Article by Kevin Savetz

First Published:
Date Published:
Copyright © by Kevin Savetz


Can you legally use a keystroke catcher to monitor your friend's PC? Can you be thrown in jail if you inadvertently download some type of sickening porn? Find out whether you're a cyber scofflaw or an upstanding citizen of the digital frontier!

You may already be a criminal.

Unless you’ve suffered through years of law school—hell, even if you have suffered through years of law school—it can be difficult to nail down exactly what’s legal and what isn’t when working on your PC. And sometimes the law even gives you rights that a license agreement summarily takes away. So we asked several attorneys and other experts who specialize in computer-related law for answers to the most burning PC-related legal questions. Read on to find out if your computing exploits are actually part of a rich and varied life of crime.

Q: Is it legal for me to make backup copies of my software for my own personal use?
The law says yes: Archival backups are indeed legal. But your software’s license agreement may say no.

For any particular piece of software, the answer to whether backups are allowed depends on the language of its end-user license agreement, or EULA, a document that comes with nearly every piece of software but hardly anyone actually reads. The license agreement is a terms of service contract that can supercede the rights given to you by established copyright law, such as the right to make backup copies. "Copyright law sets a default, but these licenses are designed to say, ‘We don’t want that bargain. We want to strike our own bargain,’" says Robin Gross, staff attorney for intellectual property at the Electronic Frontier Foundation (www.eff.org). Gross says the issue of EULAs superceding federal law is the subject of much debate and disagreement: "Some courts have held that those software licenses are binding on the theory that one can contract away certain rights one would otherwise have, and others have found them unenforceable. Unfortunately the law is quite murky here."

Luckily, most licenses do indeed allow you to make a backup copy of the software. Typically, a license agreement will specifically permit archival backups, or it won’t mention the issue at all. If the license doesn’t mention backups, then they are allowed.

But what about one of the most popular installs on the planet? In fact, the license agreement for Microsoft Office might leave you scratching your head: It says you can keep the original media after you install—that’s your backup, pally. The exception is if the disc is required to run the software. In that case, you can make one backup.

"The bottom line is people need to read those license agreements rather than ignore them," says Ross Kodner, president of MicroLaw, Inc., a legal technology consultancy. Kodner suggests that companies that use many software products create a database that summarizes the key points related to each program’s license agreement, keeping it all in simple language. Home users don’t have it so easy—so grab a cup of your favorite beverage and slog through those pages of tiny, dense legalese if you actually give a hoot.

To date, Maximum PC knows of not a single instance in which an individual user was busted for "violating" the terms of a license agreement.

Q: Can I install my office application suite on both my PC and my laptop?
The answer once again lies with our old friend the software license agreement. Some license agreements say yes, you can install software on two computers—as long as there’s no possibility the software will be used in more than one place at the same time. Other agreements specifically prohibit against installing the software on more than one computer.

If the license agreement doesn’t address this issue, then it’s safe to install the software on both of your computers. "You should assume since it is not specifically prohibited, that it is permitted," Kodner says. "The onus is on the software vendor to specifically indicate prohibitions. Absent [of these] prohibitions, end users have any rights they choose in terms of using the software."

Microsoft is (perhaps surprisingly) generous in this area: The license agreement for Microsoft Office 2000 reads, "The primary user... may make a second copy for his or her exclusive use on a portable computer." However, it also notes that you can’t use the program on more than one machine at the same time.

If the license isn’t on your side, you can always switch to software with a more favorable license agreement. For instance, StarOffice (www.sun.com/staroffice/) allows you to install the program on multiple computers within an organization.

Q: Is it legal to make MP3s of the CDs I own? Am I prohibited from sharing mix CDs with my friends?
We know that your custom "Best of Abba" MP3 mix is important to you, so you’ll be happy to know that making MP3s from your own CDs and copying those files to your MP3 player is "absolutely legal"—or so says Robin Gross of the EFF.

The Recording Industry Association thought otherwise in 1999, however, and sued Diamond Multimedia in an attempt to halt the distribution of the Rio MP3 player. In a subsequent decision, the 9th Circuit Court of Appeals sent the RIAA packing, saying that MP3 players provide for exactly the kind of "personal use copying" that’s allowed by the Fair Use provision of copyright law.

"Fair use"—pay attention, this will come up again—is an exception to the copyright law. It allows duplication of copyrighted materials under certain circumstances, including personal, non-commercial use. "Fair use is part of the public right under the copyright bargain, a limitation of the copyright holder’s right to control copying," Gross says.

