WikiLeaks and the protect-ip Act: A New Public-Private Threat to the Internet

Yochai Benkler

Abstract: The WikiLeaks affair and proposed bills introduced in the Senate are evidence of a Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 new, extralegal path of attack aimed at preventing access and disrupting the payment systems and adver- tising of targeted sites. In this model, the attacker may be a government agency seeking to circumvent constitutional constraints on its power or a private company trying to enforce its interests beyond those afforded by procedural or substantive safeguards in the law. The vector of attack runs through the tar- geted site’s critical service providers, disrupting technical services, such as service, cloud storage, or search capabilities; and business-related services, such as payment systems or advertising. The characteristics that make this type of attack new are that it targets an entire site, rather than aiming for removal or exclusion of speci½c offending materials; operates through denial of business and ½nan- cial systems, in addition to targeting technical systems; and systematically harnesses extralegal pressure to achieve results beyond what law would provide or even permit.

In December 2010, a website that the Pentagon had described in 2008 as dedicated “to expos[ing] un- ethical practices, illegal behavior, and wrongdoing YOCHAI BENKLER is the Berkman within corrupt corporations and oppressive regimes Professor of Entrepreneurial Legal in Asia, the former Soviet bloc, Sub-Saharan Africa, Studies at , and the Middle East,” and that in 2009 had received where he also serves as Faculty Co- the Amnesty International New Media Award for director of the Berkman Center for reporting on extrajudicial killings in Kenya, came Internet and Society. His publica- tions include “The Commons as under a multisystem denial-of-service attack in- a Neglected Factor of Information tended to prevent it from disseminating informa- Policy,” Telecommunications Pol- tion. The attacks combined a large-scale technical icy Research Conference (1998); distributed-denial-of-service (DDoS) attack with “From Consumers to Users: Shift- new patterns of attack aimed to deny Domain Name ing the Deeper Structures of Regu- System (dns) service and cloud-storage facilities, lation Toward Sustainable Com- disrupt payment systems services, and disable an mons and User Access,” Federal Communications Law Journal (2000); iPhone app designed to display the site’s content. and : How The site was WikiLeaks. The attackers ranged from Social Production Transforms Markets unidenti½ed DDoS attackers to Senator Joseph and Freedom (2006). Lieberman and, more opaquely, the Obama admin-

© 2011 by Yochai Benkler

154 istration. The latter attack is of particular free context for designating sites as legal- Yochai interest here, having entailed an extra- ly suspect actors, while making critical ser- Benkler legal public-private partnership between vice providers immune from responsibil- politicians gunning to limit access to the ity for any action they take by denying site, functioning in a state constrained by technical, payment, and business process the First Amendment, and private ½rms systems to targeted sites. Together, these offering critical functionalities to the elements form the basis for extralegal site–dns, cloud storage, and payments, attacks on critical services, thereby creat- in particular–that were not similarly ing a shortcut to shutting down allegedly constrained by law from denying service offending sites. The insinuation of illegal- to the offending site. The mechanism cou- ity creates the basis for public pressure on

