Due Process in Cyberspace

David R. Johnson

Introduction

Online communication has given rise to a new global commerce in ideas, information and services. Because electronic messages readily cross territorial borders, and many online transactions have no necessary relationship to any particular physical location, existing geographically-based legal systems have difficulty regulating this new phenomenon. As users and system operators encounter conflicts and seek to resolve disputes, they take action to establish rules and decide individual cases. This creates a new form of law -- a law of Cyberspace -- based on private contracting on a global basis and enforced by a combination of the sysop's ultimate right to banish unruly users and the users' ultimate right to migrate to other online service providers.

Will this emerging netlaw provide "due process"? Will it, in other words, respect basic principles of fairness, as embodied in current legal doctrines in the form of procedural protections against arbitrary action by governmental authorities and substantive rights not to have life, liberty and property taken away to serve the interests of an oppressive majority? There are some signs that the emerging netlaw will honor basic principles of procedural fairness and respect for individuals. However, the goal is to protect users from arbitrary actions of their information service providers rather than from arbitrary actions of their governments. Consequently, the methods used to achieve this goal online must differ from those available in established national legal systems.

Is Due Process Necessary in Cyberspace?

At first glance, global online communications might not seem to be in need of special protections for users or specific limitations on the prerogatives of system operators. A decision to sign up with an online commercial service or an Internet service provider is clearly voluntary -- unlike involuntary subjugation to territorial laws imposed by local sovereigns. The rules of the electronic road are set, for the most part, by private contracts -- not by legislators enacting statutes, administrators making regulatory decisions, or judges interpreting the law. If a system operator adopts rules that seem oppressive, the local "netizenry" can vote with their modems and go to another, more congenial, jurisdiction. Indeed, it is possible for some technologically sophisticated users to transmit messages without dealing through intermediaries who know who they are or who can enforce compliance with any established rules.

This primary reliance on action by private parties is important in establishing the relative freedom of users of the net from governmental intrusion. But there remain important questions raised by the potential of system operators, or majorities of communities of users, to oppress individuals and minorities. While those who disagree with local rules are free to migrate, many users will have invested very substantial amounts of time and effort in establishing a particular online identity (building a reputation based on a particular email address or web page location, for example). And many seek to participate actively in particular online communities, over long periods of time. For them, separation from those communities would impose very substantial personal loss. Thus, the check on sysop power provided by the user's right to abandon an online area is importantly mitigated by the costs imposed on the user who walks away. And the sysop's power of banishment can become the occasion for substantial injustice if it is imposed without adequate cause or without the use of procedures that give the user (and, perhaps, the cybercommunity) a chance to be heard.

Some system operators will challenge the relevance of "due process" in the networld, stressing that the rights assured apply only to limit powers exercised by sovereign governments. They will also protest that private commercial and associational dealings are not generally burdened with prohibitions against irrationality. What for government is prohibited censorship is, for a private electronic publisher, editing. What for government constitutes discrimination is, for an online community, the right of free association.

The arguments for some form of protection in netlaw for users' right may prove persuasive, however, because traditional legal authorities have difficulty regulating a global electronic network, because the entrepreneurs advocate self-regulation, and because the system providers may become the effective "government" of the networld. They collectively do have a monopoly on what passes for "force" in this environment (the off-on switch). Especially insofar as they band together to establish standards, as they have already done, in effect, to create the Internet protocols and domain name system and associated rules, collectively they do exercise something akin to sovereignty within their particular sphere.

Sysops may have to admit that the stakes involved in disputes about the creation or application of online rules can be high, from the perspective of a user. If they are not constrained by some basic principles of fairness and respect for individual rights, evolved within the context of the networld culture, then external governments may be unwilling to defer to netizen claims to a right to self-government. Moreover, a failure to protect online rights to "life, liberty and property" in the networld would likely deter many potential participants and stifle online commerce.

What Due Process is Now Provided to Users?

