The Voice of the eCommerce Industry

Redbook on Facebook (and sharing information online)

It’s not often that you see advice on Internet privacy sandwiched between articles on “4 Times it Pays to Splurge” and how to “Be a Full-time Mom with a Part-time Passion.” But online privacy is such a hot topic that even Redbook, the women’s magazine, has a story in its August issue.  The article is an informed, well-balanced look at providing practical tips (well it should be, I was interviewed for it!) on being secure and private when on various Internet sites:

If you're a LIVE-LIFE-OUT-LOUD GIRL (i.e., you offer a play-by-play of your life to your 1,000 Facebook friends, blog readers, and Twitter followers), these are the guidelines you — and everyone — should follow:

• On your social networking profiles, take the time to check out the privacy settings and decide whom you want to have access to what information. The risks here aren't great, but do you really want your cousins to read about your sex life, or your frenemy to see photos of the party you didn't invite her to?
• If you're on a public wireless network, like at Starbucks, don't do your online banking or log on to other sites that contain sensitive information about you. Other users accessing the network might be able to access it.
• Teach your kids about the risks of sharing personal information on the Web. If it feels appropriate for your child, bring up the countless cases of tweens' and teens' personal photos and videos that have ended up in the wrong inboxes because of how easy it is to forward email. Have a conversation about what sites they're visiting online, and make sure they're staying safe by signing up for a free limiting service such as AOL Parental Controls, which allows you to log in and monitor their activity. Check with your wireless carrier for similar services on your kids' phones, too.

There's more tips if interested, or read about unboring veggies sides for grilled food.

-Braden Cox

Note to Saudi Arabia and UAE: Stop picking on the Canadian guy. You've got bigger problems.

Enough with the bullies from UAE and Saudi Arabia kicking sand on the skinny Canadian guy.  

The Blackberry service comes from a Canadian company who’s just doing what every communications technology provider is trying to do: respond to growing customer demand for security and privacy of their emails, text messages, and chats. 

So what's the point of bullying the mild-mannered Canadians, when American giants like Google are already doing the same thing?   Maybe EPIC's Marc Rotenberg has the answer, "The United Arab Emirates is not in much of a position to tell Google not to encrypt e-mail."

If the UAE and Saudis won’t pick on someone their own size, the global technology and communications industry needs to step in and make this a fair fight. 

But first, lets make sure these Arab governments understand the futility of their fight.   Do they really think that barring Blackberry devices and service will prevent users from encrypting messages?

We have come a long way from the days of putting a wiretap on telephone conversations.  Electronic communications is no longer a single vendor, point-to-point connection.  Today we use packet-based messaging over a multi-layer stack of distinct services managed by multiple vendors.  

I wrote about this "Security Stack" in a paper, which included this chart showing the path of a typical email:

The Blackberry service offers encryption, and assures customers that its network is designed "to exclude the capability for RIM or any third party to read encrypted information under any circumstances."   So, even if Saudi Arabian authorities could see encrypted Blackberry messages, only the sender has the key to read its  contents.

Even if Blackberry’s operator were forced to stop encrypting messages, there are multiple layers in the security stack where devices, services, and networks can provide encryption and other privacy-enhancing features that customers demand.  Encryption can be implemented on nearly any service, so those who want to maintain their privacy will find a way.

Threatening and bullying Blackberry into submission won't stop citizens from encrypting their messages. That can only be done by forcing similar restrictions on every other provider in the stack.

It's not likely that the UAE and Saudi governments will pick a fight with every company in a global industry.  Nor is it likely they would ban all electronic messaging, knowing their monarchs would be forced to back down after a few days of embarrassing international criticism.

It's time for these governments to stop bullying a company that's investing heavily to bring connectivity, content, and commerce to their own citizens.  It will only lead to a larger fight where everyone loses.

--Steve DelBianco

Online Safety Presentation at IGF-USA Now Available on Video

Here’s a summary and video excerpt of the presentation I gave a couple of weeks ago on a panel about online safety at IGF-USA,  a national body that reports to the full Internet Governance Forum.  I discussed the NTIA OSTWG “Youth Safety on a Living Internet” report, among other online safety issues such as sexting, cyberbullying.

