may find yourself accused of spoliation. Spoliation can be loosely defined as the intentional and wrongful destruction of evidence that is material to an ongoing or imminent litigation. If a court feels that you’re guilty of spoliation, it has many weapons at its disposal if it wants to sanction you. You don’t want to go there. It’s an ugly place to be. In creating your DRP, you’re going to have to assemble a team that should consist of a high-level executive responsible for the project, your chief information officer (CIO), department heads, tax counsel, regulatory counsel, and legal counsel. Ultimately, the chief executive officer (CEO) should be the one to sign off on the DRP. You need the CIO because one of the considerations is the technological feasibility of what it is you want to do. An important issue is, to what extent can you safely and effectively automate the process? You need department heads involved so that they have an opportunity to comment on the unique document retention needs of their department. Your tax and regulatory counsel are there because of tax laws, and if you’re in a regulated industry, then those regulations may also impose some very specific requirements. The first principle is that you should be sure to keep everything needed to successfully run your business. This is a pure business issue. What do you need and how long do you need it? The second principle is that you should never destroy anything that the law requires you to keep. This principle requires you to stop all document destruction once somebody threatens or commences litigation or other legal proceedings against you. You can start again only with the approval of your lawyer. Subject to the second principle, tax law and regulatory requirements, the general rule is that you can destroy your documents any-

MANAGING IT AND SOFTWARE

77

time you want. Having said that, if a court ever puts your destruction of documents under scrutiny, it looks much better if you did the destruction in a systematic way based on a schedule and a documented DRP. It’s common sense. If you destroy all e-mail when it’s six months old, it’s hard to accuse you of spoliation because a year-old e-mail is long gone. If you suddenly have a DRP in place the day before a lawsuit is filed—well, you get the picture. One pitfall to avoid in creating your DRP is not taking into account the fact that most documents have multiple copies. You have to consider your employees’ personal files, local hard drives, and backups. It doesn’t help to destroy working data if you keep your backups forever. Dealing with backups will probably require your CIO to create backups with the DRP in mind. Depending upon the media that you use for the backup, it may not be possible to selectively destroy parts of the backup. This creates a problem for you if your DRP requires you to destroy e-mail after six months but tax records after seven years, yet they both reside on the same tape. If you think that the prospect of creating a DRP sounds like a boring and thankless task, you’re probably right. It is boring and thankless. Still, the penalty for not dealing with the issue could be a long-forgotten memo rising up from the depths to hurt you in a courtroom.

ELECTRONIC EVIDENCE If you’ve ever been involved in any type of litigation, you know that finding evidence to support your position is one of the keys to victory. As a tech lawyer, I sometimes am asked by other lawyers to look at nontech cases and offer advice on electronic evidence. Electronic evidence can make or break a case—often in surprising ways. Let’s start with the basics. Electronic evidence is any information of any type that’s stored in electronic form and is relevant to a particular litigation. It might be stored on things like a hard drive, floppy disk, or DVD. When you consider what electronic evidence you might be able to dig up (or what electronic evidence the other side might find when they start chomping into your bytes), you should take into account that every time you touch a computer, you may be creating electronic evidence.

78

CHAPTER 4

The Power of E-mail Let’s consider a single hypothetical e-mail message that you created using Word and then copied and pasted into your e-mail program. How many places could this thing turn up? Before I begin answering this question, I must warn you that after you read the answer, you may not sleep tonight. Let’s start with the good news. The most obvious place is that the text of your e-mail will be on your hard drive in whatever folder you save your correspondence. If you went through multiple revisions and drafts, it’s possible that your word processor saved every draft, every revision, and the name of everyone who touched the document. Oh yes, let’s not forget that this includes the date and time of the revisions. So, you’re thinking this is no problem. There’s no litigation pending or threatened concerning this document, so you’ll just delete the file. Your lawyer even told you that it would not be improper to destroy this particular document at this particular time. The problem is that you may have accomplished nothing. The document may also exist on your network backup tapes. Even if you think of it, generally you can’t delete a single file from a backup tape. That’s really OK because by the time I’m done tracing the life of this e-mail, you’re going to realize that the tape backup is the least of your issues. Once you copy and paste the text into your e-mail program and send it, your e-mail will also turn up in the sent box in your e-mail program. Some recycle bins or trash bins on some computers will even save every version of a file as it changes. With this feature, you may find countless versions of your sent box on your hard drive. Every time you send an e-mail, a new version of your sent box is created and another old one goes to the recycle bin. If you’re wondering why I called the stuff above the “good news,” that’s because here comes the bad news. It was good news because, assuming that your lawyer gave you the green light to destroy the document, you could control everything I’ve talked about—until now. What you can’t control starts with your Internet service provider. While your e-mail might quickly disappear from your hard drive, your provider may have its own backup procedures, which may ensnare your e-mail. Then the same goes for your receiver’s Internet service provider. And let’s not forget the person to whom you sent your e-mail. It will be in her in-box, e-mail program trash bin, hard drive trash bin, and her tape backups. For the coup de grace, if she forwarded it, your e-mail may be like a rabbit on reproductive overdrive.

MANAGING IT AND SOFTWARE

79

The Scope of the Task The good news for a lawyer looking for electronic evidence is that computers create and store massive amounts of information. Better yet, it’s often stored in ways that aren’t obvious to an average user. When you consider things like temporary and swap files (a computer creates them automatically and without a user’s control), which may be chock full of juicy information, you realize that finding helpful electronic evidence is a bit like fishing for one particular fish in the ocean. The task can be expensive if not daunting. A single floppy disk holds the equivalent of about 720 pages of text. Move to a CD-ROM and you’ve upped the ante to about 325,000 pages. Each gigabyte is about 500,000 pages. If you’re the one looking for electronic evidence, you’ll need to hire an expert who’s familiar with the latest technologies for recovering deleted computer data. It’s a well-known truism that deleting a file from your hard drive doesn’t really destroy the data. Deleting a file is more like removing reference to the file from the table of contents of a book than tearing it out and shredding it. If you want to truly destroy a file or erase an entire hard drive (let’s say before you sell your computer), the standard advice has been to use a program that overwrites the old data with random data. The fact is this isn’t really good enough if someone wants to get to your data badly enough. With techniques like magnetic force microscopy and scanning tunneling microscopy, it is possible to recover data that’s been overwritten many times. When you consider destroying data, remember that in some situations it’s illegal to do so. Check with your lawyer before you act. Once your lawyer blesses your data destruction, if you really need to ensure success, forget about overwriting data with random data—it’s not foolproof . . . but your fireplace is.

ELECTRONIC DISCOVERY I’ve written before about litigation being a form of legalized warfare. Here I’d like to touch on one of the battlefields in that war. I’m talking about the discovery process, and I’d like to specifically touch on how electronic discovery, or e-discovery, has altered the battlefield. One of the major by-products of our digital age is the enormous amounts of data we’re creating every day. We’re sending e-mail back and forth to colleagues and business partners, instant messaging and

80

CHAPTER 4

texting friends and family, and saving new spreadsheets and documents at a frenetic pace. And that’s just the easy-to-remember kinds of data. Let’s not forget about all of the metadata, backup files, and Web browsing data we’re creating while surfing the Internet. The list is nearly endless. All of this activity creates oceans of data stored away on digital media of all forms and formats. While we used to commonly measure large amounts of data in megabytes, we’ve quickly blown through the gigabyte level and are moving into terabytes, and on into petabytes. Whatever amounts of storage space Silicon Valley comes up with, I’m sure we’ll find a way to fill it. Nature abhors a vacuum, and people can’t help but collect and save stuff. If you don’t believe me, check out your garage. So what happens with all of this data when you’re involved in a lawsuit? How can you hope to find anything in all those bytes, and how can you protect your bytes from prying eyes? The answers are found in the e-discovery process. Discovery generally occurs during litigation after the initial flurry of paper and court filings that kicked off a case, and generally long before that case ever makes it to the courtroom. In the old days, the discovery process led to mountains of paper being passed back and forth between litigants, sometimes with the hope of drowning the other side in paper (sometimes this still occurs). Paralegals and associates spent long hours burning the midnight oil reviewing documents in the hope of finding that smoking gun that would win the case. Not surprising, the old rules of civil procedure had a hard time dealing with digital data and it took a while for the law to catch up to technology (again). But in 2006, changes to the Federal Rules of Civil Procedure finally went into effect, and the states are following the federal lead and slowly updating their own rules of civil procedure. The good news (or bad news depending on your point of view) is that these new rules clarify the handling of data during a lawsuit. Now, instead of mountains of paper, litigants are passing electronic data back and forth. Even in this digital age, many attorneys are uncomfortable with e-discovery issues. This has led to the development of entirely new industries to aid with the discovery process, including computer forensics and yet another legal specialty called e-discovery consulting. Savvy litigants are adding technology attorneys specialized in ediscovery to their litigation teams to handle the enormous amounts of electronic evidence that can be harvested, preserved, documented, and authenticated during litigation. Your technology attorney’s role on the

MANAGING IT AND SOFTWARE

81

litigation team is to work with both the main litigation team handling the other legal aspects of the case and to coordinate the efforts of the computer forensic company. Your technology attorney works with the litigation team to handle the legal mechanics of activities that include, but are not limited to, sending preservation letters, suspending document retention and destruction policies, and handling interrogatories and depositions. Your technology attorney also works with and supervises the work of computer forensic investigators in coordinating electronic data, analyzing electronic data, and other tasks. Your tech attorney will often retain a computer forensic investigator to find valuable data the other side is trying to hide, and to help you come up with the data you have to disclose to the other side. Yes, computer forensics is sort of a branch of forensic science like that you see on CSI, except with a lot less blood. Computer forensic investigators create backups of all relevant media to create a complete snapshot of the media at the time of acquisition, and then convert, scan, and index the data as required. They then examine the contents of the backups without altering the contents in an effort to find valuable data. Without their efforts, data can be lost over time. We need these forensic specialists because data is everywhere: from CD-ROMs to USB flash drives, from text messages on phones to the Internet itself. Sorting through all of it can be a nightmare without their help. Your technology attorney and investigator often use a number of e-discovery software applications and litigation support services on the market. These tools help ensure that your team has the capacity to process and store the huge amount of electronic data being handled. Clients are understandably nervous about sending confidential data to opponents. The loss of control over your company’s secrets can be gut-wrenching. However, there are a variety of tools, protocols, and best practices that can be used by your team to identify who has access to your data and when. Your technology attorney can also advise you on what electronic data may be privileged and how to handle such data during discovery. Early planning is the key to offensive and defensive e-discovery. Your technology attorney should be able to assist you with your handling of electronic data, electronic document review, and data production for opposing counsel, and can manage any vendors or consultants you bring on board and assist with the technology aspects of litigation such as depositions of your opponent’s key IT personnel.

82

CHAPTER 4

While e-discovery can be expensive in larger cases, it’s often very cost-effective. Instead of paying teams of attorneys and paralegals by the hour to sort through those mountains of paper I mentioned earlier, computer forensic investigators can sort through electronic data for much less. Even if you’re not involved with litigation today, you should be working with a technology attorney specializing in e-discovery to establish record management and document retention policies. You need to get your act together today in anticipation of future litigation. Get your technology attorney on your team early to help ensure you are compliant with the rules of e-discovery and don’t accidentally destroy valuable data. Don’t incur litigation penalties for your failure to comply with the rules of e-discovery.

CREATING A DATA RETENTION POLICY If your business does not have a well-thought-out and properly implemented data retention policy, you are heading for trouble. This section will explain why. The starting point is that you need a structured data retention plan so you know what kinds of data you have, where you store your data, what data you should destroy, and when. Not only is it good business, but also having a data retention plan is invaluable if you are ever sued or need to sue somebody. It’s not surprising that most of us are turning our computer systems into our garages—cluttered with piles of useless outdated stuff that we’re hesitant to throw away. Data storage is getting cheaper every day while engineers keep increasing storage capacities. So we continue our normal business operations with our data out of sight and out of mind out on the server or hard drive. Since it is not overflowing filing cabinets and storage boxes cluttering up your office, the easiest solution is to simply keep everything forever and play it safe, buying more storage as required. However, this is not practical for a variety of reasons. File sizes can become enormous, resulting in degraded system performance and the ability to manage and retrieve your own data. You’re also constantly incurring new storage expenses. While storage costs less, it’s still not free and costs can grow quickly when you consider storage for your archives, backups, and as required by your disaster recovery plan. Finally, as we’ll see later, storing everything could expose you to significant expenses in producing that data in response to an electronic discovery request.

MANAGING IT AND SOFTWARE

83

I hope that you already have a data retention policy in place. A working data retention policy helps you create policies and procedures for preserving, storing, indexing, and deleting data. As a best practice, you should have such a policy in place and operating before it is critically needed in response to a business need or litigation. Creating and implementing a data retention policy will help you answer the where, why, and how questions related to your data, and avoid the worst-case scenario where you have lost control of your data. Imagine having your intellectual property, financial records, and confidential information spread across all of your systems. Where would you start to look for your data, and how could you hope to protect it against unauthorized access? Having a data retention policy is not just good business. Depending on your industry, you may also face data retention requirements that come from a variety of legal sources. Federal, state, and local requirements are the obvious sources of possible retention requirements, but in today’s world you could also face some international requirements. What to Address A well-crafted data retention policy is a formal plan that should address a variety of issues including but not limited to (1) management of different data types, (2) retention periods for each data type, (3) policies and procedures on backing up and archiving data, (4) how to handle different versions and duplicates of data, (5) setting up deletion or purge schedules, and (6) how your plan handles aspects of the electronic discovery process. As a first step, you need to create a retention team to review the current status of your systems and data. Building your data retention team is going to depend on the size of your company. Larger companies may be able to delegate many of these tasks to the IT team after receiving input from upper management. Smaller companies may have to get individual end users involved. By combining the skills and expertise of your people the plan should be able to address and support your company’s business operational requirements, comply with relevant legal requirements, and limit the strain on IT resources. Care needs to be taken to ensure your data retention policy does not conflict with your company’s other policies such as computer and Internet use policies or privacy policies. Data comes in many types, so you’re going to need different retention policies for different types of data. How long you keep e-mail

84

CHAPTER 4

(and where) is likely to differ from how long you need to keep copies of signed contracts or customer orders and records. I’m guessing you’re not going to know all the data types you have on your systems, categorizing all of it is a step where your IT folks have a chance to shine. Once you’ve figured out what you have, how do you decide how long to keep your data? When does particular data lose its use to the organization? Now it’s time to turn to your attorney so he can advise you on the legal retention requirements (if any) your company and industry face. Those requirements should serve as a bare minimum retention period; in most cases no one is going to care if you go above and beyond those time limits. Your attorney can advise you on what’s required. If you’re in an unregulated industry then your retention requirements mostly depend on your business’s requirements and your own comfort levels. Again, the bare minimum retention period you choose should allow you to set your retention requirements so that you’re able to maintain your business operations and live up to your contractual obligations. Establish retention periods for each category of electronic data. For example, your plan might state that e-mail messages are purged after 45 days and backup tapes are purged after 90 days. You also need to be clear on when data is removed from servers, desktops, and laptops since these often contain the “live” data another party in a court case will be seeking. You also need to address what happens to your old data. Are you going to archive old data, create backups, and when (if ever) are these going to be deleted or purged? The policy should set clear standards and schedules on how these processes will occur, to include the types of data to be archived/backed up, and on what schedules. Care needs to be taken in creating your data purge schedules; you don’t want a disastrous accidental purging of data you need. Your IT team should be consulted to ensure that the data you need is archived as required, safely backed up in the appropriate places, and not purged accidentally. How long are you going to keep your backups? Don’t get confused and think that by writing over your backups every 90 days that you’re losing all data every 90 days. You’re actually only deleting backed up sets of data, not all old data that resides elsewhere on your systems. How will you address duplicate data? Your employees probably create multiple versions of the same documents during the course of normal operations (contracts, invoices, letters, etc.). They’re also probably creating multiple copies as they pass these documents around via

MANAGING IT AND SOFTWARE

85

e-mail or work on them independently. Do you need each and every copy, and if so, for how long? Deleting or purging schedules can be built into your regularly scheduled maintenance programs, though if your company or computer resources are of significant size you may want to stagger purge times to avoid the performance impact on your systems. These are only a few data retention policy suggestions to help you get started. Contact your tech attorney to help formulate your plan. Electronic Discovery The major benefit to having an established data retention policy in place is that it can really help you in dealing with litigation. Sticking your head in the sand like an ostrich and hoping litigation won’t come your way is really not an option in today’s world. Having rational and defensible data management guidelines in place helps you respond to the electronic discovery process that occurs when parties take a fight to court. You have an obligation to make a reasonable and good faith effort to preserve data that may be relevant to pending or threatened litigation. That’s right, you have to account for data that might be of value to the other side in the event of a future legal action. Should litigation start, you’re likely to face a “legal hold” request that requires you to stop portions of your normal data retention and destructions process relating to data that might be relevant to the particular case. At this point you need to preserve relevant data, but you’re not freezing your systems or data to preserve everything. Your data retention plan needs to address how you will respond to these hold requests. Should you fail to stop your process and relevant data is lost, you could face serious consequences from the court. Since you’ve taken the time to implement a data retention plan, you’re better able to assist your attorney in responding to electronic discovery requests. Your plan helps you play defense. You’ll have some idea on what kinds of costs and burdens will be associated with the production of your data, be able to control production costs, and minimize the risk of failing to produce relevant information from your systems. Having such knowledge is invaluable to your attorney and your case, and you’re really crippled without it. I can’t give you a primer on all the aspects of electronic discovery in this section. But generally, as part of the electronic discovery process, if you have relevant data on your systems, even if it is stored on an old backup tape from 1979, you’re going to have to produce it,

86

CHAPTER 4

and possibly at your own expense. There are exceptions, of course: privileged or confidential information are examples of information that may not have to be disclosed. However, you should anticipate that the other side is going to get what it is looking for. Still, by having a data retention policy in place you can effectively manage the electronic discovery process. Get your technology attorney involved in the creation and management of your data retention policy early. He can help you balance the need to retain data relevant to your company’s operations and potential litigation, and your company’s need, in good faith, to continue normal operations and delete useless data clogging your systems.

ENRON AND DATA DESTRUCTION Enron. Document shredding. File deletion. Arthur Andersen. Not even J. R. Ewing could concoct what these boys did. It reminds me of one of those law school clichés: “Law is common sense as modified by the courts and legislature.” Now, let’s take this idea and apply the smell test to Arthur Andersen’s actions. In case you were in Antarctica (do they have CNN International in Antarctica?), the former Big Five accounting firm Arthur Andersen destroyed many documents relating to its audit of oil industry giant Enron. Of course, they did this as Enron was about to collapse. Now my nose is perking up. It stinks in here. Of course, we believe that the destruction of these documents was the innocent act of a completely innocent auditor. The stench is getting worse. Applying the smell test and common sense, you know that you can’t audit a multi-zillion-dollar company and then destroy the documents underlying your audit just before the bottom drops out. I’m sorry, but it doesn’t take three years of law school to figure that out. What were they thinking? The only thing that would seem to make sense is that they thought no matter how bad the flak from destroying the documents, it would be worse if anybody saw the documents. J. R. Ewing where are you? As dumb as the document destruction was it failed anyway. Enron went into bankruptcy and Arthur Andersen was found guilty of obstruction of justice in 2002, though the conviction was later thrown out by the U.S. Supreme Court. The scandal effectively ruined both companies.

MANAGING IT AND SOFTWARE

87

Legally Destroying Data The law does permit you to destroy data, whether digital or paper. If you apply the commonsense and smell tests, you realize that the law has to allow this. The alternative is endless warehouses and data storage centers filled with information that is of no use to anyone. Of course, this begs the question—when can you destroy data? The simple answer is you can destroy data as long as you have no reason to believe that litigation or a government investigation is imminent. I’ve offered some suggestions elsewhere in this chapter on data retention and destruction policies. Enron and Arthur Andersen notwithstanding, there is nothing necessarily nefarious in having a data retention policy. It serves at least three legitimate goals. It saves valuable computer and physical storage space. It reduces the volume of your stored documents, making it easier to find something when you need it. Finally, if there is no legal obligation to keep data, it reduces the likelihood that somebody on a subpoena fishing expedition will dig up something to exploit in future litigation. All three goals are legal and proper. While it’s not a fun task that immediately translates to your company’s bottom line, you need to attend to putting together an effective and legal data retention policy. When you’re finished, if it passes the smell test and you follow your policy, you won’t find yourself in anybody’s crosshairs if a document doesn’t exist, provided that you legally and properly destroyed it based upon your long-standing data retention policy. It’s that smell test again. If you can smell the litigation coming, your data destruction will develop its own stench.

DISASTER PLANNING Experts estimate that every year American businesses lose $4 billion to computer downtime. Catastrophes like hurricane Andrew and 9/11 should have taught us how quickly an average day can go bad. Have you ever thought about how your business would recover if you lost your entire information technology infrastructure to a catastrophe? Have you ever stopped to consider all the different ways your computer systems could be destroyed or brought down for an extended period of time? The list is endless and just starts with freak stuff, stupid stuff, and Hollywood-couldn’t-have-written-the-script stuff. It could be

88

CHAPTER 4

sabotage, terrorism, weather, fire, a power company problem, and who knows what else. The point isn’t even how it happened. The point is that all your computers are dead, your company is bleeding out like a trauma victim, your eyes are glazed over with that deer-in-the-headlights look, and you’re frozen wondering what to do. Here’s the deal. If you’re looking at the rubble and that’s the first time you considered disaster recovery, let’s just say you missed the party. It’s conceivable that your business may never recover from what you lost. While a mom and pop operation may be able to get away with a disaster recovery plan that’s based on a tape backup kept at a geographically remote site, that’s not going to cut it for a large or even medium-sized business, and certainly not an e-business. Often, it’s best to outsource your IT recovery planning to companies that specialize in providing these services. Presumably, it’s not your core competency and it rarely makes sense to hire an employee with that narrow expertise. While your best in-house IT person may be a good choice to manage this outsourcing project, this person probably isn’t really an expert in this extremely important area. Moreover, even if you had a disaster recovery expert in-house, you still need to outsource because in a disaster, you’ll need access to somebody else’s computers quickly while you recover your own operation. You need to look closely at disaster recovery services offered by companies like Sungard Recovery Systems (www.availability.sungard .com/Products+and+Services/Business+Continuity/Recovery+Services/) and IBM (www-935.ibm.com/services/us/index.wss/itservice/bcrs/ a1000411). They’ll do things like consult on designing, managing, and executing an end-to-end business continuity plan for your business. They’ll help you set up backup routines and take other appropriate steps to ensure you don’t lose data to the unexpected. They have plans that will give you emergency access to their computer centers so that you can temporarily move your IT operations there while you rebuild your own. With a properly set up plan, you declare an emergency, and a series of preplanned and pretested steps go into effect. The goal—get you up and running again within a reasonable amount of time. Probably the severest test ever on the disaster recovery industry was the catastrophe of 9/11. For example, by the end of the week of September 11, Sungard says that it had 30 clients declare an emergency. From everything I’ve heard about the World Trade Center disaster, it appears that the major disaster recovery companies earned

MANAGING IT AND SOFTWARE

89

good grades for their performance. They appear to have delivered basically what they promised when the worst happened. If you decide to outsource your disaster recovery, you should be aware that these companies do have their form agreements ready for you to sign. In my experience, they’re reasonably well-written documents that describe the services they’ll provide you. Still, bear in mind that they’ve paid some lawyer good money to write a contract that’s protective of their interests. It’s not that the contract will be grossly unfair, but experience tells me that it’s tilted in their direction, is negotiable, and that with some negotiation, you can tilt it back to the middle so that it’s fairer to you. While theoretically they could volunteer a completely evenhanded, right-down-the-middle document, the fact is they won’t. Maybe it’s because they expect sophisticated customers to negotiate the agreement, so they figure they need to tilt it their way so they have room to negotiate. Maybe it’s because they know a certain percentage of less sophisticated customers won’t bother to negotiate the deal and, from their perspective, why not have a contract that’s more favorable to them. Whatever the reason, you should expect a negotiation process for your agreement with a disaster recovery company. You’ll often find that the description of services in the proposed contract doesn’t quite match what the sales rep promised. You may find nasty little surprises about unexpected fees or performance standards that don’t meet your needs. Every deal is a bit different and it’s impossible to guess where the problems will lie in your agreement, but I’ve still never seen a first draft that was perfect and ready to sign as delivered. As important as their services could be in saving your business in a disaster, let’s just say that the day after the disaster isn’t the day to read the contract and discover something unexpected about what you thought you were getting. If you don’t have an adequate disaster plan in place, taking care of this problem just might make a good New Year’s resolution.

PREVENTING DISASTER LIABILITY Good morning. It’s almost hurricane season again. Do you know where your disaster recovery plan (DRP) is? Does your business even have a DRP?

90

CHAPTER 4

Are you prepared if a hurricane or terrorist act destroys your corporate headquarters? Do you have adequate backups of your data? Will you have access to computer systems with the right software? Will you be able to restore your backups? How long will it take to get your company operating again? If you don’t think your company is ready for a disaster, I would like to politely suggest that you begin the disaster planning process today. It’s never a fun job to assign to yourself, but putting it off until tomorrow and then tomorrow after that isn’t a good option either. It’s bad business and you could be creating a legal liability for your company and you. It’s one of those double whammies. You lose your headquarters, and then somebody sues you as a direct result of you being the victim of a disaster. Of course, the basis for the lawsuit isn’t that you had a hurricane gut your building. Rather, the basis would probably be a statute, a contract, or some common law doctrine that required a DRP. On the statutory side, regulations are mostly aimed at financial institutions. For example, the Federal Reserve, the Office of the Comptroller of the Currency, and the Securities and Exchange Commission issued a white paper describing objectives for disaster recovery and business continuity plans that should be set in place. Another example would be the Federal Financial Institutions Examination Council guidelines, which state that a bank’s informational security program “shall be designed to . . . protect against any anticipated threats or hazards to the security or integrity” of customer information. Breach of contract can also be the basis of liability for your company if a disaster victimizes your company. Don’t assume that declaring it an act of God or a force majeure (what’s law without some French) will protect you. It may, but it may not. It depends upon things like the precise wording of your force majeure clause and the facts surrounding your disaster. To some extent, after a disaster (it could be something like a terrorist attack, hurricane, or destructive computer virus) your liability to a third party because you cannot do whatever it is a contract requires you to do may depend upon the foreseeability of the disaster. If a particular type of disaster is a foreseeable risk and your contract is silent on the risk, a court might rule that as between your company and the other party, your company is the one that assumed the risk of the loss. Moreover, since 9/11, even terrorism is arguably a foreseeable risk. Your best defense team in that kind of situation might use buzz phrases like “impracticability of performance” and “frustration of pur-

MANAGING IT AND SOFTWARE

91

pose.” However, this type of defense to a breach of contract is more likely to carry the day if a meteorite said hello than if a fire damaged your computers. The logic is that a fire may be unlikely, but you should have contingencies to deal with it. As for that meteorite, well, that’s just a really bad day and I think a judge is more likely to be sympathetic. Then, we have good ol’ common law as a way to create that double whammy. For example, a poor DRP could be the basis for a suit by your shareholders if they feel that the board of directors failed to exercise good business judgment in not having or maintaining an adequate DRP. After all, what board doesn’t consider and plan for things like a fire destroying the computers? It happens. One thing you should look at both before and after a disaster is your insurance. Before a disaster, it’s an exercise in planning. What insurance do you have? What does it cover? What is the maximum under the policy? Does it cover business interruption? Does it cover reconstruction of records? Do you need to improve your coverage while you can? After a disaster, it’s a salvage operation. The issue is, how much can you collect to help you recover from the disaster? If you did the before part right, you will be helped immensely when you collect your insurance proceeds. Be sure to obtain the assistance of a lawyer who has real-world experience with disaster planning. After the next hurricane is not the time to find out that your contract is a disaster too.

5

Websites Development and Upkeep, Laws, Issues, and Solutions

WEBSITE OWNERS Whether you like it or not, the utopian days of the Internet being like some hippie commune from the ‘60s are long over. Folks, it’s business now. Where there’s business, disputes follow, and then come the laws and the lawyers. Here’s a checklist of 10 things to consider so that your website doesn’t become a reason to create a line item in your budget called “litigation expenses.” Let’s start at the beginning—creating your website. If you pay someone to build it for you, you expect to own it. Right? The surprise is that you don’t unless you have a written agreement that says you do. It doesn’t matter that you paid for it. In fact, nothing matters except that written agreement. Yep—it is a trap for the unwary. The second concern is that once you create that website, you’re exposing your business to the world. That could be great for business. It could also mean that you could find yourself sued or criminally prosecuted in some state you’ve never visited or some country on the other side of the world. If you think that this can’t happen to you, you should think again. It can and does. Being exposed to courts around the world asserting jurisdiction over you because of a website is just one of the many risks your e-business faces. It leaves you having to answer questions like, “Do you need to comply with the differing laws of all 50 states—and what about other countries?” The third item to consider is privacy issues. The U.S. has few laws (I didn’t say no laws!) regulating online privacy. You need to be cautious about stepping on your customers’ privacy concerns. You should

93

94

CHAPTER 5

consider posting a privacy policy on your website. When you post it, be sure to comply with whatever it is that you post. Your fourth checklist item involves framing and linking. Linking is when a web surfer clicks on a part of your website and is taken to another website. Framing is when you have a link that changes only part of the browser display. With framing, you might have part of the display showing your navigational choices and maybe even an ad, with the rest being a webpage from somebody else’s website. If you frame or link another website, you should consider getting that website owner’s consent. This is a murky legal area and it’s not clear this is always required. Still, when faced with “murky,” I prefer the conservative approach, especially if it’s not costly. The fifth item for your checklist is your webwrap agreement. That’s the slang term for that link on the bottom of a webpage that says something like, “Terms and Conditions.” You know—it’s the link nobody ever clicks because, well, who cares? A webwrap also describes that agreement that popped up when you registered to use a website. It was the one that you didn’t bother to read, but nonetheless clicked “I Accept.” Your website must have one of these two. If you ever read somebody else’s, you’d realize that this is your best way to impose one-sided conditions on your users. Everybody else does and so should you. Your terms and conditions may save you someday from some legal hot water. Item number six on the checklist is to consider whether you may be infringing somebody’s copyright with the content of your website. Copyright applies online just like it applies to books and newspapers. When in doubt, get the copyright owner’s consent. If you’ve “borrowed” your competitor’s content, maybe you should find new content. Trademark laws are the seventh item for the list. Like copyright law, trademark law also applies online. You cannot generally use somebody else’s trademarked logo, slogan, or whatever without his or her permission. Now let’s flip the last two around and call it item number eight. You should be protecting your own intellectual property online. Your site should include proper copyright and trademark notices. You should also register your copyrights and trademarks with the appropriate government agencies. You can even copyright your website, so do it. The next item to consider is advertising, consumer protection, and product liability laws. In many ways, your website is an advertisement. As such, it’s subject to all the same laws that regulate this area. Consumer protection can be a particularly treacherous area because these regulations may vary by city or county.

WEBSITES

95

Last but not least is that you should consider having a backup and archiving procedure for your website. This way if anybody ever makes a claim concerning your website, you’ll have some way to know what was on your website at the time of the alleged problem. This may seem like a long list of things to consider. It really isn’t and you shouldn’t be intimidated by it. Never let a legal checklist stop you from making money. You just figure out how to make the money, and then make your tech lawyer earn his keep by helping you weave your way through the legal thicket.

CUSTOM SOFTWARE In a perfect world, you would be able to walk into a store or pick up the phone and get the perfect software. However, as you may have noticed, we don’t live in a perfect world. Often, the best (or only) option is to buy software custom made to fit your business needs. Having software custom made or modified for your company requires that you negotiate an agreement that touches on a whole slew of issues. Dealing with custom software is not like buying off-the-shelf software at the computer store. There, you’re typically dealing with a nonnegotiable license agreement that appears during the installation process. Agree to it and you get to finish the installation. Say no and you get a refund. Things get much more complicated in the custom software world. Here, the typical corporate buyer may have more negotiating position but still be at a tremendous disadvantage due to lack of experience in negotiating these types of agreements. With custom software, you should never consider accepting the vendor’s standard form. They’re inevitably one-sided in favor of your vendor. Trust me when I say this because I write those one-sided agreements. My goal is to give you a feel for some of the issues that you should consider. It’s Usually a License Even when you “buy” custom software, the most typical transaction has the buyer getting a license to use the software rather than the customer buying all the rights to the product. True purchases of software raise their own unique issues. This section will deal with the more typical license situation. A license is simply a grant of a right to do something that you would not have the right to do without that license. With a software

96

CHAPTER 5

license, the single most important issue is defining the precise scope of the license. Your license must clearly state whether it’s exclusive or nonexclusive, who in your organization can use it, and whether there are any limits on the location of its use. The key here is that you must accurately project your needs for the software. You must ensure that your license permits your anticipated uses and you should have a structure in place if your needs grow. A mistake here can be costly because you will have less negotiating power down the road. If you’re going to license 150 users and six locations today but think it’s possible you might need more licenses tomorrow, be sure to deal with the pricing of additional users and locations now. Once you’re married to your software, you don’t have much choice if your software developer’s pricing proposals are exorbitant for more users or locations in the future. You must also carefully define permitted users. If subsidiaries, independent contractors, or others will need to work with the software, then put that into the license agreement. A Tip from the Trenches Here is one tip from the trenches. I’ve seen this next part omitted many times and it creates problems. Always be sure to anticipate the process that you’ll inevitably go through when you move on to a different software product way down the road. What I’m suggesting is that your custom software development agreement and license should deal with its end process. For example, you want to be sure that nothing restricts your ability to convert data to a new format. Conceivably, transitioning to a new product may mean that you’ll need to give your developer’s present or future competitor access to your data and software to assist you in a transition. This may violate user, trade secret, and other restrictions in your license. This is a touchy and difficult area and one where many licenses are silent. No single perfect solution exists, but still you must address this thorny issue. Nothing is forever. Modifications Today’s innovative software is next year’s antique. You must never invest in software development without thoroughly exploring updates, modifications, and fixes. This is not next year’s issue. This is an im-

WEBSITES

97

portant part of your initial contract. Will your developer be marketing this or similar software to others? Will the developer have an ongoing program for updates and improvements? If you’re dealing with true custom-created software, you’ll probably have to fund all future development. If that’s the case, you should have some pricing parameters in your agreement. Leave this until later and the price will be higher. After all, you may have no alternative than to let this developer do the work. If you’re paying for custom modifications to preexisting software, the developer may have enough of a market for updates that it will fund the further development of the software. Then, you need to obligate the developer to license the update to you. The price might be based on a most-favored customer price or some other arrangement. A problem your development and license agreement must also anticipate is how to deal with custom modifications to an earlier version of the software. The problem is that your modifications may not just drop into the new version. In fact, they may not work there at all. If that happens, you may have to redevelop your modifications. This isn’t so bad if you, at least, have a choice to stay with the earlier version of the software. The scenario that you must anticipate is when the developer’s support obligation is contingent on you always using the latest version of the software. I’ve seen an agreement where this problem wasn’t anticipated. The client came to me looking for a solution to the endless cycle of updates to an off-the-shelf product that they paid the developer to modify for them. The updates were admittedly useful, but the client continued to have to pay for the custom work of adding custom modifications to the new versions. The compromise solution was for the vendor to agree to support the old version at a higher than normal price. My client lost the benefit of future updates, but no longer had to pay exorbitant fees for recurring custom software development. Describe the Development Project From the lawyer’s perspective, probably the single most difficult part of custom software development is defining what the software should do. It’s much like a construction contract for a building that hasn’t even been designed yet. You don’t know what it’s going to look like and yet you’re contracting for its creation. What features will the software have? How will it accomplish its required tasks? What will its interface look like? These are just some of the many questions that need to be addressed.

98

CHAPTER 5

One effective way to address these issues is to send perspective vendors a request for proposal (RFP). This gives you a chance to pick the brains of several vendors. Then you can also take their responses to the RFP and turn them into contract language. The vendors may not like that, but it’s their own words. You can anticipate a tug-of-war between the customer who wants to phrase the contract in terms of what it needs done and the vendor who wants the contract to refer to published specifications. Either way, detail is the key for the customer. You must do everything possible to ensure that the vendor knows what you need and can deliver it. One technique that I use is that I’ll ask my client to give me a list of the absolute must-have features. I’ll then give extra attention to those points. While it may be impossible to delineate everything that a yet-to-be-developed product will do, your computer lawyer should concentrate on those key features. Performance Standards The thing that makes computer-related contracting so difficult is that you have to write the contract so it provides objective standards for subjective problems. Software problems are rarely as easy as “the software won’t load.” Hardware issues that I face in my practice are never as easy as “the computer won’t turn on.” These are easy and obvious problems that a lawyer fresh out of law school could handle. The real-life complaints my clients have are ones like, “The software is too slow,” or “It crashes too often,” or “It doesn’t do what I thought it could do.” To help deal with problems like these, a good software development contract includes preacceptance performance standards to measure the software’s abilities. A good starting point is to run tests that specify particular operations and the length of time they should take to complete. Here it’s important to also specify the hardware on which you will be running the tests. In the best case, you specify the hardware that you’ll actually be using in your operation. In developing the test scenarios, you need to also consider load testing, which takes into account things like the effect of having 250 employees simultaneously accessing the same network. You may find that your results are meaningless if you have one person at a time accessing the network for testing purposes, but will have hundreds once the software is in use. There is no single perfect answer to this problem. You and your developer are going to have to be imaginative in creating effective load testing scenarios.

WEBSITES

99

Another type of test to specify would be a response time test. You might input specified data and then specify how long the system should take to process the data and take you to the next screen. If the software fails one or more of your tests, your contract should have a procedure in place for reporting the problem and requiring revisions. It should include time limits for finishing the revisions and require regular progress reports. Warranties After you’ve accepted your software, you will probably find things that aren’t quite right. Here’s where your warranty becomes important. A good warranty makes a distinction between mission critical failures and others of less importance. When your software won’t perform a basic and essential function, your agreement should require an immediate and high-level response. It should have a procedure that requires senior level developers to jump right in to fix the problem. Depending on the nature of your business and the software, this may be a 24-7 obligation. For example, if you’re running a hotel reservation service, having to wait for developers to take a look at the problem on Monday morning at 9 a.m. isn’t going to cut it if the system is down. Other types of glitches may be less critical and may require a different type of response. Generally, you don’t need to awaken (although you may want to) senior level management because an operation is taking 0.3 seconds longer than it should. It’s probably safe to wait until Monday on that one. The point is that your warranty language must be sensitive to the differing nature and importance of problems. It should have appropriate response requirements that vary based on the problem. The length of warranties is often a contentious issue in a negotiation. This issue is closely tied to the issue of maintenance obligations and agreements. A typical scenario might have a six-month warranty with an annual maintenance agreement at a specified fee after the initial period. That may be fine, but watch for maintenance obligations under the maintenance agreement that are narrower than the obligations under the original warranty. Be particularly sensitive to any software operations that you may not get to test during the warranty period. For example, you may have year-end operations that won’t take place until after the warranty is over. If they fail at year-end, will the maintenance agreement cover the required repair or modification? The answer depends on your particular maintenance agreement’s language.

100

CHAPTER 5

If you anticipate the issue, you can raise it during your negotiation and ask that the original warranty be extended in certain areas like yearend operations. I’ve had some success taking this position. Payments Payment is always near and dear to everybody’s heart. Usually, software development contracts will call for partial payments at specified milestones. For example, you might have a certain percentage due upon execution with additional payments due at completion of preliminary testing, upon training of your personnel, delivery of documentation, and completion of acceptance testing with a final payment due when going live. From the buyer’s point of view, you want to pay as little as you can up front to make sure that the developer has plenty of incentive to complete your project quickly and properly. Source Code The discussion of source code is often a heated issue. Source code is human readable computer language. Generally, you need the source code to modify software. A problem arises if your vendor goes bankrupt or for whatever reason refuses to cooperate with you if you need or want to modify or fix the software. However, your vendor considers source code to be a valuable trade secret it doesn’t want to reveal. You feel you need it to protect your investment in custom software development. Usually, the parties can agree on a source code escrow where some third party agrees to hold the source code and not release it unless certain specified things happen like the developer going bankrupt. My aim now is to make you aware of the issue, but I must also emphasize that this is a treacherous area with many pitfalls for the unwary. It may help if you work with one of the several reputable companies that are in the business of administering source code escrows. They can help guide you based on their experiences. Custom software development is a complex area and I’ve barely scratched the surface. My purpose has been to give you a feel for some of the issues that arise. Do yourself a favor and move cautiously in this area. Many businesses have paid lots of money for disappointing products. Get experts on your side so you don’t end up joining that list.

WEBSITES

101

Contract Drafting While I’m on the subject of contract drafting, I can’t help but comment on lawyers’ contract drafting habits. Why do lawyers insist on using language that’s as meaningful to today’s English as quill pens are to word processing? I mean, what exactly does witnesseth add to an agreement? Oh yes, let’s not forget a list of factual recitals that all begin with “Whereas . . . .” How about if we all agreed not to use words and phrases like hereto, hereinafter, thereto, and in witness whereof. I happen to think that the quality of our writing would inevitably improve. My all-time favorite is not contract language, but rather letter language. What mind originally conceived of, “Enclosed herewith please find the following.” What’s wrong with, “I am enclosing the following”? Just because it’s old and traditional doesn’t make it good. You can sound like a lawyer without using stilted and archaic language. In fact, you might even sound like you can write.

BAD TECH SUPPORT: HOW TO MANAGE AND ENFORCE IT My most solid suggestion for dealing with bad telephone support, other than escalating, is hanging up and trying again. Are you still trying to get that software you received as a gift to work? Still trying to get that new computer to connect to the Internet? You can always call tech support. Good luck and may the force be with you. I can still remember the days when WordPerfect was the leader in consumer tech support. (Actually, I can even remember the days when people used WordPerfect software.) The corporation had 24-7-365 tech support on its nickel. Really—you called an 800 number, anytime. Those were the days when tech support people were trained and courteous. Hold times were shorter than the time it took them to release a new version. Today, off-the-shelf software is cheaper than it was back then and one of the things we seem to have lost along the way is good telephone tech support. Not long ago, I had an intermittent problem retrieving my e-mail from my e-mail account. The error message said that I was providing the wrong password. Since I could get my e-mail at least some of the time, it wasn’t a major problem and I knew that I hadn’t forgotten my password. Still, as the problem went well into its second day, I decided to call the Customer Disservice Center.

102

CHAPTER 5

After a ridiculously long hold (the real reason they invented the speakerphone is so that you can work and hold at the same time), I got my NASA rocket science reject of the day. After she asked me my password, she proceeded to tell me that it was correct. (I knew that, but in her defense tech support people do have to deal with people who think that the CD tray is a cup holder.) “OK,” I say, “What do we look at next?” Here comes one of her punch lines. She says, “There is nothing I can do to help you with a password problem” and she tries to end the call. Fortunately, I had my wits about me and said the magic word escalate before she could hang up. (She really couldn’t hang up after the magic word because as they remind you, “We might monitor the call for quality control purposes.” Quality control? I can’t help but smile as I contemplate that phrase in this context. Who says ISPs are humorless companies?) In case you’re not familiar with escalate as a magic word in the context of telephone tech support, it means that I’d like to speak to somebody with training. Normally, this is a trump card and you go up the food chain, but she had a twist to this I’d never heard before. “I can’t escalate,” she says. Now, that was a low blow and I wasn’t prepared for that one. I suspect that company executives had set up a task force and gave it a halfmillion-dollar budget and six months to make recommendations on how to deal with requests to escalate. After all that work, and a 1,000page report, the final sentence of the report said, “Tell the customer, ‘You can’t escalate.’” I scrambled for words. She knew she had me staggered. As she was about to end the call, I mumbled, “Who can escalate?” I had her now. As she was going down, she said, “My manager.” “OK then, let me speak to your manager.” I had won the round. On hold I go. After several more minutes, she comes back on to tell me that the problem has already been escalated because they had determined they had a problem with their e-mail server. (They fixed it during the third day.) Now that I had a reasonable answer, I hung up, but did pause to wonder whether people like her even care that they are so bad at what they do. I suspect they probably don’t. It’s a paycheck. Over the years I think I’ve heard just about every annoying thing tech support can say. Here are some of my favorites: “You’re the first person to report that problem.” Why do they have to say that? It’s so annoying, and I don’t believe them anyway.

WEBSITES

103

“We’re expecting a maintenance release soon, which we hope will address that issue.” I’ve usually found that the maintenance release arrives anytime but soon, and somehow, it never fixes my bug anyway. “I can’t call you back tomorrow to see if my suggestions fixed your problem. We have no outgoing lines.” Translation: Too bad if my recommendations didn’t fix your problem. You’ll just have to call back again and wait on that endless queue. “Sorry, no support by e-mail either.” Again, you’re relegated to that long phone queue. Thanks for the great support. My most solid suggestion for dealing with bad telephone support, other than escalating, is hanging up and trying again. Although you’ll have to sit through the queue again, you might have the good fortune next time of connecting to a competent person. There are a few around.

WEBSITE HOSTING AGREEMENTS Once you’ve built your company’s website, you have to deal with hosting it. You could have your in-house IT folks handle it, but many companies will choose to outsource hosting. If you do outsource the hosting of your website, you’ll need to focus on your agreement with the hosting company to ensure that you’re getting what you expect. You know how this works. The sales people promise you the world. They say you get a pipe as big as the Alaska pipeline with triple redundancy in case of a problem, 24-7-365 tech support, no downtime, and a commitment to maintain the latest technology. Then, when you get the agreement (you know, the one they say is just their routine form), it turns out that your huge pipe is more like a 56k modem (which you’ll share with other websites they host). The redundancy is “Uhhh, like, you know, we can call the phone company if there’s a problem, and we have three different cell phones to make the call with so it’s triple redundancy.” That roundthe-clock tech support turns out to be a pager. And, as for that commitment to maintain the latest technology, well—the contract is silent on that one. Experience tells me that once you get to the contracting phase of your deal, your mission will be to turn the hosting company’s form, which on a good day is tilted toward its interests, and on a bad day borders on illiteracy, into a fair contract that properly and clearly expresses the deal. Rarely is this as easy a task as you would imagine.

104

CHAPTER 5

The first item in your contract should be a full and detailed description of the scope of services the company will provide to you. Here, you’re into nitty-gritty stuff like security measures and performance levels. Your agreement should have enough details so you know that if the company does what the contract says it will do, your transactions will be safe and a large number of simultaneous users will be able to get to your site. You will want provisions explaining the type of access you’ll have to your own data and the procedure for updating your site. Will the hosting company handle updates? If yes, you’ll want details about format and the scope of its obligations. If you’ll be doing the updates yourself, you’ll need provisions about the tools you’ll need and how you’ll get past the security, which is designed to keep people from doing what you want to do—modify your site. The obvious answer to getting in to modify your site is that you’ll have password-protected access. The less obvious issues include things like: “How many passwords can you have?” Will the vendor log access?” and “Will it have audit trails to determine who did what to the site and when?” These can be important if you ever need to track vandalism or a hacking problem. A key area of your agreement is performance standards. You want provisions that take the promises that you’ve relied upon to choose this hosting company and turn them into contractual obligations. Brochures and verbal promises may not cut it if they screw up your website and you lose money because of it. You need provisions on when your site will be available to Net surfers (usually 24-7-365), objective criteria against which to measure the performance of the host’s server hardware and software, and detailed information about its telecommunications capabilities to connect your site to the Net. You’ll want to negotiate remedies in case the system fails. Your position should be that you should get more than “I’m sorry” if your retail website goes down the weekend before Christmas. Often, you can negotiate for credits toward future hosting fees and other remedies. Experience tells me that the remedies you can realistically hope to negotiate rarely make you whole. Therefore, your best remedy may be a provision letting you out of the contract early if the company doesn’t perform as promised. These seemingly routine agreements are complex and highly specialized. If you don’t involve your tech lawyer, you’ll have nobody to blame but yourself if things go badly.

WEBSITES

105

WEBSITE AUDITS Your company’s website should enhance your company’s image and business. However, it can become a regulatory and legal nightmare for your company if you don’t attend to ensuring its legal compliance. You should have your tech lawyer audit your website. This audit will allow you to identify potential risks and devise a legal compliance strategy that takes into account where you do business and your stomach for risk. Your stomach is important because many of the issues you will address in this audit will lead to gray answers. Only you know if you’re comfortable in dark gray, light gray, or simply black and white. I will say this, though. If you like black and white, the Net is a tough place to be because Internet law is just too new and the law too undeveloped for there to be much black and white. Speaking personally, I was drawn to the entire area of tech law because it is so gray. I happen to enjoy the intellectual challenge of unraveling a constantly changing and somewhat undeveloped legal area. The starting point for your audit is to ask what you provide over the Net. Is it goods, services, computer information, or what? Do you provide it to consumers or businesses or both? If you’re a business to business site, you can often avoid compliance with the sometimes nettlesome rules that protect consumers. An important component of your audit is to look at the geographic limits of where it is you choose to do business. Do you have a statement saying that you limit your business to customers in certain places only? How do you verify that the customer is where he says he is? The answers to these questions help you determine with whose laws you must comply. I’m a big advocate of websites providing basic company information. Some of my concern here is legal, but I think it’s usually a good business move too. I think it’s usually wise to have an About Us link that details things like your full company name, location, phone number, and e-mail address. I know that when I’m surfing, I hate not being able to find this basic information. While I understand that you may be hoping you can deal with all Web business on the Web, you should still provide a telephone number—and it should not take a long wandering journey through your website to find it. One of the unforeseen penalties for not providing something as simple as an easy to locate phone number is that unhappy customers may find it easier to call their credit card company than you. Then,

106

CHAPTER 5

you end up with a lost customer, a chargeback from the credit card, and a chargeback fee. It can be an ugly triple whammy. If you have an electronic catalog and posted prices, I’d also like to focus on whether your customer can easily find all the information necessary to make an informed decision. One of the things I consider is: does the potential customer have enough information before committing himself to the transaction and giving confidential payment information? Are your prices posted in a clear and unambiguous way? Is the cost of delivery included in the posted price? If not, are you clear about shipping costs and time? Are you clear on whether sales tax is included and for what states? Do you have well-written terms and conditions of website use posted? This contract is something almost every site should have. It’s your chance to impose a contract that protects your interests should you have a problem with a customer or even a mere surfer who is passing through. You want to be clear on your express promises, recommendations, qualifying information, warranties, and disclaimers. I like to look at where your notice and disclaimers are located on your site. Are they conspicuous? Are they accessible from every page? Do you require users to click “I Accept” on your terms and conditions page before you allow users to register to use your site? No audit is complete without detailed consideration of privacy issues. I look at issues like, does your site collect personally identifiable information from surfers? Is your site geared to children or does it collect information from children? Children raise their own unique set of issues because of the Children’s Online Privacy Protection Act. The key age for this act is under 13. Be careful about compliance with the act when dealing with kids. In a similar way, financial institutions must ensure compliance with Gramm-Leach-Bliley, and anything that touches health or medical raises Health Insurance Portability and Accountability Act issues. If you work with European customers, you need to be concerned with the European Union’s more stringent (as compared to the United States) privacy rules. What I’ve attempted to do here is to give you a flavor of some of the concerns a website audit will address. It’s only a “flavor” because the list of things to consider is long and illustrious. This section didn’t even touch intellectual property issues and that, like so many other things, is extremely important. My suggestion is to deal with an audit now before you have some regulatory body or court breathing down your neck.

WEBSITES

107

WEBSITE LEGAL COMPLIANCE An improperly created website can breed lawsuits. It’s not the place to test the limits of the law. Once you put information out on the Net, it’s there for anybody to see. It’s the ultimate in unrestricted access. You might create a site for potential customers, but your competitors and enemies get to see it too. A cautious and conservative approach is the way to go. How cautious you need to be will vary depending on several things. The preventive medicine is a legal audit of your website. As with almost everything with the Net, the precise legal standards for websites aren’t easy to define as the law is in its infancy. The global availability of the Net and all the differing legal systems throughout the world has exacerbated the problem of establishing the applicable legal standard. To some extent, you need to be concerned about the laws of every jurisdiction in this country and throughout the world. Complete compliance with every variation of the law throughout the world is an obviously impossible goal. How you cope with this fact depends on what you do and where you do it. If You Don’t Do Business Overseas If you’re an American company in a generally unregulated industry, and assuming that you don’t have any overseas operations, your legal compliance strategy can probably safely center on the United States. In this scenario, your technology lawyer can guide you on what’s considered “mainstream” compliance here. While it’s true that mainstream compliance doesn’t guarantee complete legal compliance, I think that it’s the only reasonable approach. You cripple yourself if you demand a guarantee of complete legal compliance. If you do, only your lawyer will make money. There are just too many laws in too many states. Enjoy the benefits of your generally unregulated status. Accept some risk, make your money, and deal with problems when and if they occur. If we change just one variable in our scenario, the advice changes. If you’re in a generally regulated industry, you must be more cautious. The starting point in your legal audit is to decide what states may have jurisdiction over your actions. The analysis will vary depending on your industry whether it’s securities, insurance, banking, or whatever. Your website audit will then need to focus on those states and federal law. Since you’re in a regulated industry, you’re already used to the need for often fastidious compliance with the laws and regulations

108

CHAPTER 5

of multiple states. In this context, your website is no different from anything else you do. You can’t just slap up a website while blithely commenting that nobody regulates cyberspace. Wrong! In some ways, everybody regulates cyberspace. While it may be true that state legislatures haven’t yet passed many laws regulating activity of the Net, that doesn’t mean that you should assume that you can do things on the Net that you couldn’t do in other contexts. If you’re lucky, you can push the envelope in cyberspace, but only after a thorough audit of your site. If You Do Business Overseas If you do business overseas, you’ll have to be sensitive to the legal requirements of those countries that could have jurisdiction over your company. Although a computer in the United States may physically host your website, this may not stop you from being hauled into a foreign court. Worse, it’s conceivable that the foreign court could hold your website up against its legal standards. Whether you think that’s right is not the issue. I’m just telling you that it can happen and you need to be sensitive to foreign legal compliance with your American-based website. Your website audit needs to consider many things. Some of it is just common sense, but some is uniquely Internet law. Some is a mixture of the two. Here’s a sample of what I consider in a website audit. Information Accuracy This point is so obvious that I wouldn’t say it except that I’ve heard reasonably astute people say things like, “It doesn’t count if it’s online.” That statement couldn’t be more wrong. Defamation and unfair and deceptive trade practices (things like false advertising) are examples of some things that you can have on your website that can get you hauled into a courtroom. It’s essential that you carefully review information before it’s posted to the Web. Copyrights and Trademarks Copyright and trademark law fully apply to the Web. If you post somebody’s logo on your site, make sure that you have written consent from the owner. If material is copyrighted, get the author’s permission. If you want to frame another website within yours, get the owner’s permission in writing. This is an area that’s seen some well-publicized

WEBSITES

109

litigation. Although the law isn’t well established on framing, the cautious and conservative approach is to get consent. For those of you who have no idea what framing is, it’s a way webpage designers create multiple windows, or frames, on your computer screen. Each frame operates independently, so information downloaded into one frame fills only that frame, and doesn’t change the contents of the other frames. Those who think that you must get consent to frame argue that enclosing somebody else’s site within your frame is like making a copy of her site without her consent. Others think that framing is no more an illegal copy than just calling up the site on a computer. They argue that the material was put on the Web to be displayed on computers and that framing doesn’t change anything. It makes for an interesting discussion, but while the law is unclear, my advice is to get permission before you frame.

CREATE A WEBWRAP AGREEMENT While Internet law often remains nebulous, one way to reduce your legal exposure is to have your Web visitors enter into a contract with you. No, they don’t sign anything. What you do is post what’s sometimes called a webwrap agreement on your site. Webwrap agreements are a natural evolution of shrinkwrap agreements, which you see every time you buy new software. “By installing this software, you agree to be bound by the terms of this agreement” is typical shrinkwrap agreement language. “By using this website, you agree to be bound by the terms of this agreement” is webwrap agreement language. A well-drawn webwrap agreement can help you reduce your legal risks significantly. The most basic thing that I put in every webwrap I do is a limitation of liability clause. So even if you get sued and lose, at least the maximum damage award against you is nominal. I’ll typically limit damages to something like $50 to $100. To further insulate you from the claims of users, I always have them agree that use of the site is at their own risk and that you disclaim all warranties. Also, the flip side is that I include a clause making them liable to you if they upload things to the site like copyrighted or trademarked material that they don’t have a right to use. This gives you some protection if a third party sues you for something posted to your site by a user.

110

CHAPTER 5

My favorite way to discourage my clients from getting sued over nonsense is by including a clause requiring that any lawsuit be filed in my client’s home state, not the user’s. Using the courts looks a whole lot less attractive as the mileage increases. Be Proactive Having someone audit your website is a good example of effective proactive law. Once you get sued, you can’t require the other side to come to your home state if you didn’t have the agreement already on the site. Don’t be like the people who put in the burglar alarm after the burglary. A little preventive law is much cheaper and less stressful than crisis law. Have your site audited now, not after it causes you a problem.

INTERNATIONAL BUSINESS ON THE WEB If you want to be big, you have to think big. You say that you want to make your online business truly international; that’s great. The Net is a wonderful tool to get you there. Just don’t forget that once you, your products, or your website leaves the United States, you’ve become a citizen of the world—possibly subject to the law of places your feet have never touched. Today, one of the practical limits on countries trying to require compliance with their local law is simply their inability to enforce their rules. Chinese officials can say whatever they want about American websites that don’t meet their standards, but it’s not like they can do much about it. Still, that’s not where the discussion ends either. If we like the idea of local regulation, we could implement treaties calling for international enforcement of local decrees. Maybe if you think gambling is a bad thing, you like the idea of enforcing American law against websites that allow Americans to gamble in violation of American law. It’s a slippery slope, though, because then you have to be open to enforcing other countries’ laws. What to Do Today, the state of the law regarding other countries enforcing their laws against your website is uncertain. Here are some practical tips to help you minimize your risks:

WEBSITES

111

When a person is going to buy from you online, instead of asking her to fill in the name of her country, you can have a drop list of countries to which you have decided you will sell. While people can still view your site in countries that aren’t on your drop-down list, you will have available to you the argument that you’ve taken reasonable steps to avoid doing business in their country. If you’re trying to exclude particular countries, another possibility is to have a pop-up window that says something like, “If you are a citizen of countries X, Y, and Z, it is illegal for you to order our products or view the material on this site.” This is especially important because a first-time viewer doesn’t know what he’ll see on your site. Yet another approach is to localize your operation. If you want to sell to France, you could start a website called, YourName.fr. You could then hire a local attorney to ensure that you comply with local laws. This might help you if you have to defend yourself in a foreign country, especially when used in conjunction with the other approaches. If you’re in a heavily regulated industry, like tobacco or alcohol, just remember that you don’t stop being regulated when you go online. If you can’t take phone orders for wine from another country or state, you should assume that you can’t take a Web order. If you sell to a place where possession of your goods is illegal, you might be committing a crime under its local law by shipping there. Whatever you do, just make sure you get some good lawyering before you start doing business in other countries. The law in this area is murky, and therefore dangerous.

