Miree Kim[fnA]
March 31, 2003
The September 11, 2002 attacks on the World Trade Center in New York killed thousands of Americans.[1] Numerous firefighters and police officers lost their lives in attempts to save innocent civilians.[2] There is little doubt that capitalizing on such tragedy would be cruel and inhumane, yet many items memorializing September 11 were sold soon after the tragedy, and many of those items were sold online.[3]
eBay is the Internet site through which registered users can bid or auction off almost anything imaginable.[4] Memorabilia related to the September 11 attacks is no exception.[5] Immediately after September 11, eBay banned sales of September 11 memorabilia through its website.[6] On December 31, 2001, eBay officials abruptly ended the ban because they felt enough time had passed since the attacks.[7] Since then, numerous items ranging from fire department badges to a dusty pair of boots, supposedly worn at Ground Zero, have appeared for sale on eBay.[8] Although eBay removed some items at New York City’s request, some memorabilia related to the attacks were still available as of February 21, 2002.[9] New York City Mayor Michael Bloomberg was pursuing legal options against eBay at that time.[10]
Whether eBay should be legally liable for sales of September 11 memorabilia by its users and whether eBay should bear any civil liability instead of its users are decade old questions.[11] These questions have clear but unfortunate answers under current legal doctrine.[12] eBay will not be liable for its users’ activities because § 230 of the Communications Decency Act (“CDA”) protects interactive service providers (“ISPs”) from any civil liability for users’ activities online.[13]
Congress enacted § 230 of the CDA in response to two cases in the 1990s that set forth contrasting standards for defamation liability in suits against ISPs related to users’ activity on the Internet.[14] In 1991, the United States District Court for the Southern District of New York concluded that CompuServe, an ISP, was not liable for defamation because it simply enabled users to access the Internet.[15] In 1995, the New York Supreme Court held that Prodigy, which provided a service comparable to CompuServe’s, should be held liable for defamation. [16] Section 230 reflects Congress’s concern that imposing liability on ISPs may discourage self-regulation and impede the free flow of information over the Internet.[17] Section 230, therefore, protects ISPs from liability for their users’ activities, except in limited circumstances.[18]
Although § 230 provides federal immunity to a provider or user of an interactive computer service, it does not extend protection to an information content provider (“ICP”).[19] Section 230(f)(2) broadly defines interactive computer services as entities that serve multiple users over the Internet, and both ICPs and ISPs are included in that definition.[20] An ICP, unlike an ISP, creates or develops information published on the Internet.[21] Once a company qualifies as an ISP under § 230(f)(2) and (c)(1), broad immunity from civil liability applies.[22] A threshold question under § 230, therefore, is whether an entity qualifies as an ISP.[23] The relevant parts of § 230 provide:
(c) Protection for “good samaritan” blocking and screening of
offensive material
(1) Treatment of publisher or speaker
No provider or user of an interactive computer service shall be
treated as the publisher or speaker of any information provided by another
information content provider.
(2) Civil liability
No provider or user of interactive computer service shall be held liable
on account of. . . .
(B) any action taken to enable or make available to information content providers
or others the technical means to restrict access to material described in
paragraph (1). . . .
(f) Definitions as used in this section: . . . .
(2) Interactive computer service
The term “interactive computer service” means any information service,
system, or access software provider that provides or enables computer access
by multiple users to a computer server. . . .
(3) Information content provider
The term “information content provider” means any person or entity that is
responsible, in whole or in part, for the creation or development of information
provided through the Internet or any other interactive computer service.
(emphasis added)[24]
eBay benefits monetarily from sales of September 11 memorabilia.[27] Moreover, eBay presumably has the ability to block those sales.[28] The profits eBay would forego seems insignificant in comparison to the harms that society sustains by allowing people to capitalize on tragedy.[29] These harms should not go unpunished simply because they occur on the Internet.[30] Although it seems sensible for eBay to bear some responsibility for not banning sales of September 11 memorabilia, the current legal doctrine under § 230 of the CDA leads to the opposite conclusion.[31]
The Internet is a powerful tool to disseminate information at the speed of light.[32] In addition, the landscape of the Internet has changed since the enactment of the CDA in 1996.[33] Traditionally, ISPs only facilitated users’ access to the Internet.[34] Over time these ISPs expanded into non-traditional roles such as providing informational services, forums, or linking, which transcend merely providing access to the Internet.[35] For example, America Online (“AOL”) initially provided its subscribers e-mail accounts and Internet access.[36] As of 2002, however, AOL offers a variety of information and services, including financial news, gossip on Capital Hill, and instant messaging.[37]
Despite the changes and importance of the Internet, the CDA continues to provide immunity to any entity as long as information or statements are created or originated by third parties.[38] While growing numbers of entities qualify as ISPs-- for example, eBay and Amazon--the definition of ISP under the CDA remains overbroad.[39] The CDA prohibits courts from applying any additional test to ISPs to determine which ISPs should benefit from immunity.[40] Courts, therefore, do not impose civil liability on ISPs even when imposing liability protects the Internet as a valuable source of information.[41] For example, ISPs are not obligated to authenticate any information posted by a user, even when doing so is feasible.[42] Under such a broad immunity that imposes no incentive to self-regulate, the Internet may lose its utility as a powerful tool to disseminate information because the public will no longer rely on information obtained from the Internet.[43]
This Note explores why Congress’s definition of ISP is inadequate and argues that Congress should narrow the scope of ISP under § 230 by allowing courts to engage in a three-factor balancing test. Part I illustrates the broad definition of “ISP” under § 230, under which any entity that serves multiple users over the Internet can qualify as an ISP. Part II discusses the definition of “ICP” under § 230 and the mutually exclusive distinction between “ISP” and “ICP.” Part II also discusses case law and academic commentary regarding further expansion of that definition. Part III describes the way Internet Wire operates to illustrate further, in Part IV, that the CDA does not encourage ISPs to self-regulate, resulting in harm that can be prevented at a small cost.[44] Part IV argues that the current definition of ISP is inadequate because it applies indiscriminately and because it does not reflect the reality where ISPs serve ICP-like functions. Finally, Part IV proposes a three factor balancing test as a way to narrow the definition of ISP under § 230.