It was a good panel that featured Danny Weitzner (Associate Administrator, Office of Policy Analysis and Development U.S. Department of Commerce) as moderator and Michael W. McKeehan (Executive Director, Internet and Technology Policy, Verizon), Jennifer Hanley, Family Online Safety Institute (FOSI), and Stacie Rumenap (Stop Child Predators) as panelists. 

-Braden Cox

Congressman Hodes Hits a Home Run for Small Business

Congressman Paul Hodes stepped up to the plate for small online retailers, and took a swing at a proposed law that would force new tax collection burdens on even the smallest of businesses who use catalogs or websites to serve their customers.

Hodes' resolution is titled “Supporting the Preservation of Internet Entrepreneurs and Small Businesses,” and its main provision is:

Congress should not impose any new burdensome or unfair tax collecting requirements on small on-line businesses, which would ultimately hurt the economy and consumers in the United States.

It’s good to see that Rep. Hodes was joined by colleagues from both parties, including Reps Capito, Lungren, Pitts and Schrader. 

The Hodes resolution is a direct response to legislation from Rep. Bill Delahunt that would force small retailers—those doing just $100K in annual remote sales -- to act as tax collectors for thousands of state and local tax jurisdictions where they have no physical presence.

Curiously, the legislation is titled the “Main Street Fairness Act” and is being sold as good for small business.   But main street small retailers have been getting clobbered by Walmart and big-box stores – not by the Internet.  In fact, main street is learning that the internet is their best hope for finding low-cost supply and finding new customers around the world.

So what would the Delahunt legislation really mean for small retailers who are staking a claim in the online world?

The bill Rep. Delahunt just introduced sets no level for the small seller exception. Instead, it leaves that to the tax collectors running the Governing Board of the Streamlined Sales Tax Project (SSPTP).   On April 30 of this year, this Governing Board voted to cut the small seller exception from remote sales level of $5 Million to just …  $100,000.

But wait, that $100K is just for starters.   The Governing Board amendment included this prescription for driving the small seller exception even lower:

The exemption threshold shall be set at a relatively low level and over time adjusted downward so that only sellers making isolated or occasional sales are excluded from the collection requirement.

Run the numbers:  $100,000 in gross sales is about $8,000 per month.  After expenses for cost of goods, marketing, accounting, communications, travel, etc. there’s not much left to pay for the owner's time, let alone costs of collecting taxes for 46 states.

And what kinds of costs will SSTP bring? Advocates of SSTP say that Certified Service Providers (CSPs) have software that makes it trivial for even the tiniest businesses to collect sales tax for everyone. But again, a little investigation shows just how big these costs would be be.

A Cost of Collection study sponsored by the SSTP Governing Board shows that small sellers (under $1M) spend almost 17 cents for every dollar they collect for states. And even if CSP software works as promised, that only helps with 2 cents of the 17 cents in costs per dollar collected.  That leaves small sellers with a 15% cost burden on every dollar they collect, for things like:

• Paying computer consultant to integrate CSP software into the seller’s home-grown or customized software
• Training for customer support and back-office personnel
  Answering questions from customers who claim they should be tax-exempt
• Answering calls and emails from customers questioning the taxability of items, or sales tax holidays in remote jurisdictions.
• Handling audit questions from 46 states, since the CSP will inevitably pass those questions along to the small seller for resolution
• Paying accountants and computer consultants to help find the answers to all these questions.

These collection burdens will be a huge problem for catalog and online sellers who are collecting only their home-state sales tax today.    Ask any small business, on Main Street or online, and you’ll learn it’s hard enough to collect sales tax for one state, let alone all 46 states with sales tax laws of their own.

With a full picture of what small online retailers would face from Rep. Delahunt’s proposal, we can see why Rep. Hodes and his colleagues were ready to go to bat for internet entrepreneurs and small online sellers.

A close look at the facts show that the SSTP would impose big collection burdens on small businesses, while adding less than three-tenths of one percent of state and local tax revenues. 

Sounds like Delahunt's pitch for SSTP ought to be returned deep into the center field seats.   Swing away, Rep. Hodes!

--Steve DelBianco

NetChoice Concerns over the Federal Privacy Proposals

Two privacy bills are already up for consideration. And at yesterday’s Senate Commerce hearing on Consumer Online Privacy, we heard Senator Kerry announce that he will be working on new legislation to regulate online privacy.

While we wait to see what Kerry will offer, NetChoice has concerns over the bills we do know about:  Rep. Rush’s “Best Practices Act” and the Boucher/Stearns Discussion Draft. We’ve created a side-by-side comparison of each and have four main concerns:

• Both proposals would regulate small websites that don’t even collect PII. Boucher-Stearns would regulate a tiny online startup that is adding just 100 users a week, even where its users provide only a made-up user name and password. As defined, “covered information” would overly restrict the flow of useful information and harm the development of ad-supported content and services.
• Safe harbor? Hardly! A company could be torpedoed with lawsuits from enterprising trial lawyers just for sending marketing emails that were later found to be outside of the safe harbor, up to $1,000 per violation and uncapped punitive damages.
• Marketing and advertising have legitimate operational purposes. Additional consent should not be required when a business uses covered information to do follow-up marketing to customers with whom it has already established a business relationship. Congress has recognized this consumer expectation in past legislation, which is why it built important exceptions in the CAN-SPAM Act for “relationship messages” to contact customers in an existing business relationship.
• The FTC should enforce laws against unfair or deceptive practices, not micromanage self-regulatory efforts. As the overseer of the safe harbor program, the FTC will have broad powers to dictate the details of self-regulatory programs, effectively transforming the FTC into the port authority of the Internet.

We’re also worried about the Rush bill mandate requiring access to information. It broadly applies to covered or sensitive information about individuals “that may be used for purposes that could result in an adverse decision about an individual….”

More analysis to come.

When it comes to Internet taxes, where you sit determines where you stand

There's a wise adage that goes "Where you sit determines where you stand."   Keep that in mind when you hear someone advocate a new sales tax collection mandate on small out-of-state retailers.

In a post at BNET last week, Chris Dannen described how big retailers are supporting the so-called “streamlined sales tax”:

“Brick-and-mortar retailers — many of whom have operations online — are some of the most vocal proponents of the new online tax laws. The members of the pro-tax lobby, which includes Best Buy, WalMart ,Target and others, already collect sales tax online, regardless of the buyer’s state, and see Web-only retailers as having an unfair advantage.

from How to Tax E-Commerce without Killing Entrepreneurship (and eBay)”

Big-box stores like Walmart and Target support a federal mandate that forces everyone to collect sales tax, even for states where they have zero presence.  So why would these giant chains  -- who already have to collect taxes on their web sales -- stand for this? 

Because from where Walmart sits, any simplification – even a little – helps reduce their costs.  And because these big boys want to impose new tax collection costs on their small online competitors.

In his comment on the BNET post, David Campbell tells us where his company stands on these new tax collection burdens:

Our company, FedTax.net, is launching a completely FREE service named TaxCloud, which automatically calculates accurate local sales tax for every jurisdiction in the United States. Internet merchants can point their existing e-commerce systems at TaxCloud for sales tax calculation, the same way they point at USPS/FedEx/UPS for calculation of shipping rates. For those states which have come into compliance with the Streamlined Sales Tax Agreement, TaxCloud will also automatically remit collected sales taxes, file periodic sales tax returns, and FedTax.net will act as the primary responder in the event of a jurisdictional audit. - again all for FREE.

Now, think about where FedTax sits and you'll understand why they are also standing for this new tax law.  FedTax stands to gain millions in new revenue Congress forces small businesses to seek help  -- from services like FedTax. 

But don't think for a minute that a small retailer is going to find relief from the lookup and remit functions that FedTax would provide.   The real cost for small sellers starts when they have to integrate FedTax tools into their home-grown and customized online shopping carts. And after they swallow that cost, small sellers will spend loads of time and accounting fees handling exceptions, exchanges, and state tax audits.

Meanwhile, FedTax collects their fees from state tax collectors, just for giving a band-aid to small sellers suffering from mortal wounds to their cost structure.

WalMart and Target are happy, too, while they watch small online competitors follow main street retailers into the dustbin of American business history.

If you think about this from where small businesses sit, there's just no way Congress should stand for a new tax scheme like this.

--
Steve DelBianco

NetChoice Comments On FTC's COPPA Rule Review

NetChoice filed comments yesterday with the Federal Trade Commission on its current review of the Children's Online Privacy Protection Act (COPPA).

