The need for a law to kill the safe harbor defense.
Satyarth Priyedarshi
Chief eCommerce Officer, Redington Limited || ex- Google, Flipkart, Jio, Tata || 5 TEDx Talks || LinkedIn Top Voice ‘19 || LinkedIn Power Profile ‘18 || Study Board Member at Universities || Views Personal
(The article was first published in Amity University Journal "Chronicle", issue VII, May 2019)
Amul sends notice to Google and GoDaddy
On 17th January 2019, India’s biggest Dairy brand Amul sent a legal notice to Google and GoDaddy about fake ads selling franchisees in Amul's name. Here is how it worked. Someone set up domain names in the name of Amul using GoDaddy, which is a domain registrar. Then they published ads on google selling franchisee operations with 3-7 lakhs investment.
Gullible businessmen clicked on the ad and landed on the site thinking it’s a genuine Amul site and paid up the money and kept waiting for their franchisee allotment letters to come in. when that didn’t come in, they went ahead and complained to Amul, which then was forced to take this step.
Google is a trusted brand name
This might look like a simple issue but is a deeply contentious one. Here, the fraudsters could run the fraud because people saw an ad on google, which is a trusted brand name. From there, they went on a website which had the trusted Amul name and they paid.
Amul is a trademarked name. Using it without company’s permission is an infringement of the trademarks act 1999. If this was being done offline, the police could have acted directly and launched an investigation. The premises would have carried a KYC led rental agreement with the owner. Finding culprits would have been pretty easy. Online, websites are the gatekeepers. So no one knows the details of the fraudsters except Google and GoDaddy! Even on these sites, anonymizing legally is pretty easy because there are no borders.
Above all, such a fraud wouldn’t have run for long as physical space is a finite space. The streets you walk on and I walk on is same. Not so in digital space. You might land on a website and see things completely different from what I see!
No one could have been able to register a business name offline with Amul’s name in it. Offline no one could have registered Amul as a trademark, and without these there wouldn’t have been a trust issue.
This is not the only case that has come up.
The case of bank of India and fraud using Google Maps
Recently Bank of India approached the Maharashtra Cyber Cell about a scam involving Google Maps. Scammers used the public editing rights to change the bank phone number on the Google Maps listing. When unsuspecting customers looked up Bank of India’s details online and called the number, their personal details were taken over call and money swindled out of it. Why did the online user trust that they were calling the right number? Because they trust the search engine that entire planet trusts.
When you register a business as private limited, the Registrar of Companies makes sure that you cannot take a similar sounding name. In other words, there is an authority that has granted you the right to use a name, and then also taken up the responsibility to protect it. In the world of domains and ads, this step doesn’t happen. So if GoDaddy sells you a domain name, it doesn’t believe in protecting similar sounding names.
Internet is legitimate and has credibility
Once upon a time, it would have been okay. Because internet didn’t have credibility. But now, as governments and businesses all over the world have legitimized it by using it, it needs to change. Increasingly every single company out there has run huge campaigns telling people that internet is safe and they are doing everything to protect people. If people believed that internet was not safe, these issues wouldn’t have come up.
Part of the reason is that earlier, internet was the domain of chose few, who understood how technology works and what to trust and what not to trust. But as more and more percentage of world population is coming online, they are using their understanding of the world to use the internet. The world has different concepts. There are tried and tested methods to protect people. The world has existed since forever.
Who is responsible to protect us on internet?
So who is responsible to protect people on the internet? Google isn’t.
Google cites “safe harbor” in such cases claiming it is just providing a platform and is not a party or owner or filter of content being uploaded. It further claims that on complaints it looks into cases to take appropriate action.
But will Google tell you the name of the person who infringed upon your rights. Probably not. You see there are privacy laws as well. So you cannot sue a party directly, but you have to write a police complaint and then police has to ask google and then google has to disclose.
