Business Technology Law Blog

Special Seminar Event in NYC

noreply@blogger.com (Bradley Gross) — Sat, 21 Apr 2012 01:32:00 +0000

Legal Strategies of Highly Successful App Development Companies

Here's your opportunity to learn the secrets of the most successful app development companies in the country--a perspective not seen, or taught, by any business school or law school in the country.

Whether your business is a spin-off, a start-up or an experienced app development company, it faces tough legal issues that need to be perfectly handled, or your company—and its software projects—will ultimately fail.

In this seminar, we will explore the legal challenges faced by every software and app development company, regardless of the company’s age, size, structure or industry served by the company’s software products.

Topics will include:

● Privacy & Data Security: Learn what you need to know to ensure that your company’s data collection processes comply with FTC rules and regulations.

● Marketing / Branding Strategies: Learn what you need to know to register and protect your valuable intellectual property.

● Drafting Concepts: Learn to negotiate and draft the most effective and comprehensive development deals possible, utilizing up-to-date legal concepts and strategies used by some of the biggest software companies in the industry.

● Profitable Licensing: Discover the secret to effective licensing strategies used by profitable software companies throughout the United States.

● Offshore? Near-shore? Domestic? Learn the pros and cons of the various app development options available to your company. Learn how to protect your IP, even when it’s developed outside of the United States.

● Asset Protection: Learn how to structure your company to keep your intellectual property away from would-be creditors and plaintiffs—including patent trolls.

Cost: $400 (includes lunch)

Date: May 9, 2012

Time: 10:30 AM – 2:30 PM

Location: NYC (exact location to be announced)

Limited seating!! RSVP today!

The seminar will be led by Bradley Gross, Esq., managing partner of the boutique IP law firm, Law Office of Bradley Gross, PA., which focuses on specialized areas of intellectual property and technology law. The firm represents digital and new media companies and software development companies throughout the world, and is general counsel to some of the largest digital agencies and production companies in the United States. Brad has twice been named a Superlawyer (www.superlawyer.com), and has been listed three times as being in the top 2% of all intellectual property lawyers in the State of Florida. He is the editor of two newsletters: the Business Technology Law Update, and the FTC & Digital Media Law Update.

RSVP today by clicking the logo below.

Viacom's "Victory" Over YouTube Isn't A Victory At All

noreply@blogger.com (Bradley Gross) — Tue, 10 Apr 2012 19:47:00 +0000

The latest decision in the Viacom v. YouTube saga was handed down on April 5 by a federal appeals court. The decision re-instated a previosuly dismissed case against YouTube, in which Viacom sued YouTube for failing to remove Viacom's videos from YouTube's online database. And this is mostly good news for YouTube.

Wait, did you read that correctly? Did I write it correctly? Answer: Yes, to both.

It is good news for YouTube that the case against it was reinstated--not because YouTube has to defend itself again, but because the decision makes it clear that the Safe Harbor provisions of the Digital Millennium Copyright Act (or "DMCA") are alive and well, and fully enforceable. And that's good news for YouTube.

You're all familiar with the ongoing litigation involving Viacom and YouTube, right? Here's the summary:

Thousands of Viacom-owned videos were being posted on YouTube.
Viacom sent YouTube so-called "take down" letters, which are notices issued under the DMCA in which Viacom alerted YouTube to the existence of the videos, and demanded that the videos be removed from YouTube's site.
YouTube took down the videos that were specified by Viacom; however, when one video was removed, someone, somewhere, simply re-posted it. Also, Viacom claimed that the same video was saved under multiple YouTube users' names, in multiple locations, so even if one copy was taken down, several other copies were still available.
In addition, there were thousands of other Viacom-owned videos posted on YouTube which were not specified in Viacom's takedown notices.
Viacom said, "Listen YouTube, we shouldn't have to keep telling you to take down the same type of video, such as video clips of the "Daily Show" or other shows produced and owned by Viacom. You should know that any Viacom-owned television show should not be permitted to be posted on YouTube. Now go and remove all of them--even if they are not specifically mentioned in a takedown notice, and even if every copy of the same clip is not specifically referenced in a takedown notice.."
YouTube said, "Uh, no. The DMCA only requires us to take down only those videos about which we have specific knowledge. A general 'idea' that unauthorized videos exist on YouTube does not trigger any responsibility on YouTube's part to seek out all Viacom videos and remove them from our database. If you specifically tell us about them, we'll remove them. Otherwise, have a nice day." (Ok, I took some artistic license with the dialogue--but you get the point.

The lower court initially agreed with YouTube, and dismissed the case against YouTube stating that YouTube was entitled to "safe harbor" under the DMCA because it removed those videos about which it had knowledge. On April 5, however, an appellate court revived the case, and sent it back to the lower court for re-consideration.

So why is this good news for YouTube?

Because in its decision, the court completely eviscerated Viacom's position that YouTube should be responsible for those videos about which YouTube had only general, and not specific, knowledge. In other words, the court said that YouTube is protected from liability except where it actually knew of (or was purposely blind to) specific instances of unauthorized postings of Viacom videos. The court also emphasized the fact that YouTube did not have any duty to affirmatively monitor its users' activities.

Now the only remaining issues in the case revolve around whether YouTube exerted "substantial influence" on its users by encouraging them to engage in the unauthorized posting of Viacom videos. (And the odds of the lower court making that kind of finding are very slim. To make that kind of determination, the lower court will have to find that YouTube encouraged its users to post Viacom videos. A similar argument was attempted, but failed, in a case in California last December.)

The bottom line is this: the remaining claims and causes of action against YouTube have been gutted, and the court's decision makes it clear that YouTube's business model will be able to continue in the future. And that's good news for all of us.

Sometimes You Can Use Someone Else's Trademarks

noreply@blogger.com (Bradley Gross) — Mon, 02 Apr 2012 21:40:00 +0000

Here’s a case of “first impression”--that’s a fancy way of saying, “a matter that hasn’t been decided by a court before.” It comes to us from a federal court in Texas, and it reminds us that commercial printers may be allowed to display the trademarks of others if the trademarks are displayed as part of the company’s printing business. The case may have significant implications for production companies and producers of online content—so let’s take a look and see went on.

The case of National Business Forms & Printing, Inc. v. Ford Motor Company, involved a small commercial printing company, National Business Forms & Printing, Inc. (which I will mercifully abbreviate as “NBFP”). NBFP made custom signs, stickers, banners, decals, and other advertising materials for its clientele. Among the various materials it would make were signs and banners displaying various car logos, including the famous “Ford in a Circle” logo, owned by Ford Motor Company.

NBSF’s websites declared that NBFP was “not affiliated with, licensed by, or endorsed by any company," and that the product logos previewed on the websites were "trademarks of their respective companies, and are provided for accurate identification and reproduction for authorized users."

Ford, however, wasn’t too fond of NBFP’s use of Ford’s famous trademark and didn’t care much about NBSF’s attempt to disclaim an affiliation with Ford. Through its attorneys, Ford demanded that NBFP stop using Ford's trademarks on all of NBFP’s websites.

