Digital Policy Roundup: House Cyber Week Approaching, SCOTUS to Hear Key Textbook IP Case, and DOC Unveils IP Econ Report

Congress Returns, Next Week is House “Cyber Week”
With Congress back from the Easter recess, there is much activity ongoing for “cyber week,” beginning on April 23. During the week, several cybersecurity bills are expected to be brought to the House floor for a vote, including: H.R. 2096 – Cybersecurity Enhancement Act, Rep. McCaul (R-TX), H.R. 3834 – Advancing America’s Networking and IT R&D Act, Rep. Hall (R-TX), H.R. 3523 – Cyber Intelligence Sharing and Protection Act, Rogers (R-MI), H.R. 4257 – Federal Information Security Amendments Act, Issa (R-CA). In preparation for next week, Rep. Rogers continues to explore amendments to his legislation to address concerns raised by the civil liberties watchdogs, and the Homeland Security Committee is also scheduled to consider additional information sharing legislation Wednesday morning, H.R. 3674- Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act, legislation that the bill’s sponsor, Rep. Lungren (R-CA) is seeking to have considered.

Supreme Court to Hear Key Textbook “First Sale” Copyright Case
This week, the Supreme Court decided to hear the copyright case of Kirtsaeng v. John Wiley & Sons Inc., a key case for SIIA members focused on whether the copyright law’s “first sale doctrine” applies when the copyrighted work–here a foreign edition of a textbook–is made and sold outside the United States and then imported into the United States. The case at issue involves a student from Thailand who attempted to subsidize his expenses by having friends and family members send him foreign editions of textbooks, which he would then sell online. If the Supreme Court affirms the lower courts by holding that the first sale defense does not apply, the unauthorized distribution and sale of a copyrighted work here would constitute a copyright infringement.

Department of Commerce Releases IP Economic Report
As we reported last week, on April 11, the Department released a report titled “Intellectual Property and the U.S. Economy: Industries in Focus,” which estimates the economic impact of IP related industries on the U.S. economy. The report, which was prepared by the Economics and Statistics Administration and the U.S. Patent and Trademark Office, was initiated as part of the Intellectual Property Enforcement Coordinator’s (IPEC) 2010 Joint Strategic Plan to create a comprehensive study to better understand the role of IP in the economy and to inform policy decisions related to IP enforcement. In response, SIIA issued a statement hailing the Report as evidence that IP is essential to the creation of American jobs and growth and underscores the critical importance of adequately protecting the software and digital content industries.

ICANN Extends Window for gTLD Applications
Last week, ICANN extended the window for submitting applications for new gTLDs from April 12 to April 20, because of a technical issue effecting the performance of the TLD Application System (TAS). April 30 remains the target date for ICANN to publish the applied-for new domain names, but this is subject to change.

Ninth Circuit Rules on Reach of CFAA
Last week, the Ninth Circuit Court, in US v. Nosal reached a decision in a highly-anticipated Computer Fraud and Abuse Act (CFAA) case, that Nosal’s acts did not violate the CFAA, concluding that the “plain language of the CFAA ‘target[s] the unauthorized procurement or alteration of information, not misuse or misappropriation’” and more significantly that “the CFAA does not extend to violations of use restrictions.” In the case, the U.S. brought criminal charges under the CFAA against a former employee for “exceed[ing] authorized access” to his former company’s computers for the purpose of obtaining and using company information in violation of the terms of the company’s computer use policy.

For SIIA policy updates including upcoming events, news and analysis, subscribe to SIIA’s weekly policy email newsletter, Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

Takeaways from Viacom v. YouTube, Admin. Trumpets IP Protection, and ICANN Application Process Moves Forward

The Roundup was off last week for spring break. While Congress is still on recess another week, there’s been plenty going on off the Hill:

SIIA Comments on NTIA Multistakeholder Privacy Process, Calls for Collaboration Instead of Legislation

On April 2nd, SIIA submitted comments to the Department of Commerce regarding the National Telecommunications and Information Administration (NTIA) “Multistakeholder Process to Develop Consumer Data Privacy Codes of Conduct.” In our comments, SIIA applauded the NTIA’s process of bringing together relevant parties in order to gather the collective expertise, and reiterated its call for a collaborative, rather than legislative, approach to addressing consumer data privacy. SIIA believes that the proposed multistakeholder process can contribute significantly to the mutual recognition of data privacy regimes, including the European Union proposed data protection regulations.