We focus our response to the request for comments in four specific areas, and ask that the Commission:

1. Maintain the current age threshold at twelve years and under

2. Retain the “actual knowledge” standard

3. Clarify that states may not enact laws that conflict with COPPA

4. Conclude that geolocation & IP Address data are not individually identifiable information, and that COPPA already applies to the mobile Internet.

Regarding the second point, COPPA applies when a website is directed to children. But COPPA also applies when a website operator that has “actual knowledge that it is collecting personal information from a child” from children 12 and under. In any new COPPA rules, the Commission should maintain a strict construction of what it means to have “actual knowledge” and apply COPPA when website operators know in-fact that they have collected information from children.

The COPPA rule does not define “actual knowledge.” Generally, it is viewed as a heightened requirement for a mental state of possessing information. In the context of COPPA, “actual knowledge” would apply when a site learns a child’s age by asking for and receiving information from which it can determine age.

The “actual knowledge” standard is an important one for continued innovation on the Internet and for the future of user-generated content. It ensures that only culpable actors—sites that know they’re collecting information on children—are held liable for violating COPPA. At the same time, it prevents regulators from piecing together bits of information and determining on their own that a site should have known it was collecting information from children.

At the Commission’s COPPA Rule Review roundtable, we heard panelists describe how Congress initially considered a lower “knowingly” standard. This standard would have imposed a “should’ve known” obligation. A “knowingly” standard is more akin to a “constructive knowledge” standard, not actual knowledge. It would burden websites into mining data, to be sure that they would not be accused that they should’ve known.

COPPA compliance should not be a matter of shoulda, woulda, coulda. The Commission should reinforce its commitment to enforce the actual knowledge standard in ways that will not innocently trip up website operators.

-Braden Cox

When Having a Voice Isn’t Enough

In Brussels on Friday, an esteemed panel of experts got together to discuss the challenge of improving ICANN’s accountability. It’s just too bad nobody from ICANN came by to hear it.

Co-sponsored by the Washington-based Technology Policy Institute and the Brussels-based Center for European Policy Studies, the panel focused on ICANN accountability.  Four of the panelists –Shawn Gunnarson, Milton Mueller, Lawrence White, and Tom Lenard –have published proposals for new accountability mechanisms.

While their prescriptions varied widely, the panelists were remarkably similar in their diagnoses – namely, that ICANN has yet to meet the fundamental challenge of making its board and staff accountable and answerable to the community that it is intended to serve. 

It’s a message that’s been delivered to ICANN many times before, from many different stakeholders, but one that the staff and board of ICANN don't want to hear.

With the Accountability and Transparency Review now underway, the ICANN community gets another chance to make its collective voice heard about the accountability issue.  But as panelist Milton Mueller pointed out, sometimes voice isn’t enough.

Quoting from his 2009 paper, Mueller contends that ICANN has effectively substituted “voice” for other, more impactful mechanisms of accountability.

As members of the ICANN community we routinely voice our concerns, but when it comes to implementing real change, or holding the organization to account for its decisions, we’re left on the outside, looking in.

Hundreds of us devote substantial time and resources following the ICANN world-wide tour of meetings.  We take weeks away from our day-jobs and families to participate in the “bottom-up” process that's theoretically driving DNS policy. And we desperately want to believe that our participation makes a difference.

But a substantial number of stakeholders are questioning whether their participation really matters. While ICANN's board and management may not mind if there are fewer stakeholders going to the microphones during public comment periods, the organization must know that it’s credibility depends on stakeholders believing they have an impact on the process. 

In meetings between ICANN’s Government Advisory Committee (GAC) and the Accountability Review team yesterday, government representatives wondered why ICANN isn't requesting their advice more often, and gave examples where GAC advice wasn't duly considered in Board decisions.

There's a common-sense saying, "Don't moon the giant."  Alienating nongovernmental stakeholders is one thing, but ICANN is risking its very existence if influential governments feel alienated or ignored.  That's because governments have options other than ICANN.  They can turn to other venues where their voice is law, such as the United Nations and ITU. If that happens, we'll find out how tenuous ICANN's grasp on authority really is.