NBFP sued Ford, and asked the court to declare that NBFP’s online printing operations did not infringe Ford's trademark rights. Ford countersued NBFP and raised counterclaims of trademark infringement, among other sundry things. The battle was on.

While I’d enjoy offering you a cinematic description of the strengths and weaknesses of each party’s position, I’ll skip right to the chase. After all, that’s why you read this blog, right?

The court held that NBFP did NOT violate Ford’s trademark rights. Why? Because NBFP only displayed Ford’s trademark to demonstrate the types of signs and banners that NBFP could make, and for no other purpose. NBFP did not try to induce people into thinking that NBFP was affiliated with Ford, and the court found that no reasonable person could believe that the printing company was related to Ford Motor Company.

See, it all comes down to customer confusion. If there’s no likelihood of customer confusion, then trademark infringement cannot occur.

Now listen up digital content producers: although the case involved the use of trademarks on a physical product (such as a banner), there’s no reason why the same logic can’t be applied to online, digital products and services. What’s the difference between a physical banner and a virtual banner? Not much--in fact, I'd argue that there is no difference at all, at least not from a legal perspective.

If your company is in the business of producing commercial banners (or similar items) online, then under certain circumstances you may be able to use the trademarks of others without risking a trademark infringement lawsuit. But DON’T VENTURE INTO THIS AREA ALONE.

Call counsel before using other companies’ intellectual property. If you do it correctly, it can be quite lucrative. If you don’t do it correctly, it can put you out of business.

EA Sued Over Use of Helicopters In A Video Game?

noreply@blogger.com (Bradley Gross) — Mon, 26 Mar 2012 22:53:00 +0000

Electronic Arts is one of the biggest and best producers of realistic video games. So it should come as no surprise that in EA's popular video game, Battlefield 3, users have the option of flying around in simulated U.S. military aircraft like the AH-1Z Viper, the UH-1Y Venom and the V-22 Osprey.

But enter Bell Helicopter Textron and Textron Innovations, Inc--the companies that make those helicopters for the military in real-life. (I'll call them "Bell" for short.) Bell thinks that EA's use of its helicopters (virtual or otherwise) violates Bell's intellectual property rights.

To bring the issue to a head, EA filed a lawsuit against Bell, asking a federal court to declare that EA's use of Bell's helicopters in Battlefield 3 does not violate Bell's intellectual property rights. Not to be outdone, Bell filed its own lawsuit, asking a court to find that EA's video game violates Bell's intellectual property rights in the design, and naming, of its military aircraft. (Wow--this is just like Battlefield 3, but with even more terrifying weapons: lawyers. Can't wait for that to come out on the Wii.)

The lawsuits are pending, but I think Bell is wrong. Way wrong. Here's why.

We begin with the U.S. Supreme Court decision last June in the case of State of California v. Entertainment Merchants Association. You can read that decision here--but don't. At least, not yet. I'm going to tell you everything you need to know about that case right now....

Video games are a form of expression, and are entitled to First Amendment protection. Justice Scalia put it this way: "Like the protected books, plays, and movies that preceded them, video games communicate ideas—and even social messages—through many familiar literary devices (such as characters, dialogue, plot, and music) and through features distinctive to the medium (such as the player's interaction with the virtual world). That suffices to confer First Amendment protection."

(That's everything you need to know about the Entertainment Merchants case. Let's move on....)

Under the First Amendment, EA can use simulated video versions of the helicopters for expressive purposes without violating any of Bell's ownership rights in the design or appearance of the helicopters. Understand that? Perhaps not...so let me put that another way, but in the form of a question: Could EA ever make a realistic war game involving U.S. military forces without simulating the equipment and vehicles that are actually used by the military? Of course not. There would be no way to do it without referencing the actual equipment and aircraft used by the military.

So, since there is no other way to do it, does that mean that video game makers cannot create realistic war games without running afoul of intellectual property laws? Of course not. Trademark laws give trademark owners many rights, but the law does not give a complete and unfettered monopoly to trademark owners to prevent others from telling a story--virtual or otherwise.

Remember, EA is not trying to peddle helicopters or compete with Bell to make helicopters for the military. EA is only expressing its idea of a realistic wartime game through the use of virtual simulations That's not IP infringement, that's expression--the same type of expression that we have protected under the First Amendment since 1791.

Which brings me to my second point: in order to succeed in a claim of trademark (or trade dress) infringement, a plaintiff needs to show likelihood of customer confusion. In this case Bell would have to show that people would be confused into thinking that EA produced, manufactured or distributed military aircraft. And not just any "people" would have to be confused--the "people" would have to be the type of people to whom the trademark / trade dress is meant to apply, i.e., those that are normally involved in the purchase or acquisition of military aircraft.

Does anyone think that EA's game will lead purchasers of military equipment to believe that EA actually makes or distributes military helicopters? Oy vey. If anyone in the government is led to believe that EA is in the business of producing military aircraft based on Battlefield 3, then we have much bigger problems than trademark infringement.

I will continue to watch these cases, but I'm extremely confident that EA will succeed, and Bell will fail. By the way--as of the date of this post, neither of the parties' complaints in the case are easily found online--but I have them. Email me if you want a copy.

In the meantime, I'm going to ask my kids how to play the game. (IP issues aside, these games are really tough to play. I think I'm officially the slowest moving target in the game....)

FTC Issues Final Report on Consumer Privacy

noreply@blogger.com (Bradley Gross) — Mon, 26 Mar 2012 18:03:00 +0000

Today, the Federal Trade Commission issued a final report setting forth best practices for companies to protect the privacy of American consumers, and to give American consumers greater control over the collection and use of their personal data.

The report, which you can access HERE, expands on a preliminary staff report the FTC issued in December 2010. The final report calls on companies handling consumer data to implement recommendations for protecting privacy, including:

Privacy by Design - companies should build in consumers' privacy protections at every stage in developing their products. These include reasonable security for consumer data, limited collection and retention of such data, and reasonable procedures to promote data accuracy;

Simplified Choice for Businesses and Consumers - companies should give consumers the option to decide what information is shared about them, and with whom. This should include a Do-Not-Track mechanism that would provide a simple, easy way for consumers to control the tracking of their online activities; and,

Greater Transparency - companies should disclose details about their collection and use of consumers' information, and provide consumers access to the data collected about them.
We will have more analysis of the final report, and how it impacts your company's data collection practices, in the next few days. For the most up-to-date analysis on this topic and other FTC and Digital Media Law-related topics, subscribe to the FTC & Digital Media Law Update.

You can check out the most recent Update (March 26) HERE and the March 21 Update HERE.

FTC Releases Its List of Top Consumer Complaints

noreply@blogger.com (Bradley Gross) — Thu, 22 Mar 2012 03:31:00 +0000

Last month, the FTC released the Consumer Sentinel Network Data Book for January - December 2011.