Sharing copyrighted MP3s with your friends is a trickier question. Copyright holders have the right to control distribution of their work, so you’re probably infringing on their rights by giving away copies. "Most folks would admit it’s an infringement to make six million copies available on Napster… but copyright law is incredibly ambiguous. There is no clearly defined legal answer," Gross says.

So if you’re going to share MP3s of copyrighted music, the safest bet is to not get caught.

Q: If I inadvertently download illegal porn, can I be arrested? Am I obligated to alert the authorities?
So you’re surfing around looking for some nice, wholesome smut when you stumble across something that would make even the most warped of perverts grimace and look away. Now what? Do you run to the cops and plead for the mercy of the court?

No, you’re not legally obligated to inform anyone—it is not a crime to not report a crime—but you could theoretically be arrested. This is an issue where the law isn’t settled yet, and unless you’re starved for attention, you probably don’t want to be focus of an embarrassing, precedent-setting court battle. Just remember that once the objectionable porn has appeared on your screen, it’s also in your browser’s cache or tucked away somewhere else on your hard drive.

The general rule for defining what’s obscene is that "community standards" prevail. In other words, whatever a particular community considers obscene is obscene in that area. Is that definition vague enough for you? It’s important to note that there’s a difference between "indecent material" (content that mat be smutty but is nonetheless tolerated in a community) and "obscene material" (content that isn’t tolerated and is illegal). The line between the two is completely subjective and can vary from one community to another. So which community must you answer to? The answer is both.

"The Internet changes things. You’re everywhere all at once," Gross says. Indeed, although you and your PC may be located in a "porn-friendly" town, you could be in hot water if you download obscene material from a web server located in the middle of the Bible Belt. "You can’t be in every community simultaneously, but you could be held responsible for every community’s standards," Gross says.

Ross Kodner of MicroLaw, Inc. agrees that online obscenity is a gray area of criminal law and that the rules differ depending on where you live: "If you’re looking for pornography and inadvertently downloaded illegal material, would criminal liability be attached? I would say this would entirely turn on your intent." For instance, if the name of a newsgroup indicates that it contains illegal material, it’s likely that someone browsing there is actively looking for illegal material. But if your download was truly an accident, you’re off the hook: Without criminal intent, there can be no criminal act.

Despite all these gray areas, it’s important to know that a few things are illegal no matter where you are. For instance, child porn (pornography featuring people under the age of 18) is illegal under all circumstances in the United States. Beastiality, too, is obscene everywhere.

"People need to practice smart surfing. There is clearly risk involved in looking at materials that are potentially illegal. Getting your jollies on the net has become complicated. If you don’t want to have legal liability, don’t do it," Kodner says.

Ah, clarity at last.

Q: What’s the strongest e-mail encryption I can legally use? Are there any legal differences between e-mailing an encrypted file to a friend here in the U.S. and e-mailing the very same file to a friend in Europe?
Your grandmother wants to e-mail her zesty raisin cookie recipe to you, but insists on encrypting the message to make sure it remains a secret. Don’t worry, the Feds won’t send grandma to the Big House for using super-strong recipe encryption.

There are no restrictions on exporting encrypted files: Grandma could encrypt her recipe with an uncrackable, 10 million bit key, then legally e-mail that encrypted recipe to her family in the United States as well as anywhere else in the world.

"There are no restrictions about what encryption routines you can create or use inside this country today," says Dale Haag, president of Net-Defender LLC, a computer security company. "You can use any encryption you want."

Now, Grandma’s feeling pretty proud of herself and wants to release her powerful encryption software as freeware. Here’s where she needs to be careful: Grandma can share the software with her friends in the United States, but there are complicated rules about exporting the software outside of the country.

"Under current Commerce Department export regulations, you can post encryption source code that is not commercial or proprietary on a web site and make it generally available to the world," says Lee Tien, senior staff attorney at the Electronic Frontier Foundation. But Grandma will have to notify the government (she should visit www.bxa.doc.gov for information) and follow much more complicated procedures if she wants to export commercial encryption software.

Q: Is it legal for me to monitor someone else’s activities with keystroke loggers or monitoring software?
Before you start playing private detective and snooping on your ex-girlfriend’s computer... well, just don’t. Capturing keystrokes can get you in a whole mess of trouble. The Electronic Communications Privacy Act makes it unlawful to intercept a communication in transit. That could include intercepting keystrokes before the message is sent or reading a user’s POP mail before it is delivered to his or her PC.

The rules are different at the workplace. Can your boss sniff around in your computer files? The laws vary from state to state, but you can assume that employers have the right to control and monitor their computer systems. "As a matter of good practice, employers should have a policy that discloses that their systems are the property of the company and use may be monitored by the company," says Alan Sutin, co-chair of the information technology and e-commerce practice Greenberg Traurig.