Congress defined an interactive service provider broadly in § 230(c)(1) and (f)(2) of the Communications Decency Act.[45] An ISP can be either a provider or user of an interactive computer service.[46] An interactive computer service, in turn, includes almost any entity that serves multiple users over the Internet.[47] Since the enactment of the CDA in 1996, courts have interpreted the definition of ISP to include not only traditional service providers who offer Internet access, but also individuals who create a chat room or an informational website, companies which host third parties’ websites, e-commerce sites which sell merchandise online, and corporations with web-based service sites.[48] All of those entities qualified as ISPs because they served multiple users over the Internet.[49]
Many courts have found that traditional service providers were ISPs because they enable multiple users to access the Internet.[50] For example, in Zeran v. AOL, Inc., the United States Court of Appeals for the Fourth Circuit held that AOL was an ISP because it provided an interactive computer service.[51] In Zeran, an anonymous user had posted messages on AOL’s bulletin boards endorsing the 1995 Oklahoma City bombing.[52] The Fourth Circuit emphasized that AOL did not author any offending messages while it allowed its subscribers to access the Internet.[53] AOL, therefore, was an ISP under § 230 as a provider of an interactive computer service.[54]
Several courts have characterized non-traditional service providers such as individuals, website hosts, e-commerce sites, and corporations as ISPs under § 230 because they serve multiple users over the Internet.[55] For example, in holding that individual users were ISPs, some courts have emphasized that immunity under § 230 applies to a provider as well as user of an interactive computer service.[56] Therefore, individuals who use an interactive computer service are an ISP if they serve multiple users on the Internet.[57] For example, in Barrett v. Clark, the California Superior Court held that an individual defendant was an ISP because multiple users accessed the defendant’s newsgroups.[58]
Defendant reposted allegedly defamatory statements about plaintiff’s company which were originally created by third parties.[59] Because § 230 defined ISP to include users, as well as providers, of interactive computer services, a defendant who allowed multiple parties to access her newsgroups qualified as an ISP.[60] The defendant, therefore, was immune from civil liability under § 230 as an ISP.[61] Similarly, in Marczeski v. Law, the United States District Court for the District of Connecticut held that an individual who created a chat-room was an ISP because multiple users accessed the chat room.[62]
Likewise, some courts have held that web site hosts acted as ISPs under § 230 because they allowed users to create web pages.[63] In Franco Prods., the United States District Court for the Northern District of Illinois held that web site hosts GTE Corporation (“GTE”) and PSINet Inc. (“PSI”) were ISPs.[64] Plaintiffs were intercollegiate athletes who had been secretly taped by hidden cameras in restrooms, locker rooms, and showers.[65] Nude pictures of plaintiffs were sold through web sites hosted by defendants GTE and PSINet.[66] Because defendants served multiple parties over the Internet by enabling users to create websites, the court found they qualified as ISPs as providers of interactive computer services.[67]
In 2001, some courts similarly applied the definition of ISP to e-commerce sites because they served multiple users by facilitating sales.[68] Although e-commerce sites do not provide Internet access and they profit from selling merchandise online, courts have concluded that e-commerce sites still qualify as ISPs under § 230.[69] For example, in Schneider v. Amazon.com, the Washington Court of Appeals held that online bookseller Amazon was an ISP within the meaning of § 230.[70] In addition to enabling visitors to purchase books online, Amazon provided a forum where visitors could review books by submitting written comments to Amazon.[71] Amazon posted negative reviews of plaintiff’s books, originally submitted by its users, that accused plaintiff of being a felon.[72] Although plaintiff’s employees complained to Amazon, it failed to remove the review, and Schneider filed an action alleging defamation and tortious interference with business expectancy.[73] The Washington Court of Appeals held that Amazon’s web forum, where multiple users could post comments, was functionally analogous to AOL’s message boards, where subscribers could post messages.[74] The court reasoned that Amazon’s failure to provide Internet access like traditional service providers was irrelevant, because service provider represent only one type of the ISPs entitled to immunity under § 230.[75]
In November 2001, the California Superior Court reached a similar conclusion regarding an online auctioneer in Stoner v. eBay, holding that eBay was entitled to immunity under § 230 as an ISP. [76] Plaintiff alleged that eBay intentionally facilitated and profited from the sale of bootlegged music and unauthorized sound recordings in violation of California Business and Professional Code §17200.[77] Plaintiff, like the plaintiff in Schneider, argued that eBay should not qualify as an ISP under § 230 because their business model was a sales model, rather than the bulletin board model of traditional service providers.[78] The court reasoned that “nothing in [cases] or in the statutory language so limits the CDA’s application” to traditional service providers with bulletin board models.[79] Citing Congress’s original concern in enacting § 230, the court stated that imposing liability would deter a company like eBay from making its service as widely and freely available as possible.[80] As a result, the court concluded that eBay qualified as an ISP which Congress intended to protect, under § 230, because it served multiple users over the Internet.[81]
In PatentWizard v. Kinko’s, the definition of ISP was further
expanded when the District Court in South Dakota held that a corporation
qualified as an ISP because it rented computers to individual users.[82] The
district court held that Kinko’s was an ISP under § 230 because it provided
Internet access by renting computers to multiple customers.[83] Kinko’s
did not, however, record the identities of those customers, and they did
not assign unique Internal Protocol addresses to specific computers.[84] In
other words, these customers were able to remain totally anonymous when they
accessed the Internet.[85] During a promotional chat room
session facilitated by the plaintiff, a user logged on from a Kinko’s computer
and allegedly made defamatory statements about plaintiff’s software.[86] Subsequently,