pled a legally insuf½cient but publicly sa- the service providers to deny service; im- Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 lient insinuation of illegality and danger- munity replicates the legal void that allows ousness with a legal void. By publicly stat- service-provider action well beyond any- ing or implying that WikiLeaks had acted thing a court would have ordered. unlawfully, the attackers pressured ½rms Combining denial-of-payment systems skittish about their public image to cut off with the use of extrajudicial mechanisms their services to WikiLeaks. The inapplica- and private party enforcement appears to bility of constitutional constraints to non- extend basic techniques developed in the state actors created the legal void, per- war on terrorism into the civilian domain. mitting ½rms to deny services to Wiki- It represents a new threat not only to the Leaks. This, in turn, allowed them to ob- networked commons, but to the very tain results (for the state) that the state is foundations of the rule of law in the Unit- prohibited by law from pursuing directly. ed States. The range of systems affected by the attack was also new: in addition to disrupting On November 28, 2010, WikiLeaks, in technical service providers–which had cooperation with , the been familiar targets since efforts to con- Guardian, Der Spiegel, Le Monde, and El País, trol the Net began in the 1990s–the attack began to release a set of leaked U.S. em- expanded to include payment systems. bassy cables. The following is a condensed This pattern of attack is not an aberra- version of a detailed and fully document- tion. One need only observe its similari- ed event study of the response to that dis- ties to current efforts by the copyright in- closure.3 WikiLeaks, a site dedicated to dustries to shut down sites that challenge making materials leaked by whistleblow- their business models. This objective was ers public, had published a series of items laid out most explicitly in the ½rst draft of from the Pentagon and the State Depart- the Combating Online Infringements ment between April and November 2010. and Counterfeits Act (coica)1 that was The ½rst release, a video showing Ameri- introduced in September 2010, and a pow- can helicopters shooting a Reuters pho- erful version of it remains in the present tographer and his driver, exposed previ- version of the bill, the Preventing Real ously hidden collateral damage incurred Online Threats to Economic Creativity in the pursuit of insurgents. The video was and Theft of Intellectual Property Act followed by the release of thousands of war (protect-ip Act) of 2011.2 The coica/ logs in which ½eld commanders described protect-ip approach, which replicates conditions on the ground in Afghanistan the dynamics of the WikiLeaks attack, en- and Iraq. The disclosures were initially de- deavors to create a relatively procedure- scribed by the administration as highly

140 (4) Fall 2011 155 A New damaging to the security of troops and ter. In a critical move, PayPal discontin- Public- human rights workers, but as time passed, ued its service to WikiLeaks; a vice pres- Private Threat formal Pentagon assessments sent to ident of the ½rm, commenting publicly, to the Congress suggested that no such harm pointed to the November 27 letter, not to Internet 4 Commons had occurred. On November 28, Wiki- Senator Lieberman’s call, as the reason Leaks and its traditional-media partners that PayPal believed WikiLeaks had bro- began to release documents selected from ken the law, thus triggering the ½rm’s de- a cache of about 250,000 classi½ed cables cision to stop payment service to Wiki- that U.S. embassies around the world had Leaks.6 The State Department letter was sent to the State Department. In late No- complemented by a series of public state- vember and December they published, ments that tried to frame WikiLeaks’s em-

in redacted form, a few hundred of these bassy cable release as international ter- Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 cables. WikiLeaks’s decision to publish the rorism. Secretary of State Hillary Clinton materials, including when and how they called the release of the cables “an attack were published, was protected by First on the international community.” Vice Amendment law. Indeed, precedents es- President Joseph Biden explicitly stated tablished at least as far back as the Pen- that Julian Assange, the founder of Wiki- tagon Papers case support the proposition Leaks, was “more like a high-tech terror- that a U.S. court would not have ordered ist than the Pentagon Papers.” Senator removal or suppression of the documents, wrote a Wall Street Jour- nor would it have accepted a criminal pros- nal editorial calling for Assange’s pros- ecution of WikiLeaks or any of its editors ecution under the Espionage Act. Some and writers.5 right-wing politicians simply called for Despite the constitutional privilege that his assassination on the model of U.S. allowed WikiLeaks to publish the leaked targeted killings against Taliban and Al documents, American political ½gures Qaeda leaders.7 widely denounced the disclosures. More- Against the backdrop of this massive over, critics appeared to blame only Wiki- public campaign against WikiLeaks, Sen- Leaks, even though traditional outlets such ator Lieberman’s December 1 public ap- as The New York Times were providing ac- peal was immediately followed by a series cess to the same cables, and in the same of service denials: form. The most effective critic, Chairman • December 1: Storage. Amazon removes of the Senate Homeland Security Com- WikiLeaks materials from its cloud- mittee Senator Joseph Lieberman, urged storage facility. companies providing services to Wiki- –Countermeasure: WikiLeaks moves stor- Leaks to cease doing so. Senator Lieber- age to ovh in France. man issued his call on December 1, 2010, following a well-crafted letter from the • December 2: DNS. Everydns, the dns State Department to WikiLeaks sent No- registrar serving the WikiLeaks.org do- vember 27, 2010. That letter did not take main, stops pointing the domain name the legally indefensible position that Wiki- to WikiLeaks’s server. Leaks itself had broken the law. Instead, –Countermeasure: WikiLeaks uses nu- it correctly asserted that the law had been meric ip addresses updated through broken (by someone), insinuating that Twitter and begins to rely more heav- WikiLeaks was the offending party. Not ily on WikiLeaks.ch dns as well as surprisingly, implicated service providers on mirroring by various volunteers were among those who misread the let- throughout the Net.

