In light of the financial meltdown of 2008, it is reasonable to question whether the prior decade’s emphasis on corporate compliance – the internal programs that corporations adopt in order to educate employees, improve ethical norms, and detect and prevent violations of law – has been fruitful. This Article contends that the key problem with compliance is that we regulate it through an adversarial system that pits federal prosecutors against corporate defense counsel, fueling distrust between corporate entities and the government, and between the corporate employees and the internal monitors tasked with ensuring compliance. Despite this adversarial atmosphere, a number of scholars have suggested that corporate compliance is an example of a more collaborative regulatory approach known as “New Governance.” This Article challenges that notion, arguing that the government’s adversarial stance all but eliminates the experimental and collaborative approach championed by the New Governance movement. The Article further concludes that a New Governance model of compliance regulation is unlikely to take hold. Nevertheless, policymakers should consider New Governance’s administrative stance in lieu of the more punitive, “war-driven” approach that adjudication usually encourages.

We’ve seen a wave of compliance-oriented information law in recent years – perhaps most notably Sarbanes-Oxley – and it’s useful to ponder how worthwhile this approach is likely to prove.

There’s been significant fear and loathing of this proposal. At a recent legal meetup in NYC, I suggested that there may be a barrier – Section 230 of the CDA – to the FTC’s enforcement of this move (if it is adopted). Several participants thought I was a nutjob for making this argument, so I thought I’d set it forth and see what you think.

Section 230(c)(1) of the Communications Decency Act (47 U.S.C. 230(c)(1)) forbids treating a “provider or user of an interactive computer service… as the publisher or speaker of any information provided by another information content provider.” There are statutory exceptions for intellectual property law (but compare Doe v. Friendfinder with Perfect10 v. CCBill on this), the Electronic Communications Privacy Act, criminal law, and compatible state laws. The 230 shield has been interpreted quite broadly, though Roommates.com and Barnes v. Yahoo! suggest some chinks in its protection. (As always, I recommend highly Ken Myers’s Wikimmunity article on this topic.)

I’d argue 230 cabins the FTC’s Section 5 authority. Imagine a blogger who gets free passes from DreamWorks to “Transformers: Revenge of the Fallen” and, against the weight of all common sense, writes a paean to the movie, without mentioning the free tix. She’s now run afoul of the FTC guidelines: there’s no reason for the blogger’s audience to think that she got in for free, and the connection seems material to the review. What if the FTC goes after DreamWorks? In effect, the FTC’s argument is that DreamWorks is the speaker here: it helped generate the post by giving the blogger free entry to the film. (This stance is made more powerful by the fact that Transformers 2 appears to suck.) But that’s exactly what Section 230 forbids: the FTC treats DreamWorks as responsible for the blogger’s content. It seems this should work in the other direction as well – trying to hold the blogger liable for failure to disclose treats her as linked with DreamWorks and speaking on the company’s behalf. (This posture seems a closer case, though, since it imposes liability directly on the speaker / author, although what makes the blogger liable is connection to another Internet content provider.)

The obvious FTC rejoiner is an agency theory: the compensation arrangement makes the blogger a DreamWorks agent for this post. But that interpretation would render 230 a dead letter; we could readily concoct consideration-based arguments for most 230 cases that cut the other way. On this theory, Dontdatehimgirl.com would be liable for encouraging users to post stories about cads – in exchange for a public airing of their complaints, the site gets desirable content. Doe v. Friendfinder wouldn’t have to rely on a flimsy right of publicity claim: Ms. Doe could simply go after Friendfinder for the quid pro quo of attractive content in exchange for use of the service.

The employee as commenter / poster angle poses the problem neatly. If a DreamWorks publicity representative writes a blog comment, at the direction of the company’s CEO, trashing Ice Age: Dawn of the Dinosaurs as “a Blue Sky Studios plot to brainwash our children,” it is uncontroversial to hold DreamWorks liable for her speech. Firms can only act through their employees. But if she writes the same comment from home, with no studio input, based on her belief that animated squirrels are the devil’s minions, we’d be reluctant to hold DreamWorks liable. So, perhaps agency must enter the 230 analysis through the determination of who the “Internet content provider” is. I think it makes sense to separate employee blogging along these lines, but it does convert Section 230 from a relatively clear rule to more of a standard.

I don’t necessarily like the outcome here. Bloggers have been quite resistant to disclosure mandates (and even strong norms, at times) and are shocked, shocked to think that anyone could buy their support! Having the FTC push back, even if only in extreme cases, could be quite helpful. And it’s not just bloggers who are affected by this analysis – it would likely hold for Internet writing and endorsements more generally. Finally, the FTC is certain to dislike this suggestion that its Section 5 power wanes on the Internet (even though experts like Eric Goldman argue that other agencies, such as the SEC, are similarly constrained). But presumably this is what Congress wanted, and at minimum the Commission needs a cogent analysis of why its proposals escape the 230 driftnet.