6

Employees’ Rights, Obligations, and Pitfalls in Litigation

Most of the sections in this book address tech law issues faced by companies and business owners every day in the business world. In this section, I’m going to mix things up a little and address issues relating to employees and their use of technology, both at home and in the office. I’m going to cover a variety of issues, including rules for computer use in the office, e-mail etiquette, instant messenger, Internet surfing strategies, social networks, and issues relating to blogs. I hope you find these topics helpful. RULES IN THE OFFICE While your office computer is a great tool for getting work done, it can also be your worst enemy. When it comes to your company’s computer, you should always assume that Big Brother is watching because it’s easy to do and extremely common. If you want to stay out of trouble at the office, the rule is that the company owns the computer, it can look at everything on it whenever it wants to, and further, can do this even if you have a private password. Are you getting the picture? You have no rights. It’s not your machine. If you borrowed the boss’s car, would you complain when she looked in her own trunk and found your private things there? Of course, with the car, you could put private things in the trunk while you’re borrowing the car, remove them when you’re done and the boss would never know they had been there. With a computer, you should not assume this scenario works. A computer is the ultimate recording device. With the right monitoring software, your company can even record your keystrokes for 113

114

CHAPTER 6

posterity. (Just think—your keystrokes in the Smithsonian.) Even deleting doesn’t work because you should assume that your company could recover your deleted data. From a technical perspective, recovering deleted data is not rocket science. It’s called, buy the right inexpensive software and you too can recover deleted data. Your company has so much latitude when it comes to monitoring your behavior at the office, if it wanted to break the law, it would almost have to try. Some easy ways for a company to cross the line would be to do things like inappropriately placing a camera in the restroom (I feel certain that your common sense knows where inappropriate is located), surreptitiously recording your conversations with coworkers, and tapping your telephone. Interestingly, the secret recording of voices is something the law tends to not like, while videotaping without voices is usually OK. Coming back to your computer data, it’s a legal free-for-all with the company usually the winner. If you’re the company, don’t take what I’ve said so far as permission to abuse your employees’ privacy. While the law may not penalize you, you still need to be concerned about morality, ethics, and employee morale. I think that you can balance these conflicting interests and concerns by adopting a computer use policy for your company. If you want to maximize your legal right to monitor computer activity, I think you put yourself on the correct side of the law, ethics, and morality by clearly telling your employees precisely what it is you do monitor and how you expect them to properly use the computers. Don’t use your computer system as a trap for the unwary. Train your folks on your version of appropriate use and warn them that you are watching. In this way, you’ve protected your company against the consequences of your employees doing improper things on the computer while not trampling on their expectations of privacy. While the law may not require a computer use policy and subsequent training, I don’t think it’s good business to use the minimal standard the law requires as the way you want to run your business. Unless of course employee morale is irrelevant to you.

E-MAIL ETIQUETTE IS IMPORTANT E-mail has to be the best thing to happen to business efficiency since the telephone hit the office desk. Still, people misuse and misunderstand it in more ways than I can count. It’s time to clean up your act.

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

115

While your e-mail software may require you to enter a password, you should never think of your office e-mail as private. If you’re the employee, your boss can probably legally read your e-mail. If you’re the boss, your information technology department can probably read your e-mail. (Guess again if you thought that you were at the top of the food chain.) Once you hit the Send button, it’s gone and impossible to destroy. You just never know who received a forward and what hard drive it lives on. If you think that e-mail is ephemeral like a phone call, you’re wrong. It’s more like a virus that you can’t cure. A court’s ability to subpoena your e-mail is but one way that you may find your e-mail shared with the world. Ask Oliver North and Bill Gates, who are some of the more prominent victims of their own e-mail. In some ways, I miss the old days when e-mail was new and the few who used it lived by some etiquette rules. Now it seems that everybody is using it and their mothers never taught them e-mail manners. The first rule is that sending e-mail messages in ALL CAPS is yelling. Notice that I didn’t say that in a lawyerlike way, such as “All caps might be perceived, depending upon the totality of the circumstances, as speaking in a raised voice, but it depends.” What I said was that ALL CAPS is yelling, because it is. So don’t do it. Another one that should get your e-mail privileges revoked for a week is a subject line like this: “Important—please read.” I don’t know about you, but e-mails like this always end up being the least important e-mails I read in a day. That’s because they’re like a bait and switch for unimportant e-mail. If it were truly important, the subject line would read something like, “Evacuate—kitchen fire.” The purpose of the subject line is to briefly summarize the e-mail to help your overworked reader, who is bombarded by e-mail, prioritize the importance of your e-mail. Remember when you were in fourth grade and you learned how to pull the main idea out of a story? If you wondered why you learned that, now you know: it was because your teacher knew that e-mail would be invented, and she was teaching you how to complete the subject line. A three-day suspension should be the penalty for the hanging subject line. That’s the one where the writer (I use the term loosely here) fits as much of the first sentence as he can in the subject line and then picks it up in the body of the e-mail. Obviously, this is someone who struggled with the main idea thing in fourth grade. Here’s the deal on saying negative things in e-mail. DON’T! (Yes, I yelled.)

116

CHAPTER 6

First, let’s look at it like a lawyer. After all, I paid lots of money for my law degree, and I was hoping to use it a bit in this section. Negative e-mail is more likely to find its way into a courtroom. The reason is as simple as this: people don’t sue each other over happy things. If you put it in writing, you’re creating a record of something you may have to defend once cooler thinking prevails. The heat of the moment has a funny way of playing out in front of 12 bored jurors three years later. Next, let’s look at it from a human perspective. When you say something negative in an e-mail, your reader gets to feel bad when he receives it and every time he rereads it. Further, the written word has a way of seeming so much weightier than the spoken word. Few people have the ability to tone down their words enough to get the equivalent impact between the spoken and written word. If you say, “That was a dumb thing to do” with an incredulous tone to a coworker in a meeting, it’s probably the equivalent of writing, “Upon reflection, you may realize that the course you chose may not have been the best.” If you think that they’re not quite comparable, you’re probably right. The carefully chosen written words probably still stung more than the blurted spoken ones. So, if it’s negative, get up from your desk and see the person. Don’t send them e-mail. If you forget the details of this section, do yourself a favor and just remember one thought—e-mail is forever.

INSTANT MESSENGER IN THE OFFICE If you’ve been following the online tech world, you may already know that one of the fastest growing Internet applications is instant messaging (IM). It may have started with teenagers perfecting the ability to have eight simultaneous “chats” going with eight different friends in eight windows, but it has matured into a business application that brings security and legal concerns with it. I suspect that many employers are unaware that their employees use it at work. In case you’re not familiar with IM (which probably means you don’t have any teenagers at home), it’s Internet software that lets you have real-time conversations online. You type. I see what you type almost instantly on my screen. I type a response. You might call it a conversation. While e-mail is more like trading letters, IM is more like a phone call.

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

117

Your company shouldn’t continue with a policy of benign neglect when it comes to IM. It’s here, it’s growing, and it’s not going away. IM in the workplace requires some thoughtful policy making. One of the many issues with IM is security. Right now the major free IM services (companies like AOL and Yahoo provide the software) have no mechanism to encrypt messages. This means that intercepting your messages would not be that difficult for people like a determined and skilled hacker or corporate spy. Another issue is authentication. It’s all too easy to spoof somebody’s name using IM. The corporate world needs security software that will ensure that you are really talking to whoever it is you think it is. I’m sure that it will come soon. A third big legal problem is logging and archiving. While it’s generally illegal in Florida and many states to record a telephone call without the permission of everybody on the telephone call, it’s not illegal to save an IM. This is where the paradigm shift from the ephemeral telephone call to the apparently ephemeral IM session can haunt your company. People often treat IM like a telephone call. They act like it’s not going to be saved and that’s a dangerous attitude. You might even be the one saving it if you have the archiving feature of your software turned on. This can come back to haunt your company in a courtroom because your IMs are as discoverable in a lawsuit as your correspondence and other business records. That means that if you don’t want to see your IMs shown to some jury as part of a PowerPoint presentation, you shouldn’t be saying it in an IM. A fourth issue, related to the logging and archiving issue, is the entitlement issue. Once you archive an IM, the question is, who can access it? For example, if it’s your company, are you entitled to read your employees’ IMs? My guess would be yes, but the key word was guess. It’s not as if I can point to clear law on the subject. The technology is new, and law always develops after a new technology. So, what’s a company to do with IM? I say embrace it because it can be a useful business tool. While there are risks, everything has risk. The key is to mitigate those risks in a thoughtful way. Adopt a User Policy “Thoughtful” starts by adopting a user policy for IM. Your policy needs to tell your employees what you deem to be appropriate use of IM in the office. Related to the user policy is education. Your employees need to understand that what they say in an IM reflects on your business and

118

CHAPTER 6

can have legal consequences. Although there’s little law yet, you should assume that you could libel somebody in an IM as easily as in an e-mail or letter. The rule of thumb should be not to say anything in an IM that you don’t want to see later and at the most inopportune time. Education must also include drumming home the concept that people can and do save IMs. Another point is that your people need to understand the risk viruses and related security issues pose with IM. Some experts believe that most firewalls aren’t as effective in stopping viruses that penetrate via IM as those that try to penetrate as an e-mail attachment. Yet another rule is that IM and confidential information don’t mix. The technology just isn’t mature enough to risk transmitting secrets. Your user policy should explicitly deal with personal IMs at the office. The problem arises when “excessive” comes into play. I think that common sense is in order here. Consider what your policy is regarding personal phone calls in the office. I would suggest that your personal use of IM policy be similar. Instant messaging is yet another new technology to enter the workplace. Like all those before it, it brings with it many issues analogous to the technologies that preceded it, and some new baggage. If you give its use in the office the thoughtful attention it deserves, you may find that you have a new and useful tool on your employees’ desktops.

EMPLOYEES AND TECHNOLOGY I write mostly for management. This time, I’m flipping my perspective and writing to everybody but management. The theme is a simple one: things you need to know so that your computer doesn’t become your worst enemy. Privacy and the Office Let’s start with privacy issues at the office. The generalization is that the company owns the computer and everything on it. It doesn’t matter that you may control some passwords. The company still owns the data. If you want to take the analysis one layer deeper, it’s true that my generality has some exceptions. Still, for the purpose of discussing

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

119

how to keep your computer from becoming your worst enemy, you should accept the generalization as fact. Another rule of thumb is, don’t use your office e-mail for personal correspondence because your company can read it. Again, don’t confuse having a password with having control. Always assume that the company has a master password that gets management into your stuff. Moreover, as an aside, management should assume that the IT department can read their stuff. It makes you wonder who’s really in control. It comes down to this, you have no reasonable expectation of privacy on your office computer—period. Don’t rely on your company’s computer use policy even if it would appear to give you some zone of privacy. The goal isn’t to litigate your right to privacy with some former employer. The goal is to prevent the computer from becoming your worst enemy. A related point has to do with deleting data. You should always assume the worst case, which is that once you input it into a computer, you can never make it go away. Sure, we could get into an esoteric discussion of swap files, recycle bins, backups, and file wiping, but that’s not the point. The point is simply this, assume you can’t make inputted data go away. The why is a boring technical discussion. This means if you don’t want your boss reading it, don’t type it, email it, or scan it. Don’t assume that even a wipe is a perfect solution. Have you considered those backup tapes or your swap file? Those backup tapes are a great example of something you can’t control and may be the ultimate reason why you can’t be sure that what you’ve deleted is gone. You Represent the Company It’s really simple here. What you do on the computer is no different from what you do with paper and pen. It really is uncomplicated as the same rules apply. You send a letter with a statement like, “She’s a thief,” and if it’s not true, that’s libel. Your company gets sued (and maybe you too), and your company loses. You send an e-mail or instant message with libel in it and it’s like paper, it’s actionable, there’s a lawsuit, and you lose. You like your competitor’s website and since it’s easy to copy and paste from it, you do. After all, it’s the Web, which is like the Wild West and if they didn’t want it copied, they shouldn’t have put it on the Web. Therefore, you’re OK. Right? No, wrong.

120

CHAPTER 6

Forget that Wild West metaphor. It’s a myth. Cyberspace isn’t outside the jurisdiction of the legal system. The very same laws apply to your Internet connection as to you sitting at your office in front of your keyboard. The idea that once something goes out into the Internet it’s in this lawless “place” is ludicrous—yet widely believed. Forget what you think you knew. This next one should be common sense, but I’ll say it anyway. You shouldn’t use the office computer to entertain yourself at adult websites. Just assume that both your company and the website you’re visiting are tracking your activities. You should just presume that your company maintains a complete log of everything you do on the Web and that FriendlyNeighborhoodAdultWebsite.com knows that somebody from YourCompanyName.com visited them even if you don’t register or buy the “goods.” Online Contracting When you visit a website and it asks you to click “I Accept” to an agreement, you should assume that the I Accept button makes the contract you’re “accepting” as valid as your signature. For example, if you’re buying from a supplier online, be careful about the online terms and conditions changing the deal you negotiated with your supplier offline. One way to deal with it would be to have your standard written agreement say something like, “Notwithstanding the online terms and conditions, the terms of this document shall govern all transactions between the parties.” Now, you’re covered. What Law Applies? When in doubt about online law, just assume that the same law applies online as offline. While it’s true that there are many exceptions to this generalization, it’s a better rule of thumb than the Internet is the Wild West and a lawless place.

EMPLOYEE SURFING STRATEGIES In the last few years, Internet access at the office went from rare to ubiquitous. With it came new problems for corporate managers to manage—such as employees using the corporate network to visit adult

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

121

websites, download pirated software, and waste corporate bandwidth and time to recreationally surf. Here are some interesting and sobering statistics from those who study these things. Thirty to 40 percent of Internet use in the workplace isn’t related to business. Seventy percent of all Web traffic occurs during work hours. Seventy percent of employees admit to viewing or sending adult-oriented e-mail at work. Popular Sites Some of the most visited sites during work hours include Amazon.com, MySpace, Facebook, eBay, and Travelocity. I suppose that people are bidding on new desks for the office and buying plane tickets for their next business trip. I believe that. Don’t you? Experts say employees surfing the Web from their office PCs cost corporate America more than $1 billion a year. The costs are mostly attributable to lower productivity levels and bandwidth expenses. Then let’s not forget e-mail. It may not be the bandwidth hog that the Web can be, but it’s time-consuming. Many employees use their corporate e-mail to do things like write to Aunt Tilly and Uncle Bob. Again, it’s all about lost productivity. There are even sites that are designed to entertain your workforce while you’re paying them. One good example is www.ishouldbeworking .com. When you arrive, the site greets you with “Welcome Slackers!” Moreover, to help those employees you love to hate, it has an “Uh-Oh, It’s Your Boss” panic button. The instructions on the panic button tell your slacker that “If you should be working but you’re not, you may need to give the impression that you are indeed busy. The panic button, located in the upper left corner of every IShouldBeWorking page, bridges the gap between work and leisure. Simply hit the button whenever the need arises and you will immediately be redirected to a helpful, business-oriented website.” Productivity Issues While I must say that you need to get a life if you can’t see the humor in this, there is still a legitimate productivity issue too. Oh, and yes, there’s potential legal liability for your company. Don’t you just love our laws? You hire some guy. You give him Net access. He abuses it. You get sued. You pay money. Isn’t it great to be an American?

122

CHAPTER 6

Now you’re probably wondering how we could get to this. One scenario could be the “boys” deciding that Joe’s office is the place to hang during lunch while Joe gives everybody a tour of his favorite adult websites. When the women decide that this has created a sexually hostile work environment—well, you get the picture. It turns out that recreational surfing not only creates productivity issues, but also can create a host of legal problems. You could find that your recreationally surfing employees are putting you at risk for claims of sexual harassment, copyright infringement, and invasion of privacy. Many companies have turned to software solutions to control and monitor what it is that their employees do on the Internet. Let’s start with the preliminary question. May your private company control and monitor what it is that your employees do on the Internet? The answer is a resounding yes. Courts have viewed your office computers as just that: yours. You can control them. You can monitor them. Company Policy One preliminary step you should take is to have all your employees sign a computer use policy acknowledging and agreeing to the filtering and monitoring of their computer use. Filtering software prevents employees from viewing certain types of sites. One problem with filters is that they’re not as effective as they claim to be. Some experts estimate that filtering software fails to block one out of every five sites deemed objectionable. Of course, the statistic itself begs the question, “What’s an objectionable site?” Answer: it’s in the eye of the beholder. Maybe we just have to accept that U.S. Supreme Court Justice Potter Stewart was onto something when he declined to define the kinds of material he understood to be embraced within the term “hard-core pornography.” He summed it all up by saying, “I know it when I see it.” This may have to also be the standard for “objectionable” material in the office. The problem with the filtering software is that the one judging what your employees can’t see is a software company and its judgments may not match yours or your lawyer’s. Another approach is to monitor and record what your employees do on their computers. You might log the websites they visit or even record their every keystroke. It’s up to you to determine the tone you want to set in your company and the measures that you think fit the corporate culture you want to create. While we can debate how far you can and should go in filtering and monitoring employee Internet access, it’s clear that unlimited access

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

123

to the Net isn’t a good option for your business. At the very least, you should create a written policy about responsible Internet use. If you don’t, you’re playing with fire.

SOCIAL NETWORKS IN THE OFFICE If all you know about social networks is that your kids spend a lot of time at their computer on MySpace or Facebook then you’re missing out on adding an important tool used by all kinds of professionals. And if you don’t start using social networks to connect to your customers and business partners you’re giving your competitors an advantage. Social networks are online services that use software to create social communities. The kind of community varies from site to site, but most activities and hobbies now have sites designed for them. For some time kids were really the only people using social networks, usually to connect with friends, plan parties, and even find dates for Saturday night. Social networks took off with sites like Friendster, MySpace, and Facebook, and originally were used almost exclusively by teenagers and college students, before moving into the mainstream. In 2005, News Corporation bought MySpace for $580 million—a figure large enough to catch everyone’s attention. Now social networks are the hot topics in industries of all kinds and entire conferences and conventions are devoted to them. In some ways, social networks are the logical extension of older technologies like Usenet and bulletin board services (remember those?). These older technologies allowed people to communicate and exchange information online, but for many reasons the old technologies didn’t fit into the new Web 2.0 world. Not surprisingly, some bright young techies have taken the old idea of online collaboration and networking and adapted it to today’s Web-based technologies. Social networking applications were born. Since then, the marketplace has been flooded with new social network services designed to aid today’s businesses. But I’d suggest that you don’t want to be an adopter of a less popular service since it may not be of any use to you if your customers and business partners are using something else. After all, a social network has no purpose if you’re the only one there. Professional social networks are springing up offering specific features to the business community. The only useful one I’ve found so far is LinkedIn (www.linkedin.com), and it makes business networking easier for professionals. It allows you to create an online profile for

124

CHAPTER 6

yourself and to create and maintain an online list of contact details of people you know and trust. If you’re interested, you can check out LinkedIn and view my profile at www.linkedin.com/in/mgrossman27. I’ve enjoyed the process of watching LinkedIn grow. First, I started getting invitations to connect that I ignored. Then, I begrudgingly established an account and started accepting invites. I still wasn’t paying attention, still ignored most invitations, and didn’t give much time or attention to my own profile on LinkedIn. Finally, I was getting so many invitations that I thought LinkedIn had finally established that critical mass needed to make a social network interesting. I worked with my free account for several months. Now, I’m paying a monthly fee for its premium services. At this point, I think that LinkedIn has business value. Since you can start with a free account, I recommend that you try it. As for the other business networking sites, I’d ignore them. I dabbled with a couple of others, but I didn’t find them helpful. Moreover, I don’t think that they’ll survive because I think that it is already too late for any relative newcomer to develop a critical mass. Quite simply, LinkedIn owns the business social networking space. If you’re going to use social networks for business purposes, you should be aware that the use of social networks in the workplace comes with its own set of legal problems. The good news is that using social networks is not the huge paradigm shift we saw when the use of e-mail and web browsers changed the way we do business. Using social networks is more like adding instant messaging to the office— simply another networking and collaboration tool that allows faster and better communications among your employees, potential customers, and business partners. Still, you should address the use of social networks in your employee handbooks, contracts, and acceptable use policies. As with all technology in the workplace, you need to be careful to ensure that your employees don’t get you or your company in trouble. While intellectual property theft or the exposures of your company’s trade secrets online are the major concerns, there are other ways your employees could get your company in trouble or cause you problems. Libel and damage to your company’s reputation leap to mind. Loss of employee productivity is another. You should consult with your technology attorney to ensure that your company does not face any liability for your employees’ actions when using social networks. It’s a matter of education and having clearly established policies. You need to stress to your employees that their work and personal social networks should remain separate, similar to requiring them to

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

125

keep separate e-mail accounts for work and personal use. It’s all too easy for your employees to add personal contacts to their business contact list or vice versa, and the crossing of business and personal messages could embarrass everyone. One tactic to use is to tell employees that personal information should remain on personal sites such as MySpace while business information should stay on LinkedIn. Meshing work and personal networks leads to a host of problems. In a perfect world, your people won’t be interested in using personal accounts on social network services at all. However, if they are, be careful not to overreach as an employer. The easy answer is to simply prohibit access to social networks in the workplace and on company time. Block all of the sites except LinkedIn. While this may seem a bit draconian in today’s business world, and your IT guys may hate you for adding to their workload, prohibiting access while on company time or using company equipment is the safest option. But this solution is not realistic in most cases, monitoring and logging the use of social networks is the more reasonable option. Instead, be clear to your employees that they will get in trouble for any activity on social network services that could reasonably prove detrimental to your company. Tell them you’re going to be monitoring social networks generally for company-related information. If you find something damaging to your company, and you discover an employee is the source of such information, he needs to know he could be fired and sued for damages as appropriate. You need to update your employee policies and employment contracts today to address the use of social networks. The policy needs to address use on company time and on company equipment. Come up with a reasonable policy and implement it through the use of technological tools and employee training. Be clear on what you are expecting from your people in their work and private lives, and what the penalties are for violating your policy. Your goal is a simple one. You want to get everyone on the same page so your company can use social networks as a tool to give you an advantage over your competitors.

BLOGGING RISKS You can’t go anywhere these days without hearing about or reading a blog. Friends and family may be pestering you to read their blog, and even your Google searches are coming back with hits from blogs. Perhaps

126

CHAPTER 6

you’ve even been kicking around the idea of starting your own blog about your cats. To some, blogs are a waste of time, similar to amateurish high school newspapers, and years ago they might have been correct. Now, blogs have joined the mainstream. Google indexes them. Presidential candidates are courting the members of the “blogosphere” and setting up their own campaign blogs. Entire industries read leading blogs daily to monitor breaking news and their competitors. So if you decide that the time is right to start a blog, or you’ve been blogging for some time, let’s take a moment to consider some of the legal problems you face publishing your personal blog. For the uninitiated, the word blog is a shortened version of web log. They’re online personal journals or diaries resembling webpages consisting of text and images that people write on every topic imaginable and post online. And when I say that there are blogs on nearly everything, I mean everything. Thanks to a variety of free software tools, blogs are simple to set up and publish to the Internet. Thousands of blogs are born every day, and while most of them die a quick and quiet death, others grow and develop a powerful online presence. I’ll leave the mechanics of setting up a blog to the many hosting companies out there who are happy to help you set up your blog, for a fee. I’m also not going to recommend a particular blogging platform or piece of software beyond suggesting that you start out with one of the free choices. Take the time to do a little research and find what works best for you. The good news is that if you have your own blog, you have control over what is published. The bad news is that there is a real chance somebody is going to be unhappy with the information you post. As a blogger, you’re going to face many of the same liability issues associated with your blog’s content as anyone else making a publication available to the public. Remember that once you publish something, it’s out there on the Internet and you have lost control over that information. While you may be able to delete a particular posting on your blog, odds are that Google and other search engines have already indexed your site. There’s also the chance that other bloggers read your post and have copied some or all of the text to their own blogs. Like e-mail, once you hit that publish button you should consider the information you post irretrievable. At the head of the list of potential problems is defamation. State defamation standards vary, but generally defamation is a false statement of fact that is harmful to someone’s reputation. Standards differ when the aggrieved party is a private or public individual, but I don’t want to turn this section into a primer on defamation. So, let’s leave

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

127

it as defamation is a very complicated tort and litigating a defamation case is extremely expensive. Please understand the defamation standards in your state and know that you don’t have unlimited power on publishing anything about others in your blog. Another major problem that you face as a blogger is violating other people’s copyrights. In a perfect world, every word and picture on your blog would be your original work, but we know that’s not how things work. Blogging software seems to have copyright infringement in mind. The software makes it easy to copy and paste into your blog. While short quotations and the use of thumbnails of pictures probably qualify as fair use, I suggest you always provide the proper attribution to the source or author. Don’t fall into this trap of using other people’s content without giving them credit for their work. In other words, listen to your mother and don’t steal. Provide a conspicuous link back to the source site so your reader understands where your content comes from and always credit your source. Don’t violate anyone’s privacy by posting private information online. We have enough problems with stalking and identity theft without you posting your neighbor’s social security number online. I don’t care how much his barking dog bothers you; don’t post his personal information online. Finally, there’s always a chance you could face a lawsuit from a very unhappy reader. Each lawsuit is unique and limited only by the creativity of the opposing litigator so I can’t possibly address every potential lawsuit here. However, here’s a quick list off the top of my head of potential causes of action an angry party could bring against you: invasion of privacy, trespass, nuisance, conspiracy, intentional infliction of emotional distress, and interference with contract or economic advantage. This list is just a start—as always, have an attorney immediately review any lawsuit. This list only hits the highlights of potential risks you face as a blogger. I don’t want to scare you away from blogging about your cats. You just need to be aware that everything you do online, including blogging, comes with risks. This section is not a substitute for legal advice and cannot address all of the potential blogging risks. You should always discuss your unique situation with your technology attorney.

YOUR BLOG AND YOUR JOB Now I’m going to address some of the risks associated with blogging related to your job. Unless you’re really lucky, you probably won’t make a living with your blog, so you need to be careful and take steps

128

CHAPTER 6

to ensure that your personal blog does not interfere with your job. Unless you’re blogging as part of your job (where the risks discussed in the next section will apply), you need to use some common sense and keep your job and personal blogging separate. While actual blog-related firings are rare, the Internet is full of stories on bloggers losing their jobs due to their blogs. Assume your employer is reading your blog. Even if you’re writing under a pseudonym or using some tech tricks to hide your identity, you should assume that you’re not anonymous. Your employer has a legitimate interest in protecting its business interests, intellectual property, and reputation. It’s reporting to a board of directors, stockholders, and the government; it has to protect profits and maintain secrets. Your company also faces potential liability from your blog even if you’re running a personal blog on your own time. Moreover, you’re just one employee. Consider how many other people at your company are blogging. Think about the potential nightmare your employer faces in trying to control employees’ blogging activities, especially when most of this personal blogging is taking place during employees’ own time away from the office. You need to take an active role to ensure that your blog doesn’t violate company policies or your contract with your employer. Check your employment handbook and employment contract to review your employer’s policy on blogging. If your employer has a blogging policy (unfortunately few companies do), the policy may prohibit you from blogging at all or on company time, or may have some other restrictions and potential disciplinary actions outlined. If your employment contract or handbook do not specifically address blogging, review your company’s policies relating to e-mail and Internet use policies. Odds are that your employer’s view of blogging is going to be similar to its restrictions on your ability to use company e-mail and the Internet, and rereading those policies can provide you with some guidance on how your employer may view your blog. As a general rule, don’t blog on company time or use company resources. The best (but most uncomfortable) step is talking to your boss or other members of management about your blog. Tell them what you’re going to do, how your blog may or may not touch on work-related issues, and get their approval. If they reject the idea, discuss what they would be comfortable in allowing. Talk to them, you might be surprised by their answers. If they do say no, you always have the option of finding another job with an employer who supports your blogging activities.

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

129

If they’re hesitant, you might offer to put a disclaimer on your blog stating the views expressed on the blog are yours alone, and not those of your employer. If you go the disclaimer route, I’d urge you to seek legal counsel on the drafting to ensure the disclaimer is drafted correctly. With or without your employer’s approval, be careful with your blog’s content. Don’t use your company’s trademarks and copyrights without permission. It has gone to considerable time and expense in creating and protecting its intellectual property and is unlikely to allow you to use the intellectual property on your personal blog. Never discuss your company’s trade secrets and other inside information in your blog. I can’t stress this point enough. There is no surer way to get yourself into trouble than to violate this rule. If there’s one way to wave the red flag in front of your employer and get the full attention of legal and human resources, this is it. I would take the idea of editing yourself a step further and never criticize your company, co-workers, supervisors, workplace, customers, competitors, or otherwise talk about anything remotely connected to your company. What you view as a therapeutic posting of a rant about a bad customer or bad boss could be viewed by your employer as defamatory, abusive, or harassing. Even if your content is unrelated to your job, you still run the risk of offending your employer. We’ve seen examples of employees fired for “inappropriate” blog content, and in such cases it’s the employer who decides what is inappropriate. Don’t think Big Brother isn’t reading your blog. Savvy companies are monitoring their employees’ personal websites, blogs, and anything else that may reflect poorly on the company. If you blog at work on company time, it really is not that difficult for your company’s IT department to figure out what you’re doing. If you blog at home on your own time, you should assume that your company has somehow heard about or stumbled across your blog and is monitoring your posts. As mentioned before, we’ve already seen companies fire employees over blog content. With a few exceptions, your employer can generally fire you for any reason including what you post on your blog. While firing you is the extreme response, and other forms of discipline may be more likely for a first-time offense, you need to be aware of potential consequences. In most states, private employers can discipline or fire you for what you do on your own time unrelated to your job. Don’t be confused and think your blog is protected by the First Amendment. Odds are your employer is a private company, and the

130

CHAPTER 6

First Amendment doesn’t apply to them. The Constitution only restricts the government, not your employer. If you really get into blogging and are kicking around the idea of turning it into a business, then there are other things to consider. Check your employment contract and handbook again to review your company’s policy about running your own business or devoting time to other activities. Most companies want your job to take up most of your time and effort. You should consider setting up your own business and an appropriate entity to own your blog so that you can minimize your liability. Running your blog as a small business can get you out of the rat race, but keep in mind that running your blog as a business does create a whole new set of issues you need to deal with as a business owner.