156 Dædalus, the Journal ofthe American Academy of Arts & Sciences • December 3, 5: Storage. French Minister law justi½es describing this set of events Yochai of Industry Eric Besson calls on ovh to as an attack on WikiLeaks. Put differently, Benkler cease providing storage; by December 5, the service denials to WikiLeaks were the ovh removes WikiLeaks content. result of an effort by the government to –Countermeasure: WikiLeaks moves shut down the site irrespective of the fact again, to Sweden, initially to the serv- that the law prohibited the government ers of the Pirate Party, a Swedish polit- from doing so. In private conversations, in- ical party, and later to a Swedish stor- dividuals within and close to the admin- age provider. istration emphatically denied any back- channel communications threatening or • December 4: Payment systems. PayPal cajoling the companies. These claims seem stops processing donations for Wiki-

plausible, and for purposes of analysis Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 Leaks,cutting off a major source of fund- here, I consider them to be true. My claim, ing. A vice president of PayPal points to however, is based not on intent or the like- the State Department’s November 27 let- lihood of conspiracy, but on effect. A pub- ter to WikiLeaks as the reason PayPal lic media campaign against WikiLeaks, led concluded that WikiLeaks was acting by top administration ½gures and some of illegally and terminated service. the most senior politicians in the presi- –Countermeasure: No effective response. dent’s party, triggered vigilante actions by WikiLeaks loses substantial revenue as corporations that, unfettered by the laws PayPal ceases to process donations. constraining public-sector responses, like- Loss of revenue continues with the ly saw themselves as acting in the nation- credit card stoppages that follow. al interest as they degraded the site’s ca- • December 6: Payment systems. MasterCard pabilities. Regardless of how its actions stops servicing WikiLeaks. The Swiss were perceived, WikiLeaks was engaged Postal Bank closes Julian Assange’s per- in classic fourth-estate functions at the sonal account with the Swiss bank for his core of freedom-of-the-press protections. failure to provide an adequate address. In order to guard against similar outcomes in the future, it is important to understand • December 7: Payment systems. Visa joins and correctly characterize the events MasterCard. Bank of America discontin- against the site as an attack on an impor- ues services ten days later. tant practice in the networked commons. • December 20: App store. Apple removes a From a technical perspective, the attack third-party app created to allow iPhone was largely unsuccessful. The site proved users to access and search WikiLeaks enormously robust, using the core modes embassy cables. of networked resilience, namely, redun- –Countermeasure: WikiLeaks has no dancy and decentralized cooperation. possible recourse. However, apps for When WikiLeaks.org was denied dns ser- the Android smartphone were not re- vice, the site used a range of numeric ip moved. addresses circulated on blogs and Twitter. It moved through a series of non-U.S. None of these companies was compelled domains, the most important of which by legal order to deny services to Wiki- was the Swiss domain name WikiLeaks.ch. Leaks. Indeed, under First Amendment The Swiss dns service provider, Switch, law, it would have been impossible for the refused to capitulate to pressures to cease government or anyone else to obtain such service to WikiLeaks. When cloud storage an order. That aspect of U.S. constitutional was denied in the United States, the site