"A smart employer will indicate that there is no privacy that can be expected," Kodner says. "Smarter employers will even take the step to say, ‘If you want to maintain confidentiality, do it on your home computer, not on our computers.’"

The privacy of personal e-mail accounts on a work computer is a dicey question, and whether snooping is allowed depends on what state you’re working in. But it’s easy for employers to monitor incoming and outgoing packets and even to observe your screen contents, so you’d be much, much wiser to conduct all personal correspondence on your home computer, or at least use a free, web-based e-mail service (such as Hotmail) when sending out resumes and love letters from work.

Q: Is my ISP allowed full access to all the messages I send via its service?
Can your Internet service provider (ISP) read your e-mail, track your web browsing habits, and otherwise spy on you? That depends entirely on the terms spelled out in the ISP’s usage agreement. If the agreement specifically states that the ISP has that right, the answer is clear: The ISP can monitor your mail and other online activities with impunity. If that isn’t mentioned, or there is no contract, then your ISP has no right to observe your online activities.

Virtually every ISP has a user agreement, much like the end-user license agreements that accompany software. "I think a vast number of people who subscribe don’t read it—which is a fundamental mistake," says MicroLaw’s Kodner. "People need to know what rights they are retaining and giving up. Nobody wants to read this material, but people are giving up or gaining very important rights that affect their lives," he says.

For instance, the "acceptable use" policy of AT&T Broadband service states "the company will not read or disclose to third parties private e-mail communications… except as required to operate the service or as otherwise authorized by law."

Why are all those agreements written in such hard-to-follow legalese? "The material is written by lawyers to comply with complex laws. Should it be written in plain English? Absolutely. Is that likely to happen in the near future? No," Kodner says.

Q: Can I use stuff I find on the Internet on my personal web site?
Maybe—depending on what you’re copying, how much of it, and why. The answer depends on whether your copying would be considered a "fair use."

Many factors determine what fair use is, and it can be difficult to establish exactly what’s permissible and when you’ve gone too far. The copyright holder’s idea of what’s acceptable may be very different than yours. Many people have gotten nasty letters from lawyers for excerpting trivial amounts of material. Fortunately, there are some guidelines you can follow to cover your ass.

"Any time you’re going to try to make a fair use of something, four factors are supposed to be taken into consideration," Robin Gross at EFF says.

First is the "purpose and character" of that use: For instance, are you making the copy for an educational purpose or for commercial gain? An educational use is more likely to be deemed fair use than is pilfering someone else’s work for your own profit.

Second is the nature of the material that’s being copied—reproducing a newspaper article and adding commentary would likely be deemed a socially valuable fair use, whereas posting a Dilbert cartoon on your "I Hate My Boss" web page probably would not. Of course, each individual situation is different, and ultimately the courts would decide if your particular use passes fair use muster.

Third is the amount and substantiality of the copy: Did you copy a large portion of the material or just a small excerpt? Small excerpts might pass muster.

The fourth and final factor is the effect on the market or value of the original work. If your particular copying replaces the copyright holder’s ability to distribute and profit from that work, that’s not a fair use.

What does that all mean to you? It means that quoting a couple sentences from a Harry Potter book on your Muggle-mania fanpage is probably OK. But making the whole book available for download definitely isn’t. And taking a cool image from Warner Bros.’ official Harry Potter web site just because you like it is theft.

"The best approach any user could take is to never assume that copying anything is permissible. Create you own content," MicroLaw’s Kodner says. Many companies actively search the Internet looking for abuse of their copyrights. "No one should think his or her site is below the radar screen of any company or individual that has a legitimate copyright to protect," he says. "Assume they will find out, and assume they will argue against fair use."

"For many people, the Internet is synonymous with the word ‘free.’ A lot of people assume things that show an utter ignorance of U.S. copyright and trademark laws. $250 for an hour of a lawyer’s time could save you thousands of dollars," Kodner says.

Q: I want to play a game on my laptop without having to carry around the CDs, so I downloaded and installed a "fixed executable" that removes the CD-check. Have I broken the law?
You haven’t broken the law, but you’re probably violating the software license agreement. Remember, you didn’t actually buy the game—you bought a license to use the game. Unless you read the fine print, you wouldn’t know that by clicking "I agree," you actually entered a legal agreement to move to Tulsa and change your name to Sven.

Anyway, Sven, the license agreement probably disallows modifying the program code, and installing a patch that removes the CD-check routine is modifying the program code. That license agreement probably also says you’re not allowed to do anything to permit multiple copies of the game to circulate. Hacking the program to remove the CD-check would also break that rule.


Articles by Kevin Savetz