Non-compete Agreements
May 5th, 2009
Edwards v Andersen 44 Cal. 4th 937 (2008)
Edwards was an accountant working for Arthur Andersen when that company collapsed for its probably illegal work in the Enron scandal. HSBC was going to hire Edwards when they bought out part of Andersen, but as part of the agreement between HSBC and Andersen, all Andersen employees had to sign a Termination of Non-compete Agreement before being taken on by HSBC. This would absolve them from the Non-compete Agreement they had signed to start work with Andersen and release Andersen from any and all claims based on their employment there. Scared that this was an attempt by Andersen to make him legally responsible for some of their wrongdoing, Edwards refused to sign the TONC agreement and was then fired by Andersen and not hired by HSBC.
Edwards is now suing Andersen for intentionally interfering with his prospective economic advantage going to work for HSBC. But in order to do that, he needs to show an independently wrongful act, in this case, that the non-compete agreement they asked him to sign is void by Section 16600 and that the TONC waiver violated Labor Code Section 2802. The discussion in this case is almost entirely about whether the non-compete agreement with Andersen was invalid under Section 16600.
It’s worth looking at California Business and Professions Code Section 16600 itself, it’s short and sweet:
16600. Except as provided in this chapter, every contract by which anyone is restrained from engaging in a lawful profession, trade, or business of any kind is to that extent void.
Exceptions just relate to when you sell a business or are a partner in a business that’s dissolving, neither of which applies here.
California is rare in its determination that the public policy benefits of employee mobility outweigh the value to business of engaging in these agreements. In court cases, “restrained” is taken pretty broadly — an agreement can be voided even if it doesn’t completely prohibit lawful profession, even if it just imposes a penalty for working for a competitor. Muggill v. Reuben H. Donnelley Corp. (1965) 62 Cal.2d 239, 242-243 [42 Cal. Rptr. 107, 398 P.2d 147]
Andersen argues that the Ninth Circuit has found a “narrow-restraint” exception, that these agreements can provide narrow limitations to your work, like preventing you from working for a specific client or penalizing you in some way for working for a competitor. But the California Supreme Court thinks the Ninth Circuit is wrong, that no court in California buys it and that the Ninth Circuit relies on irrelevant California case law. They find for Edwards, that the non-compete agreement, narrow though it was, is invalid under California law.
Why has the Ninth Circuit been getting involved at all? It appears that sometimes federal courts have to get involved in interpreting state law when there’s a diversity jurisdiction or a choice of law question. But California gets to interpret its own laws, so the California Supreme Court wins, it seems like.
Though it isn’t discussed much, the California Supreme Court also rules that the TONC waiver of indemnity is unlawful under Labor Code Section 2802, which is also a nice short read.
Aymes v. Bonelli, 980 F.2d 857 (1992)
Aymes was hired by Bonelli (doing business as Island Swimming Sales) as a computer programmer in 1980, where he worked for two years. During this time he created a series of programs (”CSALIB”) for maintaining internal processes at Island. They had no written agreement.
The dispute is whether Aymes was an independent contractor of Island, or an employee, in order to determine the copyright status of the CSALIB applications. If Aymes was an employee, then the program would have been created as “work-for-hire”, and thus Island would own the copyright. As an independent contractor, Aymes as the creator of the software would own the copyright. Aymes is claiming that there was an oral agreement that CSALIB would only be used on one computer, but Island ended up using it on multiple computers and thus Aymes could be owed additional compensation.
Facts:
- Aymes was under the general direction of Bonelli, who gave him significant guidance but was not a programmer
- Aymes received a graduate degree from Cornell’s School of Engineering in 1981
- Aymes did most programming at Island’s office, which was necessary due to the nature of the computer system
- Aymes was paid sometimes by the hour, and sometimes per-project
- Aymes did not receive health or other insurance benefits
- Island did not pay payroll taxes nor withhold salary for taxes, and was given an IRS form 1099 rather than the employee W-2 form
- Aymes worked occasionally for other companies over the course of the two years
Employee or independent contractor?
The original district court ruled that Aymes was an employee of Island. The court of appeals had several issues with this and reversed the decision, ruling that Aymes was actually an independent contractor. Since the original district court ruling, another case (Community for Creative Non-Violence v. Reid) had established the “Reid test”, a multi-factor test for determining a worker’s status as employee or independent contractor.
In light of the Reid test, the court of appeals issued the following comments along with its decision:
- It emphasized that the original finding did not weigh or otherwise be selective about each factor, simply applied them all equally
- Not all factors are relevant or equally important in any given case
- It emphasized that “Aymes was considered an independent contractor by Island” due to lack of benefits or tax payments. The court underlined that this alone was usually indicative (and such has been the decision in every case using the Reid test since) of the worker’s status, and that Island could not treat Aymes as a contractor when it was convenient but then years later claim him as an employee
Aetna-Standard v. Rowland, 343 Pa. Super. 64 (1985)
Rowland was an employee of Aetna, and created a “plug mill receiving table” invention while employed there. A patent was granted for this invention, which named Rowland and his supervisor as joint inventors. Rowland was laid off from Aetna, and was asked to assign his portion of the patent over to Aetna, but refused. His supervisor also no longer worked for Aetna, and was similarly requested to assign his interest in the patent, to which he agreed.
Does Aetna have a claim to the assignment of Rowland’s patent?
Does Aetna have a “shop right” (an irrevocable royalty-free license) to the invention?
The Court finds that Rowland holds a joint interest in the patent with Aetna, and that Aetna has a shop right for the invention’s use.