The coalition was organized by Open MIC, a group seeking to involve investors and other private sector actors in efforts to promote openness in the development of communications media and preserve the “democratizing potential of the digital era.”

Derek and I have both written here before about the importance of market-oriented efforts of this type. Here’s Derek’s post. As I said just about two years ago:

Activists and policy wonks who work with environmental issues take it for granted that private corporate activities and markets lie at the center of both the problems and the potential solutions … to issues such as water pollution, global warming, and habitat destruction. … Until recently, the same was not true for info/law issues. The problems were often seen as based almost entirely on some combination of legal regulation and technological architecture. Tech companies were regarded as ideals by many socially responsible investors — they had low environmental impacts, typically they had progressive employment policies and benefits, and their supply chains did not involve the sorts of entanglements with corrupt regimes and human rights problems that beset industries from oil to global agriculture.

There is still a significant lag in the application of the “corporate responsibility” ethos and tactics to the problems of Info/Law. But this move by Open MIC is another sign that such efforts are emerging, albeit very very slowly.

Three quick observations: first, and most troubling, is that the collaborative effort (led by the Center for Democracy & Technology) to develop a code of conduct for tech companies operating in repressive countries has so far produced… a press release. And the tensions are showing: Human Rights Watch, a participant in the effort, criticized its pace (as did Durbin), noting that there’s significant opposition to independent monitoring for compliance with the code. Second, the Cisco slide looks bad, but it really just confirms what we already know – China uses the company’s tech for filtering, and Cisco’s employees are trying to drum up additional business based on that. (I used to work for a tech company, and if you know the client has certain key “business objectives,” you put those in your presentation – especially if it’s an internal one that tells you how to pitch the client.) Third, the business objective angle highlights a tough problem: what limits should tech companies observe in places like China, Burma, or Vietnam? (The companies themselves are a bit hypocritical: they want to pass the buck to the government to regulate their operations abroad – in theory – so they can avoid hard policy choices, but don’t really want any constraints in practice.) I’m slowly writing on exactly this topic…

The facts: Warner Bros. and J.K. Rowling are suing RDR Books, which plans to publish its Harry Potter Lexicon in book format. Stanford’s Fair Use Project is representing RDR (which is based here in Michigan). The article is quite one-sided; it paints Rowling as a copyright absolutist and a bad actor. (Let’s overlook her generally tolerant attitude towards fan fiction and her stated intent to donate profits from her competing encyclopedia to charity, and that she objected to the Lexicon only once its author and RDR sought to profit from it.)

But what really annoys me is that the article’s author, Joe Nocera, makes an embarrassingly simple mistake of copyright law. He writes, “the law absolutely allows anyone to create something new based on someone else’s art.” No, Joe, sorry. That’s called a “derivative work,” and the Copyright Act gives that entitlement to the copyright owner, exclusively. (See 17 U.S.C. 106(2).) So, if you write a trivia book with questions and answers about the Harry Potter stories, you infringe Ms. Rowling’s copyright. (See Castle Rock Entertainment v. Carol Publishing Group.)

I argue that this is a bad idea on economic grounds in a piece coming out shortly. But there’s no question about the state of the law currently, and Nocera does a journalistic disservice by pretending otherwise. I’m all for the Fair Use Project – as a prof, I depend on fair use – but I think the fair use claim here is weak at best. (On the critical fourth factor under 17 U.S.C. 107, this is obviously usurping Rowling’s stated plans to develop her own encyclopedia, and Lucasfilm has made a nice pile of change by licensing Star Wars encyclopedias. Note, though, that Tim Wu disagrees.)

The permission-based culture of copyright is obnoxious, and often undesirable – the torture / “24″ episode Nocera cites is a great example (note that the filmmaker, Alex Gibney, sought permission from Fox, and was denied – similar to Wendy Gordon’s view of fair use as a market failure). But it doesn’t help to misstate the law to suit one’s story, and it doesn’t help to focus fire on copyright holders such as Rowling, who have generally been supportive (or at least tolerant) of alternative uses of their characters (unlike Anne Rice, say). In copyright, as everywhere else, it’s best not to shoot your friends.

At least I’m awake now.

Edit (19 Feb. 2008): I changed 106(3) to 106(2) above; my typo indicated the distribution right, rather than the derivative works right as I intended. Props to Tom Sharpe for catching this!

Education lender Sallie Mae is up for sale, and it appears that the buyers are backing out. My colleague Steve Davidoff, an expert on corporate law, analyzes the breakup in the New York Times. I don’t understand all of the M&A issues, but I do love a situation where major corporations play “good cop, bad cop.”