ezine

29 Aug 2011

The recent controversy and fallout relating to alleged practices of phone hacking and paying police officers for information at UK tabloid newspaper the News of the World has been headline news the world over. As police investigations progress it is almost inevitable that the laws relating to hacking, interceptions and bribery of police officers will come under the spotlight. In our first article, Hacking, Interceptions and Corruption - News All Over The World, we consider the relevant laws in New Zealand and steps businesses can take to ensure compliance with legal, industry and ethical standards generally.

The Copyright (Infringing File Sharing) Regulations 2011 (Regulations) shed more light on whether the new file sharing law is likely to achieve its purpose cost-effectively. In the second of a series of articles about issues arising from the new law, we consider the practical implications of the Regulations in Is the Price of the New Internet Piracy Law a Treasure that No-One Can Afford?.

Our third article, Law and the Internet: On Election Day, Be Careful What You Tweet, explores the application of the Electoral Act to users of social networking sites such as Facebook and Twitter.

---

Hacking, Interceptions and Corruption - News All Over The World

The recent controversy and fallout relating to alleged practices of phone hacking and paying police officers for information at UK tabloid newspaper the News of the World has been headline news the world over. As police investigations progress it is almost inevitable that the laws relating to hacking, interceptions and bribery of police officers will come under the spotlight. In this article we consider the relevant laws in New Zealand and steps businesses can take to ensure compliance with legal, industry and ethical standards generally. 

The News of the World Story So Far

On 10 July 2011 the News of the World, a subsidiary of Rupert Murdoch's News Corporation, ceased publication amid allegations of practices of hacking into the voicemail messages of individuals and paying police officers for information.

Allegations of phone hacking first arose back in 2005 in relation to articles about Prince William, resulting in the conviction of a News of the World reporter and a private investigator for intercepting voicemail messages on royal aides' phones. Suggestions of hacking on a much wider scale then followed in 2009, when UK newspaper The Guardian published an article suggesting that several thousand public figures may have been targeted by News of the World hacking attempts. The article reported that those who may have been affected included the then deputy prime minister John Prescott and film star Gwyneth Paltrow.

However, it has only been just recently that the alleged practices of the News of the World have become the subject of international attention, ultimately leading to the paper's demise. In early July claims emerged that the News of the World had hacked into the phone of a 13 year old murder victim and deleted messages, potentially impeding the police investigation. Further allegations soon followed, including that:

• the phones of relatives of deceased UK soldiers and 7/7 victims had been hacked; and
• the paper had condoned payments to police officers in exchange for information for stories. 

These events ignited public outrage. While police investigations and any subsequent legal proceedings will still need to be played out, the consequences for News Corp have already proven extremely damaging. The fallout for News Corp so far has involved:

• the cessation of the News of the World as a paper, with the issue of several public apologies;
• its share price on the Nasdaq and ASX stock exchanges plummeting, reducing its market value by billions of dollars (New Zealand Herald, 13 July 2011); and
• News Corp aborting its multi-billion dollar takeover bid for BSkyB.

The scandal has also seen the resignation of certain senior employees, and arrests of those thought to have been involved in illegal activities. 

New Zealand Hacking and Interceptions Laws

The New Zealand laws relating to hacking and the interception of communications perform the dual roles of:

• facilitating and permitting interception for lawful purposes, generally in relation to criminal investigations and matters of national security; and
• prohibiting unauthorised hacking and/or interception of private communications.

This reflects the need to on the one hand "arm" law enforcement and government security agencies with the necessary tools to carry out their functions during the information age, while on the other hand to protect the rights of individuals and businesses to have the privacy of their private information and communications respected. 

Laws Permitting and Facilitating Hacking and Interception

A number of statutes provide Government agencies with the ability to obtain warrants which extend to accessing information stored electronically. For example, under the Fair Trading Act 1986 (Fair Trading Act) the Commerce Commission can apply for warrants to search a particular place for the purpose of investigating a breach of the Act. Such a warrant will authorise the Commerce Commission to search for and remove documents, including material stored on computers. Any access to a computer permitted under a warrant under the Fair Trading Act or other applicable laws will not constitute a breach of the anti-hacking laws discussed below.

Interceptions of private communications are permitted in fewer circumstances:

• The Police can be issued with interception warrants to investigate offending by organised criminal enterprises, serious violent offences, terrorist offences, drug dealing offences and specified cannabis offences. 
• The Government Communications Security Bureau can intercept, with or without a warrant (depending on the circumstances), communications containing foreign intelligence. 
• The New Zealand SIS can obtain warrants authorising the interception of communications where (among other things) the interception is necessary for the detection of activities prejudiced to New Zealand security or for the purposes of gathering foreign intelligence information essential to New Zealand security.

The Telecommunications (Interception Capability) Act 2004 (Interception Capability Act) is designed to facilitate the execution of these warrants. The Interception Capability Act requires:

• network operators to ensure that every public communications network and telecommunications service they own, control or operate has "interception capability". Interception capability is essentially the ability to intercept telecommunications and obtain call associated data; and
• network operators and telecommunications service providers to assist surveillance agencies (such as the Police and the SIS) by making available technical personnel and providing other reasonable assistance.

Laws Prohibiting Hacking and Interceptions

Generally hacking and interceptions of private communications will constitute criminal offences if not permitted by a warrant or other applicable law. It is a crime to:

• Access a "computer system" without authorisation or a legal right. Maximum prison sentences range from 2 to 7 years, depending on whether the access was dishonest or by deception and whether any loss is caused or property, privilege, service or benefit is obtained. The concept of a computer system is broadly defined, capturing not only computers but also:

•  
  • 2 or more interconnected computers;
  • any communication links between computers or to remote terminals or another device;
  • 2 or more interconnected computers combined with any communication links between computers or to remote terminals or any other device;
  • any part of the items described above and all related input, output, processing, storage, software, or communications facilities, and stored data.
• Intercept a private communication by means of an interception device, however there are certain exceptions such as where the interception is carried out for the purpose of maintaining an Internet or other communication service to the public. This offence carries a maximum penalty of 2 years' imprisonment.

These acts might also constitute a breach of the Privacy Act 1993 (Privacy Act) and/or give rise to a civil claim based on an interference with privacy. Under the Privacy Act it is unlawful to collect personal information for an unlawful purpose and/or by unlawful means.

New Zealand Anti Bribery and Corruption Laws

As a foreword it is encouraging to note that Transparency International's Corruption Perceptions Index 2010 ranks New Zealand's (along with Singapore's and Denmark's) public sector as being the least corrupt of the 178 countries surveyed. Nevertheless, New Zealand still has a relatively comprehensive set of laws prohibiting the bribery/corruption of public officials. These laws are predominantly found in the Crimes Act 1961 and, in respect of police officers, the Crimes Act provides that any person who corruptly offers a bribe with intent to influence a law enforcement officer in his or her official capacity is liable to a term of imprisonment not exceeding 7 years. 

Compliance Practices for Businesses

The backlash from the News of the Worldcontroversy plainly illustrates the importance of lawful and ethical business practices. While it may be a fairly extreme example of what can go wrong, the potential consequences of unlawful or unethical business activities should not be underestimated. Clearly unlawful activities can lead to fines, damages or even prison sentences for individuals. However, the negative PR and damage to business reputation are often the first felt effects and can be the most serious.

There are of course some fairly simply steps that businesses can take to ensure compliance with applicable laws and standards. These include:

1. Obtaining a General Understanding: As a first step, obtaining a general understanding of the laws and standards applicable to the business. Some laws (such as employment laws and the Fair Trading Act) will be applicable to virtually all New Zealand businesses, while others will only be relevant to particular businesses. Without such an understanding or appreciation of the legal environment, it will not be possible to set appropriate operational business policies and protocols.
2. Keeping Up-To-Speed on Developments: Businesses also need to keep up-to-speed on developments to laws and standards affecting them. This might involve any combination of signing up to receive relevant legal or industry newsletters or publications and/or employing in-house counsel or some form of compliance officer whose responsibility it is to monitor relevant changes to laws and standards.
3. Policies and Protocols: Developing, making available to employees and otherwise implementing policies and protocols to ensure compliance and otherwise set expectations around which business practices are and are not acceptable. For example, a number of businesses set policies in relation to gifts and entertainment for clients, particularly those who may be public officials, to avoid suggestions or allegations of bribery or undue influence.
4. Compliance Training: In addition to notifying employees of the business policies and protocols, addressing this in employee compliance training may also assist. This could be part of the employee induction process and/or carried out on a regular ongoing basis. Any such training should be targeted towards the employee's role. For instance, call centre employees should receive training on the procedures to be adopted to avoid Privacy Act breaches. 
5. Checks and Audits: Compliance checks and/or audits might also be an option. This might involve (for example) a legal review of any advertising/marketing pieces before they are published, or audits of business systems to ensure that applicable regulatory and industry standards are being adhered to. 