Issues:
- The mere existence of an employer-employee relationship does not entitle the employer to assignment of inventions by the employee during the employment
- A “shop right” arises when an employee creates an invention while on the employer’s time and expense — in this case, the table was designed at Aetna for a specific use and client, using Aetna’s resources
The Court stated, “given the personal, intellectual nature of the inventive process, the courts must otherwise hesitate to imply agreements to assign” although it may “readily grant the employer a shop right to use the invention”.
Trade Secrets
May 4th, 2009
Wexler vs Greenberg (1960)
Overview
This case is about what right a business has to prevent an ex-employee from disclosing trade secrets after leaving the business and being hired by a competitor.
The trade secrets in question are the formulas for three cleaning products.
In this case, a chemist named Greenberg worked for a cleaning products company, Buckingham. He left Buckingham of his own accord and was hired by one of Buckingham’s distributors, Brite Products Co. Within a short time of Greenberg working at Brite, his new employer had begun a manufacturing business, and the company had begun making three cleaning products that were essentially identical to products made by Buckingham.
The case hinged on two points. 1. How had Greenberg come to know the ‘recipes’ for the cleaning products. If it could be shown that Buckingham had taught Greenberg the formulas, then the court would have a problem with Greenberg’s giving the formulas to Brite. But if Greenberg devised the formulas himself, then he would have the right to take them with him, unless…
2. He had entered into some binding covenant with his employer that expressly forbade him from doing so.
Issues
The court was mindful of any effect their decision would have in disrupting the mobility of employees (from one company to another). It was suggested that employees moving from one company to another was very conducive for technological advances (sharing of skills and minds across an industry). And in an age of atomic bombs and superpower rivalry, the court was hesitant to tamper with this employee mobility
The question of whether there is an implicit non disclosure covenant between employee and employer was visited. In this case the court found that because Greenberg discovered the formulas himself, there was no implied secrecy covenant between employer and employee (as there would have been if the employer had given Greenberg the secret formulas).
Basically the court found that an employee has the right to use his general knowledge, experience, memory and skill at a future employer, so long as he didn’t disclose any trade secrets that the former employer had given him.
Lastly there is this concept of ‘fairly’ obtained trade secrets. “Ownership of a trade secret does not give the owner a monopoly in its use, but merely a proprietary right which equity protects against usurpation by unfair means.” As long as trade secrets are ‘fairly’ gotten, it’s fine to use them.
———–
Whyte vs Schlage (2002)
Overview
This case has to do with trade secrets, and in particular whether the doctrine of inevitable disclosure applies in California. Whyte is V.P. of Sales at Schlage Lock company. He resigns and is hired immediately by Kwikset Lock company a Schlage competitor. Schlage accuses Whyte of giving Kwikset numerous trade secrets of various types, including details of Schlage’s sales contract with Home Depot (referred to as a line review).
Facts
Whyte signed a ‘confidentiality’ agreement with Schlage to protect their proprietary information. He did not sign a covenant not to compete.
Issues
The court ruled that Whyte did know some Schlage trade secrets that had to do with marketing strategy. But it also denied that other knowledge that Whyte had could be considered a trade secret. This included market research, and the Home Depot line review. The court decided, for lack of evidence, that it had no reason to overturn the decision of the lower court that had found that Whyte did not threaten to or actually misappropriate Schlage’s trade secrets. It is not clear what part of the testimony convinced the lower court that Whyte did not misappropriate the trade secrets. But cited Schlage’s evidence that Whyte disclosed trade secrets to Kwikset was circumstantial.
Misappropriation is generally speaking, improper acquisition of a trade secret or its nonconsensual use or disclosure.
Doctrine of Inevitable Disclosure – This is the idea that if an employee who knows trade secrets goes to work for another company in the same capacity as his previous job, he will inevitably share the trade secrets with the new company. (unless he has the ‘uncanny ability to compartmentalize information’) Therefore the former employer should have the right to prevent the employee going to the competitor. The California court ruled to reject the Doctrine of Inevitable Disclosure in California because it is “contrary to Caliifornia law, and creates an after-the-fact covenant restricting employee mobility.”
Privacy in the Workplace
April 29th, 2009
<!–[if gte mso 9]> Normal.dotm 0 0 1 701 3931 University of California, Berkeley 80 17 4913 12.0 <![endif]–><!–[if gte mso 9]> 0 false 18 pt 18 pt 0 0 false false false <![endif]–><!–[if gte mso 9]> <![endif]–>
Jane Doe v XYC Corp (2005)
Overview of the Facts
An Employee of XYC Corporation repeatedly accessed ‘pornographic websites’, including child pornography using his work computer, and some of these incidents were reported to the management. Several of the reports were initially ignored, before the Employee was instructed to stop his misconduct and ‘non-business’ use of company computing and network infrastructure. However this did not result in the Employee permanently refraining from accessing pornographic material at the work site.
The Employee uploaded three nude and semi-nude images of his 10-year-old step daughter (Jill Doe) to gain access to a pornographic website. He had been secretly videotaping and photographing Jill at their home. Photographs of Jill found in a dumpster outside XYC corporation led to the Employees arrest. It was found that he had downloaded several pornographic photos on the work computer, had email correspondences and interactions with various websites regarding child pornography.
Major Issues Discussed
Plaintiff Jane Doe on behalf of her daughter Jill Doe appealed the decision to dismiss the XYC Corporation of its responsibility to monitor and report activities of the Employee, which would have helped to contain the harm to Jill Doe.
The initial summary judgment had dismissed XYC corporation on the grounds that it “had acted as a reasonably prudent corporation” by instructing the Employee to stop the misconduct. The corporation did not have a duty to invade the privacy of the Employee and also because the harm to the plaintiff (Jill Doe) was not inflicted on XYC Corporations property.