For those of you not familiar with the Consumer Sentinel Network (or "CSN"), the CSN is an online database of millions of consumer complaints, which are available only to law enforcement and prosecutorial agencies. The database covers complaints filed with certain state agencies (such as state Divisions of Consumer Affairs), as well as federal agencies (such as the U.S. Postal Inspection Service, the FBI's Internet Crime Complaint Center, and others).

You can read the book in its entirety here.

According to the book, the CSN received over 1.8 million complaints in 2011. Some interesting facts: Colorado led all other states in reported fraud incidents, followed by Delaware and Maryland. Most fraud incidents were initiated with an email (43%), while only 13% were initiated by an Internet website.

Not to be outdone, Florida stepped up and took the lead over all other states (Hooray, I think?) with the highest per capita rate of reported identity theft (Oh, never mind.) Coming in a close second and third, respectively, were Georgia and California.

Here's the "top ten" of complaint categories (from most to least):

Identity Theft: 15%
Debt Collection: 10%
Prizes, Sweepstakes & Lotteries: 6%
Shop-at-Home & Catalog Sales: 5%
Bankers and Lenders: 5%
Internet Services: 4%
Auto-related Complaints: 4%
Imposter Scams: 4%
Telephone and Mobile Services: 4%
Advance-Fee Loans and Credit Protection/Repair: 3%

I Tried, But I Can't Dislike the Cybersecurity Act of 2012

noreply@blogger.com (Bradley Gross) — Tue, 28 Feb 2012 15:26:00 +0000

I wanted to find a reason to dislike the recently proposed “Cybersecurity
Act of 2012”--but I couldn’t find one. (You can download and read the bill HERE).

Before reading the bill, I thought it was going to be another watered-down law that doesn’t address the problem of cyber-security at a national level, and doesn’t require (or facilitate) government agencies to talk to one another about their cyber-weaknesses. I was wrong.

The bill is a pretty good start for a long-term solution to remedying our nation’s cyber-security deficiencies, and here’s why:

1. The bill requires all federal agencies that maintain so-called “critical infrastructures” to conduct a comprehensive review of their cyber-weaknesses. (That’s a good thing, since everyone always thinks they have secure systems, until those systems are actually put to the test.) My suggestion: make sure that the self-assessments include all facets of security, including document retention and destruction policies, data migration policies and encryption policies. Security holes are sometimes found in garbage cans and dumpsters, and not just online.

2. The bills sets specific dates for compliance, using a phased-in approach. (Phased-in dates are always preferable to single-date deadlines that are usually randomly selected and have no relationship to real-life implementation activities).

3. The bill requires the government to speak to the private sector when setting performance and security standards. (I’m a big believer that the private sector knows best.)

4. The bill purports to be technology agnostic, and doesn’t require the use of any particular technology or software product by a federal agency. That’s an important point, since no single software or hardware solution can provide the solution sought by the government, and the ultimate security solution will likely rely upon a mixture of various hardware and software components.

But let’s remember: disparate systems need to be able to work together. The degree of interoperability between security solutions MUST be considered, or we will end up with systems that don’t communicate with each other, which will result in security gaps and deficiencies. And that’s exactly what we’re trying to avoid, right?

The SoDA Report - It's THE Predictor of Digital Marketing in 2012

noreply@blogger.com (Bradley Gross) — Fri, 24 Feb 2012 23:28:00 +0000

The SoDA Report: 2012 Has Been Released - Download it now if you want to read the single greatest predictor of digital marketing activities in 2012...

SoDA has compiled the thoughts and opinions of ≈700 marketers, agencies, technologists, digital industry insiders---and me. Dozens of SoDA member companies have contributed thought-provoking articles and case studies to The SoDA Report (formerly known as the Digital Marketing Outlook). A broad array of guest contributors, CMOs and other senior-level digital marketers from a wide array of organizations (i.e., L’Oreal, Adobe, Google, Compete, E*Trade, Bloomberg and Samsung, among many other blue-chip brands) also provided their insights.

The result: an invaluable planning resource for marketers and agencies in 2012. SoDA is releasing the publication in its traditional format today, and a tablet edition will be released in early March. SoDA will also be publishing smaller quarterly updates to The SoDA Report over the course of 2012.

Download the publication here: http://bit.ly/AmGSqf

SoDA Says No To SOPA

noreply@blogger.com (Bradley Gross) — Wed, 18 Jan 2012 19:35:00 +0000

The Society of Digital Agencies, an invitation-only consortium consisting of some of the best and most well-known digital agencies on the planet, today released its official position on the Stop Online Piracy Act ("SOPA") and the IP Protection Act ("PIPA").

You can read the position piece at the following link:

SoDA’s Stance on SOPA and PIPA.

If you don't feel like clicking, here's the text:

SoDA’s Stance on SOPA and PIPA
by Bradley Gross, Esq. & SoDA General Counsel / January 18, 2012

SoDA recognizes the very real problem of online copyright infringement. As producers and creators of some of the finest digital content in the world, SoDA’s members are often among the first to feel the sting of the unauthorized copying, use and manipulation of their creative works online. Protecting its members’ intellectual property, and ensuring that its members’ original, proprietary digital creations remain free from unauthorized use, is among SoDA’s highest priorities.

But freedom of speech is paramount to all. SoDA believes strongly that any legislation seeking to diminish online speech or curb online content must be both narrowly tailored and capable of being applied with precision. We have considered the Stop Online Piracy Act (“SOPA”) pending before the Senate, and its corresponding House bill, the Protect IP Act (“PIPA”), and believe that neither bill comports with these standards.

In addressing the vexing problem of online copyright infringement, we cannot allow ourselves to trample roughshod over the free speech rights of our colleagues, our neighbors and fellow citizens. SOPA and PIPA, however, do just that.

Among other things, the bills would empower individuals to extinguish entire websites merely by filing a unilateral notice in which it is alleged—but not proven—that the websites are “dedicated to the theft of U.S. property.” The person filing the notice would need only to state that he or she is “harmed” by the targeted websites; actual ownership of IP by the complaining individual would not be required. Notably, the amount of infringing material on a targeted website need not be particularly large or dominant; even minor acts of infringement could justify the termination of an otherwise lawfully operated site.

The bills would not require knowledge of infringing activity on the part of website owners, making innocent infringers vulnerable to attack. It is hard to see how social media sites, such as Facebook or Twitter, or content aggregators such as Google, could continue to operate effectively under those conditions.

Moreover, the number and scope of businesses impacted by the bills is neither limited nor clear. The bills would impact any website that “enables or facilitates” infringement by a third party–a category which, when taken to its logical end, could include a huge swath of innocent parties who might be only tangentially related to the business of an infringing website.

Finally, the bills would incentivize and encourage knee-jerk censorship activity by immunizing advertisers and payment processors from all liability if they discontinued their services based upon the suppositions and unproven allegations of persons claiming harm under SOPA or PIPA. Providing that type of immunity ignores the realities of online business. Simply put, business cannot be conducted in an environment where advertisers and payment processors have the unencumbered ability to withdraw their services based on the unproven harangue of a person claiming harm under SOPA or PIPA.

