By Bhumika Sharma & Poonam Pant
All online communication passes through an intermediary of some sort, whether it is an Internet Service Provider (ISP), such as Comcast, or a platform, such as Google or Facebook. Governments have a number of choices for how to treat online intermediaries. They can go after the intermediary directly by making it criminally liable for user behaviour; make it civilly liable to private parties for monetary damages; require it to monitor user behaviour; create incentives to monitor users through a liability regime; encourage an intermediary to take down material as part of a notice-and-takedown regime; or require an intermediary to cut off a user’s Internet access.
Intermediary liability has traditionally been framed as “secondary” liability where “primary” liability lies with the individual or organization from whom the unlawful content or activity originated. The liability of an intermediary for its various activities is generally determined by a court of law. Since legislative provisions are evolving in this field, the extent varies from case to case and circumstance to circumstance.
Where a person has a legal grievance in relation to online content, or where content proves to be criminal, why pursue the ISP rather than the source of the content? Information intermediaries are often seen as potentially more lucrative targets for litigation than the originators of offending information. The question of jurisdiction may also play a role, for example where the originator is in a foreign jurisdiction while the intermediary is in the claimant’s home jurisdiction.
Indirect copyright liability is a liability regime derived from tort law. It has applied to ISPs in cases associated with online copyright infringements through court practice. The doctrine is initially drawn from the negligence rule in tort law and is the imposition of liability on a defendant who did not directly commit the violation.
Rationale vis-a-vis Liability of Intermediaries
There are strong arguments for imposing liability on Internet service providers for violations of cyber security. Liability would force ISPs to internalize some of the negative externalities they impose. Any indirect liability regime needs to be created by law rather than by contract, both because many relevant bad actors are beyond the reach of law and because transaction costs are a serious obstacle to any contractual solution.
Sophisticated saboteurs use the Internet’s topology to conceal their tracks by routing messages and information through a convoluted path that is difficult for authorities to uncover. The primary ISP can detect criminal behaviour by analysing patterns of use, much as a bank can detect credit card theft by monitoring patterns of purchases.
Aspects of Liability of Intermediaries
The unique feature of liability of an intermediary is that intermediaries will not be held liable for their contravention in the same way as an individual who originates the information or who instigates its transmission or copying. Most ISPs provide facilities for the storage, copying and retransmitting of information and many exercise significant controls over the nature of information transmitted through their functions.
Civil Liability
Intermediaries may be made liable for contractual breaches and violation of competition laws in some cases. An intermediary providing Internet transaction services faces the risk that its actions or inaction may result in failure of a transaction and may be forced to compensate a party for resulting losses.
For ISPs that risk is two-fold: first, communication failure may prevent the transaction from taking place, which may be considered a failure of basic service provision; secondly, failure of an additional service, such as loss of stored data, may be considered a failure of enhanced service provision.
Another obligation receiving media and industry attention, particularly because of its importance to e-commerce, is informational privacy. In most jurisdictions, where ISPs transmit information to and from third parties and host information for that purpose, there is a growing consensus that they should not be held absolutely liable for breaches of law committed by users.
Liability is tending to be imposed where the ISP knows or has reason to believe that the content it is transmitting is unlawful; regardless of knowledge, where it benefits directly from the transmission; and, though increasingly unpopular, where the ISP fails to take reasonable steps to determine whether the information it transmits is unlawful.
Contractual Liability
Liability will arise either from express terms of the contract or from those implied by law, and the terms in development contracts will be quite different from those in supply contracts.
In their most basic form, ISPs are the glue that binds the Internet together through the supply of TCP/IP packet switching services, allowing third parties to communicate data packets across the network of networks. To facilitate information transactions, ISPs provide communication services such as access and information storage. ISPs and other Internet intermediaries may also provide additional services such as search facilities and indexes.
Where basic or additional services are defective, liability will normally be based on established legal principles of contract and tort. It may not be immediately apparent how best to apply existing principles to services previously unconsidered by legislators and courts.
Liability for Intellectual Property Right Infringement
Technology has had a profound impact on the perception of intellectual property and the appropriate distribution of rights traditionally attached to trademark, patent and copyright in the global context. Although technological advances have created unprecedented opportunities for economic prosperity, legal systems have had to adapt to maintain firm standards while fostering financial growth.