plaintiff filed six causes of action against Kinko’s.[87] The court implicitly
reasoned that Kinko’s was an ISP under § 230 because it enabled multiple
users to accessthe Internet by renting computers to individual customers.[88]
ICPs create or develop information and provide it to ISPs, which, in turn, allow multiple parties to access the information.[89] Sometimes, under a written contract with an ICP, an ISP has the right to edit or remove certain information before posting it online.[90] ISPs exercise these editorial rights by deleting or correcting certain information in accordance with the terms of the contract.[91] Several courts, however, have held that ISPs which have a right to editorial control, or which have exercised such a right, have not acted as an ICP under the statute.[92]
Section 230(f)(3) of the CDA defines an ICP as an entity that creates or develops information over the Internet,[93] and § 230 excludes ICPs from immunity for civil liability.[94] In 1997, in Zeran v. AOL, the United States Court of Appeals for the Fourth Circuit held that the user who published that the plaintiff endorsed the 1995 Oklahoma City bombing was an ICP because he actually created allegedly defamatory statements about the plaintiff.[95] Similarly, in 1998, in Blumenthal v. Drudge, the United States District Court for the District of Columbia held that the defendant Drudge was an ICP.[96] Defendant authored the Drudge Report, an online newspaper, in which he alleged that plaintiff had abused his wife.[97] The Blumenthal court stated that “it is undisputed” that Drudge wrote the story, and therefore, he was an ICP.[98] In 2000, in Ben Ezra Weinstein v. AOL, the Court of Appeals for the Tenth Circuit followed the same line of reasoning, finding that independent third parties were ICPs.[99] Standard and Poor’s (“S&P”), a financial services company, and Townsend, a software company, allegedly provided inaccurate stock information about plaintiff’s company to AOL.[100] The court concluded that S&P and Townsend were ICPs because they created and developed the information provided to AOL.[101]
Entities that actually create content, therefore, qualify as ICPs.[102]A more difficult issue, however, is whether an ISP may qualify as an ICP due to the nature of its relationship with an ICP. [103] Thus far, courts have concluded that contractual relationships are inadequate to transform an ISP into an ICP, regardless of the level of the ISP’s involvement in creating or developing content.[104] An ISP is not considered to have created or developed information like an ICP merely because it has a written contract with an ICP giving it the right to remove such content.[105]In effect, ISPs and ICPs are mutually exclusive of each other.[106]
For example, in 1998, in Blumenthal, the United States District Court for the District of Columbia held that AOL was an ISP, not an ICP, despite AOL’s licensing agreement with Drudge.[107] The parties did not dispute that Drudge wrote the column and was therefore an ICP, and that AOL was the ISP which published it.[108] The issue was whether AOL also acted as an ICP due to the written licensing agreement AOL had with Drudge.[109] The agreement provided that Drudge agreed to “create, edit, update, and otherwise manage the content of the Drudge Report.”[110] In addition, the report would be available to AOL’s subscribers for one year, and Drudge would receive a monthly “royalty payment” of $3,000 from AOL.[111] AOL also reserved the right to remove any content that it deemed inappropriate.[112]
The court concluded that the terms of the licensing agreement were inadequate to show that AOL had a role in writing or editing the allegedly defamatory material in the report.[113] The court did find, however, that § 230 would not preclude joint liability if AOL and Drudge had jointly developed the material.[114] The court found that Drudge wrote the story without any substantive or editorial involvement by AOL.[115]The court therefore concluded that AOL acted only as an ISP, not an ICP regarding the allegedly defamatory material in question.[116]
In 2000, the United States Court of Appeals for the Tenth Circuit similarly held that AOL did not act as an ICP merely because it had a contractual relationship with two ICPs.[117] In Ben Ezra, S&P and Townsend had a written contract with AOL to provide stock quotation information for the Quotes & Portfolios section of AOL.[118] Again, parties agreed that S&P and Townsend acted as ICPs and AOL as an ISP.[119]The parties disputed, however, whether AOL also acted as an ICP due to its contractual relationship with the ICPs.[120] Plaintiffs alleged that AOL’s act of sending e-mails to the ICPs requesting correction of information and deleting quotes constituted the “creation or development” of information.[121]The court, however, emphasized that the contracts between AOL and the ICPs provided that “AOL may not modify, revise, or change the information.”[122]AOL simply made the data unavailable by deleting the allegedly inaccurate information, but it did not develop or create the stock quotation information displayed on its site.[123] The court, therefore, concluded that AOL did not act as an ICP.[124]
In 2001, in Schneider v. Amazon.com, the Washington Court of Appeals reached a similar conclusion, holding that Amazon acted as an ISP but not an ICP.[125] The plaintiff alleged that Amazon acted as both ICP and ISP because it reserved the right to edit book reviews submitted by users and remove or refuse to post reviews that did not comply with its internal guidelines. [126] However, the court reasoned that if actual deletion of information in Blumenthaldid not create liability, the mere right to edit could hardly do so.[127]Plaintiff also alleged that Amazon acted as an ICP because it had a licensing right in the reviews submitted by users.[128] The court rejected this argument because AOL was held not to have acted as an ICP in Blumenthal, where it had a yearlong license with the ICP and even paid a royalty for the columns.[129] The court concluded that Amazon did not operate as an ICP because Congress made a policy decision to protect ISPs even in instances where they took an active and aggressive role in making material available online.[130]