The time is ripe to address the issue of online copyright infringement, and we applaud Congress’ attention to the issue. However, neither SOPA nor PIPA pose viable solutions for the issues at hand. We implore Congress to start anew and create legislation that properly and fairly balances the principles of freedom of speech with the need to protect online digital content.

Apple Wins Patent Case Against Android. Well, Sort Of.

noreply@blogger.com (Bradley Gross) — Mon, 19 Dec 2011 22:29:00 +0000

Steve Jobs vowed to go "thermonuclear" against Google and the Android interface. Today, the U.S. International Trade Commission (or "ITC") just helped Apple move one step closer to Jobs's dream of making the Android operating system a thing of the past.

Under a decision announced today by the ITC, Android phones made by HTC that incorporate "tapping" technology (more on that in a moment) will not be permitted to be imported into the United States starting on April 19, 2012.

What does that mean for HTC--one of the largest producers of Droid phones in the world? It's basic math:

No imports = no sales of most modern HTC Android devices in the U.S.

As I see it, HTC now has three choices: (i) license the technology from Apple (which is highly unlikely), (ii) make the technology work without using Apple's patented technology (somewhat likely), or (iii) remove the technology from HTC telephones (a possibility, but a last resort since it would make HTC's phone less feature-rich when compared to other Droid makers' phones).

The technology at issue is pretty standard fare on smart phones: it enables users to tap data in one application on a device (such as a telephone number embedded in an email), and bring up another application that uses that data (such as a telephone dialer that dials the telephone number that was tapped). Without that technology, users would have to resort to the cut-and-paste method of transferring data between applications on a smart phone. Ugh.

With all of the heavy competition among Droid phone makers, I'm pretty confident that HTC will kick its R&D department into high gear and figure out a way to use data tapping technology without violating Apple's patent. And I have no doubt that Google will throw its resources into the mix as well: after all, it is Android that were talking about.

The decision definitely gives Apple some boasting rights and, temporarily, forces Apple's competitors to spend time and money researching a workaround to their current product offerings. In the long run, I'm not sure that the decision will have a major impact on the Android product lines, since a workaround will almost certainly be developed (did I mention that Google will likely get involved??).

But in a world where new technology is being developed everyday, the delay that the decision imposed on Apple's competitors may be important. If Apple can leverage that delay to its advantage and come up with the "next great thing" while its competitors are still trying to figure out how to make the "old stuff" work, then the delay may be the most valuable prize of all.

New Privacy Guidelines? Not So Impressive.

noreply@blogger.com (Bradley Gross) — Sun, 27 Nov 2011 21:49:00 +0000

Most people don’t want their online activities to be tracked by advertisers. So it should come as good news that the Digital Advertising Alliance just released new privacy guidelines governing the collection of consumer data for “non-behavioral advertising” purposes.

The FTC heralded the new guidelines as “an important step for consumers and for self-regulation.” But are the new guidelines as important as the FTC claims them to be?

I don't think so.

I don’t think the new guidelines say anything that we haven't seen before and, in many ways, simply re-state the obvious. Historically, the Alliance has experienced only marginal success implementing privacy-related guidelines, and I’m not optimistic that the Alliance’s latest set of policies will fare any better.

Some Definitions.

“Behavioral advertising” is the art of tracking of a consumer’s online activities over time—including the searches the consumer has conducted, the web pages visited, and the content viewed—in order to deliver advertising targeted to the individual consumer’s interests. (Think “big brother” meets “super cookies”).

Most consumers find behavioral advertising surprisingly invasive—but it works. In fact, studies show that behavioral advertising is at least twice as effective as non-behavioral advertising. With that kind of ROI, we expect the use of behavioral advertising to increase exponentially over the next few years.

“Non-behavioral advertising” is everything else, i.e., no long term tracking of sites visited, and no cross-referencing a consumer’s online behavior across multiple sites. It’s the type of relatively minor tracking activity that consumers have come to expect from commercial websites.

The New Guidelines--An Improvement?.

A few years ago, the Alliance released a set of guiding principles for online behavioral advertising activities. Those principles, which can be read HERE, were roundly criticized for failing to address the non-behavioral advertising side of the industry.

In response to that criticism, the Alliance released its latest set of principles which can be found HERE. They are entitled, “Self-Regulatory Principles for Multi-Site Data”—which brings me to the first issue I have with the new principles.

Why name them something that most people don’t understand? What is “Multi-Site Data”? Granted, the term is explained in the text of the principles themselves—but why not replace the term “Multi-Site Data” with “Non-Behavioral Advertising” or something similar?

But I digress.

The new “multi-site data” principles address the privacy issues raised by non-behavioral advertising activities by requiring ad companies to “provide consumers with transparency and consumer control.”

The funny thing, however, is that the Alliance doesn’t define the terms “transparency” and “consumer control.” Now, one could argue that those are common phrases and, therefore, they are subject to common understanding and definition. But remember: in advertising, nothing is common. Advertising is about the uncommon. It’s about the unique. In the world of digital advertising, common phrases can easily elude common definition.

But again, I digress.

The new principles state that ad companies should comply with the federal Children’s Online Privacy and Protection Act (also known as “COPPA”). They also state that ad companies should not collect and use data containing financial account numbers, Social Security numbers or medical records without the consumer’s consent.

In other words, the principles say that ad companies should follow the law.

So, is that news? Am I missing something here? Since when do we celebrate a proclamation that companies should follow the mandates of HIPAA, or the Gramm Leach Bliley Act, or the Fair Credit Reporting Act, or several state laws (such as California’s Civil Code § 1798.85)? Have we reached such a low point that we now need to applaud industry principles that merely re-emphasize the importance of acting both legally and ethically?

I understand that the Alliance is merely trying to reign in the improper and over-ambitious advertising schemes employed by some of its members. But let’s not kid ourselves: the new principles don’t tread too deeply into the waters of consumer privacy. They are suggestive, not mandatory. There are no serious penalties for non-compliance. For that reason, many companies will simply ignore the principles for the sake of increasing their customers’ ROI.

The new principles don’t go into effect until next year, so we will have to wait a while longer to determine whether they are effective or not. My (early) prediction is “not".

Discovery, Facebook & You

noreply@blogger.com (Bradley Gross) — Sat, 26 Nov 2011 16:39:00 +0000

A few rules to remember:

1. What you post on Facebook is for all the world to see. You have no privacy rights in your Facebook content. Never mind that you only let "friends" or "friends of friends" access your Facebook page. If a court (or opposing party in a lawsuit) wants to see your stuff, then your Facebook page is an open book.

2. If you claim that you were disabled in an accident, then you should probably avoid posting status updates like, "Going to the gym!!", or posting pictures of yourself engaged in physical activity. Why? See rule #1, above.