These dismissals are reversed by the appellate court, after an extended discussion of issues concerning
<!–[if !supportLists]–>a. <!–[endif]–>ability of XYC corporation to monitor the Employees activities
<!–[if !supportLists]–>b. <!–[endif]–>right of the corporation to monitor the said communications of the Employee
<!–[if !supportLists]–>c. <!–[endif]–>duty of the corporation to know about the activities regarding child pornography
<!–[if !supportLists]–>d. <!–[endif]–>duty to take action to prevent the continuation of the Employee’s activities. and
<!–[if !supportLists]–>e. <!–[endif]–>the harm to Jill, as a failure for the XYC corporation to act appropriately.
The court established the XYC Corporation did have the ability, and did monitor its Employee’s Internet activities, and on several occasions was aware of him surfing pornographic web sites, including those that concerned child pornography. XYC had clearly mentioned that communications and computer use was monitored and cannot be considered to be ‘private communications’, and that the Employee and no reasonable expectation of privacy.
In relation to the duty of XYC to take action to prevent the Employee’s actions, the court highlighted issues relating to a) Employee’s use of equipment owned by XYC for transmitting the images, b) the clear direction to report suspected ‘activities relating to material involving the sexual exploitation of minors’ as part of the Protection of Children from Sexual Predators Act of 1998. The court discussed the applicability of Restatement (Second) of Torts § 317 to computer equipment and Internet use, that have implications for how much Employers are responsible for their Employee’s activities, which bring harm to third parties.
The court found that § 317 was applicable because of the special relationship between the XYC Corporation and the Employee (employer-employee). XYC had ignored the information it had about the actions of the Employee. By investigating the employee, the employer would have discovered that the employee was involved with child pornography that posed threat to others, including (but not necessarily) Jill. This was only a possible action, and the court mentions that the establishment of a proximate cause presents a contested issue for a jury. However the court also stated that the assessment of ‘harm to plaintiff’ is outside of the scope of the current record, and remanded the case.
Some Implications for Employers
Employers need to monitor and assess Internet and computer usage, and take affirmative action and investigate to prevent harm to a third party. There should be clear policies that specify what communications can and which are not monitored, to shield against liabilities involving employee actions. In view of the Doe vs. XYC monitoring and privacy policies of corporations determine which communications are seen as private communications in court, and may affect the liability of an organization. “This case might (even) suggest that an employer’s strict orders regarding Internet policies provide little protection against liability if the employer knows of its employee’s illegal behavior.” (Johnson, Jamila. 2007). A widespread citing of the ruling could possibility have the effect of limiting monitoring and create greater privacy of employees at work.
Related Sources
Tort Law Overview [link]
§ 2252. Certain activities relating to material involving the sexual exploitation of minors [link]
Employee Internet Misuse: How Failing to Investigate Pornography May Lead to Tort Liability [link]
Quon vs. Arch Wireless
Overview
Quon, a member of the Ontario, CA police department, used a city issued two-way pager to send and receive text messages. The City had a computer and Internet policy that did not explicitly cover text messages, but suggested it reserved the right to audit messages. Quon repeatedly exceeded a known monthly character limit and, after a fourth violation, transcripts of his messages were given, without warning or his consent, to the city of Ontario by Arch Wireless. Quon, along with three other Appellants with whom Quon exchanged messages, argued that the SCA and their fourth amendment rights were violated in the process. Determining whether or not Arch was, under the SCA, an electronic communications service (ECS) or a remote computing service (RCS), whether or not the Appellants had a reasonable expectation of privacy in their text messages, and whether or not the search by the Department was reasonable were key to the decisions made by both the District Court and the Court of Appeals.
The District Court determined that Arch was an RCS and not liable for revealing the text messages. A jury trial concluded that search was reasonable because the intent was to determine the efficacy of the character limitation and not to discover misconduct. The District Court also determined that there was a reasonable expectation of privacy due to the casual policy and practice for dealing with text messages and overages. Appellants filed a motion to amend or alter the judgment and motion for a new trial, which was denied by the district court.
The U.S. Court of Appeals, 9th circuit disagreed with the District Court and categorized Arch as an ECS. An ECS is “any service which provides to users thereof the ability to send or receive wire or electronic communication”, which describes the text messaging service. Additionally, the messages were held in “electronic storage” by Arch, but not at the request of the subscriber emphasizing that Arch was not providing an RCS storage service to Arch, but that the messages were stored as a result of the communication service.
An ECS cannot release stored content without the lawful consent of an addressee or intended recipient. The City is only a subscriber. Arch knowingly turned message transcripts over to the City. As an ECS, knowingly revealing message content violates the SCA 18 U.S.C. 2702(a)(1). The Court of Appeals judged in Appellants favor of their claims against Arch. The Court of Appeals also held that the Appellants had a reasonable expectation of privacy for the contents of their text messages because, for Quon, of the casual “operational reality” (if you paid your overages, your messages would not be viewed) and for the other Appellants because the contents of “messages” derive fourth amendment protection the same way the contents of a letter do.
The U.S. Court of Appeals, 9th circuit disagreed with the district court’s decision that the search was reasonable. While the intent was to evaluate the character limit and potentially help the employee, the search was “excessively intrusive”. There were other alternative approaches that the Department could have used to evaluate whether Quon’s overages were work related.
Issues
Quon v. Arch Wireless highlights problems that arise with new communication technologies and privacy. As evidenced by the Court of Appeals comparison of text message content to the content in letters, separation of delivery and content information can continue to be applied to new communication mechanisms providing protection for message content under the Fourth Amendment. The ruling also indicates that messages stored after retrieval as a result of an electronic communication are protected under the SCA requiring that law enforcement have a warrant and provide notice in order to gain access to stored electronic messages. This is a deviation from previous opinions that once a message is accessed it is no longer in electronic storage and it loses protection.