Subsequently, in Does v. Franco Productions, plaintiffs argued that GTE and PSINet acted as ISPs as well as ICPs in their capacity as website hosts.[131] GTE and PSINet enabled defendants to sell videotapes and place naked images of plaintiffs online.[132] Rejecting plaintiffs’ argument, the United States District Court for the Northern District of Illinois held that GTE and PSINet merely presented material already prepared by other parties, and mere “description or presentation of the images on the Web site does not impact the creation or development of the images and videotapes themselves.”[133]Contrasting the facts in Franco Productions to those in Blumenthal, the court reasoned that even when AOL took an active role in making the Drudge Report available, through a written license agreement, the Fifth Circuit did not find AOL to be an ICP.[134] Thus, the court concluded that GTE and PSINet did not play dual roles as ISPs and ICPs.[135]
When ISPs have taken even more aggressive roles in promoting products, courts have similarly concluded that they did not act as ICPs.[136]In 2001, in Stoner v. eBay, Inc., the California Superior Court held that eBay did not act as an ISP or an ICP because it simply provided its own product information and services to users. [137] eBay users provided original descriptions of products they offered for sale on eBay.[138]eBay, however, routinely added additional product information on its site, such as logos, category headings, and seller ratings.[139]It also provided insurance for auctioned items, “i-escrow” accounts, and payment services, for which additional fees were charged.[140] The court stated that these additional services made the site easier to use but did not show actual involvement in the development of information relating to the sale of the products.[141] Therefore, the court concluded that eBay did not play the dual roles of ISP and ICP.[142]
In sum, a party who actually creates or develops information
on the Internet qualifies as an ICP under § 230(f)(3) and therefore
is precluded from immunity.[143] Contractual relationships,
aggressive involvement in making content available, facilitating activities
to generate more profit, or even editing of content by deleting or inserting
more information have been held inadequate to render an ISP that played dual
roles into an ICP.[144]
Critics agree that under § 230, the trend in courts is to adopt a
broader interpretation of an ISP.[145] In Internet Torts and Cyberspace
and Insurance: New Issues for the E-Conomy, Adam H. Fleischer noted
that the definition of ISP under the CDA encompassed traditional ISPs that
provided Internet access for multiple users.[146] In light of
current case law, in which individuals, e-commerce sites or even corporations
qualify as ISPs, Fleischer notes that private employers, advertisers, or
marketing firms that host discussion groups might qualify as ISPs in the
future.[147]
Hillel I. Parness, in eBay Victorious (again), Yahoo! Attacked (again),
as the Auction Wars Continue, observed the same trend and concluded
that the definition of an ISP under § 230 was broad enough to include
online auctioneers and large Internet companies.[148] Parness predicted,
therefore, that different entities will continue to seek an expansion of
the definition of an ISP to benefit from immunity.[149] As new entities
succeed in gaining immunity for non-traditional ISP functions, the definition
of an ISP will necessarily enlarge.[150]
This section discusses the business model of Internet Wire and the facts of Hart v. Internet Wire.[151] Part IV will illustrate, in light of Internet Wire’s business model, how ISPs’ immunity from civil liability under § 230 allows them to disseminate information created or developed by third parties without the risk of civil liability.
Internet Wire helps companies disseminate information effectively at a small cost by distributing information via e-mail.[152] Despite the fact that Internet Wire distributes information to reputable media outlets such as Yahoo!, Bloomberg, CNN/fn, Dow Jones, CBS, and Marketwatch, Internet Wire does not verify the source or accuracy of information before distributing submitted press releases.[153] To become a customer of Internet Wire, one must fill out an online application and pay a membership fee.[154]By submitting a press release for publication, clients automatically grant Internet Wire a non-exclusive, royalty-free license to publish press releases.[155]When a customer submits a press release, Internet Wire sends the message to reputable media outlets at the time requested.[156] At no point do the employees of Internet Wire verify the authenticity of submitted information or identities of those who submit information.[157]
Through various disclaimers in the terms of services, Internet Wire preempts itself from any legal liability that may result from the distribution of submitted news.[158] Customers automatically agree to comply with the terms of service upon online submission of the membership application.[159] One disclaimer provides that clients, not Internet Wire, are solely responsible for the accuracy and authenticity of the contents of press releases.[160] Furthermore, Internet Wire reserves the right not to distribute submitted press releases if they determine the content is unsuitable for publication.[161]In addition, clients agree to indemnify, defend, and hold Internet Wire harmless in cases of third party legal claims.[162] Client are also required to pay for all expenses incurred during such proceedings.[163]Finally, Internet Wire delegates all responsibility for veracity of its content to users who originally create or develop press releases.[164]
As of October, 2002, Internet Wire still had no authentication process built in its business model.[165] Securities fraud in Hart v. Internet Wire in 2001, is a good example of the adverse effects this business model can produce.[166] In 2001, the United State District Court for the Southern District of New York dismissed a claim against Internet Wire.[167] The court held that plaintiffs had failed to allege that defendant had a reckless intent to defraud.[168] Knowing how press releases were submitted to Internet Wire, a former employee pretended to be a public relations executive from Emulex Corp. (“Emulex”).[169] He submitted a fake press release to Internet Wire, which contained news of serious problems at Emulex.[170] Internet Wire’s staff treated both the e-mail and press release as genuine, because they had no knowledge of the former employee’s motive to drive Emulex’s stock prices down.[171]When the press release was published, Emulex’s stock price dropped by $60 per share.[172]
Most likely, a simple phone call could have exposed the email and press
release as fakes.[173] An authentication procedure,
therefore, would probably have prevented that incident.[174]The
plaintiffs did not litigate other civil claims against Internet Wire besides
the § 10(b)(5) claim.[175] Plaintiff’s counsel probably
knew Internet Wire qualified as an ISP under § 230 of the CDA and therefore
civil claims against Internet Wire would have been dismissed.[176]A
civil may have been brought if the definition of an ISP under § 230 were
much narrower.