With that as a backdrop, let's visit a recent case out of Pennsylvania, Largent v. Reed. In Largent, the plaintiff's (Largent's) motorcycle was struck by a minivan that was pushed into Largent's motorcycle by a car that the defendant (Reed) was driving. Largent claimed that as a result of the accident, she had suffered serious and permanent physical and mental injuries.

During Largent's deposition, it was discovered that she had a Facebook page. The page was "public" at one time, but Largent had subsequently made her page "private" so that only her friends could see her page. (As we all know, the public/private feature of Facebook is an option that is user-controlled).

Reed wanted access to Largent's private status page, claiming that Largent had posted several photographs that showed her enjoying life with her family, and a status update about going to the gym. (Hmmm...it's hard to claim you've suffered permanent physical disability if you're going to the gym, right?)

Largent refused to turn over her Facebook information, claiming that by making her Facebook page "private", she had a reasonable expectation of privacy in the information that she posted to her Facebook account. (Ah, if life was only that simple, right?)

The court disagreed, and held that everything on Largent's Facebook page was required to be disclosed to Reed. In a decision that will surely be quoted by other courts in the future, the court admonished Largent for attempting to hide relevant facts behind a "private" Facebook page, and stated that "only the uninitiated or foolish could believe that Facebook is an online lockbox of secrets."

So, dear reader, which are you: uninitiated or foolish? (That's a rhetorical question. Please, don't send me emails explaining why you are one or the other, or neither.)

The point is this: the whole "public" vs "private" thing on Facebook (or any other social media site) is a function of that website, and that website alone. It doesn't translate into any real privacy rights in everyday life. Information you post online in any social media site can (and likely will) be found by opposing parties in litigation, and is easily reachable through the power of a subpoena.

When It Comes to E-Discovery, E-Ignorance is Dead

noreply@blogger.com (Bradley Gross) — Mon, 14 Nov 2011 04:29:00 +0000

At a recent conference in Miami, I spoke to several dozen in-house attorneys about what they need to do to meet their electronic discovery obligations. The presentation took an hour, but I'll sum it up right now in two words: Smarten Up.

That's right, smarten up. The days of pleading ignorance about how your business collects, uses and stores electronic data, are over. "E-ignorance" is dead and won't be tolerated by courts any longer. (Hey--I think I just coined a new term. E-ignorance. Not bad.)

With increasing frequency, courts (especially federal courts) are hammering litigants who fail to take appropriate steps to audit, collect and disclose relevant e-evidence to opposing counsel.

If you think your company is up to par when it comes to this stuff, I've got a message for you: it's not. Really, it's not. But don't feel bad--you're not alone. Most companies aren't anywhere near a state of readiness when it comes to this stuff.

Read the following questions (but not out loud--people might think you've lost your mind.) If you can't answer all (or even most) of these questions in the affirmative, then you're suffering from e-Ignorance, and you probably need to change the way your company maintains and preserves (or destroys) its records.

1. Do you know what cloud computing is? Do you understand that cloud computing solutions can result in data being stored in locations far from your company's physical location? Do you understanding that data stored in the cloud is often replicated in various locations (IT people call this, "co-location")?

2. Do you know if any of your employees copy and remove information on their personal devices, such as laptops, iPads, mobile phones, etc.? Do you know if they sync those devices with other devices, resulting in multiple copies of information in multiple locations?

3. Does your company have any policy concerning mobile devices? Do you know if it's being enforced?

4. Where does your data go when you delete it? Does your company automatically archive data? (If it does, do you really want it to? You probably don't....more on that in a moment.)

5. Does your company have a document destruction policy? (Ok, let's be politically correct and call it a "document retention policy." But it's really all about the destruction, not retention, of documents.) Who wrote it? When was it last updated? Who enforces it?

Ok, enough questions. Here's the point: if you're in a business that has a reasonable chance of suing or being sued (and these days, who isn't?), you need to get your document management skills and procedures in order. And that begins with a document destruction policy. If you have one, follow it. If you don't have one, then call counsel and get one--then follow it. Having a destruction policy but failing to follow it is akin to not having a policy at all.

I know what you're thinking. You're thinking, "should I destroy my documents on a regular basis?" (If you weren't wondering that before, you are now. Ah, the power of the pen...)

Answer: Yes, with a few provisos. First, you must handle document destruction in accordance with a written policy. Note: it must be in writing. Not in your head. Not something you sort of follow. Write it down.

Second, if a law or statute says you can't destroy a document, then follow the law and preserve the document for the prescribed period of time.

Third, if you receive a preservation letter from counsel, then get your own counsel involved and preserve your documents.

Finally, if there's a reasonably likely chance of your company being sued (or suing someone else), preserve everything until your counsel tells you otherwise.

Questions? Let me know.

Super Cookies and FaceBook? It's Hammer Time.

noreply@blogger.com (Bradley Gross) — Mon, 10 Oct 2011 15:31:00 +0000

A message to the FTC: break out your (regulatory) hammers and start swinging.

Late last month, a bi-partisan group of Congressmen (aptly named, the "Congressional Bi-Partisan Privacy Caucus") sent a letter to the FTC requesting that the FTC investigate certain allegations raised by an Australian technology blogger. The issue? The use by FaceBook of so-called "super cookies", which track users' activities after they log out of FaceBook.

Yes, you heard that correctly. These uber cookies track what you do after you log out of FaceBook.

Normally at this point in a commentary, the speaker says something like, "If this were true, then..." or "If it turns out that FaceBook was using this technology, then..." But we can dispense with the "if / then" scenarios. We know that FaceBook was using this technology, since (i) it was proven by our Aussie friends, and (ii) FaceBook claims that it has stopped using super cookies. (By definition, if they have stopped using them, then clearly then were using them in the past.)

So what to do? What do you do with a company that has been accused repeatedly of playing fast and loose with its users' information, and then utilizes super cookies to track users' activities in clear violation of both its own privacy policy and the FTC Act (which expressly prohibits unfair and deceptive acts or practices by companies engaged in interstate commerce)?

You hammer them. You hammer them in the way that only the government can. You make them undergo an extensive analysis of what they did wrong, and why they did it. You make the analysis a part of the public record. And then you levy a fine (something that makes them go, "Ouch"), and enjoin them from doing it again.

Anything less would be ridiculous.

noreply@blogger.com (Bradley Gross) — Thu, 06 Oct 2011 13:06:00 +0000

"Your time is limited, so don’t waste it living someone else’s life. Don’t be trapped by dogma — which is living with the results of other people’s thinking. Don’t let the noise of others’ opinions drown out your own inner voice. And most important, have the courage to follow your heart and intuition. They somehow already know what you truly want to become. Everything else is secondary."
-Steve Jobs

VARs and Cloud Providers Need Liability Protection

noreply@blogger.com (Bradley Gross) — Thu, 15 Sep 2011 14:10:00 +0000

If you sell a cloud computing solution, or if your IT company adds value to existing products or services, then you need to think about liability protection. But don't just take my word for it....actually, wait a minute, you SHOULD take my word for it.