The case also draws attention to the problems that can arise when an employer distributes and makes use of a communication technology without a clear and explicit policy and practice around use and privacy.
Supplemental Resources
EFF [link] and Gigaom [link] analyze and comment on the opinion
Employee Monitoring: Is there Privacy in the Workplace?
Posted by Mohit, Gopal, and Heather
Privacy in the Workplace
April 29th, 2009
Quon vs. Arch Wireless
Overview
Quon, a member of the Ontario, CA police department, used a city issued two-way pager to send and receive text messages. The City had a computer and Internet policy that did not explicitly cover text messages, but suggested it reserved the right to audit messages. Quon repeatedly exceeded a known monthly character limit and, after a fourth violation, transcripts of his messages were given, without warning or his consent, to the city of Ontario by Arch Wireless. Quon, along with three other Appellants with whom Quon exchanged messages, argued that the SCA and their fourth amendment rights were violated in the process. Determining whether or not Arch was, under the SCA, an electronic communications service (ECS) or a remote computing service (RCS), whether or not the Appellants had a reasonable expectation of privacy in their text messages, and whether or not the search by the Department was reasonable were key to the decisions made by both the District Court and the Court of Appeals.
The District Court determined that Arch was an RCS and not liable for revealing the text messages. A jury trial concluded that search was reasonable because the intent was to determine the efficacy of the character limitation and not to discover misconduct. The District Court also determined that there was a reasonable expectation of privacy due to the casual policy and practice for dealing with text messages and overages. Appellants filed a motion to amend or alter the judgment and motion for a new trial, which was denied by the district court.
The U.S. Court of Appeals, 9th circuit disagreed with the District Court and categorized Arch as an ECS. An ECS is “any service which provides to users thereof the ability to send or receive wire or electronic communication”, which describes the text messaging service. Additionally, the messages were held in “electronic storage” by Arch, but not at the request of the subscriber emphasizing that Arch was not providing an RCS storage service to Arch, but that the messages were stored as a result of the communication service.
An ECS cannot release stored content without the lawful consent of an addressee or intended recipient. The City is only a subscriber. Arch knowingly turned message transcripts over to the City. As an ECS, knowingly revealing message content violates the SCA 18 U.S.C. 2702(a)(1). The Court of Appeals judged in Appellants favor of their claims against Arch. The Court of Appeals also held that the Appellants had a reasonable expectation of privacy for the contents of their text messages because, for Quon, of the casual “operational reality” (if you paid your overages, your messages would not be viewed) and for the other Appellants because the contents of “messages” derive fourth amendment protection the same way the contents of a letter do.
The U.S. Court of Appeals, 9th circuit disagreed with the district court’s decision that the search was reasonable. While the intent was to evaluate the character limit and potentially help the employee, the search was “excessively intrusive”. There were other alternative approaches that the Department could have used to evaluate whether Quon’s overages were work related.
Issues
Quon v. Arch Wireless highlights problems that arise with new communication technologies and privacy. As evidenced by the Court of Appeals comparison of text message content to the content in letters, separation of delivery and content information can continue to be applied to new communication mechanisms providing protection for message content under the Fourth Amendment. The ruling also indicates that messages stored after retrieval as a result of an electronic communication are protected under the SCA requiring that law enforcement have a warrant and provide notice in order to gain access to stored electronic messages. This is a deviation from previous opinions that once a message is accessed it is no longer in electronic storage and it loses protection.
The case also draws attention to the problems that can arise when an employer distributes and makes use of a communication technology without a clear and explicit policy and practice around use and privacy.
Supplemental Resources
EFF and Gigaom analyze and comment on the opinion:
http://www.eff.org/deeplinks/2008/06/new-ninth-circuit-case-protects-text-message-priva
http://gigaom.com/2008/06/28/quon-v-arch-curb-your-enthusiasm/
Supplemental Reading
Employee Monitoring: Is there Privacy in the Workplace?
Posted by Mohit, Gopal, and Heather
Informing Public Policy
April 29th, 2009
Five Challenges for Regulating the Global Information Society
by Pamela Samuelson
1. Old law or new law? Can existing laws be adapted to the regulation of the Internet or are new ones required?
- Convergence of media. Should internet streaming be treated like broadcast television? Like passive content providers? Should it depend on the way it’s delivered? The FCC has been hands-off in order to foster new business models and lower the cost of content & service delivery.
- Competition and Antitrust. ie Microsoft. Generally can be adapted for software and Net companies.
- Copyright. Generally adaptable, legislation is trying to keep pace with the technology.
- IP of databases. The EU protects the contents of databases, but the US and Japan are looking at unfair competition principles instead.
- Personal information privacy. The EU has highly legislated this, and Canada is working on it, but the US is leaning towards industry self-regulation.
2. Proportionality. How to form a reasonable and proportional response in new regulations?
- Indecent speech on the internet. The Communications Indecency Act (1996) was so broad as to interfere with the free speech of adults. Reno vs. ACLU (1997) ruled it unconstitutional. (You can’t make the entire Internet suitable for small children.) In response, the Child’s Online Protection Act (COPA, 1998) regulated material “harmful to children” on commercial sites, though that too was deemed unconstitutional in 1999.
- Europe goes too far. In majority US views, EU database & personal data protections are disproportionately overprotective; they could harm legitimate business uses of databases and firms have incentives to protect personal data.
- Clinton. “Framework for Global Electronic Commerce”: Regulations should be predictable, minimalist, consistent, and simple to avoid disproportionate response.
