ISP Side Advertising Unlikely

A little over a year ago was the official launch of NebuAd, a company that, from the very beginning, saw itself as partnering with Internet service providers to produce targeted advertising based on the ISPs’ users’ use of the Internet. They claimed to be creating data-driven marketing without gaining access to the identities of the ISPs’ users. In fact, while they were hashing the users’ identities, Bob Dykes, co-founder and CEO, admitted that “[they] can see that same user coming back onto the Internet.” They accomplished this act of spying, by convincing ISPs to allow them to install an appliance inside the ISPs’ own networks, which allowed them to “get a 360-degree, multidimensional view over a long period of time of all the pages users visit….taking a totality of…behaviors.” In other words, they got us. They got our search terms, our page views, our page and ad clicks, our time spent on specific sites, our zip codes, our browser info and our connection speed. Using this information, NebuAd chose what it considered the optimal ad, and would display it.

For NebuAd and its advertisers, this was a boon. Up until NebuAd’s entrance into the market, the only sites that targeted advertising companies could use to determine who you were and what you would be likely to purchase were the limited number of sites that contracted with the advertising company. NebuAd’s deep packet inspection technology allowed them to track everything you did while on the internet regardless of what websites you visited. NebuAd was also a windfall for the ISPs, they received, in exchange for installing the NebuAd device, their 30 pieces of silver in the form of $2–4 per subscriber.

The outcry from the privacy community was fairly immediate. For John Palfrey of Harvard’s Berkman Center and many other privacy advocates, transparency was essential: "Consumers need to know exactly what is going on and they need to know it at all times….Today they say they are using consumer information for ads, but it could be something completely different tomorrow. The ISPs and the companies they are working with need to share as much information as possible."

In July of this year, the House opened an investigation of a trial of NebuAd’s service conducted by Embarq. The hearing ended with an open letter from Congressmen Markey and Barton urging ISPs to stop using such services. By September 3, the social pressure proved too much for NebuAd. Dykes resigned, various ISPs either cancelled or suspended trials of the device, and the company fired its PR firm and some of its staff. Additionally, various legal arguments were made regarding NebuAd’s service, including that the technology might be considered wiretapping.

At the end of September, the Senate Committee on Commerce, Science, and Technology held a hearing focused on broadband providers and consumer privacy. At that hearing, AT&T, Verizon and Time Warner Cable admitted that behavioral tracking shouldn’t be used without the meaningful consent of web users. However, they also stated that they would prefer to regulate themselves (who wouldn’t) stating that, “[They weren’t] prepared to embrace legislation.”

While the media and congressional pressure seems to have quieted NebuAd and its bretheren for the moment, it is unlikely that deep packet inspection will ever truly be gone. The benefits to the corporate whores involved are too high, and the costs involved are all paid by consumers, most of whom have no meaningful choice when it comes to choosing their ISP, and are far too willing to give up their privacy without thinking. When these companies return, they will need to smooth over relations with the appropriate congresspeople (read: bribe them), and insure that if there is a government regulator involved, it is sufficiently toothless (read: the FTC). However, I see an additional hurdle for NebuAd and its ISP stooges: copyright holders.

Copyright holders have been trying to hold ISPs secondarily liable for the infringement of the ISPs’ users for years. It was the prospect of such ruinous liability that urged the ISPs to lobby Congress for exemptions from copyright liability, and, in 1998, have Congress pass the Digital Millennium Copyright Act.

For the purposes of this discussion, it is only one safe harbor that need concern us: § 512(a) of the Copyright Act, which protects ISPs from liability for the transmission of copyrighted material. That protection is provided to any service provider who acts as a mere conduit for the copyrighted material. However, the only ones who get this relief from liability are service providers, and § 512(k)(1)(A) defines a service provider for purposes of subsection (a) as “an entity offering the transmission…of material of the user’s choosing, without modification to the content of the material as sent or received.”

It is important to note that modification is mentioned twice. When it is mentioned in 512(a)(5) it involves the specific material being transmitted, but when it is mentioned in 512(k)(1)(A) it refers to material generally. Thus, if ISPs use NebuAd, in any way, to track their users and then change or adapt the content seen by those users to better fit their behavioral profile, they are no longer mere conduits in the system and no longer protected by the DMCA safe harbor. This is true whether or not they purchase media or ad space on the original websites.

Once the ISPs are no longer under the 512(a) shield, copyright holders will only need to establish that the ISPs (1) materially contributed to the infringing conduct, and (2) knew of infringing activity. It should be a simple matter to show that the ISP materially contributed to the infringing conduct since without the ISPs aid the user would be unable to access the copyrighted material. Furthermore, the standard has generally been applied loosely. As for the second prong, given that NebuAd and the ISPs would be touting their ability to inspect every aspect of their users’ online activity, it shouldn’t be difficult to establish the requisite knowledge.

If the ISPs see such liability as a viable threat, they may attempt to turn to Congress for further amendment of the Copyright Act to extend their protection. However, given the DMCA’s concern for the protection of personally identifying information (Copyright Act § 1201(i)), Congress and the public’s new found crusade for privacy protection, and the wealth that copyright holders could squeeze from ISPs, that fight may turn out to be politically infeasible.

-- JoshS - 01 Dec 2008

• When you find that you need to use multiple "may" clauses and "might" suppositions in your conclusion, you have probably been hyperventilating for a couple sentences already. Your point about the DMCA safe harbor is interesting, and, so far as I know, fresh. It would have been sufficient to call attention to an additional and unquantifiable legal risk run by any ISP who gives the behaviorial marketers the power to change the packet coming through. This is not quite the same as saying he has a liability if he permits the surveillance and sells the resulting information to someone else. This point should be remembered before claiming that the usually-black-hat DMCA is here the white-hat cavalry coming to the defense of privacy.

• Other reasons to doubt the long-term effectiveness of the Phorm model also exist, and for now the immense plunge in consumer demand is likely to restrain business' mad desire to pay substantial amounts of money for the eyeballs of people who don't spend much. So perhaps rather than getting all alarmed about this we could step back and ask just how much damage can be done by guys trying to show me ads I'm going to use AdBlock to remove anyway.

Further Reading

Comments