Check out the CRN article covering a presentation I gave at this week at Zenith InfoTech's MSP Boot Camp...

Read the CRN article here.

We Like the Leahy-Smith America Invents Act. (Really, We Do.)

noreply@blogger.com (Bradley Gross) — Fri, 09 Sep 2011 14:49:00 +0000

An hour before President Obama went on television last night, the Senate passed a sweeping patent reform bill that will bring the U.S. patent registration process into alignment with the rest of the world. Is that a good thing? Yes, it is.

The Leahy-Smith America Invents Act, a copy of which you can read here, will change the nation's U.S. patent system from a first-to-invent system into a first-to-file system. If President Obama signs the bill (and he almost certainly will), then the patent registration process will encourage inventors to "race to the Patent Office" to ensure they file their patent applications before anyone else does. The fastest filers will win.

Why is this a good thing? Why do we want to encourage people to race to the Patent Office? Because the alternative has become intolerable.

Under the current system, if you invent a device and spend the time and money to patent your idea, your patent is vulnerable to someone coming along and saying, "Hey, I invented that device. I know I didn't file a patent on it--but you took that idea from me." At that point, you'll have to iron out the issues in court. Ugh.

The fact that you filed your patent first will mean nothing. The fact that you spent your time and money pursuing the patent, when your opponent did nothing to pursue a patent, will mean nothing. You'll spend tens of thousands of dollars to defend your patent, and at the end of the day, you might lose. Then you have nothing. Ugh, again.

Under the new bill, the first person to file the patent application owns it. Those who sit on their hands and fail to file promptly will be largely out of luck. In other words, lazy people will suffer. Is that so wrong? I think not.

The bill isn't perfect. Among other things, it doesn't bar so-called "fee diversion" practices, which occurs when Congress greedily grabs any revenue of the Patent Office that exceeds the agency's budget. In other words, if the Patent Office makes a profit, Congress takes it. Good business sense dictates that the Patent Office should be able to re-invest profits back into the agency to make the agency more productive, efficient and effective. But the federal government isn't planning on exercising good business sense in this scenario. Go figure.

Critics have also argued that the bill will give large companies an unfair advantage over smaller sized inventors, since larger companies will have the resources to file patents registrations quickly, leaving smaller inventors out in the cold.

Yeah, maybe the critics are right. But here's the thing: the current system gives smaller inventors an intolerable level of power to interfere with the patent registration process, and rewards them for failing to take steps to register their ideas with the Patent Office. And THAT cannot continue.

One final note: this bills will create jobs--and jobs are a good thing. Here's how (follow the job chain): the Patent Office will be flooded with applications from people who want to be the first to file their applications. More filings means more staff at the Patent Office. More filings also means more patents. More patents means more potential for inventions, and original products and services in the marketplace. Someone has to sell those inventions, products and services, which means more sales people. Get the idea?

The Leahy-Smith America Invents Act is a good bill. It's not a perfect bill, but it's pretty good nonetheless. Let's get it done.

noreply@blogger.com (Bradley Gross) — Wed, 17 Aug 2011 02:13:00 +0000

What’s in an IP address? Apparently, not everything—-or so says a federal judge in Seattle.

In my opinion, the recent decision in Johnson et al. v. Microsoft Corp. (No. 06-CV-0900-RAJ, W.D. Wash. Seattle Div. June 23, 2009) is right on target—IP addresses are NOT personally identifiable information. But the case reminds us that the lines between privacy and information technology are getting blurrier.

The Johnson case involved a class action lawsuit against Microsoft in which it was alleged that an update to Windows XP violated Microsoft’s user agreement because the update collected and sent users’ IP addresses to Microsoft. Microsoft’s user agreement specifically stated that no “personal information” was collected in the course of the updates, so the question was whether the collection of IP addresses amounted to the collection of “personal information".

The plaintiffs argued that IP addresses are unique, and could be used as a basis to subpoena information from Internet service providers, which in turn could lead to the discovery of a user’s personal information. (That, by the way, is an entirely correct argument. IP address collection, coupled with subpoena power, is the number one way that investigative agencies and would-be plaintiffs acquire personal information about online users.)

Microsoft argued that IP addresses don’t identify users because the addresses don't include people's names or physical (i.e., postal) addresses. (Also a correct argument). Microsoft also claimed that it didn’t combine or cross-reference the collected IP addresses with other information that could be used to identify users.

Of course, it didn’t help Microsoft’s case that back in 2002, Microsoft published a security glossary that defined “personally identifiable information” as “any information relating to an identified or identifiable individual”, and specifically included a user’s IP address under that definition. We lawyers call that an “oy vey” moment…

Nonetheless, the Court found in favor of Microsoft and held that IP addresses were not “personally identifiable information.” “In order for ‘personally identifiable information’ to be personally identifiable, it must identify a person,” the judge wrote in his ruling. “But an IP address identifies a computer, and can do that only after matching the IP address to a list of a particular Internet service provider's subscribers. Thus, because an IP address is not personally identifiable, Microsoft did not breach the [end-user license agreement] when it collected IP addresses.”

The Court got it right—IP addresses simply aren’t “personally identifiable information.” No doubt, they can be used to obtain personal information—but IP addresses, standing alone, don’t identify you to the outside world.

Yes, I know, some people out there will say, "Hey—the court's decision is not consistent with EU law." (Well, my European clients will certainly say that.) The EU Directive that covers data privacy for EU member countries (specifically, EU Directive 95/46/EC ) includes IP addresses under its definition of “personal data.”

So here's the situation: European laws are different than U.S. laws—nothing new there. But if you're collecting IP addresses from your European customers, you need to comply with the EU Directive with regard to those customers' information—email me for more information on that issue.

A final thought: the nexus between IP addresses and personally identifiable information is simply too thin to support any holding other than the one the Court came to. Disagree with me? I'd like to hear from you.....

Attention MSPs: Keep Your Eye on the SAFE Act

noreply@blogger.com (Bradley Gross) — Fri, 29 Jul 2011 01:45:00 +0000

Last week, the House Subcommittee on Commerce, Manufacturing, and Trade approved the Secure and Fortify Electronic Data Act (or SAFE Act, for short) to protect American consumers from cyber attacks and identity theft. The bill now moves to the full Energy and Commerce Committee for consideration.
Sounds good, right? Sure it is.

But if the bill is signed into law, it means that managed service providers (or "MSPs") will have to change the way they do business. Here's a "heads-up" summary of the things every MSP needs to know about the SAFE Act.

Am I Affected? The legislation would affect any company that (i) conducts interstate business, and (ii) owns or possesses data containing personal information related to the company's business. (Hint: "interstate" means business between your state and any place outside of your state, So, unless you live under a rock and/or only provide services to people who reside under the same small rock under which you live, you'll probably be affected by the law.)