3. Flexibility. Adapt to rapidly changing circumstances.
- Aim for technology-neutral
- Keep it simple. ie UETA vs UCITA – UCITA is more complex and advantages certian technologies; UETA may be more successful with its simplicity.
- Don’t legislate ahead of technology. ie ‘electronic agents.’ Wait for basis of commercial practice.
- Accurate over original. Reflect actual use.
4. Preserving Values.
- Value privacy vs use of cookies & data mining. EU legislated.
- Value encryption – munition or free speech?
- Fair use rights. If copyrighted materials have technical protections, can you circumvent the tech protection for fair use purposes?
- Fair use rights and contract law. Mass market licenses with terms that prohibit what would otherwise be fair use?
5. Transnational Cooperation.
- Possible ways: agree on guidelines first, one nation proposal as a basis for debate, reciprocity-based rules (ie EU privacy protection), policy interoperability.
Quote: “Information may be the principal commodity of an information economy in an information age, but policymakers need to realize that information is not just a commodity. It is also an essential input to innovation, knowledge creation, education, and social and political discourse. If information is commodified too much, these socialvalues may be impaired.”
Comment: Goal: legislating only when necessary, and to a reasonable degree that maintains flexibility, while also preserving societal values and cooperating with other countries. Seems like a great goal, but difficult to achieve.
Aviel D. Rubin, United States Election Assistance Commission, Hearing on Voluntary Voting Systems Guidelines, Panel on Voter Verified Paper Audit Trail, Washington D.C. (June 30, 2005).
ACCURATE: Public Comment on the 2005 Voluntary Voting System Guidelines. Submitted to the United States Election Assistance Commission. September 30, 2005
Background: This comment was written by a multi-institution, interdisciplinary, academic research project funded by the NSF’s “CyberTrust Program”. ACCURATE was established to improve election technology. This research group was established to investigate software archetecture, tamper-resistant hardware, cryptographic protocols and verificaiton systems. They also evaluate the system usability and how public policy can better safeguard voting nationwide.
Argument: Voting systems must ensure security, privacy, transparency, usability, accessibility and equality. The current guidelines do not do a good enough job tranlsating these democratic values into workable systems.
II. Framework for Voting System Assessment: 2005 guidelines fail to address the central structural flaws of the 1990 and 2002 standards that resulted in an election process with unacceptable levels of incidents and vulnerabilities.
The research group recommends four solutions for improving the Election Assistance Commission’s (EAC) process for certifying and evaluating voting systems.
III. Increase Transparency
- The EAC must formalize and regularize the development of the guidelines
- The process must incorporate a meaningful period for public comment
- EAC must facilitate greater government and public oversight of the testing an certification process
- Previous transparent functions of our election process must remain transparent and not hide behind proprietary electronic systems. They should be reviewed by independent experts
2005 Stop Gap Recommendations: • Certification results regarding a system’s performance and the exact tests performed must be made available to computer security experts and other members of the public. • Source code and related information must be available to review by independent experts.
IV. Provide Enhanced Security
- The current guidelines are unable to provide assurance of security because their security evaluation process is inadequate
- The guidelines must focus on absence of functionality not just confirming functionality for security evaluation
- State-of-the-art usability testing by actual voters must be priority
- The guidelines should address issues of equality
certified voting system.
2005 Stop Gap Recommendations: • Independent review of system security by panel of external experts. • Elimination of COTS loophole in security evaluation—all software in a voting system must be subject to inspection and testing. • EAC must announce a timeline now for the elimination of the COTS loophole to put vendors on notice and allow them time to comply. • Penetration testing as part of certification.
V: Systems Perspective
Commenters argue that one should take the perspective of voting machines as one aspect of a system, rather than evaluating the machines as independent of the contexts they will be used in. This means that field data ought to be used to influence design guidelines. Field data includes things like poll worker and voter interaction with voting machines. This kind of data is essential to developing voting systems where voters can vote “without confusion, without error, and without losing confidence in the system itself”.
With regards to accessibility, system design must take into consideration all types of people (all races, ages, classes, etc.) when evaluating usability. The Guidelines must define the degree of usability to expect, moving away from mere functional testing, and must define this degree with respect to all groups of voters. Additionally, accessibility is not just about allowing those with functional impairments to vote, but those with language barriers as well.
If we want to ensure a fair and just voting process, voter privacy must be respected, so independent voting is important. Because of this, these accessibility considerations must take place in design and not at the polling place (which usually takes the form of help from vote staff).
Within the design space, some examples of accessibility technologies that must be covered by the Guidelines are screen contrast, the rate of audio output (with special considerations for maintaining a conversational pitch), and the amount of alternate language options.
With all of these considerations in mind, the Guidelines must require that actual field data be fed back into the voting machine industry to correct any actual empirical problems that can be identified. One means of gathering this field data would be parallel monitoring, a system of video taping pre-determined votes being cast and then comparing the video record with the vote data. This would allow design decisions to be tested in an actual voting environment. An added benefit of using field data is that it can indicate certain populations that experience more problems than others.
VI: Needed changes in development of the Guidelines
A continuous and ongoing certification and de-certification process is better than certifying a system just once. Systems should be periodically re-examined based on new field data, for example. The commenters also ask that the Guidelines be implemented sooner than 2008. Commenters also expressed the need for meaningful public comment. This was in response in part to the comment period for the 2005 guidelines taking place just 3 days after their release.
Conclusion:
“Past elections have eroded public confidence in the trustworthiness, fairness and accuracy of voting systems and ultimately elections. It is imperative to restore public confidence. Voters and election-related jurisprudence demand that every vote has equal weight and each vote is counted. Voters deserve to cast their votes with equal dignity without regard to disability or language. Voting systems should accurately capture voter intent, be fully auditable, secure, and transparent enough to support meaningful public oversight.”