140 (4) Fall 2011 157 A New moved ½rst to France, where service was vent people around the world from ac- Public- again denied under pressure from the cessing the leaked materials, it failed. The Private Threat French government, and then to Sweden. materials were made available on both to the Moreover, thousands of mirror sites distributed mirror sites and the sites of Internet Commons sprang up to permit access to the docu- traditional media partners, whose public ments that had been released up to that visibility seems to have made them invul- point. However, where the system was not nerable to the kind of informal, extra- Internet based, as in the case of the iPhone legal pressure that worked to deny service app, it was impossible to replace. Nonethe- to WikiLeaks. If it was aimed to discredit less, the relative insigni½cance of the app, the reports, it clearly failed here because as long as an open Internet alternative ex- WikiLeaks’s partnership with traditional

isted, minimized the importance of that media helped raise visibility and add cred- Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 pathway. However, the fact that the Wiki- ibility to the documents. The technical as- Leaks app was not easily replaceable pro- pect of the attack failed almost entirely: vides an important indication of how vul- redundancy and the ability to move from nerable information is when available only one country to another allowed for robust over an iPhone or iPad-accessed network; storage, and the creation of thousands of the open Internet, by contrast, is robust. mirror sites by individuals around the Targeting WikiLeaks’s business sys- world made DDoS and dns attacks inef- tems proved much more successful as a fective. line of attack. WikiLeaks, which depends Moreover, not all ½rms folded as easily on donations from supporters to fund its as Amazon, PayPal, MasterCard, and Visa. operations, apparently lost 80 to 90 per- Refusing to follow the U.S.-based Every- cent of its revenue stream in the ½rst two dns, the Swiss dns registrar continued months of the attack, and only gradually to point to WikiLeaks.ch. Twitter declined was able to create a set of proxies for re- to respond to document requests until sub- ceiving donations.8 As was the case with ject to subpoena. did not remove the iPhone app, in the absence of a com- related apps from the Android system or petitive market to offer signi½cant redun- drop WikiLeaks results from its search dant pathways for payment systems, per- engine. The success of an attack that relies suading two or three companies to deny on public pressure and a legal void in service was suf½cient to severely hamper which to act depends on service provid- the site’s payment operations. Whether ers’ concern about being perceived as help- a targeted site is a nonpro½t dependent ing the targeted site; this concern must on donations or a for-pro½t or low-pro½t outweigh the providers’ interest in main- enterprise funded by transactions or ad- taining their image as providers of robust, vertising, an attack on the business sys- incorruptible services to the Internet- tems a site depends on for ½nancing ap- using public. Thus, the new form of in- pears harder to avert. This particular attack formal, extralegal attack can be only par- on payment systems seems to derive from tially effective if not all service providers the war-on-terror rhetoric applied to Wiki- are on board. Nonetheless, the denial of Leaks as well as from a decade-old program payment systems greatly affected Wiki- established to compel payment and ½nan- Leaks’s cash flow and was likely the cial services ½rms to shut off funds flow- most effective and dangerous aspect of ing to terrorist organizations.9 the attack. The attack on WikiLeaks largely failed This new pattern of attack (a) targeted to achieve its goals. If it was aimed to pre- an entire site; (b) was carried out through

158 Dædalus, the Journal ofthe American Academy of Arts & Sciences denial of service by commercial service content industries hoped to expand con- Yochai providers of critical technical and busi- trol over materials on the Net in order to Benkler ness capabilities; and (c) circumvented preserve and increase their revenues. On constitutional protections by creating an the other hand, a coalition of computer, extralegal public-private partnership for software, and communications business- censorship, using the inapplicability of es that pro½ted from the free flow of constitutional limitations to private com- information and cultural goods online, panies together with the relatively loose together with civil society organizations regulation of the standard-form contracts aiming to preserve a space for a cultural that govern the relations between service commons, was concerned that efforts to providers and their customers. impose controls would hamper the open,