International intellectual property conventions have been consolidated under the auspices of the convention establishing the World Intellectual Property Organisation (WIPO). The Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) has formed a WTO-WIPO union by integrating much of WIPO’s law into the WTO trade regime.
The provisions of the WIPO Copyright Treaty, key terms of the Digital Millennium Copyright Act (DMCA), the European Copyright Directive and the Electronic Commerce Directive reflect guidelines for ISP copyright liability. Digital transmissions allow infringers to obtain and disseminate information quickly without being detected.
Despite the apparent diversity of contexts in which global safe-harbour provisions were enacted, the core principles in most statutes are rather similar. Intermediaries providing carriage or hosting services are generally expected to act passively and neutrally. No general obligation to monitor content hosted or transmitted is commonly imposed. The global norm is to establish passive-reactive schemes requiring or permitting intervention in third-party communications upon receiving allegations of copyright infringement.
Various approaches to ISP liability for copyright infringement exist in Australia, the European Union, Singapore, the United Kingdom and the United States. Although some provisions are concise and general and others spell out detailed expectations, each jurisdiction conforms to this global theme.
In short, ISPs presently do not know if they are liable for the behaviour of their subscribers, but they know that they can escape liability by cooperating with content providers who complain of copyright infringement. In the UK, Australia and Singapore, liability can be found based on authorization within copyright law.
Potential Liability for Third-Party Content
More complex issues arise when considering potential liability of online intermediaries or ISPs in relation to content which passes across or is stored on their servers. ISPs usually operate using software which processes information automatically and therefore transfer information without obtaining or seeking knowledge of its content or the nature of the transaction of which it forms part.
This lack of knowledge does not necessarily render them immune from legal action where third-party information infringes another’s rights. A general global consensus has developed that ISPs should not be subjected to the same liability standards as real-world publishers, but some limited level of liability in respect of information carried is appropriate.
Online infringements most often arise out of making certain content available to the public, rather than from the illegality of the content per se. An online intermediary which did not itself engage in the posting act should be held liable only as an accomplice where it has performed an act beyond its intermediating function.
An intermediary should be held liable for content only if it aided or abetted the unlawful posting act, and should not be held liable for nonfeasance or non-action, namely for not preventing or not stopping the unlawful posting act.
Criminal Liability
Criminal liability may be imposed in cases of defamation, pornography and representation of women in an indecent manner.
Defamation
Defamation is an intentionally false communication, either published or publicly spoken, that injures another’s reputation or good name, or holds a person up to ridicule, scorn or contempt in a respectable and considerable part of the community.
Traditionally, the common-law tort of defamation protects individuals against published statements that are false and harmful to reputation. Concerning defamation liability related to third-party content, traditional defamation law categorized information disseminators into publishers, distributors and common carriers. The extent of editorial control over content determines the extent of liability.
Actual knowledge and obviousness of defamation are two factors that give rise to a duty of care for ISPs. This may add clarity and predictability to the ISP liability standard without causing too much of a chilling effect on the Internet.
Defamation in India is regarded both as a tort and a crime in most legal systems. Liability of service providers regarding defamation falls into two categories – liability as distributors and liability as publishers.
Liability for Transmitting Obscene Material
The primary purpose of most obscenity laws is to prevent distribution of pornographic material, presumably on the ground that if individuals are prevented from distributing it, some motivation for producing it may be lost. Three approaches can be ascertained from existing laws.
The first approach criminalizes the knowing distribution of obscene material and allows ISPs to plead ignorance of content they host or transmit if they do not monitor their servers. The second criminalizes distribution of obscene material for gain, subject to a defence of lack of knowledge or reasonable suspicion. The third criminalizes knowing distribution while providing a specific exemption for intermediaries that merely provide access to other servers without actively participating in production or distribution.
Conclusion
In light of increasing online activities, there is a need to understand the liability of various parties to online transactions. Intermediaries in the online environment play a significant role. There are different aspects for which they may be made liable, namely civil, contractual, IPR and criminal liability. In India, the legislative framework with regard to liability of intermediaries is evolving. A more comprehensive framework is likely to emerge in coming years.