The current definition of an ISP under § 230 of the Communications Decency Act is inadequate for two reasons.[177] First, the definition is overbroad, and therefore encompasses increasingly more entities as ISPs.[178]Virtually any entity that serves multiple users over the Internet qualifies as an ISP under § 230(f)(2) and (c)(1)[179] and benefits from immunity under § 230 if it simply serves multiple users.[180]Second, the definition of an ISP under § 230 is inadequate to reflect the reality where ISPs serve multiple functions.[181] Increasingly, more ISPs serve ICP-like functions by participating in the creation or development of information,[182] but § 230 creates two rigid categories—ISP and ICP.[183] Under § 230, there is no standard for granting immunity for entities that serve these dual functions simultaneously.[184] ISPs that participate in the creation or development of information, therefore, are not subject to civil liability.[185] The standard for granting immunity under § 230 does not protect the public from harms caused by inaccurate or defamatory information in these instances.[186]
Congress must create a narrower definition of ISP to protect the integrity
of the Internet as a source of reliable information.[187] If no one is
held responsible in the chain of communications over the Internet, the information
over the Internet will become unreliable.[188] For example,
the investing public such as shareholders of Emulex will no longer trust
information over the Internet when cases like Hart v. Internet Wirerecur
over time.[189] This does not mean ISPs should
always bear responsibility for its users’ activities, but ISPs should be
defined more narrowly.[190] The narrower definition should
take the form of a three-factor balancing test to distinguish which ISPs
should benefit from § 230’s protection.[191] This test would
require courts to scrutinize ISPs to determine whether immunity for civil
liability should be granted.[192] Congress must revise §
230 before courts can use such a balancing test, because § 230 currently
requires immunity from civil liability if an entity qualifies as an ISP.[193]
Because the definition of ISP under § 230 is overly broad, virtually any person or entity that serves multiple users on the Internet qualifies as an ISP.[194] As demonstrated in Part I, there is ample case law in which various entities qualified as ISPs simply because they served multiple users.[195] For example, in Marczeski v. Law, the defendant was deemed an ISP because she created a chat room accessed by multiple users.[196] Likewise, the defendant inBarret v. Clark was an ISP because she reposted messages on her newsgroups which were accessed by multiple users.[197] In Stoner v. eBay, defendant eBay was an ISP because their e-commerce site allowed multiple users to auction or purchase various items.[198] Similarly, Kinko’s was an ISP because multiple customers accessed the Internet by using their computers.[199] This overbroad definition of ISP does not require additional qualifications, beyond serving multiple users, to benefit from immunity under § 230.[200] Therefore, different entities can easily qualify as ISPs by serving multiple users.[201]
Under this broad definition, it is likely that more entities will qualify as ISPs in the future.[202] It is difficult to imagine any Internet service that does not serve more than one user, whether it is a bulletin board, a traditional service provider or even a chat room. Although courts have set no standard for determining how many users would constitute ‘multiple users,’ multiple probably means ‘at least two.’[203]
Indeed, a broader interpretation of the definition of ISP probably is on the horizon, as some critics suggest.[204] In his essayeBay Victorious (again), Yahoo! Attacked (again), as the Auction Wars Continue, Hillel I. Parness argues that a definition broad enough to define online auctioneers as ISPs will inevitably expand to include more entities as ISPs.[205] Parness correctly reasons that further expansion of the definition is inevitable because Congress defined ISP so broadly in § 230.[206] Similarly, Adam H. Fleischer, in Internet Torts and Cyberspace Insurance: New Issues for E-Conomy, suggests that private employers, advertisers or marketers that host discussion group type services might qualify as ISPs in the future because they serve multiple users.[207]
A broad definition of an ISP is problematic because ISPs vary in how they operate and the services they provide.[208] Those differences shed light on whether excluding particular ISPs from § 230’s definition will actually interfere with the flow of information over the Internet that Congress intended to protect under § 230.[209]
The number of users of an ISP is one such difference.[210]The larger the user base, the higher the degree of potential interference with the free flow of information.[211] For example, some ISPs have relatively few users compared to AOL or eBay.[212] A potential degree of interference with ways in which people communicate over the Internet, therefore, is much higher for AOL than individual ISPs if AOL exercises its editorial control.[213]
The nature of services ISPs offer is another difference that affects the flow of information.[214] The chat room in Marczeski was used to exchange opinions between users.[215]Other users besides the defendant “actually provided information” in the chat room.[216]In contrast, the website in Barrett was an informational site where no exchanges between users occurred.[217] Presumably, only the defendant ISP posted information on the site.[218] Forcing an ISP to authenticate information in a chat room, therefore, interferes more with the free flow of information because users actually exchange information in chat rooms, as opposed to simply accessing information.[219] On the other hand, even if the ISP in Barrett authenticated information placed on its website, that does not influence the free flow of information that significantly because the ISP already exercised editorial control while users did not.[220]
Profit making activities are another difference among ISPs that should be considered.[221] Commercial sites have less to do with the flow of information than making profit.[222]eBay and Amazon profit from sales of merchandise over their sites.[223] The primary objective of these sites is to make money—not to facilitate the flow of information over the Internet.[224] Commercial sites should have more responsibility than non-commercial ISPs to deliver accurate information because they profit from the users activities through their web sites.[225] When ISPs profit from sales of merchandise over their site, they at least ought to deliver accurate information.[226] Under § 230 of the CDA, a revised definition of ISP should reflect these differences in determining which ISP should be shielded from liability.