Also impacted would be those vendors that are contracted "to maintain or posses such data" on behalf of companies that collect personal information. (Attention MSPs: this means YOU!!)

What Will I Have To Do? Affected companies have to establish and implement policies and procedures regarding information security practices. These policies and procedures will have to take into consideration (i) the size, scope and nature of the company's business, and (ii) the current state-of-the-art administrative, technical and physical safeguards for protecting information. (Put another way, if your technology is not state-of-the-art, then you'll probably need to invest in an upgrade...)

Among other things, your new policies and procedures will have to:
1. List your company's policies with regard to the collection, use, sale and distribution of personal information;
2. Assign an officer to be responsible for the management of information security;
3. Identify a process for detecting any reasonably foreseeable vulnerabilities in your company's network;
4. Identify a process for correcting vulnerabilities in your network; and
5. Determine a method for disposing of / permanently erasing data, both electronic and paper-based.

If There's a Breach of Security, What Would I Do? It depends. If the incident actually resulted in a security breach, then you would have to "promptly" notify the people whose information was stolen. Oh yes--you also have to tell the FBI. And the FTC. And the credit reporting agencies.

But My State Has a Law. Now What? If the bill passes, it will trump all state data breach notification laws.

We will be keeping an eye on the SAFE Act...but in the meantime, don't wait for legislation to force you to get your internal security policies in order. Forty-six states already have data breach notification laws that require you to have policies and procedures in place. (And on that note, let's give a quick shout-out to New Mexico, South Dakota, Alabama and Kentucky--four states that are way behind the times when it comes to data breach notification laws...) If you're an MSP, you need to call your attorney, get your policies in place, and be ready for the SAFE Act to become law (which, I predict, will happen sometime in 2012).

App Store vs AppStore?

noreply@blogger.com (Bradley Gross) — Fri, 22 Jul 2011 12:33:00 +0000

Back in January, I wrote about Apple's attempt to get a federal trademark registration for the phrase, App Store. Back then (and still today) I thought that Apple's trademark application should be rejected. So far, both Microsoft and the U.S. Patent and Trademark Office agree with me.

So what do you do if you're Apple and your application for a federal trademark hasn't been going so well? Answer: you sue anyway. And to make the point, Apple's chose Amazon.com as its first target. But Amazon--not exactly a lightweight contender--fought back, and created a major legal hurdle for Apple in the process.

Here's the scene. In one corner, we have heavyweight champion Apple, which is trying to get a federal trademark for the phrase, "App Store". In the other corner, we have the challenger, Amazon.com, that's using the phrase "Amazon AppStore" to sell apps for smartphones. But not just any old smartphones, mind you. Android smartphones. (Say it with me now, "DROID!").

Apple throws the first punch and sues Amazon in federal court, alleging that Amazon's use of the phrase "Amazon AppStore" will confuse people into believing that Amazon's online app site is the same as, or affiliated with, Apple's online app site.

Amazon counters, "no way!" (Ok, perhaps I've oversimplified Amazon's argument--but that's the gist of it. And, in this case, it was quite effective.)

We go to the scorecards.....and the court rules that Amazon has won the first round. No surprise there--at least not to me. (Again, I don't think that Apple has any rights in the phrase, App Store.)

In its decision, the court found that Apple failed to prove that consumers uniquely associate "App Store" with Apple's online site for smartphone apps. That's a huge decision for Amazon, and a serious problem for Apple. But why is the decision so important?

Well, let's look at the entire picture right now. A court just ruled that Apple hasn't proved any unique association between the phrase, App Store, and Apple's online site for smartphone apps. Meanwhile, the US Patent and Trademark Office continues to maintain that Apple can't get a federal trademark registration for the phrase, App Store.

If everything remains "as is", then there is virtually no chance that Apple will be able to enforce trademark rights in the phrase, App Store. No way, no how. Then both Amazon and Microsoft will be happy. And I will be proved correct. (Is that so wrong?)

The Amazon/Apple fight isn't over yet, but Apple has yet to win a single round in this App Store vs. AppStore debate. Stay tuned.

RIP: Restrictions on Sale of Video Games to Minors

noreply@blogger.com (Bradley Gross) — Mon, 04 Jul 2011 07:04:00 +0000

Last December, I implored the U.S. Supreme Court to uphold a lower court's decision prohibiting the enforcement of a law that banned the sale of so-called "violent" video games to minors. You can read that blog entry here.

On June 27, the Supreme Court did just that (Hooray!)--check out the decision here.

The bottom line is this: protecting kids from violence in video games is important, but not as important as protecting us from poorly drafted laws that dilute the First Amendment. Justice Scalia said it best:

As a means of protecting children from portrayals of violence, the legislation is seriously underinclusive, not only because it excludes portrayals other than video games, but also because it permits a parental or avuncular veto. And as a means of assisting concerned parents it is seriously overinclusive because it abridges the First Amendment rights of young people whose parents (and aunts and uncles) think violent video games are a harmless pastime. And the overbreadth in achieving one goal is not cured by the underbreadth in achieving the other. Legislation such as this, which is neither fish nor fowl, cannot survive strict scrutiny.

Remember, it's not a "pro-violence" thing; it's an "anti-dilution-of-the-First-Amendment" thing. Read the case, and you'll see what I mean.

And on that note, have a happy and safe July 4th holiday.

Negative Options -- Do It Right to Avoid Prosecution

noreply@blogger.com (Bradley Gross) — Mon, 04 Jul 2011 06:23:00 +0000

"Negative Options" is a fancy (and shortened) way of saying, "If you buy stuff from us, then we'll automatically keep sending you more stuff until you tell us not to. Oh, and one more thing...we'll bill your credit card automatically for all the stuff we send you—until you tell us not to."

Negative options can be a really good thing—unless your company does it wrong, in which case it can get you in a lot of trouble. (And by "trouble", I mean "sued", "fined", and/or "put out of business.") Read on....

A "negative option" is not a new concept: record and book companies have been using the "negative option" for at least twenty years. C'mon, who among us didn't have a Columbia House CD showing up in the mailbox once a month? (Come to think of it, I think I still owe Columbia House some money from my 1980 purchase of AC/DC's "Back in Black." I digress.)

Despite the "negative" connotation, negative options save time by automating payments, akin to setting up automatic payment mechanisms to pay your mortgage, your electric bill, and other recurring services that you may want (or need).

The problem is that many companies don't clearly state the terms of the negative options that they offer to their customers. (There are people who don't like when that happens, and I call those people "Attorneys General.")

Customers who don't understand the negative option they sign up for usually feel like they're being ripped off. Often they're not being ripped off—they simply didn't bother to read their sales contract before making their purchases.

So, what's a company to do?? Well, you have two options: do it right, or not. If you do it right, all will be fine. If not, you'll get prosecuted. Your choice.

According to the FTC, here's how you do it "right" (with commentary by me....)