creative, participatory structure of the net- Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 The WikiLeaks affair might properly worked environment. While Republicans have been dismissed as a one-off set of seemed less responsive to pressures from events if not for a similarly structured at- Hollywood, since 2006, Democrats con- tack at the center of copyright legislation trolling the Senate have pushed through a introduced in the Senate since late 2010. slate of laws designed to implement the The protect-ip Act is the most recent Motion Picture Association of America’s iteration of the U.S. copyright industries’ long-standing agenda. Most pertinent are seventeen-year-long drive to enlist vari- the Prioritizing Resources and Organiza- ous intermediaries and service providers tion for Intellectual Property Act (pro-ip of networked facilities to enforce their Act) of 2008, which created an ip czar in rights through law and public policy.10 the White House and funded additional Beginning in the Clinton White House resources for criminal copyright enforce- with a 1995 white paper11 and culminat- ment,13 and provisions in the Higher Edu- ing with the Digital Millennium Copy- cation Opportunity Act of 200814 that re- right Act (dmca) of 1998,12 the indus- quired colleges to redesign their networks tries sought to create a set of liabilities and develop offerings to protect the that would lead Internet service provid- interests of Hollywood and the recording ers (isps) and Web-hosting companies to industry against their students. These laws remove infringing materials. The safe include the two main elements of the bills harbor notice and takedown procedures currently under consideration: that is, they adopted in the dmca represented the set- expanded the involvement of criminal en- tlement of the ½rst half-decade of policy- forcement authorities in what was tradi- making in this ½eld. Under these provi- tionally an area of private commercial law, sions, pure telecommunications carriers and they used state leverage to harness were excluded from the requirements of private platform providers to enforce the policing content. Providers of caching, interests of the copyright industries. Web-hosting, and search engines and Unlike the settlement of the 1990s, the Web directories were required to have a most recent set of bills targets not offend- procedure in place for receiving notices ing content, but offending sites. While the regarding speci½c offending materials, and dmca focused on speci½c documents that for taking down those materials; but they violated copyright, new legislation–in the were not required to search out such con- same vein as the WikiLeaks case–seeks tent themselves or to block entire sites. to take out entire sites, speci½cally those The following decade witnessed a leg- de½ned as primarily dedicated to unau- islative stalemate. On the one hand, the thorized distribution of copyrighted ma-

140 (4) Fall 2011 159 A New terials. It also substantially expands the to enforce copyright through criminal law. Public- set of addressees who are enlisted to aid If the Department of Justice determines Private Threat the content industries. In addition to car- that a given domain name is associated to the riers, caching providers, and Web-host- with a site that falls under coica’s de½- Internet Commons ing companies (which, in today’s incar- nition of unlawful behavior, it can peti- nation, cover cloud-storage facilities), the tion for a court order that would obligate new bills cover dns providers, advertis- dns providers in the United States to ing providers, and payment systems such stop resolving the domain; or, if the do- as PayPal or credit card companies. From main is registered with a dns provider a procedural standpoint, the newest bills used by U.S. customers but not subject to combine elaborate procedures that would U.S. jurisdiction, any U.S. service provid- isp allow a court order against sites or domain er, s in particular, is required to take Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 names not subject to U.S. jurisdiction, reasonable measures to prevent the do- with subtle efforts to harness and formal- main name from resolving to the offend- ize the extralegal public-private partner- ing site. Moreover, “½nancial transaction ship exhibited in the WikiLeaks affair. providers” are required to cease servicing the site and enforce their to Introduced in September 2010 as the prevent the site from using their logos. ½rst bill in this series, coica clearly iden- Finally, contextual advertising providers ti½ed its target as sites that have “no de- are required to stop serving ads to the site. monstrably commercially signi½cant pur- The innovations embedded in coica,rel- pose” other than providing access through ative to prior legislation, are (a) the in- downloading, streaming, or linking to un- troduction of a broad-based attack at the authorized materials. The breadth of the site level, rather than removal of discrete de½nition, however, captures much more, documents, and (b) the harnessing of pay- including “providing access to any goods ment systems and advertising to deny eco- or services in violation of the Copyright nomic viability to the site. In this sense, Act” or enabling a violation. The more coica presaged the attack on WikiLeaks tightly de½ned target is only an example of through the payment system. this broader set. For instance, the broad- Another element of the original coica er de½nition would include a creative site was its particularly crisp platform for dedicated to anime music videos that pro- extrajudicial enforcement. Although the vides the underlying songs, as is so often original has since been abandoned in fa- the case with the genre, in full or in sub- vor of more subtle versions, the original stantial part–even though the work is form crystallizes the intent of the later transformative. The breadth of coverage versions. In its initial form, coica re- becomes clearer when considering the quired the Attorney General to “maintain blacklist described below; developed by a a public listing of domain names that, copyright industry ½rm in June 2011, the upon information and reasonable belief, list included Archive.org and distribution the Department of Justice determines are of basic technical tools such as BitTor- dedicated to infringing activities but for rent. Here, my point is not to challenge which the Attorney General has not ½led the de½nition, but to outline the method an action under this section.” The thresh- of attack on sites targeted under the pro- old for designation as an offending site is posed law. coica empowers the Attor- extremely low: the Department of Justice ney General–the same government divi- simply must allege “upon information sion that the 2008 legislation bolstered– and reasonable belief” that a site is dedi-