The broad application of the definition of an ISP has become problematic because once an entity qualifies as an ISP, immunity is automatically granted.[227]Although increasingly more entities qualify as ISPs, § 230 mechanically directs all courts to grant immunity to any ISPs.[228] Under § 230, courts do not have authority to determine which ISPs should be excluded from immunity under § 230.[229]
In enacting § 230, Congress intended to protect the free flow of information on the Internet.[230] Congress expressed concern that imposing liability on ISPs would lead them to control information that is posted online, which would interfere with the free flow of information.[231]Insulating ISPs from liability in many cases, however, jeopardizes the integrity of the Internet as a valuable source of information.[232] A revised definition of an ISP must enable courts to strike a balance between these two competing interests.[233] The larger an ISP’s user base, the stronger is the concern for the free flow of information.[234]A traditional ISP such as AOL has millions of subscribers.[235]Requiring AOL to authenticate information online, therefore, would be impractical, and would also restrict the manner in which millions of users communicate or exchange information online.[236]
For some non-traditional service providers, however, imposing liability would neither be impractical nor interfere with the free flow of information due to their small user bases.[237] In cases where the free flow of information is less of a concern, liability should be imposed to ensure that the public can rely on information on the Internet.[238]This is especially true for individual ISPs.[239]
For example, the individual ISP in Barret v. Clark presumably reposted messages without assistance from other parties.[240]None of the users of the defendant’s site exchanged information—instead they simply obtained information.[241] Therefore, controlling the quality of information on the site would be practical, because the defendant was the only source of the information.[242] In addition, visitors only obtained information that the defendant chose to post on the site.[243] The defendant already exercised editorial control because she chose which messages to post online.[244] Hence, requiring this individual ISP to verify the authenticity of information on the website would not interfere significantly with how information flows in or out of the website.[245]When there is a little concern over the free flow of information, the broad immunity against civil liability under § 230 is unnecessary.[246]
Another good example of an individual ISP with a small user base concerns
the ISP in Marczeski v. Law.[247] The ISP created a chat room
which was actually used by people to exchange information.[248]Its
user base, however, was much smaller than AOL’s user base.[249]Therefore,
delegating liability to ISPs such as the ISP in Marczeskito control
information would not interfere with millions of people communicating or
exchanging information with each other.[250] In other words,
the degree of possible interference with the free flow of information is
far less significant in this case compared to ISPs with a huge user base.[251]The
overbroad definition of ISP under § 230, therefore, fails to protect
the integrity of the Internet as a valuable source of information, even when
the free flow of information is comparably less threatened.[252]
The second reason why the definition of ISP under § 230 is inadequate is because increasingly more ISPs serve ICP-like functions.[253]Under § 230, however, an entity is characterized as either an ISP or an ICP[254]—the definitions of ISP and ICP are mutually exclusive as defined in the statute.[255]ISP is defined in § 230(c)(1) and (f)(2), and ICP is defined in a separate section in § 230(f)(3).[256] Once an entity qualifies as an ISP by virtue of serving multiple parties, § 230 requires courts to grant immunity from civil liability.[257] Courts, therefore, must grant immunity even when ISPs serve ICP-like functions such as creating or developing information.[258]
Courts have interpreted the definitions of an ISP and an ICP as mutually exclusive of each other, even holding that ISPs did not act as ICPs when ISPs so obviously exercised some degree of editorial control.[259]For example, in Blumenthal v. Drudge, AOL had a written contract with Drudge to provide his gossip columns to AOL.[260] AOL retained a right to remove materials that violated its guidelines.[261]The court, however, held that AOL did not act as an ICP.[262]In Ben Ezra, Weinstein, and Co. v. AOL, where AOL deleted erroneous information from its Quote and Portfolio section, the court excused AOL from liability despite the presence of ICP-like functions.[263]If deleting erroneous stock quotes or contracting for the rights to publish a column does not constitute the creation or development of information, nothing less than actual authorship would make a court find that an ISP acted as an ICP.[264] Although no court has explicitly held that ISPs can never act as ICPs, many courts implicitly held that the definitions of ISP and ICP are mutually exclusive.[265]
The mutually exclusive definitions of ISP and ICP under § 230 ignore the reality that ISPs serve ICP functions.[266] The dual functions ISPs serve is evident, though not acknowledged, in case law.[267]For example, in Zeran v. AOL, AOL provided access to the Internet and bulletin boards where defamatory statements about the plaintiff were posted.[268]Connecting multiple users is a typical function of an ISP, as defined in § 230.[269] AOL, however, also served ICP-like functions.[270] In Blumenthal v. Drudge, AOL had a right to remove content before posting Drudge’s columns online.[271] It also signed a written licensing agreement with Drudge to write the columns.[272] Surprisingly, both courts held that AOL did not play the dual role of ISP and ICP.[273]