Rules online may be promulgated either by common practices developed users or as a result of private contract between provider and user. Most of these contractual rules are set by contracts of adhesion, with little or no opportunity for bargaining. Many commercial service providers' contracts purport to reserve to the sysop the right to deny service to anyone at any time for any reason. Sometimes users demand changes to online rules -- and interactive capability online provides ample opportunity, as a practical matter, to petition their online governments and to discuss preferable changes. But there is no established procedure or practice of putting proposed changes out for comment. To the contrary, many contracts for online services provide that the user agrees in advance to abide by the system's rules however arbitrary they might be or however they may change in the future. The user's only recourse, in extremis, is to quit the system if a new rule change is objectionable.

Similarly, most cases involving application of online rules to particular cases and specific users proceed on the basis of unilateral action by the system operator, who acts as prosecutor, judge, jury and executioner. There have been exceptions -- such as the famous case of the multi-user domain (Lamda Moo) whose users called for the creation of an independent judiciary after one member was had his ID rendered nonfunctional by the "wizard" on the basis a public outcry against anti-social conduct by that user. Now a pilot project has been initiated to establish a "Virtual Magistrate" to rule on online disputes, via email, that would give those with claims regarding the application of online rules a chance to have their cases heard by a neutral party. At the present justice in cyberspace is summary justice (or self-help vigilante revenge).

The current lack of meaningful protection in cyberspace is ironic, given the potential the medium offers to facilitate rational dispute resolution and public debate. Online conferences can readily marshall diverse views regarding proposed regulations. (The Nuclear Regulatory Commission is experimenting with online rulemaking and Congress has discovered that email is an effective means for at least some constituents to make their views known.) Moreover, focused adjudications can be conducted much more cost effectively online than in the real world. All parties can attend at their convenience. Experts and neutrals can be located and consulted quickly online. The entire proceeding can be archived as part of an electronic record. The net can thus facilitate thoughtful discussion of new rules, rational analysis of the facts, and expeditious adjudication of online controversies.

How Will Due Process Arise in Cyberspace?

As the number of online services and users increase, the number of disputes and the magnitude of the interests affected by such disputes, will also increase. Formerly what the techie in the back room called your computer server did not matter. Today large companies contend aggressively to trademark "domain names" and to maintain a legally protected space to call their own. It doesn't matter much that your phone number changes when you change jobs. But some employees may face serious disruption in their professional lives if their prior service provider declines to forward their email. Many intensive users of online communication would recoil in horror at the thought that a system operator could unilaterally destroy their online identity without cause, or that a committee of techies who administer naming conventions in the networld could eliminate their hard-won web page addresses based upon engineering concerns. They have come to expect a legally guaranteed entitlement to present one's case and to seek to establish individual rights against oppression. They will likely insist upon proprietary rights in phone numbers, email addresses, and web page identities as well as entitlement to a reasonable presentation of their grievances.

The first stage in the development of such online due process rights will take the form of recognition that important personal (and corporate) interests are at stake. This may at first take the form of appeals to existing legal authorities for protection. But local authorities cannot easily control a global net, may not have jurisdiction over all relevant parties, and will be inclined to defer to the terms of the contracts that users agreed to as a condition of going online. So these appeals will ultimately have to be made directly to system operators and, ultimately, to the group of interconnected systems that, collectively, control most of the traffic exchanged on the net. Collectively, those who control access to the interconnected systems have the power to discipline or deny interchange of messages to sites that fail to conform to a Cyberspace norm.

The Internet community, of long term users, has demonstrated its ability (via the IETF, for example) to come up with policies and protocols that govern the technical transmission of messages across the net and make the entire system work. Those who don't go along with these rules have systems that simply don't interconnect. Similarly, rules regarding "due process" for users can be effectively adopted by consensus, so long as this higher level type of "standard" or "protocol" is a required condition for connection or for inclusion in the groups collaborating to enhance the functionality of online communications. Some elements of such principles may be based, in part, on technical architectures -- such as the location of authority to change a domain name. Some may simply correspond to accepted practice for dealing with user complaints or rule violations, failure to follow which might make an area of the networld suspect or less frequently pointed to by means of hypertext links supported by responsible providers.