CORPORATE BLOGGING Your business folks may be pushing you to start a blog. Corporate blogs can be another tool to allow your company to talk directly to customers, potential customers, or your own employees. Since your people can put forth the business arguments (both for and against) setting up a blog better than I can, this section is going to focus on the legal risks of corporate blogging. Corporate blogs come in one of two types: the internal blog accessed through your company’s intranet with a target audience of the company’s employees, and the external blog posted to the Internet for a worldwide audience. Regardless of type, a corporate blog is written and maintained by either an outside contractor or vendor at your direction, or by company employees working within the scope of their employment. Fortunately, the legal risks to your company are largely the same regardless of the type of blog. I can’t tell you if a corporate blog is right for you, but I would encourage you to listen to your management team and employees. Encourage your employees (especially those in your IT department) to take part in discussions about the potential blog and the blog’s development process. Odds are some of them are already blogging or reading blogs daily, so they can offer you valuable tips and feedback in designing the look and feel of your blog and suggesting valuable blog content. Best of all, their experience and expertise may help cut costs. If you decide to implement a blog, as a first step, I’d suggest designating your company’s blogger or team of bloggers. Allowing anyone to post to your corporate blog could lead to a PR disaster, lost produc-

EMPLOYEES’ RIGHTS, OBLIGATIONS, AND PITFALLS IN LITIGATION

131

tivity, and conflicting or confusing messages going out to the public. Setting up a blogging process that complies with your corporate policies allows your company to maintain control and accountability over the blog. Choose your bloggers carefully since they will be representing your company. Educate the bloggers so they understand the legal and business risks. Should you decide to implement an interactive internal blog that allows every employee to post content, you’ll need to educate all of your employees. You’re also going to need to update your employment policies to set clear guidelines about blogging. If you contract with a vendor to provide your blog’s content then the usual contract risks apply. Most important, you need to ensure that you own the content you’re paying for. The content of your blog is going to cause you the most headaches. When your employees post blog content as part of their normal duties, your company is responsible for the blog’s content. Statements made on the blog by employees will be considered statements made by the company, and if something posted to the blog is plagiarized, your company is to blame. Defamation claims are a major concern. False or misleading statements in your content about someone that caused or is likely to cause harm may be grounds for a defamation suit. And don’t forget that there’s also trade libel relating to false or misleading statements made about the goods and services of a competitor. Even if posted information is not defamatory, it could be considered harassment or an invasion of privacy. Make sure that you’re not violating your own privacy policy with your blog posts. Only material and trademarks owned by your company, or another party’s material and trademarks that you have the permission or right to use, should be posted to the blog. Violating someone else’s intellectual property rights is a sure way to get your blog in trouble. While there is a fair use exception for parody, criticism, commentary, and news reporting, you shouldn’t rely on the exception without consulting your attorney. Also, be careful about providing links to other sites and don’t allow “hot linking” to other people’s content—especially pictures and graphics that eat up bandwidth. Your bloggers could accidently leak confidential information or trade secrets without some sort of monitoring of blog content. Odds are that not every employee or officer in your company is aware of what kind of information is inappropriate to disclose, but your tech attorney should be since he or she deals with protecting your company’s confidential information and trade secrets on a regular basis. Imagine

132

CHAPTER 6

waking up tomorrow and finding internal e-mails, sales forecasts, marketing campaign plans, and other confidential information posted on your blog for the world to see. If your public company investors may be reading your blog and if there’s something posted they don’t like, your stock could take quite a hit. Posting the wrong piece of information could also get you in trouble with accusations of securities fraud, insider trading, or other securities-related issues. Corporate blogs can be viewed as advertisements depending on blog content. Such blogs must comply with applicable advertising, consumer protection, deceptive practices, and unfair competition laws and regulations. What about the posting of illegal content? How can you even define what is illegal on an external blog where anyone in the world can read the content? Are you supposed to comply with the laws everywhere? In this instance, I’d suggest you strive for what’s called mainstream compliance and comply with the laws of every country in which your company normally does business or has assets. Some blogs allow readers to post comments to the blog. While getting feedback directly from your customers and other consumers may be one of the major reasons that you’re setting up the blog, be careful. I urge you to think long and hard before implementing this feature on your blog. It’s usually more of a problem than it’s worth. If you decide to enable reader comments, you’ve opened up the opportunity for anyone to violate the intellectual property rights of third parties by posting content that is not theirs to your blog. If you do allow comments, you need to notify posters that they are solely responsible for their posts, that they are representing that they have the right to post the content, and that you may remove the content at any time for any reason. One way to do this is to establish terms of use for the blog and disclaimers that limit the company’s liability for third-partyprovided content. When you allow comments and posts to the blog, you’re also going to need to figure out how to handle personal information gathered from the poster and comply with privacy laws and your privacy policy. One of the advantages in operating your company’s blog is that you have control over the content. If you see a post that might get your company in trouble, remove it immediately—but keep archived versions. In the world of backups, archives, and retention policies, odds are that the post still exists somewhere. You want to make sure that your archive has a copy too.

7

Piracy and Crime Schemes and Scams

HEFTY PENALTY FOR USING UNLICENSED SOFTWARE How many computers do you have in your office running Word? How many licenses do you have for Word? If the answer to the first question is “many” and the answer to the second question is “not as many,” or if you simply don’t know the answers, you need to immediately clean up your act. If you don’t, you risk hefty monetary penalties. You must remember one basic fact about software. When you “buy” software, you don’t typically buy the copyright to the software. What you buy is a license to use the software. Every license is different and there’s no such thing as a typical license. Some licenses require one license per computer. Some allow you to put the software on a server for many people to use. Others let you use your work software at home without having to buy a second license. The variations are endless. You know that little box that pops up as you’re installing your software. You know—the one that includes the license you didn’t read before you clicked “I Accept.” I have a suggestion for you. Next time, read it before you click “I Accept.” You should assume that it’s a legally binding agreement and you might consider understanding it. License Enforcement The Business Software Alliance (BSA) is one trade group in the business of enforcing its member organizations’ licenses. Its members include low profile companies like Microsoft, Symantec, and Adobe Systems.

133

134

CHAPTER 7

If you don’t have the proper number of licenses for the software you use, your problem might just start with a disgruntled former employee calling BSA at 1-888-NoPiracy (1-888-667-4722). I don’t know about you, but I don’t know of many businesses without disgruntled former employees. Simply put: using software without having the proper license is an invitation to financial disaster. It might start with a letter requesting an audit of your software licenses. It could also start with an unannounced raid by U.S. marshals. Either way, you will wish that you had just simply paid for the correct licenses from the beginning. BSA will not accept after-the-fact compliance as a way to resolve your piracy. They always want sizable monetary penalties and then insist on you buying the correct number of licenses after you pay the penalty. It’s not unusual to hear of settlements in the range of $50,000 to $500,000. With this much at stake, you should take any inquiry by BSA as a reason to call your tech lawyer. You’re playing with fire here. Settlement is a good option when you consider that if the copyright owner sued you, it could immediately stop you from using its software and get money damages of as much as $150,000 for each program copied. Then bad gets worse when you consider criminal prosecution could lead to a fine of up to $250,000, or a jail sentence of up to five years, or both. Scope of the Problem According to BSA, in 2006 in the U.S., about 21 percent of the software they studied was pirated. While not great, it does put the U.S. at the top of the list of countries with the lowest piracy rates. Internationally, the problem is far worse. For example, in China in 2006, it is estimated that 82 percent of the software used there was pirated. In Vietnam, it was 88 percent. The winner (or is that loser?) is Armenia, where it is estimated that in 2006, 95 percent of all software was pirated. Still, I would like to take a moment to applaud Vietnam for its improvement in this area, since in 1994 they were at a perfect 100 percent. Obviously, they take stealing other nations’ intellectual property quite seriously. Preventing a Problem One of the most important steps in preventing software theft and copyright infringement is to educate your employees. You need to

PIRACY AND CRIME

135

teach your employees about software piracy and the consequences for involving themselves in such actions. The best place to start with your employees is the computer use policy. Another good step is using metering software, which allows you to inventory and track usage of your company’s software. If you find that your company is using pirated software, you can’t undo what you did, but you can and must immediately buy the proper licenses so that you are in full compliance. If you have a server, you should get a server software license that will allow a certain number of users to connect to the network on which the application is stored. It comes down to this: software companies are serious about reducing piracy. Just like with the IRS, while it’s true that you may never be caught cheating, if you are, you will have a massive problem. I suggest that you just pay for the licenses. Besides everything else, it’s just the right thing to do.

DEFENDING YOURSELF FROM THE BUSINESS SOFTWARE ALLIANCE Misusing software in the office is simply an invitation for trouble. Everyone has a disgruntled former employee and there is no faster path to negative attention than one of your former employees reporting you to an organization like the Business Software Alliance (www.bsa.org). If you ever get a letter that starts with something like, “The Business Software Alliance (BSA), an association comprised of leading software-publishing companies, has received information that your company may have illegally duplicated proprietary software products installed on your computers,” you have a problem. Sometimes these letters will ask you to conduct a self-audit of your systems and report the results to the BSA. If your first instinct is to cooperate, please control your instincts. Your next move should be to call a tech lawyer because you probably have an expensive problem on your hands. You will need an attorney with the right experience and knowledge to help you salvage a bad situation. This isn’t the time for you to learn how to handle a software audit by yourself. You may find that the “tuition” is expensive. Conceivably, your company could face a statutory penalty of $150,000. If the way you handled your software crossed the line into criminal, you could be looking at a fine of $250,000 and five years in

136

CHAPTER 7

jail for a first offense. If you’re lucky, the BSA will only ask you to buy the number of licenses you should have and pay a hefty penalty for your past noncompliance. I repeat, you need experienced counsel to salvage this bad situation. If your lawyer assists with the audit, you may be able to shield some of the information gained during this self-audit behind attorneyclient privilege. Put another way, the more you do before you involve your tech lawyer, the more chances you have to make a bad situation worse. While having the attention of the BSA or other similar organization puts you in a salvage operation, you should realize that BSA sees itself as trying to salvage a bad situation too. According to one recent study, 21 percent of all software in the United States is not properly licensed and this costs the industry billions of dollars. My point with these statistics is to help you see that the software industry sees itself at war with software misuse. When regulators get you in their crosshairs, you need to immediately recognize that you have a major problem before they quantify your problem into some ugly demand for money. If that’s when you first seek competent counsel, you may have already cut your own throat.

SOFTWARE AUDITS Do you know how many licenses your company owns for Microsoft Word? Do you know how many use it? Does anybody in your company have a good handle on your licensing? If the answers are no, and no, you may find yourself paying large penalties for your improper licensing. The basic rule of software licensing is that when you buy software, you are not actually buying the product outright. Usually, you’re only buying a license or right to use the software in a limited way. These terms are spelled out for you in your software license that accompanies the software—you know, the thing you should read, but don’t. For smaller purchases, these terms and limitations are usually written by the software company and are extremely one-sided to favor them. Your choices with these smaller purchases are rather limited. You can either accept the software company’s terms, or find another product. On larger purchases, purchases from small software vendors, and certainly when you are talking about custom code, your technology attorney can, and should, help you negotiate better license terms. There is no such thing as a typical license. They’re all different and vary with each software company. The variations on where and when

PIRACY AND CRIME

137

you might need a software license to legally use a copy of software are also almost endless. You could possibly need one per computer, one on a server for your entire company to use, one for the server and each desktop using the program, or one for office and home use. The variations are endless. I should know, I write these licenses. There are many reasons a company might be using software licenses that it’s not properly licensed to use. Let’s face it, it’s easy to lose track of software licenses if you aren’t careful. Even well-managed companies can be using unlicensed software through bookkeeping errors or simple mistakes. These mistakes are usually caused by a company mismanaging software assets, or employees misusing software without the proper licenses. And, of course, cases of willful violations happen too. While some companies are very good at designating a person or section to keep track of the licenses they have, when they might expire, and other valuable information, most are not. As I mentioned, up to 21 percent of all software used in the United States is not licensed properly. While that may not sound like a big deal, you could be facing severe penalties if caught using unlicensed software. You should already have your technology attorney conducting intellectual property audits, and I strongly suggest you have your attorney conduct software audits for you too. It’s the type of project where a junior associate can take the lead to reduce the cost. When I conduct a software audit for one of my clients, I’m taking a close look at the software it’s currently using on each computer, server, handheld device, cell phone, and other technologies to ensure the company has paid for the right to use each and every piece of software employees are using that requires a license. I’m also going back in time through the paperwork to track software purchases, looking at dates and number of licenses bought, the initial term and renewal periods, renewal fees, and whether my client has kept up to date on renewals and software updates. If you don’t have such a system, you’re playing with fire. It only takes one disgruntled employee to turn you in. Then you are really facing a financial hit, and there is a very active industry group out there looking for companies who are not buying the licenses they should. The Business Software Alliance (BSA) was formed by a number of major players in the software industry, and calls itself the “the voice of the world’s commercial software industry and its hardware partners before governments and in the international marketplace.” Perhaps you’ve heard of some of the software companies: Adobe, Apple,

138

CHAPTER 7

Microsoft, McAfee, and SAP to name a few. The BSA’s efforts worldwide have brought thousands of companies into software license compliance through its enforcement actions. The BSA views unauthorized use of computer software as stealing someone’s property. The BSA encourages companies to examine their own software management programs, before enforcement becomes an issue, to ensure companies are using only licensed copies of computer software. “BSA recommends that all companies and organizations have strong software management policies in place—including periodic internal audits, guidelines for supervisors, and clear procedures for employees. Companies cannot be too careful about being compliant.” If you don’t think the BSA is serious, consider this: if you are caught using unlicensed software, the alliance considers you a thief. The BSA is looking at a variety of ways software piracy and theft occurs in business today. For example, they’ve found cases where end users make copies without authorization, cases of client-server overuse where too many users on a network are using a central copy of the software, cases where companies were using illegal Internet downloads of the software, cases where computer sellers were loading illegal copies onto the hard disks of new computers to make them more attractive to consumers, and straight out software counterfeiting. Keep in mind that this is not an exhaustive list. As software piracy and theft takes new forms, I’m sure the BSA will be right on its heels, so don’t think you’ve found a new way to get free software. While the BSA takes an active role in hunting down cases of theft and piracy, it uses a variety of proven methods to encourage public involvement. The alliance has set up over 65 hotlines worldwide (1-888NoPiracy in the U.S.) where anyone can call in and report cases of software piracy and unauthorized use. Alternatively, people can use BSA’s online reporting form on its website at www.bsa.org. BSA also uses radio commercials, direct mail, and other advertising efforts to get the word out. It has also been known to offer rewards. If you are using unlicensed software, can you trust your employees not to turn you in? What about the disgruntled ones, the employees you’ve fired who did not take it well, or just an aggressive competitor? Any one of these people could turn you in just for her own personal satisfaction, and the BSA’s radio spots play on this by saying that “Unless you have no current or former unhappy employees, you’re only one phone call away from a BSA investigation.” As the BSA notes, just because someone is unhappy with your company does not mean he or she doesn’t know the truth about your

PIRACY AND CRIME

139

software misuse. Sometimes people give the BSA very detailed information accessed through company computer systems. Most of the BSA’s investigations start through phone and website reports, and then the enforcement process begins. Once the BSA determines the information it received is credible, you can expect a warning letter from its attorneys requesting you to conduct a voluntary audit of your company’s software licenses and report your findings to the BSA. Even if you’ve invested in a software audit before being contacted by the BSA, now would be a good time to call your technology attorney. Do it before you conduct your own internal audit. And do not respond to the BSA in any way. Let your tech lawyer do your talking. Often, the less said, the better. If we conduct your software audit and can prove you are in total compliance, you have nothing to worry about other than some time and effort showing the BSA you have all the licenses you should. However, effectively, you will have the burden of proving your compliance. Most companies cooperate and conduct internal audits after being contacted by the BSA. Uncooperative companies could face an unannounced raid by the BSA accompanied by U.S. marshals after the BSA starts civil or criminal process. However, since most companies comply, these types of raids rarely happen. Once the letter or the marshals arrive, it is too late to change your ways—BSA is not interested in hearing that you are “working on compliance.” It is looking to get the software licensing fees you should have paid in the first place (these fees are then passed along to the software companies). Then the BSA suggests an initial settlement figure, and most companies enter into negotiations to settle since it is usually easier and cheaper than fighting the BSA in court. When settling, the BSA also wants companies to agree to delete any unlicensed copies of software from their computer systems, purchase replacement software, and strengthen their software management practices. Penalty settlements often range from $50,000 to $100,000 and even higher—money that the BSA uses to fund its education and enforcement programs. Settlements have reached as high as a single company paying $275,000. Recently, the BSA announced that three companies in Florida settled claims that unlicensed software was installed on their company computers, for a combined total of $210,000. Individually, the settlements were for $25,000, $35,000, and $150,000. Moreover, as if paying a large settlement was not enough, your settlement with the BSA is likely to be announced to the world in one of its press releases. Oh joy!

140

CHAPTER 7

While large settlements and bad press sound bad, not settling with the BSA could really cost you. If the company holding the copyright to the software you are using without a license were to sue you, you could face damages in the six figures and possible criminal fines and jail time. All because you made a simple mistake, or worst case, were trying to be cute and use software without a license. A major part of your license management strategy should be to educate your employees about software licenses, and include strong language in your employee computer use policy detailing your position. You have to eliminate your employees’ unauthorized use and/or piracy. So ask your technology lawyer to conduct a software audit on your company. Your audit can help bring you into compliance with the licenses you already have, and hopefully avoid potentially expensive penalties and bad press. It is more expensive to use unlicensed copies of software than to have your technology attorney conduct an internal software audit. If you are ever contacted by BSA or anyone regarding your software licensing, call your tech lawyer before you respond. You’re walking into a minefield, and going it alone is a bit like doing your own surgery. Bad idea.

PREVENTING COMPUTER CRIME Hollywood and newspapers love computer crime. It sells tickets and newspapers. For movies, it’s an area that’s ripe for artistic license since so few people understand the realities surrounding computer crime. Words like password sniffers, Trojan horses, denial of service, and salami attacks attract attention. This section will define some of the terms that people use in the computer crime area and make some suggestions that will reduce the possibility of you becoming a victim. Some Definitions Password sniffing is the fear of every network. It starts with a computer monitoring all the traffic on a network. What a password sniffing program does is collect the first group of bytes of information on each connection. These first bytes usually contain essential information like the username and password. The hacker then uses another program, which sifts through this collected information, to find the important information. Armed with the username and password, a

PIRACY AND CRIME

141

hacker is now into a computer network where he doesn’t belong and may wreak havoc. The way to stop password sniffing is relatively straightforward. It’s usually as simple as encrypting (encoding) logon information. Still, not all networks do this and the ones that don’t are vulnerable to this type of attack. Trojan horses are as treacherous inside computers as the Trojan horse was during the Trojan War. We all know the story of how the Greeks hid soldiers inside a large hollow wooden horse. In a similar fashion, a hacker hides a computerized version of a Trojan horse inside what appears to be a useful program. The typical scenario might have an unsuspecting Internet surfer downloading what appears to be a fun game. Little does she know that the fifth time she starts her new game, instead of the game starting, a destructive program will be unleashed that may trash her hard drive or do something similarly destructive. Denial of service is a general term that encompasses several different types of attacks on systems. Generally, a denial of service is a type of attack that prevents any part of a computer system from functioning correctly. It can be low-tech, like blowing up the building or turning off the power, or high-tech. Of course, the high-tech attacks are the interesting ones. These might involve programs that “flood” or “spam” a system. Instead of shutting it down, these attacks typically involve the use of programs that create so much work for a computer that it essentially churns to a halt. Imagine arriving to the office one morning, turning on your computer as you always do, connecting to the Internet, starting your email program, and being greeted by thousands and thousands of emails from some unknown sender. You have just been victimized by a denial of service attack. Another common form of a high-tech denial of service attack is when a website like Amazon.com is targeted. The website is flooded with download requests, so many that the website server can’t keep up. New requests are placed at the end of the queue, and thus processed very slowly, if at all. This is what usually happens when one of the major e-commerce or news websites is “down.” A salami attack has nothing to do with heartburn and Tums. Rather, it’s an assault on financial data. It involves stealing money one slice at a time. The strategy is to steal small amounts of money from many accounts. This technique depends on the fact that most people will not notice or complain about a small discrepancy in their account.

142

CHAPTER 7

Imagine a bank employee who had a program that could deduct a dime from all interest payments that exceeded $50 and deposit them in his account. How long would it take before somebody noticed? Meanwhile, we would have one rich thief. Preventing Problems Security and convenience are usually trade-offs. The simple fact is that if you put too many locks on a door, then people don’t use the locks. Nobody wants to use a computer that requires several different and unique passwords to log on. We all hate it when a system logs us off after only five minutes of not using it, but five minutes is a long period of vulnerability if you walk away from a keyboard. Achieving the balance between security and convenience is often quite a challenge. The starting point is to perform a risk analysis. Remember that your goal isn’t perfect security because perfect security probably means that your system will be difficult to impossible to use. Rather, your goal is to achieve that magical balance that won’t cause users to find ways to thwart your security because it hampers their work. Start your risk analysis by looking at your threats. Obviously, the CIA has different threats than Mary’s flower shop. Still, Mary doesn’t necessarily want employees rummaging through payroll and banking records. Your threats may include people like employees, criminals, and spies, and events like natural disasters and fires. The next step is to look at your vulnerabilities. Vulnerabilities are places where your system is susceptible to attack. Here, you want to look at things like employee training and loyalty (or the lack thereof), interconnections with other networks, including the Internet, and the fact that your office is located on the coast of a hurricane-prone area. Assessing risks and vulnerabilities is all about asking lots of questions. Who might attack you? What would they be looking for? How would they get in? What are your risks from natural disasters? Are you reasonably protected from fire? After you have assessed your threats and vulnerabilities, the next step is to evaluate some appropriate countermeasures. Try to be proactive rather than reactive. By proactive, I mean performing this assessment and evaluating appropriate countermeasures before you have a problem. Human nature is such that too often people perform reactive assessments after they have a problem. You really don’t have to wait to have a burglary to put in a burglar alarm. Before you have a problem is the time to be creative in deciding what can go wrong and what reasonable measures you can take to pre-

PIRACY AND CRIME

143

vent it from happening. You need to look not only at your procedures, but also at how your people are implementing them. For example, while it’s useful to have encryption built into your security, it only helps if your employees use it. It all comes back to what I said at the beginning of this section. Security and convenience are usually trade-offs. If it takes 20 keystrokes and a minute to encrypt a single file, you’re going to find that your employees encrypt few files. Your countermeasures must be useful as well as usable.

ECONOMIC ESPIONAGE When we think of the Wild West, we think of horse theft as a serious crime. Some people now refer to the Internet as the Wild West. In the information age, the new serious crime is information theft (like stealing trade secrets). Until recently, protecting trade secrets meant relying mostly on a patchwork of often inconsistent state laws, which provided a civil remedy, but rarely criminalized their theft. That changed a bit in 1996 when then-President Clinton signed the Economic Espionage Act (EEA) of 1996. In today’s world, information is often the most important asset a business owns. Yet these assets are extremely difficult to preserve in an environment where gigabytes of secret data fit on a small disc, companies often rely on outside consultants, and employees come and go as part of a mobile workforce. On another level, we also live in a post-cold-war world where some former military spies now find private employment and engage in economic espionage for foreign governments and companies. The EEA started as a law designed to deal with foreign economic espionage. In its final incarnation, it grew to cover the theft of trade secrets domestically. Defining Trade Secrets First, a definition is in order. Generally, a trade secret is any information that’s valuable because it is not generally known to or readily ascertainable by other people who could profit from knowing it. To maintain its trade secret status, state laws generally require that you take reasonable efforts to maintain its secrecy. Once information is disclosed, you can’t claim that it’s a trade secret. You cannot put the cat back in the bag.

144

CHAPTER 7

There are some variations on this basic definition depending on the state. Some definitions require that you use your trade secret continuously in your business or risk losing your legal protections. Some states require actual economic value, while some states protect trade secrets with only “potential” value. In deciding whether information is a trade secret, courts have traditionally looked at many factors. For example, how widely known was the information outside of the business claiming the trade secret status? How many people knew the secret? What security measures were used to maintain secrecy? How valuable was the information to its owner and competitors? How much effort and money were used to develop the secret? How hard would it have been for a competitor to duplicate the information using proper methods? The EEA requires reasonable measures to keep the information secret, but does protect potential, not just actual, value. For a criminal statute, it’s surprisingly broad and, in several ways, broader than many state laws. It’s also clearly well designed for today’s digital world. It specifically includes both “tangible and intangible” information “and whether or how stored, compiled, or memorialized physically [or] electronically.” It even seems to cover information that’s been memorized with the language “whether or how stored” and “intangible.” This is a truly broad definition of a trade secret. The Crimes The EEA includes essentially two crimes. The first crime involves foreign economic espionage. The penalty is up to a $500,000 fine and 15 years in jail for an individual violator. An organization that commits the crime can be fined up to $10 million. The domestic theft of trade secrets is also treated as a serious crime. Here, the maximum penalty is 10 years in jail and a fine governed by general federal law. The maximum fine under federal law is generally $250,000, but in cases of pecuniary gain or loss, it can be set as high as the greater of twice the gain to the criminal or twice the loss to the victim. An organization can be fined up to $5 million and arguably more based on the twice the gain or loss method that can be used against an individual. Staying out of Trouble For your organization the flip side of losing your trade secrets is the damage that can be done by your employee using trade secrets from a

PIRACY AND CRIME

145

previous employer to help him succeed in your company. You may not even realize that you’re having corporate success because you’re using stolen information. To avoid criminal and civil liability, you must develop and enforce a compliance plan. Its purpose—to prevent the use of stolen trade secrets by your company. You’re at particularly high risk if you answer yes to two of the following three questions: Does your business focus on technology and information? Are you rapidly growing by hiring? Do you have a significant reliance on consultants, outsourcers, or temporary workers? If you answer yes to any one of the following, you are clearly at high risk: Have you hired middle- and upper-level people from your competitors? Do you use consultants and temporary workers to assist with research and development? Do you have foreign subsidiaries, affiliates, and other foreign operations? A good compliance plan needs to be custom designed for your business. There is no such thing as a one-size-fits-all plan. Your plan must take into account things like your industry and competitive environment, the types of intellectual property at risk in your business, government standards for your industry, and your corporate culture. The plan must clearly establish a standard of conduct. It must let your employees and others who work for you know what you expect of them when it comes to trade secrets in their possession. If there is a particular type of risk in your industry or company, then single it out for special mention and treatment. Your plan should also tell employees how to report violations of the plan. It should create a procedure for investigation and state the consequences of violations. Most important, this is not a cosmetic document designed to be pulled out of the drawer if you’re prosecuted under the EEA or sued. It’s an educational tool that needs to be mentioned frequently at department meetings and in company newsletters. This type of treatment may even have the effect of protecting your own trade secrets because you’ve sensitized employees to the risks inherent in stealing trade secrets. It’s a winner for you no matter how you view it.

CYBERSTALKING AND CYBERTERRORISM: TERROR AND MINIMIZING ITS RISKS Imagine that every time you’re in a chat room online somebody with a screen name that you can’t attach to anybody you know says nasty and threatening things about you. Then one morning, you check your

146

CHAPTER 7

e-mail and find about 1,000 e-mails from that screen name that say, “You better look behind you. I’m going to kill you.” Stalking involves harassing or threatening behavior that a person does repeatedly. Cyberstalking takes stalking online. The general idea is that cyberstalking involves using the Internet, e-mail, chat rooms, and other types of electronic communications to stalk another person. Unfortunately, cyberstalking is becoming more prevalent as computers, the Net, and technology become larger parts of our life. The Los Angeles District Attorney’s office has estimated that about 20 percent of its stalking cases involve electronic harassment. The New York City Police Department has estimated that almost 40 percent of its computer-related investigations involve cyberstalking. People who haven’t been cyberstalked can be quick to minimize it. “It’s just e-mail.” “It’s just words on a computer screen.” “It’s no big deal.” They’re wrong. It’s serious. There are many cases where cyberstalking has foreshadowed even more significant behavior like physical violence. You should never minimize capturing the unwanted attention of an unbalanced person. If ignored, the cyberstalker may just get bored and move along. Or maybe not. Almost every state has cyberstalking or related statutes that makes it illegal to stalk another person. As for the states with stalking statutes, but no cyberstalking statute, the language of the stalking statute is sometimes broad enough to encompass cyberstalking. Still, every state needs to adopt specific cyberstalking statutes. There are still people who might argue that electronic stalking couldn’t be real stalking because, well, it’s just electronic. The law needs to be crystal clear that this view is wrong. Stalking, whether physical or cyber, should be a serious crime. There are some significant differences between offline and online stalking, but they probably won’t make you feel better. With offline stalking, the victim and the stalker need to be in the same geographic area. With cyberstalking, the stalker may be your neighbor or could be half a world away. You can’t tell. Distance is good because it’s less likely that the stalker will physically attack you, but distance adds a significant layer of legal complication. Imagine trying to get a prosecutor in another country, who doesn’t even speak your language, to take an interest in what your e-mail inbox had in store for you today. With cyberstalking it’s also easier to encourage third parties to get into the act. You could end up with lots of people e-mail bombing you, impersonating you online to post inflammatory messages, or doing whatever to make you miserable.

PIRACY AND CRIME

147

Yet another significant difference is that the impersonal nature of the Net may lower the barrier to harassment and threats. It’s a coward’s dream—the ability to send fear anonymously and long distance. There are steps that you can take to minimize your risk of being cyberstalked. For starters, never share personal information in public spaces online. Don’t use your real name as your screen name. Pick a gender and age neutral name. Let’s face it. Hotbabe18 is more likely to have a problem online than Webber. It should go without saying, but I’ll say it anyway. Be extremely cautious about meeting an online “friend” in person. If you choose to do it (real friendships have started this way), do it in a public place and bring a friend along. Although your first instinct may be to trash the e-mails or other evidence of the stalking, you must keep them for the police. If the situation doesn’t stop, contact the police. Don’t be embarrassed and don’t blame yourself. The sad fact is that many people don’t have all their bulbs burning brightly and occasionally you may find their dim light shining on you. Seek the help you need. You may be in danger. Thwart Cyberterror with Planning In World War II, car manufacturers built tanks, entrepreneurs with no experience in shipbuilding built ships, clothing manufacturers became uniform manufacturers, and so on. So too will our e-commerce economy become a vibrant part of the war machine. Our economy must be healthy to build, rebuild, and sustain what it will take to fight the current protracted war. Last week, you needed to guard your information technology systems against cybercrime, sabotage, interception of private e-mail, viruses, denial of service attacks, and other threats just because it was good business. Today, you have another reason—we are at war. Good business should have been enough reason to act, but for the most part America has done a horrendous job of dealing with computer security. Nobody knows what’s coming next from our enemies, but cyberwarfare has been a known risk for years. Back in February 1999, I said: “Every day, more commerce and sensitive information flows over the Internet. This dependence on electronic information makes for an inviting target for a new breed of terrorists that some are calling ‘cyberterrorists.’” I don’t quote myself so that you can congratulate me about writing about the risk in 1999. I do it so that maybe I can establish some instant credibility with you.