Even when ISPs such as AOL and eBay served dual functions as ISPs and ICPs, § 230 required the courts to classify eBay as either an ISP or ICP, rather than as both.[274] In Ben Ezra Weinstein Co. v. AOL, AOL deleted information in attempts to correct errors before posting content online.[275] In addition, in Stoner v. eBay, eBay also served ICP-like functions by creating or developing information related to the description of products sold on eBay.[276] eBay even added additional information on its site, such as logos, category headings, and seller ratings.[277] Those were clearly ICP-like functions, because eBay actually created and developed the additional information.[278]The court, however, held that eBay did not play dual functions, illogically concluding that these activities did not constitute the creation or development of information relating to the sale of the products.[279] This holding resulted from the fact that eBay qualified as an ISP under the CDA and § 230 required to grant immunity.[280]
As shown above, the definition of ISP is inadequate because it is overbroad
and it fails to reflect the dual functions which ISPs currently serve.[281]Therefore,
courts are given an inadequate statutory tool to determine whether ISPs should
benefit from immunity.[282] Section 230 delegates an impossible
task to courts to distinguish ISPs from ICPs when many entities serve both
functions.[283]
This section demonstrates that Internet Wire, like other ISPs, does not authenticate information even when it is practical to do so, because § 230 of the CDA provides immunity from civil liability when information is created by third parties.[284] Such broad immunity under § 230 poses a threat to the integrity of the Internet as a valuable source of information because the public may perceive that much information available over the Internet is unreliable.[285]
Internet Wire’s history demonstrates that the prevention of harm done on the securities market is possible if the definition of ISP did not apply so indiscriminately.[286] Internet Wire undoubtedly qualifies as an ISP under the statutory definition because it serves multiple parties—its customers—who create press releases distributed by the company.[287]In addition, Internet Wire is analogous to the ISP in Barrett v. Clark, which reposted previously created messages, because Internet Wire simply redistributes press releases.[288] A court would be unlikely to find that Internet Wire was an ICP merely because it retained the right to decline distribution of submitted information when it violates its guidelines.[289]Current case law demonstrates that AOL’s right to remove contents, its deletion of certain errors by an ICP, or its broad contractual right to edit and use the posted reviews were inadequate to transform AOL into an ICP.[290]
Internet Wire does not authenticate the source or accuracy of press releases submitted for distribution.[291] Internet Wire, however, would not be liable for inaccurate press releases under § 230 because it qualifies as an ISP and the civil claims did not involve federal criminal or Intellectual Property law.[292] As the facts of Hart v. Internet Wire illustrate, anyone can pretend to be an officer of a company and request the distribution of information after a simple registration process and payment of a fee.[293] The current statutory scheme protects the irresponsible business model of Internet Wire simply because they qualified as an ISP by serving multiple users.[294]
Internet Wire should be required to take responsibility for ensuring the
accuracy of the information it distributes. First, because it distributes
press releases to reputable news media outlets such as Yahoo!, Bloomberg,
CNN/fn, Dow Jones, and CBS Marketwatch, it is important that the information
be reliable.[295] In addition, Internet Wire
profits by distributing the press releases.[296] Internet Wire’s
very business as intermediary is generating profit by distributing submitted
information.[297] Indeed, the costs Internet Wire
would incur to ensure the reliability of this information is nominal compared
to the harm that may arise by not imposing such a responsibility.[298]
For example, Internet Wire, through a simple phone call, can verify whether
someone who attempts to distribute a company’s information is really a representative
of that company.[299] Such a call could have prevented
the harm in Hart v. Internet Wire.[300] § 230 currently
allows Internet Wire to be excused from civil liability, which therefore
allows these ISPs to operate with this business model.[301]Unfortunately,
§ 230 does not allow courts to even consider whether Internet Wire should
be held liable because automatic immunity is granted once Internet Wire is
determined to be an ISP.[302]
Because the current definition of ISP under § 230 is inadequate for the reasons previously discussed, Congress should narrow the definition by allowing courts to engage in a three factor balancing test.[303]The proposed balancing test would be in addition to the test courts currently use to determine whether an entity qualifies as an ISP.[304]The first factor of the balancing test would be whether an ISP directly profits by enabling its users to distribute information.[305] The second factor would consider whether feasible means exist of authenticating the accuracy of information before dissemination.[306] The third factor would weigh the cost of authenticating information against harms the public might otherwise sustain.[307] Congress should direct courts to first determine whether an entity is an ISP under the current definition, and then to apply the proposed test.[308] Courts must balance two competing policy concerns—interference with the free flow of information and the maintenance of the integrity of the Internet as a valuable source of information.[309]
The proposed test would allow courts to determine whether an ISP should benefit from immunity under § 230.[310] For example, if an ISP can authenticate information it posts online at minimal cost, and it generates significant revenues by distributing the information, then the ISP should not be shielded from liability for reporting inaccurate statements.[311]Furthermore, if the cost of authenticating information is minimal and the harm to the Internet’s reliability is potentially debilitating, then it is reasonable for an ISP to bear the burden of liability.[312]In this situation, the ISP is the appropriate party to bear this burden because it is in the best position to authenticate the information and absorb the cost.[313] Arguably, the concern over the preservation of the value of the Internet trumps the concern over the free flow of information in this context.[314]