1. Disclose material terms in an understandable manner, without making them unnecessarily long or inconsistent. (BJG Comment: if you ramble, you're cooked. If your document makes no sense, you're REALLY cooked).

2. Make the disclosures clear and conspicuous by placing them where consumers are likely to look on Web pages, by labeling disclosures (and links to them) to indicate their importance and relevance, and by using easy-to-read fonts and colors. (BJG Comment: make important things OBVIOUS.)

3. Disclose the offer’s material terms before the consumer incurs a financial obligation. (BJG Comment: Let them know the four "Hows" before you take their money: How much? How long? How often? How do I cancel?

4. Obtain consumers’ affirmative consent to the offer by, for example, having them click “I Agree” and without relying on pre-checked boxes. (BJG Comment: Either make them check the "yes" box, or have them surrender their first born child. Whichever is easiest.....)

5. Avoid impeding the effective operation of promised cancellation procedures and honoring cancellation requests that comply with such procedures. (BJG Comment: They want their money back? Fine, give it to them. You don't need the cash that badly, and in any event, it's not worth the hassle of a government investigation.)

Concluding thought: Negative options? I like them. Just make sure you do it right, or you'll end up being prosecuted by the State or Federal government.

Questions? Ask away.....

Microsoft's Loss: Not Unexpected, But Disappointing Nonetheless

noreply@blogger.com (Bradley Gross) — Fri, 24 Jun 2011 23:54:00 +0000

A few months ago, I wrote an article in which I said that the U.S. Supreme Court should overturn a $300 million judgment against Microsoft. Why did I take that position? Not because I'm a die-hard Microsoft fan (though I think I am a PC...). And not because the law was on Microsoft's side (in truth, Microsoft had a tough case...)

My position was entirely selfish. I was hoping that the Court would reverse the case, set a precedent, and take a step toward making it easier to defeat weak patents held (and enforced) by patent trolls. But alas, this one didn't go the way I wanted it to.

If you're just tuning in, here's a quick recap: the Patent Act of 1952 says that once a patent is approved by the U.S. Patent Office, it's presumed to be valid. According to the Act, the only way to challenge an existing patent successfully is to establish its invalidity, and that burden rests with the party challenging the patent. The question was, "just how high is that burden? Is it a 'preponderance of the evidence', or is it 'clear and convincing proof'?"

The Supreme Court just answered the question. It's "clear and convincing proof."

Oh well. If there's going to be a change, it's going to have to come from Congress....

White Paper: Patent Infringement Risks

noreply@blogger.com (Bradley Gross) — Wed, 22 Jun 2011 15:18:00 +0000

The Society of Digital Agencies ("SoDA") has published a white paper I co-authored with Aaron Johnson, PhD, called, Patent Infringement Risk - A Rising Challenge for Digital Agencies.

The paper was officially "launched" at the Cannes Lions International Festival of Creativity--the world's largest gathering of creative professionals in the communications industry--in Cannes, France, and has now been made available to the general public at SoDA's site: http://societyofdigitalagencies.org/

I have also drafted a separate white paper called, "Crossing the Bridge: Minimizing the Risk of Patent Troll Litigation", which you can obtain by emailing a request to me.

You Have No Privacy On Mobile Devices. Get Used To It.

noreply@blogger.com (Bradley Gross) — Sun, 12 Jun 2011 21:58:00 +0000

If I told you that Google kept track of your location, your phone number and your voice, would you be surprised? Outraged?

Now how would you feel if I told you that you gave Google permission to receive and store this information? News flash: you probably have given Google permission to get this information, and more...

Here's a message to mobile device users (and by "mobile device", I mean Droids, iPads, iPhones, and virtually any other "smartphone" device): on a scale of 1 to 10, with 1 being "no privacy" and 10 being "total privacy", your privacy rights land around "3". You need to get used to that, because that's the way it's going to be--until you start reading (and understanding) those long "terms and conditions" agreements that you keep accepting.

And now, yet another lawsuit involving privacy and mobile devices has been filed, this time against Google. The latest litigation, which was filed on May 10 in the Middle District of Florida, alleges violations by Google of federal and state anti-hacking, wiretapping, privacy and consumer protection laws, as well as claims of invasion of privacy.

It's more of the same type of stuff that we saw in the litigation filed against Apple last month: allegations that Google's Android operating system tracks users' positions without their knowledge, cross-references user information with other information to upsell products and services to those users, blah, blah, blah.

Here's the thing: if you're shocked and surprised that Google (or Apple, for that matter) is using your location-based information to upsell you products and services, then you clearly haven't read Google's (or Apple's) terms of service. Or its privacy policies.

Now, I know why you haven't read those policies: they're long and convoluted. (Case in point: I recently "agreed" to Apple's latest terms of service for iTunes. It was 67 screen pages long on my iPad device and, I confess, I didn't read it either.)

But the fact of the matter is that when you click "I agree" to those long and convoluted policies, you agree to allow Google (or Apple, as the case may be) to use your information in all sorts of ways. If you don't like it, then don't click "I agree" and don't use the service. But you and I both know that you want to use the service, and eventually you're going to click "I agree". That's reality..

So, let's re-visit my original question: what if I told you that you have already given Google permission to record your location, telephone number and voice? Here are some actual provisions from Google's privacy policy, and what they mean to you:

[Policy]: "Sometimes, we record your phone number. We record your phone number when you send it to us; ask us to remember it; or make a call or send a text message or SMS to or from Google."

[What It Means To You]: If you use any Google-based service that requests your phone number, then Google stores that information. Note: on Droid phones, text messages ARE considered to be a Google-based service, so your telephone number is recorded.

[Policy] "We collect some information on device-level events, such as crashes, and associate that temporarily with your Google Account in order to provide customer service. Most of the other information we collect for mobile, such as your device and hardware IDs and device type, the request type, your carrier, your carrier user ID, the content of your request, and basic usage stats about your device and use of Google's products and services does not by itself identify you to Google, though it may be unique or consist of or contain information that you consider personal. However, if you use an Android-powered device, Google will associate your device id with your Google Account in order to provide services, such as sync functionality for your Google email and contacts."

[What It Means To You]: If your device crashes, or some other event (such as system updates or other "device level" activity) occurs, then Google collects all kinds of information about your device, and associates that information with your Google account. Google then uses that information to upsell products and services to you related to the type of "device-level" activity that occurred.

[Policy]: "If you use location-enabled products and services, such as Google Maps for mobile, you may be sending us location information. This information may reveal your actual location, such as GPS data, or it may not, such as when you submit a partial address to look at a map of the area."

[What It Means To You]: If you use Google Maps, then Google knows where you are, and where you're going.

[Policy]: "For products and services with voice recognition capabilities, we collect and store a copy of the voice input you make to the product or service and corrections you make to the returned recognition result."

[What It Means To You]: Google records (and keeps a copy of) your voice.

The bottom line is this: Google has your location. And your phone number. And your voice. If you don't like it, don't use Google's services. You don't need a lawsuit or a judge to tell you that. You just need to read...