148

CHAPTER 7

Cyberterrorism and cyberwarfare are real threats. Could you imagine the damage to our economy if our enemies close Wall Street next time, not with planes filled with innocent people, but by hacking into and disrupting Wall Street’s computer networks? What if we all had to stop using e-mail because they found a way to bring the Internet to its knees? Moreover, let’s not forget that the day after the 2008 presidential election, the press reported that both President Obama’s and Senator McCain’s campaign staff computers were hacked by what was believed to be foreign powers. It’s a mistake to label our enemies as insane because it makes them seem weak. They’re fanatics, but quite sane and extremely intelligent. Never underestimate your enemy in war. The right way to fight a war is to assume that the enemy is smarter, more capable, and better prepared than you are. With this as the starting point, you will never make the mistake of complacency. In war, complacency kills people. My expertise is technology so that’s where I can offer advice. You must immediately develop your disaster plan with terrorism in mind. Do you maintain backups off-site and far away? You must ensure that your information technology infrastructure has state-of-theart security in place. You should consider greater use of encryption for sensitive corporate information.

PRETEXTING BREAKS THE LAW Have you noticed an increase in the number of online companies that claim they can find sensitive information on anybody? These companies say they can uncover hidden bank accounts, Social Security numbers, credit card balances—virtually any financial information on anybody. But how do they do that? The answer: it’s often something called pretexting. And online investigators who use pretexting are breaking the law. For the most part, your financial information is private. For example, unless I get your permission, I can’t call up your credit card company and find out how much you owe on your credit card, or whether you even have a credit card. Even if I had the desire (or time) to find this out, the credit card company would never release this information to me. On the other hand, there’s a lot of information that I (or anyone else) can find out about you, all of which is public information. The

PIRACY AND CRIME

149

county where you were born, for example, can tell me your full name, date of birth, and parents’ names. Sometimes you give your personal information to the world without even realizing it. Your personal information that you provide to catalog companies, retailers, and online stores is often up for grabs. However, in an effort to get even more sensitive information on their targets (and, subsequently, demand premium rates for their efforts), cybersleuths increasingly include pretexting in their investigatory toolbox. Pretexting is the practice of getting another person’s confidential information under false pretenses. Of course, cybersleuths don’t advertise that they use pretexting. Instead, they make lofty claims that they can get highly confidential information on anybody by merely typing the subject’s name into their database. Don’t you believe it. Despite the prevalence of supercomputers and broadband access, there is no single database that contains everyone’s confidential information. Instead, many cybersleuths still get highly confidential information the old-fashioned way—through lies, impersonation, and deceit. In a word, pretexting. The bad news: pretexting can lead to identity theft. With the information obtained, a malicious person can damage your credit rating, make purchases using your credit cards, and even subject you to extortion. The good news: to fight pretexting, a federal law called the Gramm-Leach-Bliley Act (often referred to as the GLB Act) was enacted. It prohibits a person from obtaining, or attempting to obtain, your financial information by making false, fictitious, or fraudulent statements to your bank or other financial institution. It also prohibits someone from using lost, forged, counterfeit, or stolen documents to get sensitive financial information. More good news: the FTC actively enforces the GLB Act. For example, recently the FTC screened more than 1,000 websites, and identified almost 200 companies that offered to obtain and sell nonpublic, confidential, financial information for fees ranging from $100 to $600. The FTC’s website (www.ftc.gov) not only describes the FTC’s efforts, but also offers helpful advice on how you can avoid becoming the victim of pretexting. How much private information are you willing to give away for a freebie or discount? Do you mind having all your drugstore purchases tracked for a markdown? People complain about the lack of privacy in our digital world and yet they seem all too willing to give away their secrets for a pittance. Maybe it’s ignorance about what they’re giving away, so let’s dispel some of that.

150

CHAPTER 7

I haven’t seen this as much in South Florida as other parts of the country, but many stores have discount programs that require you to give the cashier a small card with a barcode as you check out. The barcode identifies you, which gives the store the ability to record and study your purchasing patterns. In return, you get a small discount on your purchases. In some ways, it strikes me as a fair deal. You give the store the ability to market to you better because they know what you like and you get a discount. The problem I have with this is so few consumers really understand what it is they are giving away. After all, it’s not like the drugstore or supermarket has a big warning sign that says, “By signing up for this program, you agree to let us collect personal information about you, use it to our advantage, and sell it to whomever we want, whenever we want.” If you think that can’t be the deal because there “must be a law,” you’re sadly mistaken. There is very little in the way of privacy protection in the United States. Most of your protection comes from educating yourself about privacy issues.

SPYWARE It shouldn’t be surprising to you that privacy issues follow you onto the Net. The biggest culprit is what’s called spyware. Despite the name, it’s legal. It often comes in the form of “free” software that performs some useful function. You want the functionality, so you install the freebie. What you’re often not told is that you’re “paying” for the freebie by letting them spy on your Internet activities. Defining spyware isn’t easy. The best definition I’ve found comes from Steve Gibson, a well-known software entrepreneur. He says, “Silent background use of an Internet ‘backchannel’ connection MUST BE PRECEDED by a complete and truthful disclosure of proposed backchannel usage, followed by the receipt of explicit, informed, consent for such use. ANY SOFTWARE communicating across the Internet absent these elements is guilty of information theft and is properly and rightfully termed: Spyware.” He goes on to say that “the number one reason for declaring software to be ‘spyware’ is that it sneaks into the user’s system and communicates secretly. This is never going to be OK . . . since the goal is to inform the user, burying this information beneath a mountain of legal mumbojumbo, then claiming to have ‘informed the user,’ misses the mark.” Like the barcoded card at the drugstore, spyware isn’t all bad. You make a trade-off between your information and something else of

PIRACY AND CRIME

151

value you’re getting. Of course, this assumes you understand the trade-off after a full disclosure. As Steve Gibson said, the issue is that spyware “sneaks” onto your system. Still, “sneaks” is in the eye of the beholder. One product that received a lot of attention a few years ago was the GatorSM eWallet. It was software that made surfing easier because it remembered things like website passwords for you. The home page told users that it “fills in forms with no typing” and “remembers passwords automatically.” It sounded great. I know that it’s a pain to fill in those long forms on the Net. This was the answer to not having to type your address repeatedly. Gator disclosed the trade-off in innocuous language: “The Gator eWallet comes bundled with OfferCompanion separate software— your direct link to some of the Web’s most valuable offers.” Hmmmm? So, let’s jump in what Steve Gibson calls the “legal mumbojumbo” to see what the trade-off was. The following is from Gator’s privacy policy, “While we don’t know the identity of [our] users, [our software] and [we] anonymously collect and use the following kinds of information: Some of the Web pages viewed; The amount of time spent at some Web sites; Response to the ads displayed; Standard web log information (excluding IP Addresses) and system settings; What software is on the personal computer; First name, country, and five digit ZIP code; Non-personally identifiable information on Web pages and forms; GAIN-Supported Software usage characteristics and preferences.” I don’t know about you, but the legal mumbo-jumbo seems to say a bit more than the innocuous statement about “your direct link to some of the Web’s most valuable offers.” My advice is that before you install any “free” program, you should do some research to learn whether it includes spyware. What’s distressing is that while it’s easy to give the advice, you may find that its practical application is difficult because these companies labor to cloak their spying. I occasionally run Lavasoft’s Ad-Aware. It’s a freebie that detects spyware. You can get it at any major software download site like www.cnet.com. You may be shocked when you learn more about how your computer is spying on you.

THE NEED FOR SPYWARE LEGISLATION Just the word—spyware—sounds evil. Well, it is and the problem is that it’s not clearly illegal. It’s time that it was. Did you know that with spyware somebody could be logging all your keystrokes and having that information sent to them over the

152

CHAPTER 7

Internet? They could also be looking at your private financial information, your confidential memo, or other private information. Ever had an advertisement pop up over another ad? That could be spyware too. Spyware is a great example of the proposition that the Internet is so new that we have yet to pass all the fundamental laws that should govern it. To me, surreptitiously installing spyware on my computer is not much different than spying on me using more traditional means. It seems to me that it should be a crime to bug my house with a listening device or to bug it with software. Right now, only the listening device is clearly illegal and that’s absurd. Spyware is a rampant problem. If you have never checked your computer with one of the antispyware utilities, it’s likely that you have spyware lurking on your system. (My favorite utility is AdAware. It’s free and you can find it at www.lavasoftusa.com/.) One of the problems with legislating on spyware is that it’s not easy to define and “I know it when I see it” won’t cut it. The best pithy definition I can come up with is that spyware is any software program that installs itself on your computer without your knowledge or consent and monitors your online activities and transmits this information to a third party; or causes advertisements to appear on your screen. Utah was the first state to enact a statute on spyware. When it was a pending bill, several large reputable companies expressed their concern about the law. In a letter, they said, “[I]ts definition is extremely broad and would cover a host of important and beneficial Internet communication software, and even the communication of routine network information. . . . They may include information necessary to provide upgrade[d] computer security to protect against hacker attacks, to provide interactivity on web sites, to provide software patches, to improve Internet browser performance, or enhance search capabilities.” I think that we can overcome the objections with careful statutory drafting and proper disclosure by software companies. While I do recognize that the “definition” issue is not simple, I don’t think that this should slow our pursuit for legal protection we so obviously need. I happen to think that if you are going to program my computer to send you information over the Internet, I have a right to know. That’s not a difficult concept. Spyware purveyors often argue they do disclose their activities in their license agreements and technically that might be true. However, let’s get real here. They typically bury their “disclosures” in an intimidating license agreement written in obtuse legalese. We all know no-

PIRACY AND CRIME

153

body reads that license and they depend on that. The types of disclosures I’m advocating are in plain language and are conspicuous. The bottom line is that we need legislation against a rampant and serious problem. We should not let the details get in the way. Rather, let’s deal with these details and get some legislation passed.

WEB BUGS If I asked you if the website you’re viewing has a Web bug, you might think that I was asking if it had a glitch or problem. Actually, in this context, when I use the word bug, you should think of a little surveillance device. Did you know websites and even e-mails can be bugged? Big Browser may be watching. Web bugs are an information-gathering tool. They’re not new, but they have been getting more attention lately. They upset privacy advocates because they’re invisible and people can put them anywhere they can place pictures or images on the Web. This means that people can bug webpages, banner ads, e-mails, and newsgroups. Welcome to the world of spyware. Can you imagine you actually thought you could surf anonymously? Think again. You can’t even necessarily read your e-mail without sending a message back to the sender saying, “I opened your e-mail.” This must be against the law. Right? As Johnny Carson might have said, “Guess again, keyboard breath.” (If you’re not old enough to understand the Johnny Carson comment, I suppose that your parents would be proud to know that you’re reading business books.) It turns out that it’s really not clear that Web bugs are illegal. While government agency investigations and class-action suits have put Web bugs under intense legal scrutiny, I can’t point to anything that says that Web bugs are clearly illegal. I can tell you that the Michigan attorney general has shown interest. The E-Commerce Law Report quoted him as saying that Web bugs are “similar to Big Brother. . . . People have no idea their thoughts and practices on the Internet are being tracked or policed. We’re going after this secret, third party surveillance.” Dangers from Web Bugs Web bugs are a great asset to spammers because they let spammers know if your e-mail address is valid. As soon as you open the spam, the spammer gets a message back that says “valid address.”

154

CHAPTER 7

When marketers use cookies (another technology that upsets privacy advocates) and Web bugs, they obtain the Web addresses of pages you’ve visited. If that’s not bad enough, it gets worse because the address sometimes includes your search terms or personally identifiable information. It’s even possible that using Web bugs and cookies together, “they” can track you by your e-mail address as you surf the Net. In other words, the website knows it’s you although you didn’t try to tell it that it is you who is surfing the site. Are you feeling paranoid yet? Maybe you should. It’s an area that’s clearly ripe for federal legislation. It strikes me as outrageous that my surfing and e-mail activities can be monitored and I don’t know it. It’s so over the line that I can’t imagine any legitimate debate. Having said that, I’m not suggesting that Web bugs be banned completely. I’m just suggesting that they be strictly regulated with meaty penalties for violating the law. Web bugs do have legitimate commercial uses and you may not object to a particular use if you knew it was happening. It’s that it’s done surreptitiously that is so outrageous. The Privacy Foundation (www.privacyfoundation.org) has suggested a multipronged approach for Web bugs. While it may not provide the ultimate answer, I would suggest it’s a good starting point for the discussion about legislation. The foundation starts by suggesting that invisible Web bugs not be permitted. Rather, Web bugs should employ a visible, easily spotted icon on the page. Next it recommends that the icon identify the name of the company that placed the Web bug on the page. In addition, the icon should be labeled to say it is a monitoring device. When a user clicks on the icon, the foundation suggests she receive a disclosure that includes things like what data the Web bug is disclosing, how the data is used after it’s collected, what companies receive the data, what other data the Web bug is combined with, and if a cookie is associated with the Web bug. Also important is that users should be able to opt out from any data collection done by Web bugs. Finally, nobody should use the Web to collect information from webpages of a sensitive nature. Examples may include pages intended for children or about medical, financial, job, or sexual matters. Using Web Bugs Properly Today, the law in this area is uncertain. Web bugs are out there, businesses use them (including some of my clients), and they do have some

PIRACY AND CRIME

155

legitimate purposes. If you want to stay on the correct side of this legally uncertain area and on the good side of those who surf your site, I would suggest that you adopt a policy of voluntary compliance with the Privacy Foundation’s multipronged approach. With people’s increased sensitivity to privacy issues, I don’t think you can go wrong by erring on the good guy side on privacy issues.

METADATA TRAPS FOR THE UNWARY When you e-mail a Microsoft Word file to somebody, she may be able to see information you consider private like text you’ve deleted, older versions of your document, the names of everybody who has worked on the document, and other goodies. It’s called metadata. Do I have your attention yet? To put it simply, metadata is data about data. It’s the who, what, when, where, why, and how about a document. It’s also a trap for the unwary. While this section will focus on Word, it’s only because almost everybody uses it. Other programs have metadata issues that you need to consider too. If you’re not aware of metadata and blithely e-mail documents, you may be inadvertently giving away more information than you intend. If you’re a lawyer, you may be giving away privileged information and creating an argument that you’ve waived some aspect of attorney-client privilege. If you’re a businessperson, you may give away trade secrets. If you’re involved in a negotiation, you may inadvertently reveal your negotiating strategy. However you look at it, metadata can be a disaster waiting to find you. What Can You Give Away? I happen to use various versions of Word so my specifics apply to that application only and some of the details like how to access the metadata may vary depending upon the version you use. Still, the generalizations about the examples I mention do apply. In Word, when you create or save a document, it saves summary information about the document. You can access it by clicking on File and then Properties. You may find information there you don’t intend to give away. Another interesting feature is Track Changes. I use it all the time so that all sides of a deal can see the changes made in a document,

156

CHAPTER 7

when they were made, and by whom. The feature can have a dark side if you’re not aware that it’s turned on. This can happen if somebody clicks on Tools, Track Changes, Highlight Changes, and then unchecks the box Highlight Changes on Screen. Now the document is tracking changes and you don’t know it. With this scenario, what you thought was a private process of edits within your organization or between attorney and client are there for your recipient to see. Imagine the possible consequences if your recipient could view the wording evolution from “You are a disreputable thief with no morals,” to the carefully crafted “Some people have raised issues about the ethics with which you conduct your business and we are somewhat concerned.” Another feature you need to be aware of is the “fast save” feature. Its bright side is that it speeds up saves by only saving the changes and not the entire document. Its dark side is that it saves text you delete from a document and you don’t know it. You can turn the feature off if you click on Tools, Options, the Save tab, and then uncheck “Allow fast saves.” In recent versions of Word, the default setting is that the fast save feature is turned off. Still, somebody could turn it on and as easy as that, he may have access to the evolution of your document. Another possible information leak can occur because Word saves the names of the last 10 people who worked on a document. This one is particularly dangerous because it’s an automatic feature that you can’t turn off. There’s also no way to command Word to delete this information. To get rid of this list of authors, you have to save the document in either RTF (rich text format) or HTML and then resave it in Word. The problems are that it’s an extra step most people won’t take and it can be problematic because when you do this type of round-robin between formats, you get unpredictable results with formatting and other features. Caution Is Required If you want to minimize the possibility of metadata causing a problem, the solution starts with awareness. Remember that just because you can’t see the data, doesn’t mean that it’s not there. Every good litigator is now aware of metadata and the general goldmine one can find in the digital versions of documents. If you find yourself in litigation, you should expect document requests to specifically ask for the digital version of documents and not a photocopy of a printout.

PIRACY AND CRIME

157

There are third-party applications that purport to strip documents of their metadata and you may want to consider them. Still, you need to remember to run the metadata stripper with every version of the document you create. Moreover, you shouldn’t assume that your stripper strips all the metadata. Be careful. My best suggestion is to look to the developer of your software for information on the metadata its software collects. For example, Microsoft’s Knowledgebase on its website is replete with information about its metadata. Read it or weep.

IDENTITY THEFT One of the curses from computers and the Internet has been the explosion of identity theft. A crime virtually unheard of a few years ago, it’s one we all know too well today. When it happens to you, it’s the ultimate twenty-first-century nightmare. Until now, you were left to your own devices to fight the identity thieves. However, now there are a number of industry-leading recovery services available that coordinate and steer the recovery process for you using lawyers and other professionals. Fixing an identity theft problem is almost always a time-consuming process that requires months (and sometimes years) of follow-up to remedy. With all of that personal information about you floating around, it should come as no surprise that identity thieves are finding it easier to steal. Historically, identity theft was about stealing wallets and mail, or dumpster diving into the trash to find your valuable information. Now your personal information is all too often digitally floating around out there just waiting for an opportunist to take it. We used to gladly hand over our Social Security number and other vital information to anyone who asked. Now, even the most trusting among us hesitates before disclosing this valuable information. Moreover, it’s not just the big pieces of information the thieves are stealing and using, it’s also what we thought were the irrelevant tiny bits floating around out there. Sure, Social Security and credit card numbers are the magic keys we’ve heard about and now guard. But other things like your address, employer, salary, phone number, or even just your name can be enough for a thief to start. Almost any piece of information can be sensitive enough to allow an experienced identity thief to take over your life. Even if you employ all of the latest techniques to protect yourself, over time you’ve already disclosed vital information to employers,

158

CHAPTER 7

banks, landlords, and other parties. How are they protecting your information? Companies have been building, using, and sharing databases of customer information for years. Data mining techniques allow companies to turn these databases into valuable assets, and unfortunately, the security of those databases is often very poor or ignored entirely. Only recently has news of breaches in security surrounding these databases become common, but such breaches have been going on unreported for some time. The truth is that we have created a monster called identity theft and let it out of its cage. Computers and the Internet do make our lives easier, but they also enable the identity thief. An entire industry has developed around identity theft protection. You’ve probably seen the ads on TV from credit card companies and banks offering such services, but these services are often little more than insurance programs that will reimburse you for costs incurred in cleaning up your identity theft mess. Other companies offer credit monitoring services that will notify you of suspicious activity on your account. As a victim, it will provide little comfort to know that you are not alone. And if you have not heard of identity theft, here are some statistics that should scare you. Recently, the Federal Trade Commission (FTC), the government agency that established a central clearinghouse of identity theft reports, received nearly a quarter million identity theft reports in a single year. Fortunately, all levels of government are responding to this new consumer threat. Local and state law enforcement agencies are now taking the problem seriously and actively investigating cases. Further, states have enacted new criminal laws. The federal government is even in the act, with the FTC taking the lead in protecting the safety of consumers, backed up by various other agencies. If you think you are a victim of identity theft, the news can be a little overwhelming. How do you even start fixing the damage? Victims can spend hundreds of hours over months and years trying to clean up the mess the thieves have caused. For many folks, the do-ityourself kit approach may be the best one. There are many websites that can offer you suggestions on how to handle your identity theft problem. The FTC provides a wealth of information on its website at www .ftc.gov/bcp/edu/microsites/idtheft/, and should probably be your first stop. The FTC serves as the starting point when dealing with government agencies since victims can file complaints with them. These

PIRACY AND CRIME

159

complaints are entered by the FTC into a secure database and used in tracking and fighting identity theft. Florida’s attorney general also has a very useful website at www.myfloridalegal.com/identitytheft, which offers tips and resources to Florida residents. Others will prefer obtaining professional help. Such services help you in identifying suspicious activity on your credit report and other places, and then take the lead in resolving the problem. They can stop the calls of debt collectors and actually get them working with you in resolving the problem. These services should take the initiative in contacting and working with the entities an identity theft victim needs to notify when her identity is stolen, including credit reporting agencies, creditors, local, state, and federal law enforcement agencies, the FTC, the Social Security Administration, the U.S. Postal Service, U.S. Department of State (and other various federal agencies), your state department of motor vehicles, utility companies, and all of the banks and other financial institutions unique to your situation. They will request that identity theft alerts be placed in all your files. This way, those you do business with will be aware of your problem and can be on the lookout for things like new accounts being opened in your name. They will also help you obtain a copy of your credit report from all three credit bureaus three separate times. These reports are an essential part of the process because these reports may reveal previously unnoticed suspicious activity in your name. They should also assist you in reviewing these credit reports. You would be amazed how many people have never actually seen their credit report. If you think you’ve been the victim of identity theft don’t hesitate in remedying the situation. Acting quickly and effectively will help bring yourself the peace of mind you need to get on with the rest of your life.

8

Privacy, Policy, and Encryption

IT’S ALL ABOUT PRIVACY These days it’s easy to become distracted. We’re all doing our best to restart our stalled economy, while simultaneously managing our dayto-day affairs. In the meantime, however, legislation is occurring around us that may affect the way your company conducts its business online. If you’re not careful, while you’re busy doing other things, your business might unknowingly violate some of these laws. For example, if either of the following two names sound familiar to you, raise your hand: the Gramm-Leach-Bliley Act, and the Health Insurance Portability and Accountability Act. These are just two of the many laws that have kicked into high gear over the last few years, either of which could seriously impact your online company. Privacy is in many ways the number one issue affecting the Internet. Unfortunately, from a legal perspective, it’s still tough to tackle. We all want to do everything online, but we’re not quite ready to give up all of our personal information or privacy rights to do it. We want the government to take a hands-off approach to governing the Internet, while at the same time we clamor for laws that punish those who steal our sensitive information using the ubiquitous resources of the Web. Congress has tried to deal with online privacy through various pieces of legislation. From a business perspective, trying to keep tabs on Congress’s love/hate relationship with e-privacy rules has driven more than one CEO to therapy. Although much of what is proposed never becomes law, some e-privacy rules have survived congressional roadblocks and presidential vetoes. The Gramm-Leach-Bliley Act is one such law.

161

162

CHAPTER 8

Financial Privacy Named after its congressional cosponsors, the Gramm-Leach-Bliley Act (or GLB Act) requires companies that collect financial information, such as federal and state banks, financial brokers, and insurance brokers, to comply with strict guidelines concerning what they can (and can’t) do with their clients’ nonpublic financial information. The long arm of the GLB Act applies to all nonpublic financial information obtained by financial institutions about their customers, no matter how they got it. This is a fancy way of saying that if you collect financial information about your clients, there’s a good chance that your ability to share that information with other businesses is severely limited. Depending on the type of information you collect, you may have to obtain your clients’ permission before sharing any of their financial information with your affiliates or any other third parties. The deadline for compliance with many of the GLB Act’s privacy and security provisions has long since passed. So, if you haven’t checked in with your tech attorney in the past year or two, you might have blown right by the compliance deadlines without even realizing it. If you think you might be in violation of the act, then run—don’t walk—to your attorney’s office. The penalties for noncompliance can be hundreds of thousands of dollars, or prison, or both. Medical Privacy The only thing we value more than our financial privacy is our medical privacy. After all, you’d probably rather have your stock portfolio disclosed than have some stranger discover that you have to apply an ointment to your “affected area” twice a day. Enter the Health Insurance Portability and Accountability Act of 1996, or HIPAA. Originally designed to help employees with preexisting medical conditions get into certain group health plans, HIPAA has evolved into a maze of e-privacy regulations that seeks to protect our medical records. In short, HIPAA requires health plans, healthcare clearinghouses, and healthcare providers that conduct certain financial and administrative transactions electronically to adhere to certain strict privacy standards. These standards are designed to make sure that your medical information is used only for your own therapeutic purposes, and not to populate the mailing lists of third-party drug providers, marketers, or other similar companies. Most immediately affected will be

PRIVACY, POLICY, AND ENCRYPTION

163

those insurance companies and medical billing companies that conduct part or all of their businesses online, or those companies that transmit patients’ medical data to each other over the Internet. In addition, as physicians move to Web-based billing systems or strive to achieve paperless offices, they too will become increasingly exposed to HIPAA’s requirements. The time is ripe to find out whether your e-business falls under HIPAA’s privacy standards. As our lives become increasingly more complicated, it behooves us to remember that laws related to e-business are being passed and enforced all the time. Take a few minutes to think about how your e-business uses the data it collects, and consider whether your business might be running afoul of recent privacy legislation. If it is, or if you’re not sure, then find out immediately and deal with it. Online Privacy Issues Online privacy is just a consumer and web surfer issue. Right? Actually, that’s absolutely wrong. It’s a major issue for your business. To the extent that your business has an online presence, you need to focus on online privacy issues to ensure that your customers and potential customers are happy campers who trust you with their private information. It’s a fair generalization to say that Europeans take privacy issues a bit more seriously than Americans do. They seem to see it as a fundamental human right akin to the way we see free speech. American companies doing business in Europe certainly need to be extremely sensitive to European sensibilities and laws relating to privacy. In the United States, we give lots of lip service to privacy issues, but the fact is that there are few laws regulating privacy. While financial services and healthcare have laws that directly impact them, most businesses don’t. Still, I think there’s a certain inevitability to more privacy laws in the U.S., especially under an Obama administration. I know that I have conflicting feelings on the issue. As a business lawyer, I want to help my clients maximize the value of the customer information they have without breaking the law or finding themselves on the front page of a newspaper with an article telling the world that they have “misused” personal information. I put “misused” in quotes to help make the point that it’s not just about “illegal” use. After all, there aren’t many ways to break American privacy law because we have so little law to break. Still, misuse as I’m using it can simply mean “offend your customer’s sensibilities.”

164

CHAPTER 8

You always want to be a good guy when it comes to privacy. I don’t know about you, but if I bought a personal item at an online pharmacy, I wouldn’t be too happy to find out that my buying habits were being bought and sold like pork bellies. Ultimately, privacy begs for comprehensive federal legislation. The thought of the Internet having 50 differing laws on privacy is a potential regulatory nightmare for companies who have an Internet presence. The costs of compliance could be astronomical, and it might even be impossible depending on what these 50 laws say. I would hate to see a day when websites have to exclude potential customers from certain states because they can’t or won’t comply with the privacy laws of that particular state. For years, many of us who have followed legislative developments in this area have thought that federal legislation was just around the corner. With the change in administrations, it now looks more likely. In an environment where Congress won’t act, states have historically taken the lead with legislation that sometimes becomes the model for federal legislation. It either works or results in a failed law that other states (or Congress) improve upon when they do act.

PRIVACY POLICY ONLINE AND OFFLINE Have you reviewed your website’s privacy policy lately? I know you didn’t post it a few years ago, when you first created your website, and forgot about it. Right? If you did, it’s time to redo it from scratch. Much has changed in the privacy arena over the last few years. The privacy policy you posted may just be a time bomb waiting to explode. The Federal Trade Commission (FTC) has made it quite clear that it will increasingly scrutinize privacy policies and bring enforcement actions. For those of us who pay attention to this area, I remember most tech lawyers were surprised by a December 2001 statement by the director of the FTC’s Consumer Protection Bureau. Before the annual meeting of the Promotional Marketing Association, he said that the FTC’s position was to consider privacy policies posted on a company’s website to represent the company’s position on privacy—both for data collected online and offline—unless the privacy policy clearly stated that it applied only to online data collection. In my experience, few privacy policies make the distinction between online and offline data collection because lawyers assumed that

PRIVACY, POLICY, AND ENCRYPTION

165

if you posted a privacy policy online, it only applied to data collected online. This policy change was like a lightning bolt from the blue. Bear in mind that online privacy policies started largely as a way to assuage the concerns of technophobic newbies to the Net who were worried about what information they might be unknowingly giving away, to who knows who, just by surfing the Net. So, privacy policies started as relatively simple documents. I think the first one I did years ago was only about a page long. These policies have gradually evolved into much lengthier documents, but still the focus has always been on the technological collection of data. Therefore, you often see lots of discussion about uniquely online concerns like cookies. Before online privacy policies were in vogue, the offline world had long-established rules, or maybe I should say it had been long established in the offline world that there were no rules. The fact was and still is that there’s almost no privacy legislation in the United States, and you could and still can largely buy and sell customer information like any other asset. If you sell a business in the offline world, you sell your customer list as a matter of routine course. After all, it’s a valuable company asset. Then came privacy policies, increased concern about digital data collected online, a push for more privacy legislation, consumers offended by how their personal information was treated like a commodity, and that brought us to where we are today. Interestingly, despite the push for increased privacy regulation in the United States, the only truly substantial pieces of recent legislation impact only the healthcare and financial worlds. I would suggest that unless your privacy policy clearly distinguishes between online and offline data collection and was written this year, it’s time to revisit it with your tech lawyer. This is an area of the law that’s evolving so fast that you should consider reviewing your privacy policy at least annually. In revisiting it, the first choice you need to make is either to clearly state that it only applies to your online data collection practices or rewrite it as a comprehensive policy to address both your online and offline privacy policies. The way to go about this is more of a business than a legal decision, but I would just point out that people are increasingly concerned about their privacy. A comprehensive privacy policy may be what it takes to make some people comfortable doing business with you. Although privacy is still largely unregulated in the United States, it doesn’t mean that your customers and potential customers aren’t

166

CHAPTER 8

concerned and sensitive about the issue. I would just suggest that from a business perspective, you might want to take the high road as a way to win and keep customers. Whatever you decide to do with your privacy policy, there is one piece of advice that you must follow. Whatever you say in your policy must be completely accurate. Although the law may not specify what your privacy policy must say, the law is clear that you must abide by whatever it is you do say. So now you have two reasons to reexamine that dusty policy you posted a long, long time ago. One, you want to make sure that you properly deal with the fact that the policy may be deemed your offline policy too—a result you probably did not intend. Two, you want to be sure that it accurately reflects your privacy practices as they exist today. This isn’t rocket science and it’s not hard to get this right. You just need to take the time and make the effort.