Under the proposed test, Internet Wire would not qualify as an ISP.[315]Internet Wire charges its users fees for distributing information, thereby profiting from it.[316]Therefore, it should bear more responsibility to authenticate information than entities that do not profit.[317]In addition, Internet Wire can verify the accuracy of information by a simple phone call.[318] The cost of such a call is nominal compared to the potential harm if the content is not verified, as demonstrated by Hart v. Internet Wire.[319] The new test, therefore, would impose liability on ISPs when it is appropriate to do so to protect the Internet as a valuable source of information.[320]
In many of the cases previously discussed, the holdings would have been different if the balancing test was used in addition to the current § 230 test.[321] For example, AOL would be an ISP under § 230, but courts would apply the proposed test as a second prong, reaching results that reflect the public policy Congress intended to advance under § 230.[322]Under the balancing test, AOL would have benefited from the immunity under § 230 in Zeran v. AOL but not in Blumenthal v. Drudge.[323]
In Zeran, AOL profited indirectly from anonymous users’ activities through its website, because an anonymous user of AOL paid monthly subscription fees to access the services.[324] AOL, however, did not earn money directly from the sale of “Oklahoma” memorabilia by the user of AOL’s bulletin boards.[325] In other words, AOL profited as an ISP, by providing the user access to the Internet, but not as an ICP would, from the dissemination of information it created.[326] Second, AOL did not have a practical means of verifying the accuracy of what users post on their bulletin boards.[327] Even if AOL requires users to post their real names online, they could easily conceal their real identities. In addition, AOL’s user base is in the millions.[328]Requiring AOL to control its content, therefore, would mean a high degree of interference with the free flow of information.[329] Therefore, using the proposed test, § 230 would continue to shield AOL from liability in this case.[330]
On the contrary, AOL would not benefit from immunity under the proposed balancing test in Blumenthal v. Drudge.[331] AOL directly profited in this case because of its contractual relationship with Drudge.[332]AOL users paid subscription fees, which were used by AOL to pay Drudge.[333]In other words, AOL capitalized on the columns it solicited to be written by Drudge.[334] In addition, Drudge was the only one who wrote the columns for the Drudge Report.[335] Therefore, it would be quite feasible for AOL to authenticate the information Drudge had written.[336] Because Drudge was the only one writing the columns, AOL’s authentication would result in a low level of interference with the free flow of information, unlike in Zeran v. AOL.[337] Additionally, the Drudge Report was not an interactive site, unlike the bulletin board in Zeran.[338] Requiring Drudge to write accurate columns would not cost AOL very much money, compared to the potential harms which could result to a defamed and innocent person from not imposing liability on AOL.[339] AOL, therefore, would not have benefited from immunity under the proposed balancing test.[340]
Similarly, in Stoner v. e-Bay, eBay would be held liable if the new balancing test were used.[341] It is undisputed that e-Bay directly profits from sales of items on its site.[342] In this case, eBay benefited from the sale of bootleg music and other unauthorized infringements of sound recordings.[343] eBay certainly has the ability to ban sales of certain items on its site, as it did in the case of the September 11 memorabilia.[344] The cost of such an action to eBay would include the profits they forego by prohibiting the sales of some items.[345] However, banning sales would not interfere with communication between individual Internet users.[346] eBay is an auction site, so such regulations would only interfere with what items users can purchase.[347] Such regulations do not interfere with how people communicate their opinions like the bulletin board users in Zeran.[348] Here, interference with the free flow of information is a more remote concern, because eBay’s website is mainly an auction site.[349] In conclusion, e-Bay would not have satisfied the proposed balancing test and thus would be excluded from the immunity under § 230.[350]
As shown above, the proposed balancing test would allow courts to consider
the merits of each individual case.[351] Under the proposed test, even
if AOL qualifies as an ISP in one case, it would not qualify as an ISP and
automatically gain immunity in another case where it served a different function.[352]This
test, therefore, would distinguish between ISPs in order to resolve the competing
concerns of the free flow of information and the integrity of the Internet
as a valuable source of information.[353]
By enacting § 230 of the CDA, Congress intended to protect the free flow of information on the Internet. As case law developed, the inadequacy of the definition of an ISP has become evident. Distinguishing among ISPs to determine which should benefit from immunity is impossible under the current broad definition. Situations with facts akin to Hart v. Internet Wire should be prevented from occurring. Internet Wire should not be encouraged to use a business model where there exists no incentive to authenticate the source or accuracy of information. Redefining an ISP under the proposed test will further Congress’s intent of protecting the free flow of information over the Internet while protecting the Internet as a valuable source of information. Otherwise, recurrences of cases like Hart v. Internet Wire could eventually make the public believe that information on the Internet is unreliable, along with information from other reputable news media which rely on information from Internet Wire. Therefore, shielding ISPs from responsibility may threaten the value of the Internet as a valuable source of information. The proposed balancing test is an attempt to identify factors to distinguish the ISPs that should be held responsible for civil liability from those that should not. The three factors in the proposed test, however, are by no means exhaustive. Until Congress decides to amend § 230, be wary of what you read off financial websites, even the reputable ones, because they may contain a bogus news release from an unverified source.