Key Contacts

Karen Ngan
Matt Smith

Back to top

---

Is the Price of the New Internet Piracy Law a Treasure that No-One Can Afford?

The legal implications of the controversial new Copyright (Infringing File Sharing) Amendment Act 2011 (Act) have been considered in a number of articles, including our recent article Full Stream Ahead - Are There Leaks in New Zealand's New Internet Piracy Law? The Act will be accompanied by the recently-released Copyright (Infringing File Sharing) Regulations 2011 (Regulations), which are intended to address a number of procedural gaps in the Act. Provisions to be included in the Regulations were proposed in a recent paper by the Minister of Commerce (Minister) (available on the Ministry of Economic Development's (MED) website.

The commercial efficacy of the Act has been of particular concern to rights owners and internet protocol address providers (IPAPs), such as internet service providers. The Regulations shed further light on the commercial implications of complying with the Act, and whether the Regulations are likely to assist the Act in achieving its purpose.

Fees and Cost Recovery

The Act provides that, when an IPAP receives a notice of alleged copyright infringement from a rights owner (Rights Owner Notice), the IPAP must then give notice to the relevant account holder of the alleged infringement (Infringement Notice).

There is much interest in the fee IPAPs can charge rights owners for administering a Rights Owner Notice. Whether the fee is affordable for rights owners, and whether IPAPs can recover their compliance costs from rights owners, may determine whether the Act provides a financially viable regime.

The Regulations provide that an IPAP can charge a rights owner up to $25 per Rights Owner Notice sent to the IPAP. The Minister proposes reviewing the fee six months after the Act comes into force on 1 September 2011, as the MED has recommended calculating the fee based on the number of Rights Owner Notices sent, and the volume of notices is uncertain at this stage.

There is significant tension between IPAPs and rights owners as to the appropriate fee, if any, to be charged to rights owners for filing Rights Owner Notices. Setting the fee too high would add to the considerable cost incurred by rights owners in acquiring the information needed to file a Rights Owner Notice, such as the relevant internet protocol (IP) address. A high fee may also inhibit rights owners from filing a large number of Rights Owner Notices, which would hinder the Act's purpose of aiding the ability of rights owners to enforce their rights, and educating the public through the notice system. Rights owners have indicated that 15,000 Rights Owner Notices (at a cost of $375,000, at $25 per notice) may be filed per month for the first few months after the Act comes into effect (Illegal Peer-To-Peer File Sharing, Minister of Commerce). However, the Minister is of the view that rights owners must bear the significant proportion of implementation costs, as rights owners are likely to benefit from the Act by aiding the enforcement of their rights and encouraging compliance with the law.

IPAPs have also claimed that the Act is an unwanted burden with significant compliance costs. However, IPAPs benefit from the safe harbour granted from third party liability if they comply with the Act. IPAPs also arguably benefit indirectly from account holders who conduct illegal file sharing, due to the significant bandwidth used to download files. It is also arguably open to IPAPs whether they take the risk of not complying with the Act, and therefore not being granted the safe harbour from liability. Practically, the status quo may be maintained if IPAPs do not comply with the Act, as IPAP third party liability is a legal issue which is yet to be determined in New Zealand. However, a rights owner can seek an injunction to require an IPAP to comply with the regime.

Despite the tension between IPAPs and rights owners, the fee of $25 per Rights Owner Notice sits (perhaps sensibly) between the average full cost recovery fee of $40 suggested by the Telecommunications Carriers Forum, and the $2 fee generally suggested by rights owners.