160 Dædalus, the Journal ofthe American Academy of Arts & Sciences cated to infringing activities. This provi- with immunity, allows the state to place Yochai sion invokes standard language used in substantial pressure on sites deemed of- Benkler litigation to indicate the minimum level fending without obtaining a judicial deter- of knowledge required for plaintiffs to mination prior to triggering the attack. sustain a complaint without subjecting What makes this form of attack so wor- themselves to sanctions; it suggests a risome? Ultimately, cases will be subject generalized suspicion more than a real to judicial review, and if the court rules investigation. Once a site is blacklisted, that the closure is unjusti½ed, it will be dns service providers, isps, payment sys- lifted. The problem is that this procedure tem providers, and advertising providers allows for effective elimination of reve- are immunized from liability if they deny nues and technical access for lengthy pe-

service to the site listed as offending. riods pending review. Because there is no Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 Note that the technique employed here speci½c order or process prior to black- is similar to the one utilized in the attack listing, a site can ½nd itself technically in- on WikiLeaks. The evidentiary threshold accessible and unable to use payment sys- for state designation of a “bad actor” is tems or advertising. Unless a site can im- well below what would be necessary to mediately reestablish a backup presence obtain judicial approval of that actor’s –that is, use the redundancy of multiple “badness.” For this reason, the statute sites–it will likely be economically dead cannot demand that private third parties by the time it can challenge the listing. comply with the enforcement efforts. In combination, coica expands the Nonetheless, this substandard designa- vectors of attack to include payment sys- tion of bad-actor status can be used to tems and advertising networks and pro- pressure private service providers into vides an extralegal avenue of attack with- acquiescence. By combining the extra- out prior judicial approval that can be judicial designation with immunity for sustained for an unspeci½ed period while ½rms that discontinue service to the tar- administrative and judicial appeals are geted sites, the state increases the likeli- pending. These elements largely, though hood that private parties will comply. not completely, enable the state to cir- The promise of immunity both expresses cumvent or severely curtail the require- the state’s expectation that cooperative ments of legality and the protections of private providers will, in fact, act against procedure. the designated entities and minimizes The Senate abandoned this explicit the risk and cost of doing so. The immu- entanglement of the state in extralegal en- nity creates the legal void necessary for forcement. The procedure was replaced by vigilante enforcement and shows that an immunity provision that created space such actions are desirable to the state. By for private enforcement of the multi- contrast, the targeted site owner’s de- system attack. In the revised bill, the pro- fense becomes expensive. The procedure vision simply states: “No domain name proposed would not create a legal black registry, domain name registrar, ½nancial hole: the Attorney General was required transaction provider, or service that pro- to create mechanisms for allowing site vides advertisements to Internet sites owners to challenge their blacklisting shall be liable to any person on account of and to appeal an unfavorable decision any action described in this section vol- to a reviewing court. But the process re- untarily taken if the entity reasonably be- verses the normal presumptions of inno- lieves the Internet site is dedicated to cence. The “bad actors” blacklist, coupled infringing activities.” The promise of