Appeals Court Rules in Viacom v. YouTube

Last Thursday, the U.S. Court of Appeals for the Second Circuit issued a decision in Viacom v. YouTube — the well-publicized copyright infringement case brought by several motion picture companies. The Second Circuit reversed portions of a 2010 decision by the lower court that held YouTube was not liable for copyright infringement and sent the case back to lower court for trial on the basis that “a reasonable jury could find that YouTube had actual knowledge or awareness of specific infringing activity on its website.” The three key takeaways from this case are:

(1) under the DMCA, ISPs can be liable if they either “subjectively” know of the specific infringements or they were subjectively aware of facts that would have made the specific infringement “objectively” obvious to a reasonable person, but cannot be liable for having a mere general awareness that the service was being used for infringing purposes;

(2) in an issue of first impression, the doctrine of willful blindness (defined as engaging in “‘conscious avoidance’ amounting to knowledge where the person was aware of a high probability of the fact in dispute and consciously avoided confirming that fact,”) “may be applied, in appropriate circumstances, to demonstrate knowledge or awareness of specific instances of infringement under the DMCA;” and

(3) for an ISP to be held liable under the DMCA’s “right and ability to control” standard “requires something more than the ability to remove or block access” but the copyright owner need not go so far as to prove that the ISP has specific knowledge, item by infringing item, in order to control the activity.

ICANN gTLD Application Period to Close Thursday

The application period for new gTLDs closes this Thursday, April 12. At least 859 applicants have created accounts in the applications system, and many of them have submitted multiple applications. In all, indications are that several THOUSAND applications have been, or will be submitted. On Monday, SIIA provided a policy update for members on this ongoing process and SIIA/industry engagement, and we’ll continue to update with further developments.

Administration Released IP Enforcement Report, Prepares for IP Economic Report Tomorrow

On March 30th, White House IP Enforcement Coordinator Victoria Espinel released the 2011 U S Intellectual Property Enforcement Coordinator’s (“IPEC”) Annual Report on Intellectual Property Enforcement, highlighting the steps the administration took in 2011 to enforce IP rights and crack down on the sale of pirated American products, and announcing plans to work with Congress to ensure law enforcement has the right tools to cut down on online counterfeiting and piracy. Among the highlights for 2011, the Report lists the voluntary best practices between payment processors and rights holders to reduce infringement, enhanced U S law enforcement efforts to fight counterfeiters and pirates, and the March 2011 release of the Administration’s White Paper on Intellectual Property Enforcement Legislative Recommendations.

Additionally, tomorrow the Administration will unveil a new Commerce Department report on the role intellectual property plays in the economy. The event will feature DOC Secretary John Bryson, Victoria Espinel and PTO Director David Kappos, and we’ll provide further update on details next week.

SIIA Facts & Findings
IP Report – On March 30th, White House IP Enforcement Coordinator Victoria Espinel released the 2011 U S Intellectual Property Enforcement Coordinator’s (“IPEC”) Annual Report on Intellectual Property Enforcement, steps the administration took in 2011 to enforce IP rights and crack down on the sale of pirated American products, and announcing plans to work with Congress to ensure law enforcement has the right tools to cut down on online counterfeiting and piracy.

Admin Big Data Initiative – On March 29th, the Obama Administration released a “Big Data Research and Development Initiative.” By improving our ability to extract knowledge and insights from large and complex collections of digital data, the initiative is intended to help accelerate the pace of discovery in science and engineering, strengthen U.S. national security, and transform teaching and learning.

EU Data Protection – On March 23rd, the EC Article 29 Working Party adopted an Opinion on ECs data protection law reform proposals, including the draft Regulation that is of particular importance for businesses. The Working Party’s Opinion serves as the national data protection authorities’ contribution to the legislative process before the European Parliament and the European Council. Hunton & Williams has provided a summary.

For SIIA policy updates including upcoming events, news and analysis, subscribe to SIIA’s weekly policy email newsletter, Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

Cyber on the Docket for April, FTC Releases Privacy Report, and Mobile Payments on Hill’s Radar Screen

Cyber: Legislative Flurry Continues, House and Senate Poised to Act in April

On Monday, Senate Majority Leader Harry Reid (D-NV) said that the Senate would consider Sen. Lieberman’s (I-CT) Cybersecurity Act (S. 2105) “in the coming weeks.” In remarks on the Senate floor, he also called on Republicans to help move the bill forward. While no date has been firmly set on the Senate calendar, suggestions by Sen. Lieberman are also that the bill would be brought up after the recess, either the last two weeks in April or the first week in May.

And on the House side, Republican Cybersecurity Task Force leader Mac Thornberry (R-TX) suggested last week that the House would have a so-called “cyber week” in April. House Leadership has not yet confirmed a date or specific legislation to be considered, but it’s rumored to be possibly the week of April 23rd.