The maximum amount the Copyright Tribunal can award in a claim is $15,000, through which rights owners may be able to recover some of their enforcement costs. It is possible that, even if the maximum amount of $15,000 is awarded in a proceeding, rights owners will not recover all costs associated with filing Rights Owner Notices related to that proceeding (let alone recover any damages for the infringement). For example, the cost of sending 700 Rights Owner Notices, which could all relate to one account holder, would be $17,500 (at the filing fee of $25 per notice). However, rights owners will not know the identity of account holders, so may be unable to effectively target particular infringers or manage the number of Rights Owner Notices sent to an account holder.

With a maximum amount for an award, and the potential for several Rights Owner Notices to relate to the same proceeding, there will not be a consistent basis for calculating an award. This means that there will be difficulty in making an award which reflects the nature of the infringement (as the Act "requires").

Content of Rights Owner Notices

The Minister is aware that notices must contain sufficient detail to allow IPAPs to easily match alleged infringements with account holders. The Regulations require that details of the relevant copyright work must be contained in a Rights Owner Notice, including any unique identifiers of the work. This may be an issue where files are labelled differently to the actual content of the file. For example, a file named "harrypotter.mp4" could contain any one of the Harry Potter movies, or may not contain a Harry Potter movie at all. This can also make identifying the rights owner difficult. Using the incorrect details of the alleged infringement could lead to an account holder challenging the notice sent to them.

Rights Owner Notices must also include the date and time (to the nearest second) of the alleged infringement, as well as the relevant IP address and file sharing software. This highlights the difficulty of matching dynamic IP addresses to an account holder.

The Regulations are silent on what form Rights Owner Notices must take. However, it is proposed that IPAPs can choose the method of receiving Rights Owner Notices from rights owners. This should benefit IPAPs, who can select their preferred method, which we expect would usually be an electronic filing process.

The detailed information required means it will be important for rights owners to ‘tick all the boxes’ when collecting and providing information in Rights Owner Notices. The omission of even some of the required information may mean an IPAP can reject the Rights Owner Notice. There is also the risk that a corrected Rights Owner Notice cannot be re-submitted within the set timeframe.

Content of Infringement Notices

The Minister emphasises that a purpose of the Act is to educate the public. This is reflected in the Regulations by requiring Infringement Notices to include a link to an MED website with details of the infringing file sharing regime and account holders' obligations.

Much of the information required for Infringement Notices could be pre-prepared in a standardised format. However, matching the Rights Owner Notice details to an account holder is likely to take a significant proportion of time when preparing Infringement Notices. Infringement Notices must also include a unique notice identifier indicating the notice number and type of notice (whether a detection, warning or enforcement notice). Ongoing costs are likely to be incurred by recording and matching the unique notice identifiers with any future Infringement Notices sent to the account holder.

The Regulations leave it open to IPAPs to choose what form to use for Infringement Notices, and which method to send them by. Email is likely to be more efficient, but all methods may sometimes encounter difficulties in proving that the account holder has received the notice.

Challenge Process

The Regulations also prescribe a form for a challenge notice to be used by account holders.

Overall Efficacy

The filing fee of $25 per Rights Owner Notice appears to take a middle-ground. Given the volume of Rights Owner Notices which may be filed with IPAPs, it is yet to be seen whether the filing fee will undermine the Act's purpose of providing a viable enforcement process for rights owners. Ensuring that rights owners and IPAPs 'tick all the boxes' for the notice process will also be important for implementing the regime efficiently. The impact of the fee on the volume of Rights Owner Notices filed, and therefore Infringement Notices sent to account holders, will also affect the Act's purpose of educating account holders.

Even if the regime provided by the Act is not financially viable, there may be deterrent value by merely having the Act in place, along with the process to enable enforcement of rights owners' rights. The significant publicity (and controversy) around the Act to date may have at least partly achieved its purpose of educating account holders.

Key Contacts

Earl Gray
Raymond Scott

Back to top

---

Law and the Internet: On Election Day, Be Careful What You Tweet!