In Today's opening ceremony, CEO Rod Beckstrom said that ICANN invited the voices of stakeholders who might be critical:

By bringing in diverse and even contradictory voices, we are driving toward even greater innovation and openness and laying the path for the Internet of tomorrow.

But when one is disagreeing with proposals being pushed by ICANN staff and management, just having a voice isn't nearly enough.

--Steve DelBianco

NetChoice to Commerce Department: Be Our Advocate Over There, Over Here

Now is a critical time for online commerce as policymakers assess their approaches to privacy. And as NetChoice says in our comments filed today, now is the perfect time for the Department of Commerce to be more involved in privacy issues.

What? We’re calling for more government involvement in a politically charged issue? Yes, and here’s why it’s an appropriate response to the Commerce Dept’s Notice of Inquiry.

Data flows today are much more complex than they were even a decade ago.  Simple one-way transfers between one country and another have been replaced by multinational corporations that transfer data across multiple jurisdictions on a daily basis.

Because of this, privacy-related laws and regulation can have a broad impact on the growth of online commerce, not just here in the U.S. but across the globe. And as a voice for commerce, the Department of Commerce should promote pro-commerce policies over there (EU, Asia, elsewhere) and over here (in the U.S.). 

Here’s what we say in our comments:

• The Commerce Department should act as an international ambassador for innovative American online companies.  The Department can play an important role as a government-to-government advocate for flexible international rules to promote continued innovation and economic growth.  And as a government agency speaking to other government agencies, the Commerce Department can bring credibility and leverage that cannot be matched by corporate interests alone.
• Domestically, the Commerce Department should work with the FTC to step-up state and federal enforcement against unfair or deceptive information practices. Aggressive enforcement will help foster a better climate for innovation than would expanded regulation. New regulations are followed only by legitimate businesses who were already complying with the old regulations. Bad actors, on the other hand, ignore both old and new regulations with impunity (e.g., Spammers are still spamming even after the FTC issued new regulations pursuant to the CAN-SPAM Act).

But whether it is overseas or here in the U.S., we advocate that the Commerce Department promote a privacy framework that is flexible enough to permit innovation, and that opposes static laws that undermine consumer interests in improved online services.

-Braden Cox

California Bill Prevents Social Networking Sites from Displaying Home Address & Telephone # – How can this be…bad?

There’s a bill moving in California (SB 1361) that restricts how social networking sites display the personal information of 13 to 17 yr olds. It’s billed as a privacy bill and at first glance seems relatively harmless -- after all, kids don’t need to be broadcasting their contact information, right? Maybe. It all depends.  

It depends on the situation, obviously. We teach our kids to recognize risky situations and to react appropriately.  

But whether or not teens are at risk by publishing their telephone numbers is not the threshold question here. The law presumes such and I’m not aware of any specific findings offered in testimony about the bill.

Instead, the issue at hand is whether we need a law to restrict social networking websites from publishing certain information from teenagers. And with any law, there’s always the corresponding principle of unintended consequences.  

A bit more about the bill. It restricts a social networking website from displaying the home address and telephone numbers of minors who self-identify as being under 18. It only applies to “web fields specifically designated to display the registered user’s home address or telephone number” – recognizing the impracticality of having hundreds of thousands of websites police every area where kids can share information.

Arguing against bills that aim to protect children is really hard work – who can be against the children (or in this case, adolescents)? But I truly believe this bill has serious unintended consequences and sets a bad precedent for how minors are allowed to share information on the Internet. 

Here’s why SB 1361 shouldn’t become law:

• It’s a one-size-fits-all approach that encourages kids to lie about their age. If a teen can't share this info in a pre-prescribed field, they will either share it in a general space, share it via text or email, or lie about their age in order to share the info.---thereby circumventing a site’s safety features.
• It undercuts existing safety solutions and the sort of “teachable moments” endorsed by the NTIA OSTWG and Berkman Internet safety reports.
• It wrongly assumes that predators discover a kid’s home address or telephone number through the Internet and then contact them offline (instead, we know that at-risk kids are groomed online, not offline).
• It provides a false sense of security to parents.
• Finally, it’s better to educate teens on how to properly give out their contact information than to have the government do it for them.

The bill is before the Assembly, having been referred to the Arts/Entertainment committee. It will likely be heard in the next week or two, and has already passed the Senate.

-Braden Cox