Comments:
Is it even possible to accommodate usability needs of all groups in the country? Should we tolerate voters who just can’t understand simple digital technologies? What should the line be where we say: any normal person could understand how to use a touch screen, we aren’t going to accommodate your needs in the design of our system? And if this line must necessarily get drawn, how can we reconcile this with basic conceptions of democratic participation?
Re: Comments on RIN 1400-AB93 Electronic Passport
The government needs to consider the security & privacy implications of using RFID chips in passports.
The new data format increases risks, though it contains the same information that is on the data page of a passport and biometric data.
- Similar example: Magnetic data stripe on drivers’ licences used to verify age; some bars captured all of the data and used it for marketing purposes – feature creep from change of for.
Ease of data accessibility & capture:
- Skimming. Data can be read without the knowledge & consent of holder with an off-the-shelf RFID reader. Chips can be read from up to 30 feet away despite standards of 10cm.
- Eavesdropping. Interception of data while it is being accessed by a legitimate reader. Shielding readers proposed.
- Problems from skimming and eavesdropping: Identity theft, tracking of passport holders, black market value of passport makes holder a target.
Cloning:
- Creating fake passport copies. Relatively easy with commercial RFID chip + stolen passport.
Biometric instability:
- Proven inaccuracies could make false negatives the norm
- Current facial data included doesn’t qualify as biometrics
Making electronic passports more secure with simple measures:
- Encryption. Gov’t reasons for not, and why they fail:
- Data is visible on the data page of the passport anyway. But new data format has increased risks.
- Encrypted data will take longer to read. The small amount of data on the chip is fast to en/decrypt.
- Requires more technical coordination with other countries. Coordination exists under int’l Basic Access Control standards.
- Faraday cage. Passport cover should contain RF blocking material. Alternately, electronic lock on chip that must be swiped through a special reader to unlock, as endorsed by the EU.
- Biometrics Options. Facial biometrics maximum accuracy is 90%, which would be a massive problem on a large scale. Fingerprints more accurate, but still errors. Iris untested. Need a contingency plan for when biometrics fail.
Final request: use available technology to protect against known and obvious threats.
Comment: These are all logical recommendations, and it is surprising that basic security measures have not been seriously considered or implemented.
Cheers,
Alex, Laura, and Nathan
API and Privacy
April 23rd, 2009
Last semester, I collected data from Facebook for a class project. The collected data was friendship network in each domain.
Generally speaking, I think your friend list should not be exposed to those who are not your friend unless you choose to expose. However, I was able to do that anyway through the API.
The Facebook API provides a function that confirms whether two IDs are friends or not. Another function confirms if an integer is valid ID of Facebook. Since Facebook ID is just an integer, I put two IDs ranging from 1 to 10000 and checked which two are friends. Let me illustrate the process below in detail.
| ID | 1 | 2 | 3 | 4 | 5 | … |
| 1 | N/A | Yes | No | No | Yes | |
| 2 | N/A | No | Yes | No | ||
| 3 | N/A | Yes | No | |||
| 4 | N/A | No | ||||
| 5 | N/A | |||||
| … |
By starting with (1-2), I tested through all possible pairs of IDs. Since CEO Zuckerburg’s ID is 4, he is also included in my collected data. More interestingly, the friend list of some IDs were not visible via a usual web browser.
After this experimental attempt, I realized that privacy could be sometimes compromised through APIs, because APIs could grant the access to private information to third-party entity. The access through API is sometimes freer than the one through normal web pages.
As APIs are more widely used, I think more consideration should be put into privacy concerns in the API area.
Non-PII becoming PII
April 23rd, 2009
I used a contact form on a website yesterday to send a request for help. The company responded promptly this morning via email, but I noticed that there was more information in the email than I provided myself. The quoted reply portion of the email looked like this:
Name: [my name]
Comments: [my comments]
IP Address: 24.xxx.xxx.xxx
Country: UNITED STATES
Region: CALIFORNIA
City: BERKELEY
Matching IP addresses with specific geographic regions is not always accurate, but it definitely worked here to tell the company where I was writing from. Now with an automated lookup, this company can take information that seems anonymous and turn it into information that provides greater identification. Who knows what IPv6 will bring?
Week 13: Professional Ethics and Approaches
April 21st, 2009
Prepared by Karen Braverman, Ben Cohen, and Jesse Dedman
Analysis
All three models are helpful to people who are facing difficult ethics decisions. But no model offers enough guidance to make a final decision on any one ethical dilemma.
ACM Code of Ethics
The ACM Code provides a framework for describing guidelines and values that are relevant to computer professionals at the general, individual and leadership levels. But the Code offers no guide for prioritizing one value over another in the case of a conflict. It mentions conflict only in passing when it discusses the responsibility of the professional to make an “ethical judgment” and then accept the consequences. Since the entire point of explicitly making ethics guidelines is to help people manage difficult decisions when values may be in conflict, the lack of guidance about this in the code is a weakness.
Paramedic Ethics
It gets better. If the Code was helpful but weak, we found the Paramedic Ethics paper to be helpful but also weak and even slightly absurd. We understand that the authors’ intent is to help computer professionals organize themselves in the face of an ethical dilemma and explicitly enumerate the actors and the rights and obligations in the problem. We felt the alternative and obligation diagrams that are drawn out in the cases of George and Jill were comforting in their simplicity. But we also found the simplicity to be a trap. In the case of George, why is his boss not in the diagram? Or coworkers? The way the diagram is drawn, differences in the level of detail and omissions of actors could lead to different outcomes. If George resists, he may be passing the buck to a coworker and the whole cycle starts again. And if he is in the situation of being a whistle blower he may need to weigh the decision of ruining his co-worker’s career along with the reputation of his company. The authors acknowledge that different assessors will come to different outcomes based on their initial values, but this point is more dramatic than the authors intimate.