The principles and basic rights that gain general acceptance -- such as the transportability (or ownership by the user) of a domain name -- are unlikely be embodied in a written constitution. The technology of global online communication is developing so rapidly that it will be difficult to deal with many potential issues by means of such written rules. The Internet community has responded to this difficulty in part by developing a loose doctrine of "netiquette" that is based on group discussion and can adapt in a manner similar to the common law. Accordingly, there will likely be no definitive "law library" of authoritative texts from which one can determine the extent of due process protection accorded in the networld -- and even past cases, though widely reported, will need to be discussed from time to time in light of new conditions. There will be only a weak version of "stare decisis" on the net, because the rational presumption will be that relevant circumstances (including the capabilities of technologies and the mix and interests of online participants) may well have changed since the last time an issue was considered. But there will be wisdom derived from discussion among informed and neutral parties.

For example, when "spamming" (sending multiple, offpoint messages to news groups) became a problem in the Internet, the offended users took direct, vigilante action -- flooding the offending party's mailbox with hate mail. But there turned out to be a technical means to eliminate inappropriate messages much more surgically -- a cancellation message appearing to come from the originating party (a "cancelbot") could be sent. Soon a discussion group was formed to spread news of new spamming episodes and also to deliberate on when and whether this "cancelbot" technology should be used to remove offensive messages. Some self-help justice is still present, of course, but the reaction to spamming has generated a growing sense that severe actions taken to protect the online public's interests -- whether canceling messages or eliminating IDs -- ought to be preceded by thoughtful discussion and implemented by a neutral decision-maker. This cultural practice has the potential to become, in effect, a type of "due process" right enjoyed by all users in the networld.

How will Due Process on the Net Differ from Due Process in the Non-Virtual World?

"Due Process" in Cyberspace may arise in the form of a general consensus among most users and sysops that the ultimate enforcement tools available (banishment, cancellation of IDs, elimination of online addresses) ought not to be wielded arbitrarily. Users will avoid systems that reserve to the sysop the right to terminate a user, or alter valuable identifying information, or adopt rules prohibiting legitimate and established activities, arbitrarily. Users accused of wrongdoing will demand and get a hearing -- and any cavalier treatment of individual cases will be widely reported and discussed in a manner detrimental to the callous system operator. Such protection cannot readily be built directly into the laws of local sovereigns, who may not even have jurisdiction over all of the interested parties. They will, however, become part of what connecting system operators expect from one another and what users in general demand. They will become, in effect, a form of private global netlaw, probably applied by private arbitration and enforced by means of all parties' ability to decide with whom they will deal.

Under United States law, due process is guaranteed by virtue of a written constitution, covering a particular geographically defined place and its citizens. It is based upon key conceptions regarding the duty of a "state" to serve the interests of its citizens in an equitable manner. In contrast, the protection of fairness for individual users in the global networld will rely less upon the law of territorially based jurisdictions and more upon the actions of online communities. The efficacy of netlaw will depend more upon sysops who control the on-off buttons and the reactions of their customers, wherever they may reside, than they will upon theories relating to limits of "sovereign" powers.

Moreover, the nature of the beneficiaries of the online version of "due process" may differ from that of those who can invoke the established "real world" doctrines. Users can do business online without necessarily disclosing the details of their identity or the other roles they play in the real world. Thus, those who formulate the doctrine of online due process will need to decide whether such rights attach to any online "persona", whether the user claiming rights must disclose additional personal information as a condition of appearing in the forum that can vindicate any such right, and whether rights to "life, liberty and property" online may belong to a group or "corporate" entity.

Perhaps the most important question regarding "due process" in cyberspace concerns the online equivalent of the right to life, a question presented when a sysop desires to remove an online identity against the wishes of the user. This kind of question can arise, for example, when a user violates rules applicable to a particular online space, or annoys other users to the point of outrage. Is the user in question entitled to a decision based on analysis of competent evidence, rather than the whim of a sysop or the cries of an online "lynching" crowd? Must the decision maker be "neutral"? Should the penalty fit the crime? To the extent that users desire and expect such restraint by sysops to whom they give their business, limitations on sysop action may evolve as a natural evolution of the new netlaw.