And regarding the potential legislation for consideration, the list of proposals continues to grow. Joining the two information sharing bills, H.R. 3523 and H.R. 3674, sponsored by Reps. Rogers (R-MI) and Lundgren (R-CA) respectively, Reps. Bono Mack (R-CA) and Blackburn (R-TN) introduced a house companion of Sen. McCain’s Secure IT Act (S. 2151), that is reportedly almost identical, save for a few technical modifications, and Rep. Bob Goodlatte (R-VA) recently confirmed that he is still working on his cybersecurity legislation, which focuses on penalties for cybercrime.

Privacy : FTC Releases Long Awaited Privacy Report

Weeks after the President released a “Privacy and Innovation Blueprint,” the FTC yesterday released its long awaited final report, “Protecting Consumer Privacy in an Era of Rapid Change,” making recommendations for businesses and policymakers. The Report recommends best practices in a three-part framework: privacy by design, simplified choice for consumers and greater transparency about data practices. While the report largely tracks the draft released in late 2010 and echoes support for a Consumer Privacy Bill, it also establishes more detailed recommendations in four key areas: Do Not Track, De-identified Data, Sensitive Data and Mobile Disclosures. In response to the Report, SIIA released a statement welcoming this clarification of the FTC’s policy, but reiterating our position that new legislation is not necessary at this time.

Also on Privacy, Rep. Bono Mack’s Subcommittee on Commerce and Trade will hold a hearing to review the President’s Privacy and Innovation Blueprint, and comments on the proposed privacy multistakeholder process are due on Monday, April 2nd.

Mobile Payment Policy Officially on Radar Inside the Beltway

Following a House Financial Services hearing last week, the Senate Banking Committee will take their turn on mobile payment technology and security at a hearing on Thursday. And next month the FTC will host a workshop to examine a wide range of issues, including the technology and business models used in mobile payments, the consumer protection issues raised, and the experiences of other nations where mobile payments are more common.

Also, last week the Internet Caucus Advisory Committee held a discussion on the topic. The discussion, led by SIIA’s Mark MacCarthy, covered issues such as customer financial privacy, cyber security, financial accountability and fraud, and reviewed the regulatory agencies in charge of assuring basic consumer protections. Further info. and audio of the event are available on the ICAC site.

For SIIA policy updates including upcoming events, news and analysis, subscribe to SIIA’s weekly policy email newsletter, Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

EC Privacy Conference and Joint US-EU Statement

EC Privacy Conference and Joint US-EU Statement

On Monday, the European Commission (EC) held a high-level Conference on Privacy and Protection of Personal Data, focused on efforts to deepen the transatlantic dialogue on commercial data privacy issues. In conjunction with the event, EC Vice-President Viviane Reding and US Secretary of Commerce John Bryson issued a joint statement on data protection expressing the mutual commitment to working together and with other international partners to create mutual recognition frameworks that protect privacy, and the mutual agreement that standards in the area of personal data protection should facilitate the free flow of information, goods and services across borders. In line with the objectives of increasing trade and regulatory cooperation, the statement served to officially reaffirm their respective commitments to the U.S.-EU Safe Harbor Framework, including collaboration to ensure the continued operation and progressive updates to this Framework.

Also at the event, Commerce Assistant Secretary Larry Strickling announced that the comment deadline for the NTIA request for input on the privacy multi-stakeholder process would be extended one week, from March 26 to April 2, 2012.

SIIA Launches PSIG: Public Sector Innovation Group

Last week, SIIA officially launched its Public Sector Innovation Group (PSIG), a new Division to help SIIA member companies understand proposed reforms to the IT acquisition environment, help them position for success in the new Federal IT marketplace and maximize our collective ability to affect these change.

PSIG builds off the themes of SIIA’s annual Cloud/Gov Conference over the last six years that the U.S. Government is rethinking how it buys and implements IT products and services, shifting from a traditional procurement process set up to buy systems, to one that provides agencies with the ability to purchase a broad range of IT services in a utility-based model.

Recent key policies that will be a driving force of the PSIG activities include the issuance of the 25 Point Plan to Reform Federal IT, introduction of the “Cloud First” policy, launch of FedRAMP and the recently proposal Shared Services Initiative. For more information or to become involved, contact Mike Hettinger.

Education Leaders Launch Digital “LEAD” Commission

Last week, a group of education and technology leaders launched the Leading Education by Advancing Digital (LEAD) Commission, with the goal to develop a blueprint detailing the opportunity for using technology as a catalyst to transform and improve American education. In conjunction with the launch of the Commission, FCC Chairman Julius Genachowski and U.S. Department of Education Secretary Arne Duncan announced their support for the Commission’s objective to incorporate input from a cross-section of teachers, parents, local government officials, school officials, students and education technology industry leaders and expects to release its findings and a blueprint for action in late 2012.

For SIIA policy updates including upcoming events, news and analysis, subscribe to SIIA’s weekly policy email newsletter, Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

DOC Cancels ICANN RFP; Analysis of Chinese MIIT Plan for Software and IT; SIIA Files Comments on Accessibility

ICANN: DOC Cancels ICANN RFP

This week, the NTIA announced that it has cancelled the RFP issued in November, for performance of the IANA functions contract (including operating the domain name system) currently held by ICANN. NTIA had added requirements meant to address concerns that the global Internet community expressed regarding ICANN’s deficiencies, including conflict of interest provisions, reporting requirements, and other provisions to ensure ICANN was acting in the public interest. NTIA determined that no submission — including ICANN’s — met these requirements, and announced that it will reissue the RFP in the future. In the meantime, NTIA granted a 6 month extension to ICANN’s current contract in order to ensure continued operation of the DNS. What this appears to mean is that NTIA is taking a hard line in forcing ICANN to address long-held concerns by many that ICANN needs to improve in order to deserve the right to continue running the DNS.

Trade: SIIA and Industry Groups Oppose India’s New Protectionist Procurement Rule

Last week, SIIA joined with several other leading industry groups in a letter to USTR staunchly opposing India’s new procurement rule and urging assistance in addressing the new rule that imposes a 30% domestic content requirement on an ill-defined range of electronic products and services. Not only does the rule explicitly target laptops and computers, but it could also extend to any software, application or electronic content that the Indian government might deem to be covered. SIIA’s members in the software and digital content industries are deeply concerned by this development and urge the U.S. government to engage strongly with the government of India to rollback this protectionist policy. Allowing the policy to stand not only increases the risk that India will extend it to other sectors, but also that other countries will seek to imitate it.

China: Analysis of MIIT 5 Year Plan for Software and IT Services Industry

As a follow-up to our report earlier in the year about the recent release of the Chinese Ministry of Industry and Information Technology (MIT) release of its Five Year Plan for the Development of the Software and IT Services Industry, SIIA’s sister organization in China, the U.S. Information Technology Office in China (USITO), has provided a summary and analysis of the Plan. In general, the plan aims to develop China’s domestic software sector very broadly, including specific areas such as operating systems, databases, office productivity software, middleware, security software and industrial design software (CAD) through a variety of funding channels including the core, high, basic program and other local government R&D support. If you would like information and are not a USITO member, please follow-up with SIIA staff.

Accessibility: SIIA Files Comments on Accessibility of Information and Communication Tech

Also last week, SIIA filed comments in the Access Board’s recent proceeding on electronic accessibility of information and communication technology, including software and digital content. The proceeding is meant to update the requirements for vendors to ensure that their products are accessible to users in different disability categories. The key point of the filing was to ensure that ICT would be subject to a single review for satisfying clear technical requirements, rather than subject to an additional review for compliance with general qualitative goals.

For SIIA policy updates including upcoming events, news and analysis, subscribe to SIIA’s weekly policy email newsletter, Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

Administration Seeks Input on Data Privacy, Cyber Legislative Proposals Proliferate and NIST Releases Draft Security Guidance with Cloud and Mobile Implications

Administration Seeks Input on Data Privacy

As a follow-up to the release of the White House Privacy Report, the DOC National Telecommunications and Information Administration (NTIA) has formally requested comment on what issues should be addressed through the privacy multi-stakeholder process, as well as procedures to foster the development of these codes. Comments are due by March 26th.

Consistent with indications from Administration officials, the Federal Register Notice explains that while the NTIA plans to facilitate the development of enforceable codes of conduct that implement the full Consumer Privacy bill of Rights proposed in the Report, as a start to the process “NTIA seeks to conduct a privacy multi-stakeholder process focused on a definable area where consumers and businesses will receive the greatest benefit in a reasonable timeframe.”

Among the list of potential topics, the list of potential topics supplied by NTIA includes: mobile apps and associated issues, cloud computing services, accountability mechanisms, online services directed towards children and teens, trusted identity systems, such as NSTIC, and data collection from various technologies.