It is also worth noting that in both cases, once they had gone through the four steps of the analysis, George and Jill both “should” have chosen a social contract alternative that was not the product of the process but relies on negotiation and consensus with other parties. The fact the authors do not support their process with examples that show it will lead to the best outcome is troubling to us.
And REALLY, who is going to spend all that time drawing diagrams and spreadsheets to make an ethics decision that is time sensitive? The fact that this is called “paramedic” is funny in itself. Imagine a real paramedic about to give CPR who then stops to draw diagrams and tables. We decided that a multi-step process that identifies the alternatives, parties, obligations, opportunities and vulnerabilities is something that is more likely to be done tacitly in the real world rather than explicitly. The main value that goes into this model is about being explicit and organized. But once things are written down and noted with pluses and minuses, it is still up to the user of the model to prioritize values and guidelines that are in conflict. The emphasis on explicit and organized analysis makes this is a cover-your-ass model of ethics rather than a real problem solving model.
The authors note that during the design process, often values that seem contradictory (such as transparency and privacy) are in fact not so contradictory but result from contradictory material constraints they imposed on the system. They recommend trying to resolve such situations by redesign. When such situations can not be resolved, they turn into value-oriented trade-offs.
The third and last aspect is the verification, in which designers assess whether the values important to them have been incorporate into the system. It can be done via internal testing among designers, usability testing, interviews, and more.
ACM Code of Ethics
The code is a high level document, providing ethical guidelines for ACM members. It is the ACM’s intention that the code would be used as a basis for resolving any future conflict with ethical principles, rather than as regulations. ACM guidelines will serve as supplement and will be changed more frequently.
The Code of Ethics is divided to three parts: The first part lists general moral imperatives, emphasizing that computer ethics are derived from more general ethical principles; the second part provides specific professional principles to the computer science field, and the third addresses the perspective of the organization rather than that of the individual. These may apply to organizations and / or their leaders.
The organizational leadership principles focus on the following responsibilities:
1. social responsibility
2. enhancing, rather than degrading, quality of life
3. define and enforce proper and authorized use to avoid harm
4. conduct users needs assessment to define system requirements
5. articulate and support policies to protect privacy and dignity
6. educating organization members on computing
John Morris and Alan Davidson, “Policy Impact Assessments: Considering the Public Interest in Internet Standards Development,” August 2003
The authors present yet a different approach than that of Collins and Miller. The authors call standards bodies to establish internal, systematic assessment processes to ensure that public policy issues are taken into consideration as a part of the setting standards process from the start. According to their approach, the involvement of policy experts and public interested advocates in the discussion and decision-making processes of standard bodies is helpful and necessary, but not sufficient, for several reasons that they go into in detail. The authors therefore strongly advocate for early and systematic consideration of public policy issues by standards organizations, to address the importance of protecting public interest and to compensate for the public interest community’s inability to cover it by itself. They are aware of the time and complexity added to the entire process but argue that this is compensated by fewer post-development marketplace and regulatory obstacles.
The need to increase consideration of public policy concern within standards bodies
Currently, standards development processes within standards bodies do not recognize potential public policy impacts or address those impacts. To explain the significance of technical standards, the authors point to the example of the Internet, which is founded on the core idea that different computers and networks can connect through technical standards. However, very often those standards are agreed on in private bodies such has IETF and W3C, while their decisions have serious implications on the public, such as property rights, personal privacy concerns, and public access to information. These implications grow owing to “broad societal embrace” of the internet and its rapid change.
Specifically, they point to the example of introducing IPv6 in 1998: IPv6 ties IP address to the MAC address and therefore the computer is identifiable and traceable regardless of location or connection means. After much debate, IETF published alternatives to IPv6. Other examples include DRM and fair use, ebooks and blind users, etc.
The authors don’t deny that public policy concerns are not addressed by standards bodies, just that they are done in an ad-hoc manner and therefore lack a systematic analysis and input outside feedback.
Indeed, in the early Internet days, technical requirements of openness, accessibility, anonymity, and robustness overlapped with public values. However, the overlapping at the outset was a “coincidence” and we cannot count on that happening again. Two major factors contributed to this change: the Internet’s growth from a very small user group to wide worldwide use, and its commercialization since the early 1990s, which introduced private interests to a mainly research-based standards community. As a result, diverging market interests prevent participants’ agreement on network architecture, and private interests come at the expense of public interest.
The initial challenge is identifying the design elements that might affect public policy.
Limits of public policy advocates involvement in standards setting processes
The authors point out that while involvement of public policy advocates is necessary and useful, it is often limited, for several reasons. First, to be effective, public policy advocates must understand technical details about the issue at hand, and commit to substantial investment of time and effort.
The authors see intervention as essential: only public interest advocates can detect subtle issues, evaluate gravity of issue and possible solutions, and protect public interest against commercial agendas. Also, without expert advice, some bodies will avoid addressing the issue altogether.
However, the authors are convinced that current intervention is not sufficient. For public interest participation to be sufficient, advocates must have a mixture of public policy experience and technical knowledge that is rare to find. The long-term commitment of time and resources that is usually required is difficult for most non-governmental organizations.
Other reasons why advocates’ participation does not yield successful results are the standards organization opposition, multiple standards organizations to cover, and the mere fact that some standards don’t apply to public interest.