There may be specific attributes of US-based "due process" that will have little or no applicability online. For example, a right to a six or twelve person jury -- a limitation based on historical factors and the constraints on summoning people to a physical, "real time" courthouse -- that has little application to the capacity of the networld to allow interaction with neutral evaluators at their own convenience. U.S. "due process" guarantees a right to "confront" accusers and witnesses in person. That right may make little sense when the deeds in question took place entirely online. U.S. "due process" guarantees a right to "cross-examine" witnesses in an elaborate procedural dance. That level of formality may be unachievable or irrelevant online.

In contrast, certain features of online interaction may facilitate the growth of new forms of "due process" rights. It may be judged "fair" to allow an accused party to reply by email or public posting to any allegations of wrongdoing. It may be easy, and therefore fairer, to give proactive email notice to any persons whose actions online are the subject of public discussion, in order to facilitate such replies. Given the relative importance of community sentiment and the likely ability of dispersed contributors to enhance the quality of deliberations in a particular case, online tribunals may be much more open to discussion by "friends of the court" -- even to the point of allowing non-parties to participate in online questioning and argument.

One important feature of the U.S. doctrine of "due process" offers protection to corporations and other organizations that are permitted to act as "legal persons". In the networld, the whole idea of legal personhood takes on a new dimension -- because participants in online interactions cannot easily tell (and may not care) whether an online identity belongs to only one individual. The networld offers important opportunities for online collaboration in the delivery of services and information by means of group action. Accordingly, it is only a matter of time before the networld faces the question whether any "due process" rights attach to coherent groups presenting themselves via email or web pages -- conferring upon them additional rights and duties distinct from those of the individual participants. We already allow "real" corporations to register domain names. It's not clear why such groups need to be "registered" in any particular physical territory. Exactly how we go about evolving the protections afforded or denied to collective entities online may influence what kinds of electronic commerce can evolve.

One ultimate issue for the development of due process online will be the question whether to evolve a doctrine that protects individuals against having to bear undue burdens even if the policy decisions imposing such burdens are taken for the greater good. Currently system operators enjoy an "eminent domain" power unconstrained by any need to compensate the victims of a reassigned email address, a canceled domain name, or the enactment of a new rule outlawing some activity which the individual user had counted on continuing as a commercial operator. Users maintain some protection against tyranny by virtue of their ability to move to another system. But a doctrine insuring compensation for such "takings" would provide far greater protection against unreasonable burdens imposed by collective decisions that cannot readily be remedied by migration -- an increasingly likely type of decision as the networld welcomes increasingly valuable "investment backed expectations". (Of course, to be viable, such a doctrine would likely require something akin to the "taxing" power.) The assertion of such a claim to compensation may put to the test the question whether limitations on the power of those charged with online governance stem only from the ability of unhappy users to desert -- or, instead, derive from a joint commitment of online "netizens" to resolve cases rationally and prevent the imposition of unfair burdens on individual users who do not deserve their fate.

Conclusion

Due Process in cyberspace will concern a different set of persons -- online personae (whether individual, corporate, or group) rather than the "citizens" of a given nation state. It will protect a different set of values -- the continuing "life" of an online identity, the "liberty" to engage in established activities free from arbitrary new rules, and the "property" of an established domain name or well known web page address. Procedural protections will likely take the form of an assured opportunity for community discussion, as distinct from physical rights (such as the "confrontation of witnesses") or particular "real time" dramatic processes (such as "cross examination"). Indeed, the substantive protections of due process in cyberspace may well differ in content from place to place, with users free to choose their online environments on the basis of whether the local rules suit their needs. But, despite these differences, the law of most areas of Cyberspace will very likely embody many of the same core principles that underlie current due process doctrine: respect for the interests of individuals in the face of majority oppression, thoughtful and rational evaluation of individual cases, and appropriate opportunities to participate in creating and applying the law of the networld.