Cyber Legislative Proposals Proliferate

Following the release last week of a new cybersecurity legislative proposal, the Secure IT Act, offered by Sens. John McCain (R-Ariz.), Kay Bailey Hutchison (R-TX) and several other Republicans, Reps. Mary Bono Mack (R-CA) and Marsha Blackburn (R-TN) announced Monday their intention to introduce companion legislation. Sponsors have offered the legislation as an alternative to the Cybersecurity Act (S. 2105), introduced last month by Sens. Joe Lieberman (I-CT) and Susan Collins (R-ME), that would not give the Homeland Security Department the power to require critical computer systems to meet certain security standards, and both bills propose to enhance cybersecurity information sharing, reform FISMA, increase cybersecurity R&D and enhance cybercrime enforcement.

And at a time when cybersecurity is becoming an increasingly partisan issue, House E&C Subcommittee Chair Greg Walden (R-OR), in conjunction with the upcoming hearing on Wednesday, announced the formation of a bipartisan Communications and Technology Cybersecurity Working Group, which will include Reps. Lee Terry (R-NE), Anna Eshoo (D-CA), Doris Matsui (D-CA), Bob Latta (R-OH), Michael Doyle (D-PA) and Adam Kinzinger (R-IL).

NIST Security Guidance with Implications on Cloud and Mobile

Last Wednesday, NIST released a draft revision to Federal Guidelines on Security and Privacy Controls for Federal Information Systems and Organizations. Known as SP 800-53, the recent revision results from a year-long initiative to update the content of the security controls catalog and the guidance for selecting and specifying security controls for federal information systems and organizations, seeking to handle “insider threats, supply chain risk, mobile and cloud computing technologies, and other cyber security issues.” In announcing the document, NIST highlighted that “in most instances, with the exception of the new privacy appendix, the new controls and enhancements are not labeled specifically as “cloud” or “mobile computing” controls or placed in one section of the catalog. Rather, the controls and enhancements are distributed throughout the control catalog in various families and provide specific security capabilities that are needed to support those new computing technologies and computing approaches.

Indian Gov. Adopts New Localization Procurement Rule

India has recently approved a new procurement rule that imposes a preference for domestically manufactured electronic products. Specifically, the rule creates a 30% domestic content requirement on an ill-defined range of electronic products and services. Not only does the rule explicitly target laptops and computers, but it could also extend to any software, application or electronic content that the Indian government might deem to be covered. SIIA is working with other leading trade associations to urge the U.S. government to engage strongly with the government of India to rollback this protectionist policy.


Learn more about key policy developments affecting the software and digital content communities with Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.

Privacy: Administration Releases Long-Awaited Privacy Report, Highlights DNT Agreement

Last Thursday, The Obama Administration released its long awaited Privacy Whitepaper proposing a framework for consumer privacy in the digital age. The whitepaper calls for both a “Privacy Bill of Rights,” as well as an announcement of the Administration’s intention to lead a multistakeholder processes to implement general principles for particular sectors or contexts.

In conjunction with the release of the Report, the Administration cited an agreement by members of the Digital Advertising Alliance (DAA) to comply when consumers choose to opt out of tracking as an “example of the value of industry leadership as a critical part of privacy protection going forward.” In response to this report, SIIA issued a statement of support for the goal to adopt voluntary, industry-specific privacy guidelines while cautioning that one-size-fits-all privacy laws or regulations would inhibit innovation, without establishing the most effective privacy protection for the public.

Cloud Computing: US-China Seminar
The U.S. Department of Commerce and the Chinese Ministry of Industry and Information Technology (MIIT) will co-host a Cloud Computing Seminar under the auspices of the Joint Commission on Commerce and Trade (JCCT) Information Industry Working Group (IIWG) on April 19 in Beijing, China. The seminar presents U.S. and Chinese industry and government leaders with the opportunity to discuss trends and challenges in cloud computing in each country, including the government’s role in cloud computing promotion, business models and technologies, data privacy and cross-border data flows, and the regulatory environment for cloud computing services.

This event is being coordinated by USITO, SIIA’s partner organization in China, so please follow-up with SIIA for more information.

ACTA: EU Puts Agreement on Hold
Following the mass protests against ACTA in Europe, several EU member states, including Poland, Latvia and the Czech Republic, withdrew their intent to ratify ACTA or delayed the decision in their national parliaments. Last week, pursuant to a request by the European Trade Commissioner, the EC put the ACTA ratification process on hold and referred the treaty to the European Court of Justice to determine if it is compatible with EU law.


Learn more about key policy developments affecting the software and digital content communities with Digital Policy Roundup.


David LeDuc is Senior Director, Public Policy at SIIA. He focuses on e-commerce, privacy, cyber security, cloud computing, open standards, e-government and information policy.