THE CHILDREN’S ONLINE PRIVACY ACT: THE LAW AND ITS COMPLIANCE If you control a website that collects personally identifiable information from children under the age of 13, you must ensure that your site complies with the federal statute called the Children’s Online Privacy Protection Act (COPPA) and rules enacted under COPPA. If you don’t comply, you may find your company facing hefty penalties. While there has been much talk about regulating online privacy in the United States, the reality is that the law doesn’t impose many restrictions on the ways your business can use information it collects online from surfers. There are three prominent exceptions to this generalization. The first covers financial services businesses like banks. If you’re involved with financial services, you need to consider a new federal regulatory scheme, which deals with both online and offline privacy. The second covers medical records. Health plans, healthcare clearinghouses, and healthcare providers that conduct certain financial and administrative transactions electronically have to adhere to certain strict privacy standards. The third exception involves COPPA and children. If you’re a website operator, COPPA regulates your online privacy policy, when and how you seek verifiable parental consent, and your responsibilities to protect children’s privacy and safety online.

PRIVACY, POLICY, AND ENCRYPTION

167

The first step in the compliance process is to determine if your site is directed to children. Refreshingly, the Federal Trade Commission uses a common-sense approach in its rules. It looks at the “[s]ubject matter, visual or audio content, the age of the models on the site, language, whether advertising on the web site is directed to children, information regarding the age of the actual or intended audience, and whether a site uses animated characters or other child-oriented features.” It is important to understand that COPPA applies to information, which you collect online, that would make a child individually identifiable. This information includes full name, home address, e-mail address, and telephone number, and any other information that would allow the child’s identity to be compromised or that would enable somebody to contact the child. It also includes other types of information such as hobbies, interests, and information collected through cookies (no, not the kind of cookie you eat, but rather a small text file that your web browser saves on your hard drive; it might contain personally identifiable information) and other tracking mechanisms that may be linked to information that would disclose the child’s identity. Compliance Let’s be practical here. The easiest way to comply with COPPA is to not collect information from children under the age of 13. If young children aren’t your target market (let’s say you sell retirement plans), you should include a provision in your terms of website use that either prohibits children from using your site or at least warns them not to provide any personally identifiable information. In case you’re not familiar with terms of website use, it’s the contract governing the use of your site by surfers. (You do have terms of use on your website, don’t you?) Many sites just have a link at the bottom of their home page to the terms. Of course, we all know that nobody except first-year law students (they read and analyze the back of laundry tickets, too) and people without a life (wink, wink) read them anyway. Other sites make surfers click “I Accept” to the terms before they can surf or buy things at their sites. Then, you should go a step further. On the form where you might collect personally identifiable information, you might add a box asking the surfer to certify that he is not under the age of 13. Of course, you’ll have no way to really know that the surfer is telling the truth, but if you’re not directly or indirectly gearing your site or a portion of

168

CHAPTER 8

your site to young kids, you’ll probably be fine with these procedures in place. Posting a Privacy Policy If you do gear your site or a portion of it to kids under 13, you will have to give COPPA a close look. Among other things, you’ll need to post a privacy policy. It must include specifics on the types of personal information you collect, how you’ll use the information, and whether the information will be passed on to advertisers or other third parties. You have to give parents the right to agree to the collection and use of their child’s information while also having the right to withhold consent from disclosures to third parties. You also have to give parents the right to access, review, and delete their child’s information. Parental Consent The biggest headache with COPPA compliance is the requirement of parental consent. The consent must be actual (“they gave the kid a computer, that’s consent” won’t cut it here) and obtained using methods like e-mail and old-fashioned snail mail. The method that you can use to get parental consent depends upon the way you will use the child’s information. If it’s for internal purposes only, you can use email. If you’ll be disclosing the information to third parties, you’ll need more meaningful consent, like a signature on paper or a fax. To fully understand COPPA, you’d have to set up a flowchart with arrows going in different directions depending upon your answer to different questions. It’s not that COPPA is conceptually complex, but still proper compliance requires attention to detail and can undoubtedly be expensive. You’ll have to live with that because the blow to your reputation for noncompliance along with Federal Trade Commission penalties can be far more costly than compliance. You need to be sensitive to the issues here. After all, we’re dealing with children.

PRIVACY AND THE AMAZON.COM CASE If you own an e-commerce or another type of online business, one of your most valuable assets is the information that you’ve collected about your customers. Like any business asset, you should use it to help you turn a profit. Caution is in order, though, unless you’re will-

PRIVACY, POLICY, AND ENCRYPTION

169

ing to risk having the press mercilessly attacking you. Amazon.com learned this lesson. I’ve told you that some people think the Net is like the Wild West. While it’s true in some ways, it’s also true that in many ways everybody is watching the Net like a hawk. While SallysDollShop.com can slide by in a relatively unregulated environment, if you manage a big-name website like eBay.com or CNN.com, you’re living under a microscope. One false step and the press jabs at you like you’re a bull in a bullfight. Even if you’re a lower profile company, you’re not off the hook. You still live in a world where negative publicity or even a disapproving customer buzz can cripple your bottom line. The Amazon Tale Of course, I’ve left many of you hanging since I mentioned that the press fried Amazon, but didn’t tell you why. The why is that a few years ago Amazon changed its privacy policy in a way that made privacy advocates sizzle. Here’s the most controversial part (English translation follows). “As we continue to develop our business, we might sell or buy stores or assets. In such transactions, customer information generally is one of the transferred business assets. Also, in the unlikely event that Amazon.com, Inc., or substantially all of its assets are acquired, customer information will of course be one of the transferred assets.” Simply, this means that if Amazon sells some or all of its business or goes bankrupt, it can transfer whatever it knows about its customers to whomever ends up with Amazon’s assets. So? It’s never been different. Businesses have been buying and selling business assets, including everything they know about their customers, since the first apple cart business changed hands in some place called the Garden of Eden. Having said this, I should also point out that it’s clearly not a PC (as in politically correct, not personal computer) view. The PC view says that your privacy policy should say, “We treasure the trust that you have shown us by giving us your name, telephone number, mailing and e-mail addresses. Under no circumstances will we ever reveal this information to anyone. Further, we’ll never send you an unsolicited e-mail unless we first call you at home during dinner and ask you if that would be OK.” Why is it that PC seems to care less about that really annoying telephone call? Could it be that Net businesses get unfair scrutiny?

170

CHAPTER 8

I’m a consumer too. I don’t really want my name in a database along with a comprehensive list of everything I’ve bought in every drugstore, record store, and bookstore this year either. Still, since the information is digital now and moves at Net speed, prohibiting its flow may be a bit like making it illegal for water to run downhill. I’ll go out on the not-PC limb here. I think that what Amazon.com did was reasonable and responsible. Selling its customer list as a part of some future hypothetical sale of assets is just the way it has always worked and will always work. Amazon.com isn’t the evil one here. What it did was fully and frankly disclose a universal business practice. Toysmart.com also ran afoul on this issue when it tried to sell its customer list as part of a sale of its assets. This, after it had a posted privacy policy that said, “When you register with Toysmart.com, you can rest assured that your information will never be shared with a third party.” Selling information in the face of this explicit assurance is wrong. (I have my PC moments in this area.) Post Your Privacy Policy If you’re responsible for a website that collects information about web surfers, you should prominently post a privacy policy. It should include a clear disclosure of what information you collect, what you do with it, how you keep it secure, how customers can see the information you have, what choices they have about how you can use it, how they can fix incorrect information, and with whom you share the information. The bad news is that the law is a bit unclear when it comes to where some of the lines are as to how you can legitimately use your customer’s information. At the same time, this same uncertainty is the good news. The political issue of what the law should be is an interesting question, but not the one your business needs to concern itself with today. For now, work with the broad parameters the law gives you and maximize the value of the information assets you possess. Furthermore, you should closely watch the law, and the outside parameters of political correctness, as it develops so that you maximize your profit while not finding yourself at the ugly end of bad publicity. He who walks the fine line just right can win this game as the rules quickly evolve.

E-SIGNATURES AND SAFETY As businesses have increased the use of electronic records and contracts, one practical problem has been that you can’t use a pen to sign

PRIVACY, POLICY, AND ENCRYPTION

171

a computer screen. (Well, technically you can sign the screen, but then you’d have to put the whole monitor in the file cabinet.) The good news for business is that now you have some legislation that will make it easier for you to use electronic signatures as a substitute for that quaint pen and ink John Hancock. The idea of e-signatures as a substitute for traditional signatures isn’t really a new idea at all. Several good technologies to implement e-signatures have been available for a while. The problem has been that while it made logical sense that an electronic record of a person’s assent to an agreement should be valid, legal, and binding, the law hasn’t necessarily been there to confirm the logic. While tech lawyers have generally been able to conduct a long-winded analysis that ended with “the e-signature was probably valid,” “probably” is not always good enough. Would you close a million-dollar deal on “probably?” With the new legislation, the answer is that an e-signature is as good as a pen and paper signature. The “probably” is now gone. The Law In June 2000, Congress passed the Federal Electronic Signatures in Global and National Commerce Act (E-Sign). E-Sign creates two general rules. The first is that “a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form.” The second is that “a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation.” In plain English, the result of these two rules is that we now have a federal law that validates e-signatures. Generally, E-Sign doesn’t affect any requirement imposed by any other law. It’s a narrow law that only deals with validating e-signatures. Importantly, what E-sign doesn’t do is require any person or organization to agree to use or accept electronic records or electronic signatures, other than some governmental agencies. Consumer Protection As you might expect, consumers get some special protection under this law. If a law requires that information be made available to a consumer in writing, the use of an electronic record to make it available is allowed only if the consumer has consented to receiving an e-notice

172

CHAPTER 8

and if the consumer, before consenting, was provided with a specific notice required by E-Sign. The notice deals with things like an option to receive the information on paper, how to withdraw consent, and how to obtain a paper copy. One of the more interesting requirements is that a consumer must consent “electronically—in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used to provide the information that is the subject of the consent.” This is a crucial consumer protection provision. It’s designed to prevent a consumer from signing a paper form, which, in its fine print, has a consent to receive e-documents in a form that a consumer may not be able to read. If you’re at all inclined to begin using electronic documents and contracts in your business, E-Sign is the most welcome thing to come your way in a long time. It’s an open invitation to take your business methods into the twenty-first century. While E-Sign is a big boost for e-signatures and e-documents, there still may be some conflicts with state law that you need to closely examine. But my take on this is that it’s now safe to rely on e-signatures in business. While there are more requirements when you’re dealing with consumers than other businesses, you can now use e-signatures with consumers. Just be sure that you’re well informed about the requirements of the legal landscape before you jump in.

ENCRYPTION AND E-COMMERCE Without encryption, e-commerce is nearly impossible. When you buy something online and use a “secure server,” this means that your private information is being encrypted before it’s sent over the Internet. Similarly, when you do Internet banking, your bank uses encryption to make your private financial information unreadable to anyone, but your bank. Encryption is a set of complex mathematical formulae that permits anyone transmitting electronic information to scramble the message so that only the intended recipient can decode and thus understand it. Encryption is essential for e-commerce because e-commerce largely takes place over the Internet, which is an open network. As a practical matter, this means that somebody other than the intended recipient of your information can intercept and read it. Encryption protects your credit card number and all other private information you send.

PRIVACY, POLICY, AND ENCRYPTION

173

There are several ways to learn whether your browser is encrypting your information. For example, when you purchase something online with a browser, if the picture of a lock in the lower left-hand corner is in the locked position with a glow around it, you’re using encryption. You can also look at the Internet address of where your browser is. If it starts with “https” instead of just “http,” it means that you’re using a secure server that uses encryption. The Inner Workings of Encryption The basic concept of how you encrypt information is simple. You use a computer program, which uses an encryption algorithm (essentially a mathematical equation). This algorithm or equation converts the intended data (confidential files, credit card number, etc.) into an encoded message using a key (think of the key as your password for decoding or deciphering the message). The result of the encryption process is that your plain text message comes out the other end unreadable because it looks like gibberish. Encryption comes in two basic flavors. One uses a single key (or password) and the other uses dual keys. With single key encryption, you use the key to encode information, which you then send to your intended recipient. Your recipient then uses this same key to decipher the encrypted message. This means that you have to share the secret key with the recipient. The biggest problem with this is that you need a secure way to share the key. This limits the usefulness of single key encryption in e-commerce because it’s rarely practical to whisper the key into someone’s ear when you’re doing business online. Dual key encryption is the fuel of e-commerce. With this system, you have two mathematically related keys at work. One key is called your public key and the other key is called your private key. Your public key is a key that you can and should announce to the world. You can post it on your website and put it in an ad in the New York Times if you like. It’s not a secret. When somebody wants to send you a confidential message that only you should read, they encrypt it using your public key. If you want to send your credit card number to ReputableMerchant.com, your browser might encrypt it using ReputableMerchant.com’s public key. The interesting part of this is that if a thief intercepts your credit card number over the Internet and tries to decode it using ReputableMerchant.com’s public key, it won’t work. The beauty of a dual key system is that the public key is a one-way key. It encrypts information,

174

CHAPTER 8

but it won’t decrypt it. That’s why it’s not important for you to keep it a secret. When ReputableMerchant.com is ready to read your credit card number, its software will use ReputableMerchant.com’s private key to decrypt or decode the information. The private key is the key that must remain absolutely secret. It’s the one that lets recipients read messages intended only for them that were encrypted using their public key. The Politics of Encryption While strong encryption is essential for e-commerce, the U.S. government has traditionally been a world leader in encouraging encryption controls around the world. It has used economic and political pressure on other countries to encourage them to adopt restrictive policies. The problem is that while encryption is good for e-commerce, it’s also good for criminals and espionage. After all, it’s more difficult to convict a bookie of bookmaking if the books are encrypted. A few years ago, the Electronic Privacy Information Center (www.epic.org) did a survey on encryption laws in other countries. In commenting on domestic controls, it said, “Most countries do not restrict the domestic use of encryption by their citizens. Of the handful of countries around the world that do, few are democracies and most have strong authoritarian governments. The countries include Belarus, China, Israel, Kazakhstan, Pakistan, Russia, Singapore, Tunisia, Vietnam, and Venezuela. In many of those countries, the controls do not appear to be enforced.” In the United States, there aren’t any restrictions on the manufacture, use, or sale of encryption technology within the country. We’ve treated exports quite differently. Until the end of 1996, export of encryption technology was governed by the Arms Export Control Act, which was administered by the State Department. This meant that encryption software was considered a “munition.” If you wanted to export it, the same laws that regulated nuclear missiles and tanks regulated you. Since then, there has been a trend toward liberalizing those export restrictions. It’s a trend that culminated in a White House announcement that said that export controls would be largely eliminated. The change will greatly simplify the Commerce Department’s complex licensing requirements for the export of encryption software. A ban on exporting encryption technology to terrorist countries like Iran, Iraq, Libya, Syria, Sudan, North Korea, and Cuba will remain.

PRIVACY, POLICY, AND ENCRYPTION

175

This policy change finally recognizes that while we can limit the export of strong encryption products from the United States, we can’t change the fact that other countries already have strong encryption software. This policy only served to hurt American companies that couldn’t compete in the global marketplace with others who had and could sell strong encryption software.

THE PAYMENT CARD INDUSTRY DATA SECURITY STANDARD Credit card security has come a long way from the days when a bored clerk ran your card through the credit card slider to make an impression. There’d be a copy for you, a copy for them, and “mystery copies” going who knows where. And let’s not forget the carbons that dropped out as the clerk ripped apart the credit card slip, which were immediately dropped into the trash without any shredding. Fortunately for all of us credit card fraud took a lot of work back then, often involving dumpster diving. Times have changed. While you often still have to deal with bored sales clerks, unless the power or data connection is down, odds are they won’t take an impression of your card. We’ve advanced to sliding the cards ourselves, or tapping our card if it has the right chip imbedded inside. And those carbons are ancient history. As we all know, accompanying the advances in technology has been an explosion in identity theft, online fraud, and database breaches. Data security is on the minds of everyone and a variety of government and industry efforts have been enacted recently to protect credit card data. You’ve probably heard of government efforts such as Gramm-Leach-Bliley, HIPAA, and Sarbanes-Oxley. Now I’d like to discuss another compliance program, this one created by the private sector. Originally individual card companies had their own security programs designed to protect consumers by requiring companies to meet minimum levels of security when dealing with consumer data. The companies wanted merchants and other companies accepting credit cards to protect the account numbers, expiration dates, and other card data. However, a few years ago a few of the major card companies came together and combined their efforts. The Payment Card Industry Security Standards Council (PCI SSC; www.pcisecuritystandards.org/) has come up with a new card industry standard for companies that handle credit card data. The council is an independent standards body originally formed by five major

176

CHAPTER 8

card companies: American Express, Discover Financial Services, JCP Co, MasterCard Worldwide, and Visa International. PCI SSC took the technical and operational security programs, policies, and best practices developed by major credit card companies and combined them to create the new Payment Card Industry Data Security Standard (PCI DSS). The council designed PCI DSS to prevent electronic and paper theft of cardholder data before, during, and after card transactions. The PCI DSS governs all merchants and organizations that store, process, or transmit cardholder payment data. This new standard, coming down as it did from PCI SSC and major card companies without much (if any) input from merchants has not been met with universal acclaim. Some merchants think that what the card companies are really doing is transferring the risk of data breaches from the card companies to the merchants. By establishing a minimum set of standards the industry can point to its standard and attempt to focus the liability and PR fallout on the merchants who are holding the data and suffered the breach. This criticism is fair, but merchants do have a duty to protect card data. Merchants must be PCI DSS compliant or risk losing their ability to process card payments, being audited, or incurring fines. All merchants need to be PCI DSS compliant regardless of size. Compliance is mandated by the card companies and not the council, and of course, the individual card brands handle compliance differently. Methods of validating compliance vary. Merchants should check the PCI SSC website (www.pcisecuritystandards.org/) and their own card brand or bank for more details. There’s also an industry of payment card experts, auditors, and trainers out there. Deadlines for compliance have already passed, so the council suggests that merchants check with their card company or bank to see if any specific deadlines apply to them. Merchants also need to check with their card company about penalties for noncompliance. Penalties include fines, increased transaction rates, and exclusion from processing card transactions. Merchants were initially slow in complying with the PCI DSS, but rates of compliance are increasing. Part of the problem has been the view by some that since PCI DSS is a private standard it lacks strong enforcement powers. I’m not sure how valid that criticism is. It seems to me that if you lose the ability to process credit card transactions, that’s a pretty strong remedy. Have you noticed the blank expression on people’s faces when you tell them you only take cash? Lose the ability to take cards and you’ll lose customers.

PRIVACY, POLICY, AND ENCRYPTION

177

Another reason for slow compliance has been that merchants have to cover the costs of satisfying the PCI DSS. For merchants with lax or nonexistent security, there’s likely to be a significant investment of time and money required to get things compliant. And it’s tough to quantify if a merchant will ever see a direct return on her investment. I’d like to suggest that you shouldn’t think of the PCI DSS as an additional burden for your company. Instead, consider it another security tool in your security plan. The council’s standard actually provides you with a lot of good network security information you can incorporate into your own security plan, and it can be used as a starting point in creating a new security plan. The PCI DSS specifies 12 requirements for compliance that are broken down into six “control objectives.” The control objectives and requirements are briefly described below. Space here is limited, so I strongly urge you to read the details on each of the objectives and requirements as set forth in the PCI DSS since each of the 12 requirements contains important additional details. The current version of the PCI DSS is available at www.pcisecuritystandards.org/ security_standards/pci_dss.shtml. Build and Maintain a Secure Network Requirement 1: Install and maintain a firewall configuration to protect cardholder data. Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters. Protect Cardholder Data Requirement 3: Protect stored cardholder data. Requirement 4: Encrypt transmission of cardholder data across open, public networks. Maintain a Vulnerability Management Program Requirement 5: Use and regularly update antivirus software. Requirement 6: Develop and maintain secure systems and applications. Implement Strong Access Control Measures Requirement 7: Restrict access to cardholder data on a business need-to-know basis.

178

CHAPTER 8

Requirement 8: Assign a unique ID to each person with computer access. Requirement 9: Restrict physical access to cardholder data. Regularly Monitor and Test Networks Requirement 10: Track and monitor all access to network resources and cardholder data. Requirement 11: Regularly test security systems and processes. Maintain an Information Security Policy Requirement 12: Maintain a policy that addresses information security. This last requirement represents the latest standard, and the current version of the PCI DSS (v 1.2) was last updated in October 2008. Keep in mind that the PCI DSS is a set of minimum standards; you can always go above and beyond in protecting card data. If you’re willing to invest the time and money to come up with additional measures beyond the council’s minimum standards, they’re not going to complain. Take a look at your current security plan. You do have one, right? Odds are your current plan needs only minor tweaks to satisfy the PCI DSS. PCI DSS is not perfect. It’s only designed to prevent electronic and paper theft of card data—it does not prevent skimming and other forms of fraud. It also is not designed to police the Internet or be some sort of universal standard. Implementing these standards is good for business in this age of credit card theft.

9

Negotiations Policies, Procedures, and Suggestions

THE ART OF NEGOTIATION: IMPROVING NEGOTIATING SKILLS ONLINE AND BEYOND As a tech lawyer, the thing I do more than anything else is negotiate. Almost every time I take a phone call or meet with somebody, I’m negotiating something. Most people are so unskilled at it that sometimes it feels like taking candy from a baby. Getting Ready It starts with preparation. Take the time to decide what you want and then chart a course for getting there. You rarely want to start by putting everything you need on the table. It’s naive to think that there won’t be give and take during the negotiating process. You should also learn everything you can about the other side and the people representing the other side. The more you know about them, the more likely it is that you’ll be able to satisfy their needs while taking care of your own. In a complex negotiation, where you might have 100 or more points to hash out, you’ll want to be sure to mix it up by discussing crucial points in between things you can give away. Resist the temptation to get the important stuff out of the way first. In a negotiation, “information is power” is a cliché—and it’s also absolutely true. Strategic information (in fact, any information) is something you should only give away parsimoniously and then only when you get some information back as a quid pro quo.

179

180

CHAPTER 9

Sometimes I’ll start a negotiation by saying, “Let’s get the stuff that’s really important to you first.” It’s often a good tactic because I’m making them feel loved while getting them to give me crucial information about their big issues. It’s likely that until they were done telling me about the “important stuff,” I didn’t have an accurate picture of their agenda. With this true picture of the other side’s big issues, the game begins. With these crucial issues identified, I now know the areas I’ll have to give the most on. That’s fine, but I’m going to make them stomach the things that are important to me in return for giving them what’s important to them. Or maybe I won’t. I might keep them off balance by linking my little issues up to their big issues. If I do it this way, when that round is over, I’ve now given on issues I had to give on anyway and scored on lots of smaller issues. What is now left are my big issues. With some dancing, I might be able to win on those points without having to give too much back— because other items they might hope to trade off on were already put to bed earlier in the negotiation. While this may be a legitimate example of how a negotiation might proceed, it’s also a gross oversimplification of the dynamic of a complex business negotiation. For one thing, when there are a hundred points on the table, a skilled negotiator never falls into the trap of agreeing that he can never revisit earlier points. You shouldn’t visualize your negotiation as a linear progression from one point to the next. Rather, a negotiation is arrows pointed in all directions linking points in the most unexpected ways. If you have to give on a particular point, then push back on something, maybe even something you had given on earlier. Never give without getting something back. Be Quiet People love to hear themselves talk, but a skillful negotiator listens. When you walk into that conference room to negotiate your big deal, or take that phone call to discuss your little deal, you already know what it is that you want. It’s not important to make sure the other side instantly knows that. What’s important is that you learn their agenda and their needs. You have to get inside their heads, and this requires listening. Early in a negotiating session, you should ask open-ended questions and just listen. If you want to interrupt, don’t. Let them talk.

NEGOTIATIONS

181

The more you listen, the more you learn. I can’t emphasize this point enough. As we walk into a conference room, I’ll often remind my client to listen. He assures me that he will listen. Then, no sooner are we done shaking hands and talking about the weather, and my client won’t shut up. Get the Pepto Bismol. He has diarrhea of the mouth. It’s like a manager telling a boxer, “Jab, jab, jab.” But as soon as the bell rings he’s out there flailing wildly. You have to take the game plan into the game. Write yourself a note if you have to. “Listen! Don’t talk. Never interrupt.” As you work on improving your negotiating skills, remember that it begins with preparing, developing a game plan, listening a whole lot, and talking very little. If you can just start with that, you’ll be a muchimproved negotiator.

MORE ON THE ART OF NEGOTIATION Let’s start with the situation where you need something in the deal that you know will give the other side heartburn. Let’s say you’re a smaller software developer who creates custom software with a hefty price tag. Normally, you give your customers on-site service with a fast response time. In fact, central to your reputation in the industry is your reputation for support. Of course, you’re able to do what you do by selling only within 100 miles of your office. Now, you’re discussing selling your product to a company that’s 3,000 miles away. You want the sale, but to do it you’re going to have to sell the other side on the “outrageous” (from their perspective) idea that you’ll provide support by telephone and by tying into their system remotely. What is one to do? Drop the Big Idea Early Sometimes the answer is to drop the idea early, let them vent about how outrageous the thought is and then move along to other issues, promising to resolve this one later. This often works because time works wonders. The idea is that if you’re going to propose an outrageous idea, do it early in the negotiations and then move on. It’s an amazing thing but my experience has been that the mere passage of time helps it go down better than last week’s tuna fish. I think it has something to do with “precedent.” The problem with your idea was that it was unprecedented. You’re known for your incredible response

182

CHAPTER 9

times with a live body and now you’re suggesting (drum roll please) “telephone tech support only.” A month later, as you’re progressing toward the final details of your deal, a funny thing will have happened with the concept of telephone tech support. It will no longer be a new and unprecedented idea. It will be an idea that they’ve heard before, albeit from you, but still it’s no longer a new idea. The result is that the idea will often be more palatable. It’s ironic that time can have this magical power. Then again, when you consider the magical power time can have in helping us cope with whatever it is that life throws at us, this use of the “mere passage of time,” and the dramatic results I’m suggesting you can get as a negotiator, seems trivial. This is an example of why you can’t usually effectively compress negotiations into an arbitrarily short time. Time itself is a part of the process. If you ignore this truism, you may risk a poor result. The Nibble The flip side of dropping a bombshell on the other side early is nibbling late. The more time, effort, and money the other side invests in you, the more they want and need to do the deal with you. Nobody wants to spend weeks working a deal and lose it right at the end. Drop the big ones early, but then you should save some little stuff for some nibbles at the end. Let’s say you’re buying 1,000 desktop computers for your company and they’re proposing 200-gigabyte hard drives. You know you need at least 300 gigs. If you bring this issue to the fore early, you’re likely to find yourself paying “retail” for the difference in cost. Mention it when your pen is about a millimeter from the paper and you may find that they’ll just give you the bigger hard drives at their wholesale cost. (Nibbles are often delivered with that innocuous “Oh, by the way” lead-in like, “Oh, by the way, it turns out we really need 300-gig hard drives and I can’t spend more than this.”) I will say this about nibbling. While it’s often effective, you win few friends doing it. I don’t recommend it when you intend an ongoing relationship, but it may fit your needs when negotiating a one-time deal. It Can Be Win-Win In a negotiation, you should never lose sight of the fact that you’re usually negotiating more than money. If it will be a long-term deal,

NEGOTIATIONS

183

never forget that you need to live with these people long after you sign the contract. A nibble, although a time-honored and legitimate tactic, is probably not one you should use as you finish negotiating an employment contract. Then again, it might be a perfect way to get something like that long-planned family vacation, which will happen to fall one month after you start, although the normal policy is no vacations for the first six months. The overriding point is that negotiation isn’t war or litigation (government-sanctioned legalized warfare). It’s a process that should end in a deal that’s a compromise of everybody’s initial positions. Give and you’ll get. Avoid phrases like, “This is a deal point,” or “This is not negotiable.” Speak softly. State your points gently. When the other side raises the pitch, you lower it. Remember that negotiating isn’t a science. Rather, it’s an art honed by experience. Still, by studying this art and learning for the experience of others, you’ll improve faster.

MORE NEGOTIATING POWER Whether it’s a tech deal, a lawsuit, or any other type of business deal, you’re going to need to bring the same negotiating skills to the table. Telephone Talks Negotiating a deal by telephone is practical and can be effective for simple deals that aren’t important to you. As for complex and important matters, my advice on negotiating by telephone is simple and easy: don’t. I’m hard-pressed to imagine anything less effective than amorphous voices on a speakerphone trying to negotiate a complex deal. It’s slow. It’s ponderous. Moreover, it’s ineffective. The upsides of the telephone are probably limited to two. One is that it’s easier to arrange a telephone call than a meeting. The second is that you save money by negotiating by telephone rather than in person. While the first one is undoubtedly true, the second one may be an illusion. While you may save on the front end by reducing your travel expenses, you may cost yourself money in the long run. The problem with the telephone starts with losing all your visual cues. You can’t see the other person’s body language or eyes. If you’re good at reading people, those signs can be more important than what

184

CHAPTER 9

they say. I also find that it’s easier for people to say no and be obstinate on the phone. Maybe that flows from the distance the telephone brings. There’s just something about looking somebody in the eyes that brings people together. The telephone also fosters less focus. If you call a meeting, you monopolize everyone’s attention. This usually helps to move the deal. The advantages of this focus may even offset the additional time that it may take to organize a meeting. Yet another problem with the telephone is that you lose the ability to have back-channel communication. When I’m sitting next to my client, it’s easy to write notes or simply walk out of the room for a private discussion. On the telephone, people seem to forget about how important that back channel can be. This one can be easier to overcome than some of the other problems with telephone negotiations. Sometimes I’ll suggest that my team run AOL’s Instant Messenger while we’re on the conference call so that we can type back-channel messages to each other. It’s nice to be able to quickly type, “Don’t go in that direction,” or “Be quiet. I think they’re about to give on that point.” Your cell phone can also be a good tool to help overcome the back-channel problem. It can be as easy as walking out of the room and using it to privately discuss a point. No Authority Ever notice that when you buy a car, the “sales manager” with the authority to make the deal is invisible in some ivory tower. You talk to the salesman, who is always on your side (sort of like a pet rattlesnake) and is on the edge of being fired for giving you such a great deal. The problem is that he can’t make the deal. He can only “propose” the deal to the invisible sales manager, who always says no, as they slowly drive up the price in successive rounds of this charade. Not bringing the decision maker to the table is a monstrously effective technique. Large tech companies like IBM, Computer Associates, and Microsoft do it all the time. You bring your president and lawyer to the table to get the deal done, and they send a salesperson and paralegal. You make concessions and they take things to the ivory tower and get back to you because they don’t have authority. Don’t fall into the trap of bringing too much authority to the table. Never ever have more authority on your side of the table than the other side has. If they send a midlevel person, you send a midlevel person. When things are going too slow, if they want the deal, they’ll sug-

NEGOTIATIONS

185

gest that the decision makers meet. If they never make that suggestion, it tells you something about the importance they place on your deal. The problem with an imbalance of power is that no authority creates a situation where a person can’t give away the tough points. This leaves it to the side that brought a decision maker to the table to give away important points as both sides push to close the deal. Set your ground rules before the “big meeting” (or phone call—if you must). Make sure that you know who will participate and what authority they have. Then make sure that your side has the same or less authority than the other side. As for the next time you buy a car, my advice is when you get down to the nitty-gritty, you let your kid discuss price and walk their offers to you, while you sit in the car. When they get tired of your farce, the guy in the ivory tower will make his royal appearance. Then, it’s time to cut the deal.