Examples for public policy advocates involvement:
· Platform for Privacy Preferences (P3P) (1997) – involvement from inception: P3P lets users quickly interpret privacy policies and make informed decisions about disclosure. Public interest participation was critical to the development of P3P in providing input on all possible practices and implications for personally identifiable information (and as we have recently seen in the Ackerman paper for 203, critique was necessary)
· Open Pluggable Edge Services (OPES) (2001) – mid-process: proposed OPES would permit operators of servers mid-way to modify content in mid-stream from a server to a user. Issues raised: censorship, data integrity, user privacy. OPES met opposition from outside as well as internally from IETF. CDT submitted comments that started a review process. Result?
· GeoPriv working group (2001) – from inception: CDT and other advocates pushed the IETF to include strong protections for privacy in transmissions of location information. Result?
Developing a Public Policy Impact Assessment
The authors recommend that technical standards bodies develop an internal procedure for a brief, focused assessment of new technology proposals that will identify any public policy concerns. The purpose of the assessment is identifying the issues only, not addressing them. The procedure will not involve direct involvement of public policy experts of advocates.
Rather than asking public-policy oriented questions, issues should be broken down into concrete known technological elements. So, rather than “Does this harm privacy?” asking “Does this technology expose information to a third party?” would be more useful.
Standards bodies vary by the kind of technologies they deal with, and therefore different public policy issues arise for each. Implementation also varies depending on organizational characteristics (all-volunteer vs. staff, for example the W3C technology and society domain).
Impact assessment for IETF
When developing their impact assessment for the IETF, the authors followed the model used by the organization for security assessment, as well as a more general model for Internet designers published by one of the IETF’s committees. This model instructs Internet designers to consider those design elements both have a potential to raise public policy issues and are likely to arise within IETF standards. The point is that for each standards organization, the design elements that come up may be totally different, depending on the kind of technologies they deal with and their relation to public policy issues.
Collins, W. R. and Miller, K. W. 1992. Paramedic ethics for computer professionals. J. Syst. Softw. 17, 1 (Jan. 1992), 23-38.
The article suggests a set of ethical guidelines that constitute a methodology for computing professionals to make timely decisions ethically. The methodology is supposed to assist computing professionals when confronted with an ethically (although most often also technically) complex situation for which they need to either find a quick solution or they need a temporary resolution while they seek additional help, depending on the severity of the situation. The medical analogy is derived from the similarity to the way a medical emergency is managed by a paramedic.
They use their method to analyze two case studies of computer professionals taken from the work environment and suggest resolutions for the dilemmas they raise. We have provided a summary for the first below.
George is an electrical engineer working for an aerospace contractor as a quality control manager. His project develops a computerized control system for a new military aircraft. Even though the system passes simulation tests following patching that was done to fix some problems that arose during early simulations, George is convinced that there are fundamental flaws in the design that necessitate an extensive system redesign. He informed his supervisors that the current system might end up in plane crashes. However, his supervisors rely on the tests as assurance that the system is good to go to the next phase of flight tests.
George’s dilemma: should he sign off the system?
Arguments for signing off:
- Loyalty to employer
- Might be taken of the project
Arguments against signing off:
- Abidance by the AMC Code of Ethics
This case is in conflict with the second principle under the general moral imperatives, Avoid harm to others. Per the principle, harm is defined as injury or negative consequences. Computing professionals are asked to “minimize malfunctions by following generally accepted standards for system design and system”. George’s supervisors can rightfully claim that they have followed the imperatives: they conducted the early simulations, realized that there is a problem, patched the software, and then tested again. The software passed the tests and therefore the system should be fine.
As a compromise, one could make the assertion that George had not thoroughly assessed the system and that following the imperative, he should consult other computing professionals from outside the company before reporting such severe violations and causing much reputational and financial damage to the company. As the authors suggest in the introduction, the will to act ethically is not enough. Professionals must have the skills and knowledge to make the most ethical decision.
Computing Professional Specific principles that apply to this case are:
- Striving for highest quality (first principle): by refusing to sigh off the project, George would be following this principle.
- Knowing and respecting existing laws (third principle): If George decides to report the company or refuses to sign off the project, he must bear the consequences (would refusing to acknowledge the legitimacy of the post-patching tests be considered as violating a company regulation?)
- Accept and provide professional review (fourth principle): George is abiding by that principle.
- Give comprehensive evaluations (fifth principle):
- if George provides objective evaluation, we would be in a conflict of interest; if he doesn’t, he would be violating this principle.
- “any signs of danger from systems must be reported to those who have opportunity and / or responsibility to resolve them.
- Honor contracts:
- computing professionals’ ethical judgment prevails:
- whatever decision, computing professional would need to accept responsibility – including when acting “against one’s own judgment”.
The method is presented in an algorithmic form and assumes the user is a computing professional who faces one or more difficult ethical decisions. It follows the waterfall model for software life cycle it involved sequential phases but is also dynamically reversible. Users should iterate through the phases to get to the solution (but waterfall isn’t iterative?).
The method focuses on two central issues in solving computing problems: power relations and the most vulnerable group.
key terms:
- opportunity (principle 2.5) to gain from an alternative. Security opportunity: the potential of making more money
- vulnerability to lose from an alternative. Security vulnerability: the potential to lose one’s job
- power
- obligation
- right (complements obligation)
Court flunks high schoolers’ appeal on plagiarism database
April 21st, 2009
http://arstechnica.com/tech-policy/news/2009/04/headline-here.ars
As I mentioned in i202, TurnItIn.com is the company where my brother works. Located in downtown Oakland, the company provides plagiarism detection services for teachers and administrators, scanning through submitted papers and looking for similar phrases from a corpus of documents. The service also archives submitted papers so that they can be compared against papers that are submitted later on. Recently, a few students have tried to sue the company for copyright infringement, but a federal appeals court has ruled that this practice is fair use.