140 (4) Fall 2011 161 A New immunity creates a legal space for infor- evidence” test of “reasonable belief” set Public- mal pressures on advertising and ½nan- out in the protect-ip Act. This makes Private Threat cial services ½rms to deny services to the blacklist, however imperfect, a base to the potentially offending sites. It effectively from which to launch an extrajudicial at- Internet Commons invites private entities to create blacklists tack on payment systems, contextual ad- of their own. Similar to the reasonable vertising, dns, and other technical servic- belief envisioned in the original coica es of these sites, entirely circumventing bill, those lists could provide the justi- the procedural and substantive protec- ½cation for blocking targeted sites. tions embedded in the Copyright Act and The current draft of the protect-ip the federal rules of civil procedure. Act replicates this latter approach. It ex- coica pands on by (a) creating a private The years 2010 and 2011 have witnessed Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 right of action, which gives the copyright the introduction of a new pattern of at- industries the power to initiate and en- tack on controversial websites, one that force the attacks and (b) making the im- involves both the state and major private munity provision applicable with regard actors in a public-private partnership to any site accused, rather than only non- formed to suppress offending content. U.S. sites, as was the case in coica. Sec- WikiLeaks publishes content that is of tion 5 of the protect-ip Act immunizes primary concern to the state; the suppres- any service provider that in “good faith sion of such content is prohibited by the and based on credible evidence has a rea- First Amendment. The attack on the site sonable belief that the Internet site is an sought to circumvent constitutional pro- Internet site dedicated to infringing activ- tections by applying informal pressure ities.” This weak standard encourages the (which is not reviewable under the Con- creation of industry-maintained black- stitution) to private actors (who were not lists to implicate sites allegedly engaged subject to constitutional constraints) to in offending activities. In turn, the legal further the state’s objective of suppress- immunity creates the perfect context for ing the publication of the materials in putting pressure on private infrastructure, question. protect-ip represents the in- payment systems, and advertising pro- verse of this public-private partnership for viders to deny service to the blacklisted censorship. Here, the interests are those sites. Not surprisingly, in June 2011, less of certain segments of the business com- than a month after publication of the most munity–the copyright industries–seek- recent iteration of this type of immunity, ing to use the state to help harness other the advertising ½rm GroupM, whose cli- private actors to enforce their interests. ents include Universal Music, Paramount, The elements common to both methods and Warner Bros., developed a blacklist of attack are the denial of business and of more than two thousand sites to which technical systems and the use of extra- it would not serve ads.15 The list report- legal or very weakly legally constrained edly includes sites that indeed appear to forms to designate the target of attack provide primarily illegal downloads as and to de½ne the pattern of denial of ser- well as sites whose practices are clearly vice. The effect is to dispense with, or at non-offending, such as Archive.org and a least limit, the procedural and substan- broad range of basic technology sites that tive protections afforded to targeted sites, could, in principle, be used for ½le shar- and to degrade, if not completely pre- ing.16 Reliance on such a list is unlikely to vent, the operations of the organizations fail the “good faith and based on credible that use the site. All this is achieved with

162 Dædalus, the Journal ofthe American Academy of Arts & Sciences practically no need for judicial approval execute the goals of the state is rooted in Yochai before the action, and with only relative- the model developed for the “war on ter- Benkler ly expensive and slow judicial review while ror” of the ½rst decade of the 2000s. This the attack is ongoing. model now appears to be introducing The features of the attack are eerily two new elements into much more mun- familiar. They are the common charac- dane areas of social policy and organiza- teristics of what was described as early tion. The ½rst is the use of extrajudicial as September 24, 2001, as “the ½nancial models for designating targets for attack. front in the Global War on Terrorism.”17 The second is harnessing private actors, The coica model for designating bad in particular business and ½nancial sys- actors to be blocked by private parties tems providers, to choke off fund flows