NEGOTIATING TECH DEALS Tech-related deals sometimes lead to disputes just like any other type of agreement. It might be a software development deal gone sour, an outsourcing deal straight from hell, or whatever, but things go wrong. When they do, lawsuits often follow. This is your “how to” on negotiating your way out of a major dispute involving technology. Let’s start with the end and work our way forward. I’m often asked why it is that disputes tend to settle only as the trial approaches. It turns out to be a complex question that defies a simple answer. Part of it is that the parties use the discovery process (things like depositions and subpoenas) to learn about the other’s strength and weaknesses. This takes time and delays the time when the parties are ready to talk. Another issue is the purely emotional side. A lawsuit is essentially “civilized” society’s way of handling warfare between its members. (I put “civilized” in quotes because having participated in hundreds of hearings, I’ve watched many a lawyer act in a way that defies my definition of civilized.) Lawsuits are ritualized, expensive, and complex, and sometimes I think not an improvement over trial by ordeal. Part of the ceremony is that people yearn to vent before they want to talk. It’s all too human. Yet another part of the answer is the lawyers. Now, don’t get me wrong. Pure litigators are an important part of the legal profession, but so are soldiers. We need them both and they serve a purpose. Still, you

186

CHAPTER 9

won’t find too many soldiers who make great diplomats. It’s a different personality type. If you want to negotiate early and seriously, I would suggest to you that the litigator is not the lawyer you want taking the lead. Life is like that. You go to Midas Muffler and you usually walk away with a muffler. You see a surgeon and you usually walk (or roll) away with stitches. See a litigator and guess what, you’re likely to end up involved in a lawsuit. It’s not an evil conspiracy to clog the courts. It’s just a mindset. Warriors fight wars. Diplomats negotiate treaties. If I were the client, I would ask my litigator which lawyer in the firm is the best deal negotiator. Rarely is that someone in the litigation department. I would politely (honey is usually better than vinegar) ask to bring that person in to consult on negotiating a settlement. If you have a tech dispute, you want the person who is best at doing complex tech deals. Have him evaluate your situation. Then, ask your lawyers to two-track your case. What I’m suggesting with the two-track is that you simultaneously litigate and work on negotiating at the same time. Too often, lawyers handle lawsuits sequentially. The traditional sequence starts with a token effort at resolution. I say token because all too often it consists of a nasty letter that ends with “Please be governed accordingly.” In my book, that’s not exactly the language of diplomacy. Then comes the token settlement meeting or worse the quick call, which represents one last effort to settle. Next, somebody declares war. At this point, the lawsuit develops a life of its own. As the client, you need to try to short-circuit the “life of its own” part. Show strength through your litigator, but I strongly suggest a vigorous effort to settle simultaneously. The strongest objection that people will have to this advice is that by showing a willingness to negotiate early, you’re telling the other side that you think your case is weak. It sounds good, but I find that in the fog of litigation (like war), the other side really can’t get anything out of your willingness to negotiate. The ironic part is that they may be just as willing as you are to negotiate, but don’t have the skill or strategic sense to know how to make it happen. When you get them to the negotiating table, you should not expect the process to be easy. After all, you’re at war with them. Expect them to vent. And you should vent too, but let them go first. In any negotiation, I’m a big advocate for listening early and talking later. Remember that in the first hours of your negotiation, it’s more important for you to know their position. You’ll tell them yours in good time. Be a good listener, be willing to compromise (although

NEGOTIATIONS

187

you feel that you shouldn’t have to compromise), and you may just find your lawsuit behind you. It’s usually good business.

TIPS ON NEGOTIATING TECH DEALS Businesses buy technology-related goods and services all the time. Just to name a few examples, they buy the services needed to create a sophisticated e-commerce website, custom develop software, and provide technology solutions for their business. The way the parties usually handle the paperwork is that the vendor gives the customer their form and the customer signs it. After all, the form is printed so it can’t be changed. Wrong! I have two comments about those forms. One, I represent vendors as well as buyers of these services. Trust me when I tell you that if you’re the customer, you never want to accept those form contracts without changes. They’re designed to be one-sided in favor of the vendor. I write them. I know. Second, they’re almost always negotiable. The basic premise is that most customers won’t read them carefully and even fewer will take the time to really negotiate them. A smart customer sees the form as nothing more than a one-sided first offer and goes from there. Involve a Lawyer? Clearly, you can’t involve a computer lawyer every time you buy something computer related. So, how do you know when you need legal assistance? I think that you make that judgment based on what’s at stake. You have to look at the size of the contract and the importance of whatever it is that you’re buying. Essentially, I’m suggesting a quick, down and dirty cost-benefit analysis. I recommend that you start by assuming that the form contract you’re seeing was written by a skilled lawyer whose marching orders were to write a contract that gives you as little protection as possible. Next, imagine that the deal goes badly. The final step in this analysis is to assume that if you’re forced to sue under the contract that you’ll lose because the form agreement had a pro-vendor bias. How much would you lose? How bad would this scenario damage you? If the damage is more than what is an acceptable loss to you, then you need a lawyer on your side too. A problem in doing this cost-benefit analysis is that you may not know everything that you need to know to make these judgments. In

188

CHAPTER 9

that case, I suggest consulting with a lawyer to help you with your cost-benefit analysis. Some Red Flags—Damage Limitations One of the things you should always focus on is damage limitations. Be leery of clauses like, “Vendor’s liability for any loss, damage, or expense of any kind, resulting from the products or services, negligence, or any other cause whatsoever, regardless of the form of action, whether in tort or in contract, shall be limited to the selling price of the products or services.” Variations on this type of clause may limit you to six months of service charges or some predetermined, and usually low, dollar figure. Reduced to its essence, this clause says that no matter what they do to you, the most you get is a refund. So, you pay them lots of money to redo your office network, the system functions poorly, you lose lots of money and you get—a refund? It’s not fair, but if you sign a contract with a damage limitation, you may have to live with it. I say may because some courts, in some contexts, won’t enforce contracts that are too onerous. Still, in negotiating a contract, you certainly don’t want to agree to a damage limitation in the hopes that if it ever mattered, a court won’t enforce it. Some states prohibit disclaimers of responsibility for negligence in some types of contracts. The more general rule is that a party can limit its liability for ordinary negligence, but not gross negligence. Gross negligence is a difficult concept to define since it lacks a bright-line test. Generally, the concept is that gross negligence entails conduct that’s almost willful and something worse than just ordinary negligence. Limitations of Time to Sue Many agreements have provisions like “No action, regardless of form, arising out of or related to this agreement may be brought by the customer more than one year after a cause of action has arisen.” This clause and similar ones reduce the time that the law gives you to file a lawsuit. For example, most states will give you four or five years to file a breach of contract claim. This clause, which you should assume is enforceable, reduces you to one year. In my experience, this is a perfect example of a clause that’s always negotiable. It’s as simple as you taking the time to focus on it and asking for something better. I’d start by asking that the clause be deleted

NEGOTIATIONS

189

as unnecessary. The law provides for a statute of limitations and your lawyer should argue that it’s not needed. Even if they say no to that, they always agree to something more than the printed language. Even if you agree to three years instead of one, you’ve come out better. Is this significant? I can’t know that without a crystal ball. I’d have to know if a situation will ever arise where you’d need or want extra time to file a lawsuit or make a claim. The point is that you often don’t know whether what you do when you negotiate a contract will matter. When you’re negotiating, you’re often just dealing with possibilities. Sometimes you have to wait until the contract plays itself out to know whether it mattered. I don’t think that the question “Is it significant?” is the right question. Yet, that’s the one people ask. It’s as if by some magic the form becomes the starting point of what’s significant and fair. Don’t let the vendor’s form take on magical properties. It’s nothing more than their idea of what a one-sided deal should look like. I can assure you that if I ignored the vendor’s form and created a procustomer contract from scratch, it would be completely different from the vendor’s. My pro-customer contract wouldn’t even mention statute of limitations and if it did, I’d say five years instead of one. Usually, I’d be happy to live with the law’s typical four-or-five-year period. Look at how different the whole dynamic of the negotiation changes if it’s my form and the vendor is now “asking” that we reduce it to one year. It seems so unfair. Moreover, fairness not significance should be your primary focus in a negotiation. In negotiating your agreements, you must avoid that very natural tendency to see the deal’s starting point as being the vendor’s form. You should first see the deal from your one-sided perspective. What do you want and need? In a negotiation, you’re not likely to get everything you want either, but you must work to pull contracts back to the middle, that is, back to what’s fair. You shouldn’t ask for changes in a vendor’s form only after asking yourself whether the change is significant. If it’s onesided in favor of the vendor, ask that the provision be made neutral. If the vendor asks that you indemnify them for your wrongdoing, you should ask that they indemnify you for their wrongdoing. If they get attorney’s fees if they’re the prevailing party, then you should if you’re the prevailing party. If they can terminate the agreement if you sell your company, the reverse should be true. After you’ve put every unfair provision on the table, you can use the issue of significance to decide which points to give up. Certainly,

190

CHAPTER 9

not every point has equal importance to you. Just remember, what’s good for them is good for you. That’s fairness. Don’t walk into a deal thinking about how big they are. They want your business or they wouldn’t be talking to you. Sure, the Microsofts of the world budge less than the local vendor down the road, but they all bend. The only way to find out how far is to push back.

NEGOTIATING AS A TEAM If you ever saw the movie The Godfather, you may remember a scene where the godfather’s family is negotiating whether to get into the illegal narcotics business with another family. The godfather is adamantly opposed to selling drugs. However, his son Sonny (played by James Caan) chimes in and says that maybe Pop is wrong. Jump to the next scene and you have a furious Pop telling Sonny to never ever disagree with him in public again. To the outside world, they’re one family with one position. Jump ahead a few more scenes and you see an attempted assassination of the godfather. Later we learn that the motive behind the assassination was to make Sonny the family’s leader because he was willing to enter the drug trade. The godfather had it right. If you want to be effective in your negotiations, your team must have a single, unified voice. Show disharmony to the other side, and if they’re any good, they’ll use it to shear holes right through you. You start hearing things like, “Your lawyer said this is a nonnegotiable deal point, but you’re saying it isn’t.” Don’t ever do that to me or any member of your negotiating team. Don’t forget the five Ps: prior planning prevents poor performance. Before you begin negotiations, spend time planning your positions. Going in, you should know things like what you need and want, what your bottom-line positions will be, and where you’ll start. You should also choreograph who your lead speaker is and who’s playing backup to reinforce points. Also, you should agree not to hesitate to leave the room together to privately discuss any internal points of disagreement as they come up during the negotiation. Coming back to my Godfather story, the godfather’s rule is a cardinal one. Speaking now from the perspective of outside counsel who is often hired in the role of professional negotiator, and frankly usually paid quite well for the role, once my client has disagreed with me in public, I might as well go home. He’s now told the other side that a back channel around me might get them a better deal.

NEGOTIATIONS

191

It’s a simple rule and don’t ever break it. No member of the negotiating team should ever publicly disagree with another member. Period. Do it and you’re an amateur waiting to be eaten alive. Once I notice internal discord on the other side, I look for ways to have back-channel communication with the guy whose position is most favorable to my client. My goal is to make him an ally and then let him sell it to his side. Cliché time—”Divide and conquer.” Let’s say we’re buying a software company and the biggest advocate for the deal on the other side is their director of marketing. I’ll go out of my way to privately let him know that we think the marketing department is one of his company’s strengths and budget won’t be an issue under the new regime. You get the picture. It has something to do with saliva dripping from his mouth. I remember one client in particular (and this was years ago) who just didn’t get it when I talked about a united front. We were just acquiring a division of a company. The problem was that one of the human beings on the other side had the personality of a rabid dog on a bad day. This was a complex negotiation that went on for days. We would start each day with a private meeting. We’d agree on what positions the client wanted to take. I’d reiterate that we can and should evolve our positions during the course of the day as things develop, but we should do it in a unified way after a private discussion in the hallway (be careful about who might be sitting on the other side of that cubicle wall). After all, in a negotiation your position must evolve. Here’s the caveat, though. Whoever took the position that you’re changing should be the one to deliver the message about the compromise position. You emasculate your lawyer, acting in his role of professional negotiator, when you publicly modify the position he took for you. In the deal with my friend the rabid dog, I finally resigned. The client was simply incapable of effectively using a professional negotiator. It’s frustrating to privately discuss a strategy and as soon as the game begins watch a person with no stomach for the stress of a sophisticated business negotiation give it all away. They wore him out. He felt desperate to do the deal, they knew it, they played tough, and he caved in faster than a house of cards. I felt like I was coaching a little league team against the New York Yankees. The close for this section is simple. Remember the story about The Godfather.

192

CHAPTER 9

OUTSOURCING BUSINESS TECHNOLOGY If your technology company is like most (or if you’re not a tech company, but use a lot of technology in your business), you’ve probably considered outsourcing technology as an effective, cost-cutting measure. How you begin the process of deciding to outsource can be just as important as the decision to outsource itself. To that end, a good exploratory team can mean the difference between enjoying a successful outsourcing endeavor and enduring a recurring corporate nightmare. Without a doubt, one key to successful outsourcing is deciding which area of your business you want (or need) to outsource. It’s not easy and you shouldn’t do this yourself. It’s virtually impossible for you to know every aspect of your business and be fully informed about which of your departments or internal business functions are ripe for outsourcing. Building a Team First, create an exploratory team, and let the team conduct the initial investigation into the advantages and disadvantages of outsourcing a particular function. Building an exploratory team is different from simply gathering your colleagues and setting an agenda. In a perfect world, you’d approach your colleagues and ask, “Hey, who wants to help me figure out a way to outsource some of our business functions and save this company some money?” Everyone would joyfully accept your offer, and the world would be a peaceful, happy place. But, let’s get back to reality. If your company is like most, many of your employees will give you every conceivable excuse not to outsource. I predict that shortly after you make your request for volunteers, your e-mail in-box will begin to fill with messages like, “We don’t need to outsource,” or “Our work is too important to outsource.” Don’t be discouraged when this happens. It’s entirely understandable and completely predictable. After all, you may think you’re saying the word outsource, but what your employees really hear is, “You’re fired,” or “We’re looking into ways to get rid of you.” To them, outsourcing is akin to supplying them with a company shovel and asking them to dig their own corporate graves. In other words, you should expect the team selection process to be a bit rocky.

NEGOTIATIONS

193

Choosing a Leader To begin, pick a team leader. The leader will be responsible for setting the tempo and direction of the team, and serve as the team’s mouthpiece as well. It makes sense, therefore, to pick a leader who shares your vision and objective of outsourcing. Of course, this is easier said than done, because even the candidates for team leader might fear losing their jobs to outsourcers. It’s often said that for a team leader to seriously (and impartially) consider outsourcing, she should be at least two levels above the area you’re considering outsourcing. Once you’ve selected the team leader, you have to begin staffing your team with competent employees who understand the long- and short-term goals of your company. Many companies limit membership of the team to supervisors and upper-level managers—this is a big mistake. Clearly, you’ll need the input of upper-level management, because they’re in the best position to analyze high-level issues and provide guidance in areas to which most employees are not regularly exposed. However, low-level employees can help the process too. First, low-level employees often understand the day-to-day needs of your employees better than your managers. Second, by including them, your team will appear balanced and fair, instead of elitist and unresponsive. In any event, your goal should be to create a team that represents a cross-section of your company.

Outside Advisors Without question, your team should also include outside advisors, such as your company’s attorney and accountant. Outside advisors can increase the efficiency of your team by providing objective advice, and making sure the team’s goals remain within the boundaries of practicality. Also, advisors can even the playing field when it comes time to draft and review requests for proposals, or negotiate outsourcing contracts. Often it’s easier (and cheaper, I know from experience) to include advisors at the initial decision-making level, rather than bring them in after the team has drawn its conclusions or, worse, has become deadlocked. Further, if your tech lawyer brings legitimate experience in negotiating outsourcing agreements to the table, the earlier you involve him, the better. Early, he can do more to guide and nudge your deal in the direction you’ll want it to ultimately go. Later, agendas are set and the outline of the deal is established. Moving the deal in a material

194

CHAPTER 9

way after the parties have developed expectations is harder and in some cases may be impossible. Bear in mind that your experience base in negotiating outsourcing deals may be small, but hopefully your tech lawyer has been there and done this before. Everybody makes more mistakes when their experience level is low. In these situations, it’s usually wise to hire a professional to set the course in unfamiliar territory. Picking an exploratory team and negotiating your deal isn’t necessarily fun or easy. You’ll have to make some hard decisions and, at least temporarily, you’ll likely be the target of company paranoia, strife, and criticism. Nonetheless, there is no better way to explore the advantages you may reap from outsourcing than to pick the right team and forge ahead.

TIPS FOR TECH PURCHASES If you’re currently in the market for technology purchases, here are some tips that can help you ensure that you get the most for your money. Vendor Forms You should always assume that a form contract is completely negotiable. While this may not always be true for small deals, once you’re spending real money, you should presume that the form the vendor presents to you is merely a first offer. The typical scenario is that the sales folks talk to you about a few high-level points. They’ll tell you what they can create, how wonderful it will be, how it will pay for itself before you’ve even paid them, and on and on it goes. The “details” that get discussed are often not much deeper than price, delivery date, and functionality. Then comes this monster agreement filled with details nobody discussed. It never ceases to amaze me how even sophisticated business folks treat that document with reverence. It’s nothing more than their lawyer’s one-sided take on what the deal should be. As someone who drafts these contracts for vendors, trust me when I tell you that I write them assuming there will be some push back from the other side. If you don’t push back, well, let’s just say that you’re making a big mistake. Furthermore, if you don’t get help from a lawyer with lots of legitimate experience doing these types of deals,

NEGOTIATIONS

195

you’re at a tactical disadvantage and you will end up on the losing end of this negotiation. Basic Business Points At some level, the purchase agreement should correctly and clearly state the business points that you actually discussed with the vendor. Is the price as discussed? Did the understanding on features make its way from the salesperson’s mouth to your contract? If not, don’t expect to see those features because when they’re not provided, your insistance that “the salesperson said so” will be a losing plea. It’s so elementary, but you must be sure that everything you were promised makes its way to the contract. Don’t be so foolish as to accept assurances like, “Don’t worry. The contract is just a formality. We’ll do it like we promised.” Of course, it’s that sort of foolishness that keeps my litigation plate full. The Undiscussed Part Before the first draft of the contract appears, few business people fully discuss issues like limitations of liability, warranty, indemnification, and other similar issues. Business folks tend to relegate these and similar issues to the world of “lawyer’s points.” You can label them whatever you want, but they are important. Get it wrong on some of the lawyer points and you may find yourself without a meaningful remedy if your deal doesn’t pan out as you might have hoped. Not surprising, most form contracts presented by vendors have a vendor-favorable take on these lawyer points. You can always do better if you take the time to professionally negotiate your deal. It’s your money. Why should you be promised the world by a salesperson, but your agreement says you accept whatever it is the vendor delivers to you “as is.” That’s not a warranty, folks. Why is it that the agreement limits their liability to you in case of a dispute to whatever it is you paid them? In plain English, that means that no matter what they do to you and no matter how bad it is, the most you get is a refund. Moreover, why is it that they get a limitation of liability, but you don’t? A typical vendor-provided form agreement has pages and pages of one-sided protection for the vendor. I’ll typically negotiate to either remove these provisions or make them apply to both parties. The old cliché should apply: “What’s good for the goose is good for the gander.”

196

CHAPTER 9

It Takes Time One of the things vendors count on during negotiations is that the buyer is more anxious to consummate the deal than they are. Car dealers depend on the same thing to put you at a disadvantage during negotiations. Don’t fall into the trap. You must clearly communicate to your vendor that you’re not in a rush to sign anything. You’ll sign when the contract is right and not one minute before. Just that small bit of posturing can help level the playing field. Any smart negotiator will use time against you if he can. Don’t fall victim to it. Then you need to manage your own expectations. Technology deals simply take time to properly document in a contract. The deals tend to be complex and there is no magical one-size-fits-all form.

KEEP TECH LAWYER ON THE COMPANY TEAM You signed your big deal. Next, you pop the corks, thank your tech lawyer for his great work, and send him home. The legal part is mercifully over and now you can get back to business sans lawyers. Sorry, but it’s the wrong approach in tech deals, and in any big deal of any kind. You must keep the team intact and functioning. Once you sign your agreement, you should begin the process of managing the deal. If you don’t manage it, then your vendor will. I would point out that it should be obvious that you may not have overlapping priorities. It doesn’t matter if the deal was custom software modification, implementing a new network for your company, an overhaul of your website, or whatever. If you manage the project right, you’ll maximize the value of whatever it is you bought. You took the time to put together a team to decide what it is you needed, you evaluated several companies, and you spent time negotiating your deal. One common mistake I see all the time is that at this point many businesses dismantle the deal team because it’s “done.” Well, as Yogi Berra said (and if he didn’t say it, he should have), “It ain’t over til it’s over.” Don’t dismantle the team! There’s no one-size-fits-all formula here, but the idea I’m floating is that your team must stay together throughout the implementation phase. You might need a weekly meeting or just a monthly conference call among your team members, but whatever, you need to manage the process.

NEGOTIATIONS

197

You want your team to give you input on issues like this: “Are you getting the service levels required by your agreement?” “Are you receiving the required status reports from your vendor?” and “Are they meeting deadlines?” In the broadest sense, you want to know if your vendor is complying with the terms of the agreement. All too often, I see many companies not doing as I suggest here. Rather, they deal with issues like this through crisis management. They tend to be reactive instead of proactive. Only when the situation gets ugly do they reassemble the team and try to reel the vendor back in. I know from my role as outside counsel that some of my clients don’t take this advice. Once the corks pop, I’m out of it unless and until the parties are staring down the barrel of a rifle. Then, I’m asked to fix it before there’s a war. It should be obvious that it’s much harder to fix a problem than prevent it. If your vendor’s performance isn’t up to what they agreed to provide, it’s so much easier to deal with the issue amicably when it’s identified in your routine monthly meeting and immediately brought to your vendor’s attention (rather than if it’s allowed to go on for a lengthy period because nobody is minding your deal). Beyond the issue of identifying minor problems while they’re still minor, another issue is properly documenting the issue in the way required by your agreement. I’ve litigated too many cases in my time as a lawyer where I was up against a contract that says that my client should have sent a written notice of a problem within 15 days and they didn’t. They didn’t because while they might have been doing a reactive, so-so (at best) job of managing the business relationship, nobody was minding the legal side. It’s asinine when you consider a company jeopardizing any legal remedies it might have in a deal because it didn’t want to budget one hour per month for its tech lawyer to participate in monthly team meetings by conference call. Crazy. Moreover, it’s not really about “legal remedies.” If we’re talking about legal remedies, we’re talking about a seriously ill deal. Actually, what we’re talking about is the concept best expressed by the line from Robert Frost, “Good fences make good neighbors.” As much as you want to have an informal, “Can’t we all just be friends?” relationship with your vendor, experience tells me that some level of formality is a good thing. Wait for the relationship to deteriorate before you reinvolve your lawyer and an e-mail from me to your vendor is like moving your military to a higher state of alert. The better approach is that when you notice a minor problem during your first monthly meeting, you have your lawyer send a formal

198

CHAPTER 9

notice as required by the agreement you spent days or weeks negotiating. Now, that same e-mail, and others that follow, are more like a routine diplomatic exchange. So often business folks are reticent to send that formal notice. Don’t be. It’s the procedure everybody agreed to in the agreement, so use it. If you don’t, you may unintentionally waive rights you had under the agreement and send the message to the vendor that you’ll let things slide. The right message is, “We’re watching closely, we expect you to do what you said you would do exactly as you said you would—and in return, you’ll just love how our progress payments arrive like magic— right on time.”

10

History, Background, Thoughts, and Legal Considerations

VOTING OVER THE INTERNET We’ve all heard the jokes about how Florida handled the 2000 presidential election. You know the ones like, “How come them old folks can do eight bingo cards at one time, but can’t handle one ballot?” One solution suggested to the problems created by our antiquated voting system is voting over the Internet. The problem is that it’s just not ready for prime time. (If you keep reading, I promise that you won’t see anything about hanging or pregnant you-know-whats.) Clearly, Internet voting could be an improvement over a lot of methods now used throughout the country and light-years ahead of the punch cards that we used in South Florida. Just as clear is that Internet voting is rife with its own legal and practical problems. Political science types (yes, I was a political science not computer science major before law school) list at least five key attributes to ensure a free and fair election. Take a deep breath, and here’s the list: transparency, security, secrecy, timeliness, and equity. Any reasonable method used at a public polling place wins on transparency compared with Internet voting. Voting is “transparent” when partisans can watch ballots from the moment that they’re issued to the moment they’re counted. While computerized audit trails may someday serve this purpose, the issue of security causes people not to trust computerized audit trails. Today, we live in a world where we regularly read stories about major companies and government agencies being victimized by hacking and other types of computer crime. This doesn’t exactly engender trust in the idea of using the Internet to choose a president.

199

200

CHAPTER 10

Another big security issue is ensuring that the Internet voter is who he or she purports to be. In Chicago, they used to say, “Vote early and often.” Unless we solve the security issues with Internet voting, we might have to change that to “Vote early and remember that your computer doesn’t need to stop for bathroom breaks.” Secrecy is a tough one. Computers are all about retaining information. If you vote online, the simple fact is that it may be possible for somebody to trace your vote back to you. Still, if you take “secrecy” to its logical extreme, you could point out that your ballot card has your fingerprints on it. The Internet is a winner when it comes to timeliness. It was a bad joke to think that in 2000 we had to wait 10 days after Election Day to total the foreign absentee ballots. With Internet voting, votes will be instantly cast and counted. For many people, equity is a big hurdle with Internet voting. I think it’s a red herring. Here, we get into digital divide issues about how less advantaged people have less access to computers. While that’s true, they also have less access to cars to drive to voting places. Life is never perfectly fair. No matter what system we use for voting, it will always be better for one group than another. Internet voting may help the homebound and disabled while not helping the poor or those who choose not to own computers. No matter the system, we’ll need to have more than one way to vote because no system is perfect for everybody. Nationally, we rely today on some odd mix of punch cards, voting machines, handwritten ballots, computers, mail-in ballots, and other methods. Maybe part of the answer is to make Internet voting an option, but not a requirement. If we did that, we could certainly reduce the number of physical polling places while making use of the latest technology. Now that I’ve discussed some of the many flaws with an Internet-based voting system, the obvious question becomes, what do we do to improve voting methods? Of course, the answer is—use the Internet. I’m convinced that we can solve all the problems with online voting to our reasonable satisfaction. I emphasize the word reasonable because no system is perfect and all too often, we refuse to adopt a computerized system to replace a traditional system because the high-tech solution isn’t perfect. Well, the traditional system isn’t perfect either. While new systems often create new problems, we should adopt new systems whenever they provide a cost-effective net improvement over the old way.

HISTORY, BACKGROUND,THOUGHTS

201

Do you think that most people will be voting from home in 2050? I suspect that most people believe that they will. If that’s the case, I’d like to suggest that we invest the money to develop those improved systems sooner and not later.

NANOTECHNOLOGY Nanotechnology is the science of very small things and I mean very small. Like every new technology that preceded it, the development of the law surrounding nanotechnology is well behind the advances in the technology. The law in this area is where Internet law was in 1995. It fills only a pamphlet. According to the Nanobusiness Alliance, a more precise definition of nanotechnology is “the ability to do things—measure, see, predict and make—on the scale of atoms and molecules. Traditionally, the nanotechnology realm is defined as being between 0.1 and 100 nanometers, a nanometer being one thousandth of a micron (micrometer), which is, in turn, one thousandth of a millimeter.” Some speculate that nanotechnology, or simply nanotech, may be the next big thing in the world of technology, following a list that includes the industrial revolution, atomic energy, computers, space, the Internet, and now, nanotech. To help you understand just how small is small, consider this: a nanometer is one-billionth of a meter, which is approximately 1/80,000 the width of a human hair and 10 times the diameter of a hydrogen atom. The size of a nanometer relative to the width of the human hair is comparable to relating 6.5 feet to 100 miles. A nanometer is roughly the width of four atoms. With nanotech, we’re talking about working on the atomic and molecular level to create things that have unique chemical, physical, and biological properties because of their nano size. In a sense, nanotechnology mirrors the workings of living cells, which manufacture with atomic precision. Nanotech cuts across many disciplines, including chemistry, physics, biology, computer science, and engineering. It’s gone from Star Trek to an industry that receives more than $500,000,000 a year from the U.S. government. If you think that nanotech is just hype, consider that companies like IBM, Hewlett-Packard, Texas Instruments, General Motors, General Electric, Siemens, Intel, Hitachi, and Dow are involved in nanotechnology R&D. Furthermore, the U.S. is getting stiff foreign competition from the usual suspects including Japan, the European Union,

202

CHAPTER 10

Russia, Korea, and China. Unfortunately, some believe that they are ahead of the U.S. in some ways. Also, President Bush’s 2004 budget provided $847 million for the multiagency National Nanotechnology Initiative (NNI). This was a 9.5 percent increase over 2003. According to the president’s Office of Science and Technology Policy (OSTP), this money would “advance fundamental understanding of the nanoscale phenomena—unique properties of matter that occur at the level of clusters of atoms and molecules. This increased understanding promises to underlie revolutionary advances that will contribute to improvements in medicine, manufacturing, high-performance materials, information technology, and environmental technologies.” Interestingly, the most significant increases were for the Department of Energy (DOE) and the National Science Foundation (NSF). According to the OSTP, “NSF continues to have the largest share of federal nanotechnology funding, reflecting the broad mission of NSF in supporting fundamental research across all disciplines of science and engineering. The request for DOE’s nanotechnology program reflects, in part, the development of five geographically distributed user centers.” The OSTP goes on to say that examples of notable achievements include “the development of single molecule electron devices, molecular motors, nanoscale fabrication using atomic force microprobes, micro-cantilevers to detect proteins, and enhanced medical imaging using nanoparticle-based probes.” It’s not just Star Trek and science fiction anymore. There have been a few legislative efforts to focus policy-making attention on the area of nanotech. That has to be a good idea when there has really been so little focus on the many issues raised by nanotech. The issues raised start at the ethical and moral, and work their way right into legal issues. For example, if nanotech could allow us to go into genes and fix them to prevent disease, is it OK to go into genes to “improve” genes that have no obvious problems? You then go from the high-level ethical, moral, and legal issues right into practical business issues. As lawyers inevitably get involved in what will undoubtedly be a high-stakes business, all sorts of patent, copyright, health, safety, environmental, and other legal issues arise. Then once you create the nanotech devices, you have business issues involving turning the devices into profitable inventions and businesses.