Online media such as social networking, effectively unheard of less than a decade ago, now permeates many people's everyday lives. Social media is not just used by individuals for keeping in touch but has become a powerful tool to assist businesses to engage with customers, and has even been used as a part of business continuity plans. However, along with the benefits of the explosion in access to online media come challenges for laws designed for the analogue world. One example of these challenges is the 'electioneering' restrictions in the Electoral Act 1993 (Electoral Act). With the national parliamentary election date of 26 November 2011 looming, this article explores the application of the Electoral Act to users of social networking sites such as Facebook and Twitter.

Pre-polling Day Publications

The Electoral Act governs, among other things, how political parties and individuals may advertise in relation to elections in New Zealand. One key provision is that different rules apply for campaign material published before polling day and for material published on polling day itself. The restrictions before polling day only relate to when a person publishes an "Election Advertisement".

"Election Advertisement" is defined in the Electoral Act as an advertisement (in any medium) that may be regarded as encouraging voters to vote (or not to vote) for a particular candidate or political party.

A publisher of an Election Advertisement must meet certain conditions set out in the Electoral Act. These conditions include:

• the promoter of the advertisement (the person who initiates the publication of the advertisement) must be either a party secretary, a candidate, a registered promoter, or an unregistered promoter who does not spend more than $12,000 (incl GST) on advertisements;
• the advertisement itself must include a "promoter statement", stating the name and address of the promoter;
• if the advertisement encourages voters to vote for a particular candidate, the advertisement must be authorised by that candidate in writing; and
• if the advertisement encourages voters to vote for a particular party, the advertisement must be authorised in writing by the party secretary.

Certain publications, even if they are intended to influence voters, will not be considered to be an Election Advertisement and will therefore not be required to fulfil the conditions listed above. Some of the exclusions from an Election Advertisement are:

• the editorial content of a magazine, television programme, radio programme, or news media internet site; and
• the publication on the internet of personal political views, provided the author has not received payment for expressing their views.

The latter exception means that, before polling day, statements made on blogs, on online forums and social networking sites such as Facebook and Twitter will be exempt from the Election Advertisement restrictions under the Electoral Act (provided the author has not received payment for expressing the author's views).

Polling Day Publications

On the day of the election, it is effectively unlawful under the Electoral Act to interfere with a voter with the intention of influencing his or her vote. This includes publishing, broadcasting, or distributing statements that advise/influence a voter as to which candidate to vote for, distributing any party emblem or flag, taking part in any demonstration that relates to the election, or making any kind of public address referencing the election or candidates.

This prohibition is very wide and not only captures publications on blogs and online forums but also the personal opinions of individuals made on social networking sites, including a Facebook status update or a tweet, about a candidate or party. A simple "vote party x" or "support candidate y" status update or tweet will technically breach the law.

So, under the current legislation, social media users need to ensure that they do not publish electioneering statements from 12 am until 7 pm on 26 November 2011. The punishment for doing so is a fine of up to $20,000. While this may seem excessive in the context of an individual, the Chief Electoral Officer Robert Peden has been reported in various media publications as saying that the commission will monitor social media websites and take action.[1] It is also likely that those who are visible public figures will be subject to greater scrutiny (and this includes businesses). 

There is a limited exception to liability for the prohibition on publications for online statements on polling day. The exception applies only if the statement was loaded on the website before polling day, the author does not make the statement available to people other than those who voluntarily access the website, and the author does not distribute any material advertising or promoting the relevant website on the day of the election. Accordingly, individuals and businesses should also be careful not to refer back to previously published articles about the election.

Social media websites blur the lines around publishing electioneering statements. For example, while a retweet would seem to be publishing a statement, it is not so clear whether "liking" a Facebook status update published before polling day will fall foul of the Electoral Act. 

Reform

The Chief Electoral Officer has said that he senses that New Zealanders like campaign-free election days. However, the interplay between social media websites and the Electoral Act discussed in this article could fall under the scope of the Law Commission's "Review of Regulatory Gaps and the New Media". The focus on this review is new and emerging forms of news media - sometimes referred to as the “new media”. Part of that review will consider whether existing criminal and civil remedies are effective in the new media environment, and if not whether alternative remedies are available. The Law Commission review is led by Professor John Burrows QC and the Law Commission expects to have its preliminary analysis ready for public consultation by November 2011.

---