replicates the model developed in 2001 to suspected organizations. Setting aside Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 that allowed the Treasury Department to debates over whether those elements can designate “blocked persons,” a label that be justi½ed when the targets are suspected triggers obligations by banks and others terrorist organizations, observing them to freeze assets and deny further use of metastasize to the civilian part of normal payment systems. Administrative desig- political and economic life in a democrat- nation without need for judicial order, or ic, networked society is extremely trou- weak-to-nonexistent procedural protec- bling and should be resisted–politically, tion for targets, combined with the use of legally, and technically. private business systems providers to endnotes 1 Combating Online Infringements and Counterfeits Act of 2010, 111th Cong., 2nd. sess., Sep- tember 20, 2010, S. 3804. 2 Preventing Real Online Threats to Economic Creativity and Theft of Intellectual Property Act of 2011, 112th Cong., 1st. sess., May 12, 2011, S. 968. 3 The description is drawn from the extensively documented study, Yochai Benkler, “A Free Irresponsible Press: WikiLeaks and the Battle Over the Soul of the Networked Fourth Estate,” Harvard Civil Rights-Civil Liberties Law Review 46 (2011). The study is also available at http:// www.benkler.org/Benkler_Wikileaks_current.pdf. 4 Adam Levine, “Gates: WikiLeaks Don’t Reveal Key Intel but Risks Remain,” cnn.com, Octo- ber 16, 2010, http://articles.cnn.com/2010-10-16/us/wikileaks.assessment_1_julian-assange --documents?_s=PM:US. 5 Benkler, “A Free Irresponsible Press,” Part III. 6 According to a PayPal executive, “What happened is that on November 27th [the day before WikiLeaks began releasing cables] the State Department, the us government basically, wrote a letter saying that the WikiLeaks activities were deemed illegal in the United States. And so our policy group had to take a decision to suspend the account.. . . It was straightfor- ward from our point of view”; Benkler, “A Free Irresponsible Press,” n.146–148. 7 Ibid., Part II.A. 8 Ibid. This information is based on statements by Julian Assange in comments on an early draft of the article. 9 Patrick D. Buckley and Michael J. Meese, “The Financial Front in the Global War on Terror- ism,” U.S. Army War College Strategic Studies Institute, 2001, http://www.au.af.mil/au/awc/ awcgate/army/usma_terrorists_½nances.pdf.

140 (4) Fall 2011 163 A New 10 There are many histories of this long battle. See James Boyle, The Public Domain: Enclosing Public- the Commons of the Mind (New Haven, Conn.: Yale University Press, 2008); Jessica Litman, Private Digital Copyright: Protecting Intellectual Property on the Internet (Amherst, N.Y.: Prometheus Threat to the Books, 2001); and Yochai Benkler, The Wealth of Networks: How Social Production Transforms Internet Markets and Freedom (New Haven, Conn.: Yale University Press, 2006). Commons 11 Intellectual Property and the National Information Infrastructure: The Report of the Working Group on Intellectual Property Rights (Washington, D.C.: U.S. Department of Commerce, 1995). 12 Digital Millennium Copyright Act of 1998, Public Law 105-304, 105th Cong., 2nd. sess., Octo- ber 28, 1998. 13 Prioritizing Resources and Organization for Intellectual Property Act of 2008, Public Law 110-403, 110th Cong., October 13, 2008. 14 The Higher Education Opportunity Act of 2008, Public Law 110-315, 110th Cong., August 14, 2008. Downloaded from http://direct.mit.edu/daed/article-pdf/140/4/154/1830072/daed_a_00121.pdf by guest on 26 September 2021 15 Mark Sweney, “wpp Blacklists More than 2,000 US Websites,” Guardian, June 8, 2011, http://www.guardian.co.uk/media/2011/jun/08/wpp-groupm-sir-martin-sorrell. 16 “BitTorrent.com and Archive.org Blacklisted as Pirate Sites by Major Advertiser,” Torrent- Freak, October 6, 2011, http://torrentfreak.com/bittorrent-com-and-archive-org-blacklisted -as-pirate-sites-110610/. 17 Buckley and Meese, “The Financial Front in the Global War on Terrorism.”

164 Dædalus, the Journal ofthe American Academy of Arts & Sciences