HISTORY, BACKGROUND,THOUGHTS

203

As this all goes from science fiction to reality, I look forward to negotiating more and more of the licensing and technology transfer deals that will certainly arise.

STARTING A BUSINESS Having practiced law for more than 26 years and after doing this tech law thing for most of those years, I’ve seen my share of economic cycles. The list of tech products and businesses that have come and gone since the ‘70s is long and illustrious. Some disappeared, some merged into something else, and some are still around, but they may as well have disappeared. Remember Central Point’s PC Tools? It used to compete with Norton Utilities. Do you remember Zeos? They sold mailorder computers before Michael Dell was a household name. We all watched the tech marketplace prove Newton right again as it fell precipitously. In the late ‘90s and into the twenty-first century, while the price for computer hardware dropped like a brick, the price for services rose. Things changed quickly. In the mid ‘90s, web development was cheap because everyone was new at it and trying to develop a portfolio. In the late ‘90s, major web development could easily get you into the six and seven figures. Demand was high, skilled programmers were in short supply, and it was a seller’s market. For a while, it seemed that nobody but a dot-com could afford a Super Bowl commercial. Then, it all crashed and burned. In the early 2000s, one kind of deal I saw a lot is what I called salvage deals. The survivors of the tech sector’s debacle started doing deals they couldn’t possibly do at the top of the cycle. Often, they bought the tottering remains of start-ups from the mania period or jumped into deals where they replaced some failed tech company—but this time on business terms that made sense. And this time many of those companies doing salvage deals survived and became profitable. Website and software development has again become affordable. Guess what—the web developers and programmers who could command monstrous salaries in 1999 are simply looking for good work in 2008. The web project that was unaffordable in 1999 is more affordable today. Economic reality hit the tech sector with the near collapse of the sector. It has been sobering, but undoubtedly a positive survival of the fittest experience. The serial entrepreneurs who made some quick

204

CHAPTER 10

money early in the tech sector’s rise to the stratosphere, but then may have made missteps later in the bubble period, are often still in the game years later. People who had retrenched and seemed to almost disappear often made money in their later attempt. Like a maturing child, I’m seeing some differences in the tech sector’s business practices. Skateboards, chief morale officers, pool tables, ginseng tea, and millions of dollars of funding based on 30-page business plans are definitely out. It’s been some time since I saw a tech “contract” written on the back of a napkin. The “fun” part (lawyers do have a perverse sense of fun) was litigating those napkins. On this go around, “in” are Honda Civics, chief financial officers, coffee, funding based on a functioning and profitable business, and contracts negotiated and drafted by skilled lawyers. It’s back to basics. There’s less focus on “Internet speed” and more focus on “let’s make sure that the two sides of the deal actually understand what each expects from the other before they begin the deal.” I’m no longer seeing business plans based on fantasy, like 50 percent market share, and eight-figure revenue based on “first to market” and banner advertising revenue. Now it’s more like we have a functioning and profitable business, and we believe we can grow it faster if we do some key deals. Many of these involve brick and mortar businesses that now see a way to make the Internet a profit center. It’s now often clicks and mortar and variations on that theme. Tech’s been beaten up in the past, but it’s not as if it’s a passing fad. It’s not going away.

MONEY FOR START-UPS: RAISING VENTURE CAPITAL If you want to turn your small e-business into a big e-business, you’re going to need money, and a lot of it. The big issue is how to find the money you’ll need to get your e-business off the ground. During the dot-com boom, venture capitalists (VCs) offered big money fast. These days, it’s harder to get venture capital dollars. Still, there’s plenty of money floating around. However, in light of the recent spate of dot-bomb deaths, VCs have become more selective in how and where they invest. To attract venture capital dollars, you have to produce a viable business plan, a proven customer base, and a rudimentary revenue stream. In reality, most e-businesses that need money don’t have these things. Some e-businesses have found alternative sources of capital by offering equity investments to nontraditional sources of capital. For ex-

HISTORY, BACKGROUND,THOUGHTS

205

ample, competent legal counsel is something that e-businesses can’t live without, but cash-poor start-ups often can’t afford. They often do their own legal work, and hope they can survive long enough to generate some funds. Equity investments can change all this. Some cash-strapped businesses still offer law firms stock in exchange for reduced-price services. Like VCs, professionals are more reluctant to invest in start-ups than they were during the dot-com boom. Still, if you can find a willing professional, this could be a win-win situation. If you’re not quite ready to give up a piece of your company, Washington, D.C. has several bureaucracies that may be available to help finance your e-business. One example is the Small Business Administration (SBA), www.sba.gov/services/financialassistance/index.html. It offers commercial loans to e-businesses with terms more favorable than you’d find at most commercial banks. Further, the SBA licenses and regulates other private investment firms called Small Business Investment Companies (SBICs), www.sba.gov/aboutsba/sbaprograms/ inv/index.html. Of course, you’ll first have to complete a lot of paperwork and then wait while your paperwork is processed. Unfortunately, delays in closing loans can kill your start-up as thoroughly as if you had received no loan at all. Therefore, if you’re thinking about applying for an SBA or SBIC loan, avoid putting all of your cash eggs in the same financing basket, and consider simultaneously pursuing other avenues of funding. Founders of tech start-ups often find it tempting to self-fund their companies. To do this, they often mortgage their family’s home or withdraw their life savings. I think this financing method is even scarier than watching your start-up go down the drain. After all, if you haven’t invested all your personal funds in your start-up and your company fails, at least you have a place to call home. If you’ve leveraged your house to support your failed business, you may end up on the street. Nonetheless, if you extend a personal loan to your e-business, remember that this should not be thought of as a “goal.” Instead, you should treat a personal loan as a “beginning,” and use the money to support your company while seeking other sources of revenue. Once you secure those additional revenue sources, immediately pay back your personal loan. Be aware if you find VC funding: VCs don’t like you paying yourself back with their money. Finally, many businesses have started with funds from one of the three Fs of financing: friends, fools, and family. If you win your bet on your business, they win too.

206

CHAPTER 10

With a bit of creativity, you can find revenue sources other than traditional venture capitalists. Speak to an attorney or accountant experienced in venture capital issues from the beginning. They’re often plugged into a network of investors. Just a few minutes with a knowledgeable lawyer or accountant could save you hours of funding frustration.

BUSINESS PLANS If you’re seeking investors for your business, writing a business plan is one of those daunting tasks you’ll have to face. Whether you choose to hire a professional business plan writer to help or you do it yourself, you’ll need to be the chief architect of the ideas that will lead to success. Here are some tips to help you through the process. Every plan should start with a one- to two-page executive summary. This section isn’t a warmup, preface, forward, or “make ‘em feel good (rah, rah) about your business” section. Rather, it’s your entire business plan reduced to its essence. And your essence better boil because if it doesn’t, they (the ones with the checkbooks) aren’t going to read the rest of your plan. Those of us who have to read business plans hate it. I’ve yet to meet anyone who would choose to read a business plan over doing— well, anything else. It’s amazing what it takes to make a dental appointment look like an attractive break. Your executive summary must capture your reader. You have two pages to make your jaded reader want to learn more about you. You have two pages to talk about things like your market, your product or service, why your management team is the best lineup put together since the squad that brought home Apollo 13, your projected revenues and expenses, how much money you’re seeking, what you’ll do with their money (this isn’t the time to pay down the home equity loan) and, most important, why you. After the executive summary, I’m an advocate with front-loading your business plan with information about your management team. Tell the venture capitalist about the business experience and successes of the team. It’s a simple formula. VCs invest in people as much as, if not more than, they invest in technology. Most will tell you that they’d rather have an A team and a B technology than vice versa. If there isn’t much to say here, you’re probably not going to find venture capital. You may not want to hear this, but the sooner you come to

HISTORY, BACKGROUND,THOUGHTS

207

terms with this reality check, the sooner you can begin moving toward a path that may lead to success—like adding strength to your management. The next section begins the body of your plan. At some point, you’re going to need to present the mundane facts. You’ll talk about things like when you incorporated, who owns the company, and what you’ve accomplished. Today, the venture capital market is clearly tighter than it was a few years ago. More than ever, VCs are looking for new, unique, and hard-to-duplicate technologies and ideas. The key to funding in today’s market is a great explanation to answer the why you question. In writing your plan, never lose sight of the fact that VCs may read hundreds of business plans for every one they agree to fund. People, like attorneys and accountants, who act as filters to VCs, similarly read many plans for every one they send to those in their venture capital network. Those of us who do this know that our credibility is at stake every time we forward a plan. I know that if I want VCs to read the business plans I send, I have to prove to them that it only gets beyond me if it’s quality. If any professional who gets involved in venture capital sends clunkers to VCs, he could find his packages heading straight for the trash. Your plan must answer why you in such a way that it’s clear you have an unfair and sustainable advantage over your competition. You have to demonstrate how you’ll survive direct competition, reverse engineering, and a bigger company entering your space. Further, you need to explain how you’ll sustain any advantage you have. Remember, VCs aren’t looking for 10 or 15 percent per year return on their investment. They could invest in mutual funds and hope for that. They’re looking for returns upward of 25 percent per year and some would say upward of 100 percent per year. Your plan must show that numbers like this are possible. Now, of course, the paper will hold whatever numbers you put on it. While some level of optimism is acceptable in projecting your numbers, you should increase your antihallucinogenic medication to where your delusions are at a moderate level when you do the financial projections. Absurd projections won’t help your cause. If you want venture capital, hunker down and get to work on that business plan. When you have it done, don’t mass mail it to the VCs. Look to your network of professionals and friends to present it to a VC they know. Mass-mailed business plans have something approaching zero chance of being funded—no matter how well written.

208

CHAPTER 10

CLIENTS BEWARE: LAWYERS TELL JOKES TOO We’ve all heard our share of lawyer jokes over the years. I’ll tell you a secret. Lawyers tell client jokes. Here’s one of my favorites: A man in a hot air balloon is lost. He reduces the balloon’s height and spots a man below. He shouts, “Excuse me, can you tell me where I am?” The man below says: “Yes, you’re in a hot air balloon hovering at 30 feet.” “You must be a lawyer,” says the balloonist. “I am,” replies the man. “How did you know?” “Well,” says the balloonist, “everything you have told me is technically correct, but useless.” The man below says, “You must work in business.” “I do,” replies the balloonist, “but how did you know?” “Well,” says the lawyer, “you don’t know where you are, or where you’re going, but you expect me to be able to help. You’re in the same position you were before we met, but now it’s my fault.” Both client and lawyer jokes are funny, but what’s not amusing or useful are the culture and communication gaps brought to the fore by the humor. The two sides don’t understand each other. Business folks don’t care about terms and conditions of website use. They’re not interested in the niceties of an arbitration clause or warranty provision. What they want to know is how these things protect their business interests. It’s like fuel injection in a car. Most of us don’t ever think about fuel injection, don’t want to think about fuel injection, and don’t care to change our blissful state of ignorance about fuel injection. The experts decided it’s an improvement over carburetors and will make our cars run better. The “run better” part is all that matters to us. For some reason, this is lost on many lawyers. Lawyers seem to think that most of the world cares about the technical side of what they do. The fact is that the world doesn’t. Most people want to know the bottom line and hate the way lawyers can talk in circles. Business folks don’t care about the law of domain-name disputes. They want to know if they can register the dot-com version of a name and not be sued. They want to know what steps they need to take to protect themselves. They want answers. The point is that from the client’s perspective it’s not about the law, it’s about business. If you use your lawyers properly and they do their job, it’s about mitigating risk, solving business problems, and making money.

HISTORY, BACKGROUND,THOUGHTS

209

Call for a Truce I’m not going to try to take on the entire battlefield of the lawyerclient culture gap. It’s too big. Instead, I’m going to address this culture gap in my niche area of technology law. I’m going to point out that tech lawyers tend to be more entrepreneurial and younger—there are not too many 50- and 60-something-year-old tech lawyers around, for obvious reasons. Entrepreneurial is the nature of the beast because of the personality type technology attracts. The lawyer-client culture gap is naturally narrower here. Let’s recognize that and use it to our mutual benefit. When I tell you that your million-dollar tech deal will take more than a week to negotiate and document, and your fee will be measured in the many thousands not the many hundreds, I’d like to suggest you be open-minded and accept that the deal may be more complex than you realize. You’re like the lost balloonist and it’s not my “fault” that your deal will take 30 pages to explain. If that’s a problem for you, then scratch it out yourself and good luck. I’ve seen clients come and go with the economic winds of the tech bubble-and-bust cycle. We’re on the same side. I’m always telling my clients that I need and want them to succeed. Their success is my success. We should be enjoying the benefits of a symbiotic relationship. One of the worst effects of the culture gap is that business folks wait until the last second before they involve their lawyer. Tech deals take time. They’re as inherently complex as the technology that underlies them. Let’s make a new deal. Let some entrepreneurial tech lawyer somewhere show you his stuff early in a deal when he can make a real difference. Give him the time he needs to do his job properly. Let’s have no more lawyers talking in circles. Last, but not least, no more lawyer or client jokes—just a profitable deal for everyone.

Index

adult websites, 59, 120, 122 advertising, 13, 46, 64–65, 94, 108, 132, 138, 149, 152, 167–68, 204 agreement in principle. See letters of intent alternative dispute resolution (ADR), 36 Amazon.com, 52, 55, 121, 141, 168–70 Anti-Cybersquatting Consumer Protection Act. See cybersquatting arbitrary trademark, 14 Arms Export Control Act, 174 Arthur Andersen, 86–87 attorney’s fees, 4–5, 17, 36, 189 audit, 12–14, 86, 104–8, 110, 134–140, 176, 199, 211 banking, 2–3, 12, 61, 63, 72–75, 86, 90, 100, 107, 142, 148–49, 158–59, 162, 166, 169, 172, 176, 189, 205 blogs, 4, 9–10, 13, 125–32. See also copyright breach of contract, 90–91 browsewrap, 22–23, 43–44. See also webwrap BSA. See Business Software Alliance bugs. See web bugs

business plans, 206–7 Business Software Alliance (BSA), 133–40 change order, 70–72 chat, 4, 10, 59, 116, 145–46 Children’s Online Privacy Protection Act, 106, 166–68 clickstream, 3 clickwrap, 22, 43–44. See also webwrap computer crime, 140–50 computer forensics, 81 computer network, 2, 15, 29–30, 63, 98, 120, 135, 138, 140–42, 148, 152, 172, 177–78, 188, 196 computer use policy, 113–14, 119, 122, 135, 140, 212 confidentiality, 13, 24–28, 45, 81, 83, 86, 106, 118, 131–32, 149, 152, 173; agreement, 13, 25–28; trade secret, 27–28, 72, 96, 100, 124, 129, 131, 143–45, 155 consumer protection, 51, 64, 94, 132, 164, 171–72 contract, vii–x, 2–3, 5–6, 13, 17, 19–20, 28, 103–06, 109, 131, 167, 183, 187–89, 193–97, 204; analysis, 35–36; drafting, vii,

211

212

INDEX

48–50, 101; employment, 125–30; exit strategies, 37–40; online, 21–22, 42, 59, 120, 170–72, 212 cookies, 154, 165, 167 COPPA. See Children’s Online Privacy Protection Act copyright: blogs, 127, 129, 133; Digital Millennium Copyright Act (DMCA), 9–11; fair use, 8–9; Internet, 3–13, 41, 58–59, 94, 108–9, 202; ISP, 10–11; notation, 6–7; registration, 6, 12, 58, 94; software, 7, 32, 133–34, 140; websites, 39, 94 credit cards. See online purchases criminal law, 3, 158 custom software. See software cybersquatting, 15, 51–52 cyberstalking, 145–47 cyberterrorism, 145, 147–48 damages 31–32, 35–36, 51, 109, 125, 134, 140; actual, 6; statutory, 6, 9, 42, 90, 135, 152 data/document retention policy (DRP), 75–77, 82–87, 89–91 defamation, 4, 108, 126–27, 131 denial of service, 140–41, 147 Department of Energy (DOE), 202 Digital Millennium Copyright Act. See copyright digital signatures, 3 disaster recovery planning (DRP), 87–91, 148 DMCA. See copyright DOE. See Department of Energy domain name, 15–16, 50–53, 55, 57, 208; contract right vs. property right, 53; gripe sites, 56–58; poachers, 52–53; redemption grace period, 53 DRP. See documentation e-commerce, 1–2, 4, 10, 28–29, 55–56, 60, 64, 141, 147, 153, 168, 172–74, 187, 212

Economic Espionage Act of 1996 (EEA), 143 e-discovery. See electronic discovery EEA. See Economic Espionage Act of 1996 electronic discovery, 79–82, 85–86, 212 electronic evidence, 77–80 Electronic Privacy Information Center (EPIC), 174 email, 58–59, 66, 78, 114–16, 119, 141, 168 employee productivity, 124 employment, 3, 125, 128, 130–31, 143, 183, 212 encryption, 143, 148, 172–75, 177 Enron, 86 escrow, 100, 172–75 E-Sign. See Federal Electronic Signatures in Global and National Commerce Act. See also esignature e-signature, 170–72 Facebook. See social networks Fair Credit Billing Act (FCBA), 61 fair use. See copyright fast save, 156 FCBA. See Fair Credit Billing Act FCC. See Federal Communication Commission Federal Communications Commission (FCC), 62–63 Federal Electronic Signatures in Global and National Commerce Act (E-Sign), 171 Federal Rules of Civil Procedure, 80 Federal Trade Commission, 64, 66, 158, 164, 167–68 file deletion. See documentation financial services, 163, 166, 176 fine print, 46–48, 65, 172 firewall, 118, 177 first amendment rights, 57, 129–30 Force Majeure, 90 Ford Motor Company, 56

INDEX

213

framing, 94, 109. See also websites Friendster. See social networks FTC. See Federal Trade Commission

Internet service providers (ISPs), 10–11 IT. See information technology iTunes, 11

generic mark, 15 Gibson, Steve 150–51 GLB Act. See Gramm-Leach-Bliley Act Gramm-Leach-Bliley Act (GLB Act), 149, 161–62 graphics, 131 gripe sites. See domain name gross negligence, 188

JAD. See joint application development joint application development (JAD), 68–69 jurisdiction and venue, 36, 43, 93, 107–8, 110–11

harassment, 122, 131, 146–47 Health Insurance Portability and Accountability Act (HIPAA), 106, 161–63 hot linking,131 hosting. See websites hypertext markup language (HTML), 16 identity theft, 127, 149, 157–59, 175 IM. See instant messaging indemnification, 36, 45, 189, 195 information technology (IT), 28, 44, 72, 87, 115, 147–48, 202 instant messaging (IM), 113, 116–18, 184 insurance, 75, 91, 106–7, 158, 161–63, 212 intellectual property, (IP) 2, 9, 16, 32, 36, 38, 41, 45, 51, 73, 83, 94, 106, 124, 128–29, 131–32, 134, 137, 145 intellectual property audits, 12–14 international business, 110 Internet, 1–2, 4, 7–10, 17, 34, 41, 48, 52, 55, 57–70, 78, 80–81, 83, 101, 105, 108–9, 113, 116, 120–23, 126, 128, 130, 138, 141–43, 146–48, 150, 152–53, 157–58, 161, 163–64, 172–73, 178, 199–201, 204, 212–13; use policy, 120–23. See also copyright

Kaplan, 50–51 letter of intent (LOI), 23–24 liability, 11, 21, 30–32, 45, 61–63, 89–90, 94, 109, 121, 124, 126, 128, 130, 132, 145, 176, 188, 195; limit of, 30–32, 36; product liability laws, 94 libel, 4, 41, 59, 118–19, 124, 131 license, 13, 22, 33–34, 38, 72–73, 75, 95–97, 133–40, 152–53, 205 LinkedIn, v, 123, 124–25 linking, 94, 180 litigation, ix, 79–81 LOI. See letter of intent mainstream compliance, 107, 132 McDonald’s 50, 52 medical records, 162, 166 memorandum of understanding. See letter of intent metadata, 80, 155–57 metatags, 16–17 Microsoft Knowledgebase, 157 Microsoft Word, 34, 136, 155 movies, 9, 11–12, 140 MTV, 52 music, 10–11 MySpace. See social networks nanotechnology, 201–2 National Nanotechnology Initiative (NNI), 202 National Science Foundation (NSF), 202

214

INDEX

negotiation: art of, 179–83; authority, 184–85; the big idea, 181; damage limitations, 188; lawyer—when to involve, 187; as a team, 46, 49, 71, 76, 190–94, 196–97; tech deals, 185–87; telephones, 180–85 Netscape, 22 NNI. See National Nanotechnology Initiative non-disclosure agreements (NDAs), 27 notice, 44 NSF. See National Science Foundation object code, 72–73, 75 Office of Science and Technology Policy (OSTP), 202 offline privacy. See privacy online dispute resolution, 54–56 online privacy. See privacy online purchases: disputes, 54–56; credit cards, 60–61, 105–6, 157–58, 172–74 online shopping, 60–61 OSTP. See Office of Science and Technology Policy outsourcing, 28, 88, 185, 192–94, 211 overseas business, 5, 106, 163 parental consent, 166, 168 password sniffing, 140–41 patent, 2, 51, 202 Payment Card Industry Data Security Standard (PCI DSS), 176–78 Payment Card Industry Security Standards Council (PCI SSC), 175–76 PCI DSS. See Payment Card Industry Data Security Standard PCI SSC. See Payment Card Industry Security Standards Council performance standards, 98–99, 104 piracy, 10, 133–35, 137–41

poachers. See domain name pornography, 122 pretexting, 148–49 privacy, 2–3, 83, 93–94, 106, 114, 118–19, 122, 127, 131–32, 149–51, 153–55, 161–70, 174, 212; in Europe, 106; offline, 165–66; online, 93, 106, 161, 163, 165–66 Princeton Review, 50–51 The Privacy Foundation, 154–55 product liability law. See liability public domain, 4, 7, 41, 58 Quittner, Joshua 50 registration, 6, 12, 15–16, 22, 43, 52–53, 57 request for proposal (RFP), 19–20, 63, 98; format, 20 RFP. See request for proposal risk of loss, 29–30 salami attack, 140–41 SBA. See Small Business Administration SBICs. See Small Business Investment Companies scope creep, 69–71 secure server, 61, 172–73 security, 10, 63, 90, 104, 116–18, 127, 142–44, 147–48, 152, 158, 162, 175–78, 199–200 service level agreement (SLA), 44–48 service mark, 14–15 sex.com, 53 signatures, 13, 29, 34, 44, 120, 168, 170–72; faxed, 42–43. See also esignature SLA. See service level agreement Small Business Administration (SBA), 205 Small Business Investment Companies (SBICs), 205 social networks, 113, 123–25; Facebook, 121, 123; Friendster, 123; MySpace, 121, 123

INDEX software, ix–x, 6–7, 10, 13, 19–20, 22–23, 28, 30, 32–35, 38, 46, 67–68, 72–75, 81, 90, 101, 104, 109, 113–17, 121–23, 126–27, 134–40, 150–52, 157, 174–75, 177, 187, 191, 196, 211, 213; contract management, 33–35; custom, 95–101; development, 2, 23, 72, 96–98, 100, 181, 185, 203. See also copyright software license. See licenses software updates, 137 source code escrow, 72–75, 100 spam, 65–66, 141, 153 spoliation, 76–77 spyware, 150–53 starting a business, 203 suggestive trademark, 15 Sungard recovery systems, 88 tech law, v, 1–3, 11, 105, 113 tech purchases, 194–96 tech support, 46, 101–3, 182 telcos. See telecommunications providers telecommunications providers (telcos), 62–63 television, 11–12, 15, 62–63, 212 term sheet. See letter of intent

215

terms and conditions of website use, 21–22, 42–43, 106, 208 tort, 3, 31, 127, 188 trade secret. See confidentiality trademark, 3, 12, 14–17, 41, 50–52, 56–57, 94, 108–9, 129, 131 Trojan horse, 140–41 vendor contracts, 194–96 venture capital, ix, 23–24, 204–7 virus, 90, 115, 118, 147, 177 voting, 199–201 vulnerabilities, 142 warranty, vii, 28–29, 35, 47–48, 99–100, 195, 208 web bugs, 72, 153–54 websites, 3–5, 7–11, 13, 16–17, 21–22, 29, 33, 39, 41–43, 47–48, 50, 53–54, 56–59, 61, 64–68, 93–95, 103–11, 119–22, 129, 138–39, 141, 149, 151, 153–54, 157–59, 164, 166, 167, 169–70, 173, 176, 187, 196, 203, 208; audits, 105–6; framing, 94, 109; hosting agreement, 33, 103–4; payments, 32, 45, 100; performance standards, vii, 20, 29, 68, 89, 98, 104. See also copyright. webwrap, 94, 109

About the Author

Mark Grossman is a 26-year business lawyer who began focusing his practice on technology about 20 years ago. This makes him an oldtimer in a new practice area. He is also an author and frequent speaker on technology, business, and the art and science of negotiating deals. Mark’s “TechLaw” column is published by CIO magazine. Mark is AV-rated by Martindale-Hubbell, the highest level attainable, and has been a member of the Florida Bar’s Computer Law Committee. Further, he was chosen by his peers to appear in the last several editions of The Best Lawyers in America. Since its inception in 1983, Best Lawyers has become universally regarded as the definitive guide to legal excellence. Since Best Lawyers is based on an exhaustive peer-review survey in which more than 25,000 leading attorneys cast almost two million votes on the legal abilities of other lawyers in their specialties, and because lawyers are not required or allowed to pay a fee to be listed, inclusion in Best Lawyers is considered a singular honor. Corporate Counsel magazine has called Best Lawyers “the most respected referral list of attorneys in practice.” A 1982 cum laude graduate of Georgetown University Law Center in Washington, D.C., Mark started in the big-firm world working on large corporate deals. Then he had his own firm for many years until one of Florida’s larger law firms courted him in 1997. They asked him to start and lead their technology practice, which he did until 2005. Mark started his career as a business lawyer gaining experience as a negotiator and litigator, but then began to focus his practice on technology outsourcing, telecommunications, licensing, and custom development deals. Working on such technology deals led to experience with nondisclosure agreements, software audit disputes, computer use

217

218

ABOUT THE AUTHOR

policies, the Internet, privacy policies, online contracts, e-commerce, document destruction policies, intellectual property, employment agreements, electronic discovery, and issues unique to start-ups. Mark also has extensive experience as a litigator. Although he no longer litigates, Mark consults with other law firms on issues pertaining to electronic discovery and does depositions relating to electronic discovery. Mark’s clients have ranged from clients selling technology-related goods and services who needed a lawyer who understood their industry, to working with clients on the buying side of a transaction. On that side, his clients have included banks, insurance companies, and medium- and large-sized businesses in many diverse industries. Mark has advised small start-ups and Fortune 500 companies on their technology deals. Mark’s technology clients all share the need for a lawyer with meaningful experience in technology law. In many cases, his clients are spending large amounts of money buying complex technologies and need to hire a technology attorney to ensure that they have a meaningful contract. His general business clients share a need for personalized service from an experienced business lawyer with an attention for detail and a penchant for negotiating deals. In 1996, Mark started writing about technology law just as technology and the Internet were exploding and the dot-com bubble started. He began his writing career with PC World magazine. In 1997, he created his weekly “CyberLaw” column in South Florida’s Daily Business Review. In 2000, he renamed his column “TechLaw” and moved it to the Miami Herald where the column ran for many years. Now, Mark’s column is in CIO magazine. Since the mid-1990s, Mark has spoken to hundreds of groups domestically and internationally including multiple appearances at Georgetown University Law Center’s Advanced Computer Law Institute, COMDEX in Las Vegas, and seminars offered by the American Corporate Counsel Association. He has also been a guest on many television and radio shows including ABC’s Nightline. Mark has written for Washington’s Legal Times, the Texas Lawyer, the Recorder of San Francisco, the University of Texas School of Law’s Review of Litigation, and the Florida Bar’s Computer Law Journal. He also coauthored a chapter called “Web Development Agreements” in the American Bar Association’s book titled Internet Law for the Business Lawyer. Mark has served as special counsel for technology for the X-Prize Foundation (www.xprize.org), a subject matter expert for the State of

ABOUT THE AUTHOR

219

Florida’s Internet Task Force, was a member of the Board of Directors of the InternetCoast, served as general counsel for the South Florida Interactive Marketing Association, and was a member of the Board of Trustees of the Coral Gables Museum. Currently, he is a member of the Board of Directors of the South Florida Technology Association, a member of the Advisory Board of BNA’s Electronic Commerce & Law Newsletter, and a member of the Board of Editors of Internet Law and Strategy, a publication of Law Journal Newsletters. In 1998, Mark was one of three cofounders of the software company Eisenworld, Inc., which was later acquired by Microsoft in 2006. Microsoft incorporated Eisenworld’s PC Relocator software into Microsoft’s Vista operating system. Mark received his B.A., with high honors, in 1979 from Stony Brook University. He is a member of the New York, Florida, and District of Columbia Bars and is admitted to practice in the U.S. District Court, Southern District of Florida.