All of this will happen in its sweet time, and by that time, there is a good chance that the digital footprints have disappeared. Even if it happens in real time, there are ample technologies to make sure that digital footprints don’t exit.
Other industries also faced similar challenges once
We used to have the same challenges in early days of telephone. But the industry had to step in, provide services like caller ID and government enforced KYC. Because human society is based on communication and while the right to speak one’s mind is supreme, right to justice is equally inalienable.
I feel similar steps are being taken to ensure that technology is not being misused by bad actors and governments have woken up to the challenge. I feel with recent pressures on Facebook (election ads, fake news), WhatsApp (forward restrictions, rumors) and the general policy wind against MNCs (India -ECommerce policy, EU-GDPR) change is afoot.
And I think the time is ripe to chip away this safe harbor. Like Supreme Court Justice DY Chandrachud recently said “Sunlight is the best disinfectant”.
How is security provided in offline world?
If you were running a mall and people were using your premises to do illegal things, then either you will have to stop them or let police in. But someone will have to act as the authority to bring law and order. You can’t leave law and order to people’s own good nature. I hope we reach that stage someday, but in immediate future that is unlikely. If you don't take responsibility to stop illegal activities in the mall and don’t let others as well, your mall will be shut. If the government thinks that your Mall business model is helping people skirt law, your business will be shut. But the same law hasn’t been applied online.
You cannot have unregulated islands with public access in society. That is what Wild West was all about. You can't leave public safety and social welfare at the mercy and chance of a Good Samaritan passing by!
Millions and billions of private data records have leaked, and most of the online companies just walk away with a weak apology and no penalty! Companies tell us that data is secure and the internet is secure, but frauds happen anyways and never get solved. No one has been brought to justice on any of these accounts. But the bigger problem is that no one has been fined substantially as well. Most of the fines have barely been a fraction of the huge profits that security companies in the online world make.
Take this scenario. You are travelling from US to India and someone hands you a sealed pack to deliver in India. You land in India and the customs finds that there is contraband in the package.
What happens here? The airlines doesn't have the responsibility because it has signed an agreement with you.
But here the government has taken up the responsibility and with it, the authority to check every package that comes into the country. The privacy doesn't exist in this case. And you have given away that right for ensuring a just and equitable society.
But in case of online systems, there is a passenger, there is a contraband, there is even a customs check, but there are no x-ray machines. Now you need to ask, if the X-ray machines are needed and who will run them or we should we simply trust the goodness in people's heart and let it be.
The customs in this case not only secures physical safety but also economical safety. If the airlines business was mostly coming from shipping contraband, it would resist any such law which allows for an X-ray scanner to be placed in airports citing privacy.
Conclusion "Trust but verify"
As far as i understand law, it works on the principle of "Trust, but verify" and when you find culprits punish them. There is no “Verify” online.
That sadly is today's internet. All profit, no responsibility. But with the current spate of laws, that might change. In terms of penalty, till now, the users have been burdened with loss. But I hope that with enough cases now, the government takes note and brings about a policy to take care of these recurring crimes.
References:
--------------------------------------------
The views expressed in the article are my own and don't reflect upon the views of any of my employers, present and past.
Impactful support for growing Businesses
5yBang on. Ditto with online marketplaces where caveat emptor still applies.
GRC/Risk Management/Payments/Privacy/Data Security
5yGood article! While account and content whetting is undoubtedly required to ensure safe online experience, comparisons with offline retail whetting and customs control processes offer little help, because the internet by premise and design has been and continues to be unregulated. This is presumably why safe harbor clauses have been inked into content provider (google,facebook etc) contracts. While it would be practically impossible to whet individual accounts manually given the scale as in retail establishments, certainly, the content providers can do a lot more to use automation to detect and alerts users on content abuse.
Founder at KalyanAstroGems
5yCompletely agree! Especially with the provision that Trust but Verify. Google, domain registrar's etc. should check for authenticity at least for public facing names or say trademarks. They should invest in algorithms to detect the same.