Greetings. It's human nature to want to believe that what we see on the printed page actually represents reality. We've tended to accept the proposition that what we read in reputable newspapers or hear from the mass media wouldn't be printed or broadcast unless there were at least some truth to what was being disseminated. Unfortunately, the Internet has proven to be fertile ground for all manner of misinformation and hoaxes, capable of doing a great deal of damage, often at little or no cost to the perpetrators. Purposeful acts such as libel, fraud, character assassination, untruthful propaganda, and the like are becoming increasingly simple to engage in, and ever harder to prevent thanks to the Internet.

A widely publicized example is the fraudulent press release that recently caused a drop of around 60% in the value of a technology stock (Emulex Corporation) almost immediately after the hoax's release and re-dissemination via various Internet sources who picked up the item and treated it as fact. While the stock ultimately regained most of its value later in the day when the company refuted the material, there were still massive losses and costs borne by Emulex stockholders from this attack, as a result of margin calls, automated sell programs, and widespread panic selling by individual investors. Whether this subterfuge was "merely" a mean-spirited prank, or a calculated attempt to manipulate stock prices for financial gain (evidence concerning stock trading patterns reportedly suggests the latter), it should serve as a wake-up call for the global Internet community.

These sorts of events really shouldn't come as much of a surprise at all. The world has never before seen a medium where an individual can reach mass audiences for little or no financial cost and in many cases with practical anonymity. When you combine such capabilities with the 24-hour news cycles that now prevail around the world and the ease with which news organizations can obtain and distribute stories with great rapidity, the stage is set for a cascade of misinformation that can be awe-inspiring in its impact.

False information on the Internet doesn't have to be of the "mass" variety to cause individuals a great deal of trouble--it can also be very personal. The rush to put all manner of information online creates all sorts of risks, often without any serious thought as to the ramifications of those actions. For example, there are popular Web sites that provide "genealogical" information, ostensibly to help people research their family trees, but which often make no serious attempt to assure that the information submitted is accurate in any way. Users of such systems may often be misled into assuming that such information has been validated in some manner and the submitters positively identified. Many persons have also expressed concerns about information purporting to be about their families, especially their children, being present on such systems for public access, regardless of the data's accuracy or inaccuracy -- either way it can be trouble. Information that has not been properly vetted, posted without the permission of all individuals involved, is an invitation to bad feelings at best, and to serious problems at worst.

Inevitably, complex matters regarding the concept of anonymity come into play when discussing the issues of hoaxes, misinformation, and similar activities on the Internet. On one hand, it is clear that certain forms of speech frequently need the protection of anonymity to ensure their viability. Obvious examples include political speech (though the precise definition and implementation of this concept tends to vary from country to country and between political systems), and the protection of "whistleblowers" operating in the furtherance of public knowledge and/or safety.

However, the kinds of damage, both personal and more broadly financial, that can be done through the spread of false information on the Internet can be significant to say the least. It is difficult to assert that the individuals behind such activities deserve the protection that true anonymity offers. As a society, it is not tenable for such actions to be permitted without any penalty to the perpetrators. The creators of systems to allow for anonymous postings of e-mail and other materials on the Internet are usually focused on the laudable goal of providing these services for decent folks who have good motives. Unfortunately, there seems to be a tendency for many of these same technologists to dismiss as unimportant, or totally beyond their control, the issues surrounding the abuse of their systems by persons with evil intent.

An upcoming PFIR statement will deal specifically and in more detail with the issues of anonymity; for now, it is worth noting that societal concerns regarding this area are likely to soon reach a flashpoint. A real risk exists that society's reaction to abuse of truly anonymous systems may result in highly undesirable legislative crackdowns, perhaps even attempts to alter the constitutional speech protections in the U.S. and similar protections where they exist in other countries. The result could be serious damage to the precious freedoms that the operators of most anonymous systems presumably are seeking to promote.

This strongly implies that the need for responsible behavior will be paramount, both on the part of the users and creators of these systems. The classic newspaper model, where materials may be published on a "name withheld" basis when appropriate, but where true authorship is known to the publisher to help ensure responsibility for the letters or articles in cases of libel, fraud, or similar problems, may be useful in this context.

However, it is crucial that carefully structured and uniform standards be established whenever possible to ensure that access to such "protected" identity information be possible only with due process and appropriate notifications, and then only when absolutely necessary in cases of genuine risk or harm (e.g. to persons or property). The current environment, where different Internet Service Providers (ISPs) vary widely in their requirements for and responses to requests for such information, has itself created a dangerous situation. Clearly-defined procedures, presumably including the specific delineation of the immediate risks and a requirement for court orders before actions could proceed, would seem absolutely necessary.

In general, a mix of technical and legislative actions, combined with user and ISP responsibility, will likely be needed to deal with these problems in a manner that can help prevent the Internet from becoming an uncontrolled conduit for abusive behavior, but still protect important speech freedoms. In some cases, such as avoiding the dissemination of false press releases (at least through legitimate news organizations and Web sites), relatively straightforward digital signature systems could be used to validate releases' authenticity, provided that they are implemented on an end-to-end basis including the involved corporations, intermediate news agencies, and the like. Here we have an excellent application for such technologies, as contrasted with the risky e-commerce approach promoted in the Electronic Signatures in Global and National Commerce Act, a law that created an ill-defined situation where virtually any "electronic" procedure, regardless of how insecure or poorly implemented it might be, could be considered to create a binding signature for commerce purposes, even of very high value. (Please see the "PFIR Statement on Electronic Signatures and Documents" for more information about this topic.)

As always, and most particularly in this case, we must be on our guard to ensure that any legislative actions relating to these areas are both balanced and carefully considered. As we've seen, legislation can be both positive and negative, and when dealing with matters that relate to speech issues, our sensitivity must be most finely tuned. Already, we've seen some national governments proposing or implementing unilateral actions in this regard that could have serious negative consequences for individual speech rights. However, we can be sure that society will not be willing to ignore the problems to institutions, organizations, and individuals that Internet misinformation and its various cohorts are creating. It is in our own best interests, and the interests of freedom-loving people everywhere, to start striving toward balanced approaches now, with the goal of avoiding the possibility of knee-jerk, repressive reactions down the line that could seriously impact us all.

--Lauren--
Lauren Weinstein
lauren@vortex.com or lauren@privacyforum.org
Co-Founder, PFIR - People For Internet Responsibility - http://www.pfir.org
Moderator, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy